KR102471699B1 - Genome data de-identification processing device, method and computer program for generating non-identifying genetic data by de-identifying genomic data to protect personal information - Google Patents

Abstract

Genomic data de-identification processing apparatus and method for generating de-identified genetic data obtained by de-identifying genomic data according to embodiments of the present disclosure include de-identification of markers capable of personal identification in individual genome information, Non-identifying genetic data can be provided.

Description

Genome data de-identification processing device, method and computer program for generating non-identification processing device, method and computer program for generating non-identified genetic data by de-identification processing of genome data for protecting personal information identifying genetic data by de-identifying genomic data to protect personal information}

An embodiment of the present disclosure discloses a genome data generating device, a method for generating non-identified genetic data obtained by de-identifying genetic data, and a computer program.

Since the decoding of the human genome sequence was completed in the early 2000s, techniques for studying individual genetic variation have developed rapidly. For example, single nucleotide polymorphisms (SNPs) have become capable of determining hundreds of thousands of genetic mutations in a short period of time at low cost due to the development of large-capacity analysis technology. Genome-Wide Association Study (GWAS) is a research field that derives hundreds of thousands of SNPs using NGS (Next Generation Sequencing) technology and finds genetic variations statistically significantly related to phenotypes among them. .

Individual phenotype and genetic variation information corresponds to personal information. Therefore, securing the security of personal phenotype and genome information is an important issue in various genetic analysis fields including GWAS. Currently, as a large amount of personal phenotype and genome information is shared with a large number of researchers, it is highly likely to be exposed to third parties.

(Patent Document 0001) Korean Registered Patent No. 10-0537523

Provided is an apparatus and method for providing non-identifying genetic data by de-identifying markers capable of personal identification in individual genome information.

According to embodiments of the present disclosure, a data input unit configured to receive genome data of a target cell from an electronic device; Among the genomic data, an anonymity score is calculated based on the degree of identity between nucleotide sequences of markers corresponding to a homogeneous class, and among the genomic data, sequences of markers corresponding to a homogeneous class Calculate a diversity score based on the degree of difference between the genomic data, and determine whether to process de-identification for each marker region included in the genomic data by considering the anonymity score and the diversity score for each marker included in the genomic data. De-identification process determination unit; Generating de-identification genetic data in which one or more marker regions for which de-identification processing is true are de-identified, and a proximity score proportional to the degree of equality between the genetic data and the de-identification genetic data is calculated, so that the proximity score is Determine whether or not the proximity score is greater than or equal to the reference proximity value, store the non-identified genetic data in a storage unit if the proximity score is greater than or equal to the reference proximity value, and store the non-identification genetic data in a storage unit if the proximity score is less than the reference proximity value Non-identification data generation unit for regenerating genetic data; In response to a distribution request signal, a distribution unit that generates output data corresponding to the distribution request signal from among genome data stored in a marker reference database and transmits the output data to a data request terminal; A genetic data de-identification processing device for generating de-identification-processed de-identification genetic data is disclosed.

The genomic data may include potential genetic information capable of inferring identification of individuals.

The de-identification processing determination unit may calculate an allele frequency for each marker included in the genome data.

The anonymity score may be a value determined in proportion to a ratio of the number of samples distinguishable by a designated marker within the genome data set.

The proximity score may be a value determined in proportion to a degree of similarity between the genetic data and the non-identified genetic data.

The proximity score may be a value determined in proportion to the degree of equality between the genetic data and the non-identified genetic data.

The de-identification processing determination unit may select markers corresponding to individual identification markers from among markers included in the genome data.

The de-identification process determination unit selects markers corresponding to personal identification markers from among one or more markers included in the genome data, and selects markers having a high importance for markers for diseases based on disease information of the genome data. Markers can be excluded.

According to embodiments of the present disclosure, the genome data de-identification processing device may include receiving genome data of a target cell from an external electronic device; The genomic data de-identification processing device calculates an anonymity score based on whether or not the sequences of markers corresponding to a homogeneous class are identical among the genomic data, and among the genomic data, the homogeneous class ), a diversity score is calculated based on the degree of difference between the sequences of markers corresponding to ), and each marker included in the genome data is calculated by considering the anonymity score and the diversity score for each marker included in the genome data. Determining whether to process de-identification for; Generating de-identification genetic data in which the marker for which the de-identification process is true is de-identified, and calculating a proximity score proportional to the degree of equality between the genetic data and the de-identification genetic data, so that the proximity score is set in advance. Determine whether the proximity score is greater than or equal to the reference proximity value, store the non-identified genetic data if the proximity score is greater than or equal to the reference proximity value, and regenerate the non-identified genetic data if the proximity score is less than the reference proximity value doing; And in response to the distribution request signal, generating output data corresponding to the distribution request signal from among the dielectric data stored in the storage unit, and transmitting the output data to a requesting terminal; A method for generating non-identified genetic data subjected to identification processing is disclosed.

The computer program according to an embodiment of the present invention may be stored in a medium in order to execute any one of the methods of generating non-identified genetic data by de-identifying genetic data according to an embodiment of the present invention using a computer. can

In addition to this, another method for implementing the present invention, another system, and a computer readable recording medium recording a computer program for executing the method are further provided.

Other aspects, features and advantages other than those described above will become apparent from the following drawings, claims and detailed description of the invention.

Genomic data de-identification processing apparatus and method for generating de-identified genetic data obtained by de-identifying genomic data according to embodiments of the present disclosure include de-identification of markers capable of personal identification in individual genome information, Non-identifying genetic data can be provided.

1 is a network diagram of a genome data distribution system according to embodiments of the present disclosure.
2 may include a genome data de-identification processing device 100, a data request terminal 200, a data collection server 300, and a marker reference DB 400 according to embodiments of the present disclosure.
3 is a block diagram of the distribution unit 140 .
4 is an exemplary diagram of genetic data and non-identified genetic data according to embodiments of the present disclosure.
5 and 6 are flowcharts of a method of de-identifying genome data according to embodiments of the present disclosure.
7 is a flowchart of a process of encoding and distributing non-identified genetic data according to embodiments of the present disclosure.

Hereinafter, the configuration and operation of the present invention will be described in detail with reference to embodiments of the present invention shown in the accompanying drawings.

Since the present invention can apply various transformations and have various embodiments, specific embodiments will be illustrated in the drawings and described in detail in the detailed description. Effects and features of the present invention, and methods for achieving them will become clear with reference to the embodiments described later in detail together with the drawings. However, the present invention is not limited to the embodiments disclosed below and may be implemented in various forms.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, and when describing with reference to the drawings, the same or corresponding components are assigned the same reference numerals, and overlapping descriptions thereof will be omitted. .

In this specification, terms such as "learning" and "running" are terms that refer to performing machine learning through computation according to procedures, which are not intended to refer to mental operations such as human educational activities. interpret

In the following embodiments, terms such as first and second are used for the purpose of distinguishing one component from another component without limiting meaning.

In the following examples, expressions in the singular number include plural expressions unless the context clearly dictates otherwise.

In the following embodiments, terms such as include or have mean that features or components described in the specification exist, and do not preclude the possibility that one or more other features or components may be added.

In the drawings, the size of components may be exaggerated or reduced for convenience of description. For example, since the size and thickness of each component shown in the drawings are arbitrarily shown for convenience of description, the present invention is not necessarily limited to the illustrated bar.

When an embodiment is otherwise implementable, a specific process sequence may be performed differently from the described sequence. For example, two processes described in succession may be performed substantially simultaneously, or may be performed in an order reverse to the order described.

Throughout the specification, genomic data refers to data obtained from a specific user's sample (sample) and a living organism (human, animal, microorganism, etc.). For example, genomic data is a base sequence obtained from deoxyribonucleic acid (DNA), ribonucleic acid (RNA), or protein from cells, tissues, etc., gene expression data, genetic variation with standard genome data, DNA methylation ) and the like. In general, genomic data includes sequence information obtained by analyzing a specific sample. Genomic data is usually represented as digital data. Sequence data obtained through an NGS analysis device and the like correspond to this.

Genome analysis data refers to information obtained by analyzing genome data. For example, genome analysis data includes diagnosis results obtained by analyzing genome data, disease prediction results, disease risk levels, paternity confirmation results, means for treating diseases, new drug candidates, and the like.

Medical data refers to data that can be used to determine the health status of a specific user (eg, patient). For example, medical data may include electronic medical record (EMR) data within a hospital. That is, medical data may include test results (clinical information) using medical equipment or diagnosis results by medical staff. Also, for example, medical data may include bio-signal data obtained by a mobile terminal capable of measuring bio-signals (eg, a healthcare device).

Hereinafter, data refers to digital data holding various types of information regardless of the format or type of data. Data may include personal information, information generated by individuals, data obtained by analyzing personal data, and experimental data on individuals. For example, the data may include at least one of the aforementioned genome data, analysis data, and medical data. Data may be data produced by individual objects (people, companies, research institutes, schools, hospitals, etc.) that are biological or social subjects.

Throughout the specification, "fastq file" is basic genome data for analysis, and may include sequence ID, base sequence information, base sequence quality, and the like.

Throughout the specification, "bam file (binary alignment/map format file)" refers to a file obtained by mapping each sequence of the fastq file to a standard base sequence, and is a binary (binary) format of a SAM file (sequence alignment/map format file). As a version, it can be the result obtained in the second step of data analysis.

Throughout the specification, the term “variant call format file (vcf file)” may include a file containing variant information.

1 is a network diagram of a genome data distribution system according to embodiments of the present disclosure.

The genomic data distribution system may extract genomic data from the genome of the specimen donor.

The data requestor transmits a request signal (request for sale) for genome data to the cohort collection institution, and a separate institution may review the request for sale in response to the request for sale. The deliberation of the sale request may be determined by consultation between the deliberation members or may be performed according to deliberation rules set in a separate institutional server. If the request for sale is determined to be available for sale through deliberation, a sale approval signal indicating approval of the sale may be transmitted to the distribution unit.

The distribution unit loads the original and set of genome data in response to the sale request signal, specifies the scale for preventing personal information inference for the genome data, and selects the required inclusion marker based on the designated scale for preventing inference of personal information can be specified or determined.

The distribution unit may receive the original and set of genome data from the genome data purification unit. In this case, the genome data refiner may generate a fastq file, which is basic data for analysis, from the genome data, and convert the fastq file into a bam file. The genome data purification unit may convert the bam file into a vcf file containing mutation information.

The vcf file generated in the genome data purification unit is moved to the personal inference prevention unit. Upon receiving the vcf file, the personal inference prevention unit may store the vcf file as a meta database (Meta DB).

The distribution unit may distribute non-identified genetic data of the genome data to the terminal of the data requester by presenting a personal information inference scale for the genome data to be distributed in response to the sale request signal. At this time, the non-identified genetic data may be encrypted. The distribution unit may manage an encryption key used to encrypt non-identified genetic data. At this time, the distribution unit may determine a region for which de-identification processing is true among the genome data based on the anonymity score, the diversity score, and the proximity score. The anonymity score, diversity score, and proximity score are determined through the external personal inference prevention unit, and the area where de-identification processing is true may also be determined through the personal inference prevention unit.

The personal inference prevention unit may determine the personal inference prevention scale, whether or not to de-identify, and the personal inference prevention area by using data stored in the beta data DB and the genome data archive in order to determine the area where de-identification processing is true. In the meta data DB, meta information that can utilize a large amount of genome data is entered and stored. In the meta data DB, meta information describing files generated before and after genomic data purification and linkage information with cohorts are stored. Here, the meta information about the files is the storage location of the files (address of the physical server, logical address value in the server, etc.), de-identification scale value, data management information (information on the management institution of the cohort, manager), etc. , and information associated with the cohort includes the purpose of the cohort, the disease classification of the cohort, and the number of subjects in the cohort. The purpose of the cohort is set by the requester, and may include a diabetes cohort, a childhood obesity cohort, and the like.

Genome Data Archive stores genome data in the form of files. Examples of stored genome data include raw sequence (fastq), called genome type data (genotype data (vcf)), refined genome type data, There may be de-identified genomic type data. Genomic data in the genomic data archive may be in the form of files that are large to load into memory. The personal inference prevention unit may determine a personal inference region from among genome data by using a personal inference prevention algorithm. The personal inference region refers to a region in which each subject of the genome data is identified, and may be set based on a marker. The personal inference prevention unit may classify the genome data of samples by marker among genome data and determine whether to perform de-identification based on the degree of identity and difference between sequences of markers. The personal inference preventing unit may receive information about the marker from the marker reference DB unit, and determine a personal inference region as a sequence and/or region for each marker by using the information about the marker.

The personal inference prevention unit may receive the de-identified genetic data processed by the marker-based de-identification unit, and may also determine whether personal inference prevention processing has been performed on the de-identification genetic data. The personal inference prevention unit may determine whether personal identification information, race, gender, rare disease, etc., is inferred from non-identification genetic data, and determines whether personal inference prevention processing has been performed.

The marker-based de-identification unit may de-identify the personal inference area. The marker-based de-identification unit may set at least one marker region for which de-identification processing is true as a personal reasoning region, and de-identify the personal reasoning region to generate de-identified genetic data.

The marker-based de-identification unit may process de-identification based on the VCF file, but is not limited thereto and may process de-identification based on various types of files.

The marker reference DB unit may include marker information about a disease or a sequence region for markers related to a disease. The marker reference DB may include a table for weight values used to determine information about markers and non-identification processing or a table for classification of weight values.

Locus-based marker information that can genetically identify individuals, such as cancer, disease, and race, can be stored in the marker reference DB. The marker reference DB may receive data received from an external database. The marker reference DB may store a rare disease, race, gender, etc. of a subject of genome data, which is data necessary for calculating weights applied to determine whether or not to de-identify. 2 may include a genome data de-identification processing device 100, a data request terminal 200, a data collection server 300, and a marker reference DB 400 according to embodiments of the present disclosure.

The genome data de-identification processing apparatus 100 includes a data input unit 110, a de-identification marker determination unit 120, and de-identification data generation in order to de-identify a personal identification area and/or a personal inference area in genome data. A unit 130 and a distribution unit 140 may be included.

The data input unit 110 receives genome data of a specimen from a genome data analysis device. Genomic data may be one of a fastq file, a bam file, and a vcf file, but is not limited thereto and may refer to any data obtained by digitally converting genome information. Genomic data may include potential genetic information capable of personal inference and/or personal identification.

The de-identification processing determination unit 120 may determine whether de-identification processing is performed for each marker included in the genome data.

The de-identification process determination unit 120 may determine whether the de-identification process is TRUE for a sequence region in which each sample can be identified among genome data. The de-identification process determination unit 120 may receive data on essential markers that are easy to infer individuals, such as diseases, races, and genders of subjects, and data on genome data of subjects from a marker reference database.

The de-identification processing determination unit 120 may classify essential marker regions and non-essential marker regions in the genome data based on essential marker data. The de-identification processing decision unit 120 classifies the base sequence values of the marker region for each sample, and considers an anonymity score, a diversity score, etc. between the base sequence values of the samples to determine whether to perform de-identification processing.

The anonymity score may be determined by a matching ratio by comparing the nucleotide sequence values of the marker region for each sample. The diversity score may be determined as a non-matching ratio by comparing the nucleotide sequence values of the marker region for each sample. An anonymity score may be determined based on whether the matching rate falls within the first range and the non-matching rate falls within the second range. An anonymous score and matching rate and/or non-matching rate may be set as a corresponding table. In this case, the marker area is classified into an essential marker area or a non-essential marker area, and whether to process non-identification may be determined. The essential marker region may be a marker region for a disease in relation to a disease occurring in the specimens or a disease requested by a data requestor. It may be implemented so that whether the mandatory marker region is de-identified is not set to TRUE. The anonymity score and/or diversity score for determining whether to de-identify the essential marker region may be set high. A marker area with a high anonymity score may not be set as a personal inference area, or the de-identification process may be FALSE. A marker region with a high diversity score may be set as a personal reasoning region and be de-identified, or de-identified by setting whether or not to be de-identified as TRUE to be de-identified.

The de-identification treatment determination unit 120 may recalculate the anonymity score, the proximity score, and the diversity score after generating the de-identification genetic data. The de-identification process determination unit 120 generates one or more de-identified genetic data candidates for the genetic data, calculates anonymity score, proximity score, and diversity score for the de-identified genetic data candidates, and the terminal of the data requestor. It is possible to determine non-identified genetic data to be transmitted among candidates of non-identified genetic data. In this case, the anonymity score may be a value determined in proportion to the ratio of the number of samples distinguishable by a designated marker within the genome data set. The proximity score may be a value determined in proportion to a degree of similarity between genetic data and non-identified genetic data.

The de-identification processing determination unit 120 may calculate an anonymity score based on the degree of equality between samples of nucleotide sequences of markers corresponding to a homogeneous class among genome data. The degree of identity between samples can be calculated by the number or ratio of samples having identical nucleotide sequences. The de-identification treatment determination unit 120 may compare the nucleotide sequences of the markers for each sample to calculate an anonymity score based on the number or ratio of deductions having the same nucleotide sequence value.

The de-identification processing determination unit 120 may calculate a diversity score based on the degree of difference between specimens in the nucleotide sequences of markers corresponding to a homogeneous class among genome data. The degree of difference between samples can be calculated by the number or ratio of samples that do not match and have different base sequences. The non-identification processing determination unit 120 compares the base sequences of the markers for each sample and calculates a diversity score based on the number or ratio of samples having non-matching base sequence values, that is, different base sequence values.

The de-identification processing decision unit 120 may determine whether to de-identify each marker region included in the genome data by considering the anonymity score and the diversity score of the genome data and/or the de-identification genetic data. The non-identification processing determination unit 120 calculates an anonymity score based on the degree of identity between samples of the nucleotide sequences of markers corresponding to a homogeneous class among the genome data, and among the genome data, the homogeneous class ( homogeneous class), a diversity score is calculated based on the degree of difference between samples, and each marker region included in the genome data is considered by considering the anonymity score and diversity score for each marker included in the genome data. You can decide whether or not to de-identify.

The de-identification process determination unit 120 may calculate an allele frequency for each marker included in the genome data.

Allele frequency can refer to the composition ratio between different alleles constituting the same gene within a population. The de-identification processing determination unit 120 may determine markers for which de-identification processing is true in the genome data using the allele frequencies.

The de-identification process determination unit 120 may select markers corresponding to personal identification markers based on whether or not the de-identification process is performed among the markers included in the genome data. The personal identification marker may be a marker capable of identifying at least one of race, gender, and rare disease of each subject.

The de-identification process determination unit 120 selects markers corresponding to individual identification markers from among one or more markers included in the genome data, and selects markers with high importance for the disease based on the disease information of the genome data. It may be excluded from the personal identification marker.

The de-identification data generation unit 130 may generate de-identification genetic data obtained by de-identifying nucleotide sequence values of one or more marker regions for which de-identification processing is true. Here, the de-identification process may de-identify markers that are risky in personal inference using a data mining technique for the selected k data sets. Here, the data mining technique can classify the nucleotide sequence values of the genome data for each marker, and determine the type of marker to be de-identified based on the anonymity score, diversity score, and proximity score for each nucleotide sequence value for each sequence. . As shown in FIG. 4, it is possible to determine the type of marker to be appropriately de-identified for genome data extracted in response to a cohort request, a data request, and the like.

The de-identification data generator 130 may calculate a proximity score proportional to the degree of equality between the genetic data and the de-identification genetic data. When the degree of identity between the genetic data and the non-identified genetic data is high, the proximity score may be set high. The degree of equality can be calculated as a ratio of base sequence values that have not been subjected to non-identification processing. The de-identification data generation unit 130 may generate evaluation information on the de-identification process of the genome data through the calculated proximity score. When the proximity score is equal to or greater than the preset reference proximity score, the evaluation grade for the de-identification process of genome data may be set to 'Pass'.

When the proximity score is less than the preset reference proximity score, the evaluation grade for the de-identification process of genome data may be set to 'Fail'.

If the evaluation grade is 'failure', the sequence regions for which de-identification is true may be determined again through the de-identification determination unit 120 . In this case, the de-identification processing determination unit 120 may reset the reference values for the anonymity score and/or the diversity score for determining whether or not the de-identification process is performed. The reference value for the anonymity score may be determined as a value determined in consideration of the degree of the disease of the sample or the request of the data requestor.

The reference values for the diversity and proximity scores may be determined by the data manager in consideration of the degree of request of the data requester and the purpose and/or characteristics requested by the cohort. Reference values for diversity and proximity scores may be changed through repetitive data mining for genome data corresponding to a request.

The distribution unit 140 may generate non-identified genetic data corresponding to the disease, data capacity, and request marker included in the data request signal in response to the data request signal from the terminal 200 of the data requester. In response to the data request signal, the distribution unit 140 may generate output data corresponding to the data request signal from among the genome data stored in the marker reference database and transmit the output data to the data request terminal 200 .

As shown in FIG. 3 , the distribution unit 140 may include a scale change processing unit 141, an essential marker designation unit 142, a data encryption unit 143, and a distribution control unit 144.

The scale change processing unit 141 may change a reference value for determining whether or not to perform de-identification processing when the proximity score of the de-identification genetic data generated by the de-identification data generator 130 is equal to or less than the reference proximity score. The scale change processor 141 may regenerate non-identified genetic data based on the changed reference value.

In an optional embodiment, a reference anonymity score and a reference diversity score, which are reference values for generating non-identifying genetic data, may be determined in consideration of the disease name, data volume, and request marker included in the data request signal. Whether or not to process de-identification may be determined based on the standard anonymity score and the standard diversity score determined in this way.

A reference proximity score, which is a reference value applied to non-identifying genetic data, may be determined in consideration of at least one of the disease name, data volume, and request marker included in the data request signal. Whether or not to process de-identification may be determined based on the reference proximity score determined in this way.

The essential marker designation unit 142 requests essential marker information for a disease from the marker reference DB 400, receives essential marker information from the marker reference DB 400, and applies essential marker information to genome data based on the essential marker information. A marker region can be determined. Essential marker information refers to information about markers highly related to diseases.

When the data encryption request signal is received from the non-identification data generator 130, the data encryption unit 143 may encrypt the received non-identification genetic data. The data encryption unit 143 may encrypt non-identified genetic data using an encryption key shared with the data requesting terminal 200 . The encryption key used to geneticize the non-identified genetic data may be identification information of the data requesting terminal 200 or a key corresponding to the non-identified genetic data.

The distribution controller 144 may transmit encrypted non-identified genetic data or non-identified genetic data to the data requesting terminal 200 .

4 is an exemplary view of a region in which de-identification processing is true.

As shown in FIG. 4 , the original genome data T1 may include base sequence values of 7 specimens. Since the base sequence values (T21) of m1 in the genome data (T1) are AA for all samples, the anonymity score of m1 can be set high and the diversity score of m1 can be set low.

In this way, since the nucleotide sequence values T22 of m2, m3, and m4 are the same for all samples as in m1, the anonymity scores of m2, m3, and m4 can be set high.

The nucleotide sequence values (T23) of m5 are AA, AA, GG, AA, AA, AA, AA, and patient 3 having a GG value can be identified in the m5 region. For this, the anonymity score may be set low and the diversity score high. The m5 region can identify patient 3 with a GG value.

The nucleotide sequence values (T24) of M6 are AA, AT, AA, AA, AA, AA, AA, and patient 2 having a GG value in the m6 region can be identified. For this, the anonymity score may be set low and the diversity score high.

According to embodiments of the present disclosure, the sum of the anonymity score and the diversity score for m1, m2, m3, m4, m5, and m6 (IQ) is -0.7, -0.8, -0.9, -0.9, -0.1, - may be 0.1. In view of these scores, m5 and m6, which have relatively high scores, may be genetic regions where individual inference is possible.

The IQ value can be calculated by the equation below.

I

Here, X={ AA,AC, AG,AT, ??}: genotypesets, P=patients, k=number of requested patients.

는 가중치 값을 말하며, 개인을 식별할 수 있는 암, 희귀질환, 인종에 따라 분류한 등급으로 결정될 수 있다. 예를 들어, 희귀 질환인 경우는 0.1, 암인 경우는 0.3, 건강 정보인 경우는 0.5 일 수 있다.

Denotes a weight value, and may be determined as a grade classified according to cancer, rare disease, or race that can identify an individual. For example, it may be 0.1 for rare diseases, 0.3 for cancer, and 0.5 for health information.

는 데이터 요청자가 요청한 환자 수(k)에 따라 게놈 타입 별로 해당 마커의 분포 정도를 측정하는 함수일 수 있다.

는 아래의 수학식에 의해 산출될 수 있다.

may be a function that measures the degree of distribution of the corresponding marker for each genome type according to the number of patients (k) requested by the data requestor.

can be calculated by the equation below.

ρ

=

=

5 and 6 are flowcharts of a method of de-identifying genome data according to embodiments of the present disclosure.

As shown in FIG. 5 , in S110, the genome data de-identification processing device 100 may receive genome data of a target cell from an external electronic device.

In S120, the genomic data de-identification processing apparatus 100 may calculate an anonymity score based on whether the sequences of markers corresponding to the homogeneous class are identical among the genomic data.

In S130, the genomic data de-identification processing apparatus 100 may calculate a diversity score based on the degree of difference between sequences of markers corresponding to the homogeneous class in the genomic data.

In S140, the genomic data de-identification processing apparatus 100 may determine whether to de-identify each marker included in the genomic data in consideration of the anonymity score and the diversity score for each marker included in the genomic data.

In S150, the genomic data de-identification processing device 100 generates de-identified genetic data by de-identifying markers for which the de-identification process is true, and a proximity score proportional to the degree of equality between the genomic data and the de-identified genetic data. It is possible to determine whether the proximity score is equal to or less than a preset reference proximity value by calculating .

In S160, the genome data de-identification processing apparatus 100 may store de-identified genetic data when the proximity score is equal to or greater than the reference proximity value, and regenerate de-identified genetic data when the proximity score is less than the reference proximity value.

As shown in FIG. 6, in S210, the dielectric data de-identification processing device 100 may receive a request signal from the user terminal of the data requestor.

In S220, the genome data de-identification processing apparatus 100 may load the original genome data to be processed based on the disease condition and quantity condition included in the request signal.

In S230, the genomic data de-identification processing apparatus 100 may classify essential marker regions or non-essential marker regions in the original genome data to calculate anonymity scores and diversity scores for base sequence values. Since the operation of S230 is the same as that of the de-identification processing decision unit, a detailed description thereof will be omitted.

In S240, the genomic data de-identification processing unit 100 generates first de-identification genetic data in consideration of the anonymity score and the diversity score, selects an essential marker region based on the disease condition included in the request signal, and selects the essential marker region. Second non-identification genetic data may be generated so that the non-identification process is not performed.

In S250, the genome data de-identification processing device 100 may transmit the second non-identification genetic data to the user terminal of the data requestor.

7 is a flowchart of a process of encrypting and distributing non-identified genetic data according to embodiments of the present disclosure.

In S310, the dielectric data de-identification processing device 100 receives a data request signal from the data request terminal 200.

In S320, the genome data de-identification processing device 100 loads the original genome data from the database.

In S330, the genome data de-identification processing apparatus 100 may determine a de-identification processing region from among the original genome data. The de-identification processing region may be determined based on an anonymity score and a diversity score among sequence values for each marker of the genome data.

In S340, the genome data de-identification processing apparatus 100 may de-identify a region where the de-identification processing region is true to generate de-identification genetic data.

In S350, the genomic data de-identification processing apparatus 100 may determine processing confirmation for essential marker regions in the de-identified genetic data. Treatment confirmation may be determined so that essential marker regions are received from the database for each disease and base sequence values of essential marker regions are not de-identified.

In S360, the genome data de-identification processing device 100 may encrypt the de-identification genetic data with an encryption key. The genome data de-identification processing device 100 may encrypt the de-identification genetic data using an encryption key shared with the data requesting terminal 200 . The encryption key used to geneticize the non-identified genetic data may be identification information of the data requesting terminal 200 or a key corresponding to the non-identified genetic data. The encrypted key is composed of an asymmetric key to protect genetic data, and it is transmitted to VPN or offline under the judgment that the requester's request is appropriate for information security (review committee), so that the genetic information of the de-identified marker can be decoded. can

In S370, the genome data de-identification processing device 100 may transmit the encrypted non-identification genetic data to the data requesting terminal 200.

The devices described above may be implemented as hardware components, software components, and/or a combination of hardware components and software components. For example, devices and components described in the embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA) , a programmable logic unit (PLU), microprocessor, or any other device capable of executing and responding to instructions. The processing device may run an operating system (OS) and one or more software applications running on the operating system. A processing device may also access, store, manipulate, process, and generate data in response to execution of software. For convenience of understanding, there are cases in which one processing device is used, but those skilled in the art will understand that the processing device includes a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that it can include. For example, a processing device may include a plurality of processors or a processor and a controller. Other processing configurations are also possible, such as parallel processors.

Software may include a computer program, code, instructions, or a combination of one or more of the foregoing, which configures a processing device to operate as desired or processes independently or collectively. The device can be commanded. Software and/or data may be any tangible machine, component, physical device, virtual equipment, computer storage medium or device, intended to be interpreted by or provide instructions or data to a processing device. , or may be permanently or temporarily embodied in a transmitted signal wave. Software may be distributed on networked computer systems and stored or executed in a distributed manner. Software and data may be stored on one or more computer readable media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. Program commands recorded on the medium may be specially designed and configured for the embodiment or may be known and usable to those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. - includes hardware devices specially configured to store and execute program instructions, such as magneto-optical media, and ROM, RAM, flash memory, and the like. Examples of program instructions include high-level language codes that can be executed by a computer using an interpreter, as well as machine language codes such as those produced by a compiler. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

As described above, although the embodiments have been described with limited examples and drawings, those skilled in the art can make various modifications and variations from the above description. For example, the described techniques may be performed in an order different from the method described, and/or components of the described system, structure, device, circuit, etc. may be combined or combined in a different form than the method described, or other components may be used. Or even if it is replaced or substituted by equivalents, appropriate results can be achieved.

Therefore, other implementations, other embodiments, and equivalents of the claims are within the scope of the following claims.

Claims (17)

a data input unit receiving genome data of a target cell from an electronic device;
Among the genomic data, an anonymity score is calculated based on the degree of identity between samples for nucleotide sequences of markers corresponding to a homogeneous class,
Among the genomic data, a diversity score is calculated based on the degree of difference between samples for marker sequences corresponding to a homogeneous class,
a de-identification processing decision unit determining whether to perform de-identification processing for each marker region included in the genome data in consideration of the anonymity score and the diversity score for each marker included in the genome data;
Generate non-identified genetic data in which one or more marker regions for which de-identification is true are de-identified,
A proximity score proportional to the degree of equality between the genetic data and the non-identified genetic data is calculated to determine whether the proximity score is greater than or equal to a preset reference proximity value, and if the proximity score is greater than or equal to the reference proximity value, the proximity score is calculated. a de-identification data generation unit that stores de-identification genetic data in a storage unit and regenerates the de-identification genetic data when the proximity score is less than the reference proximity value;
In response to a distribution request signal, a distribution unit that generates output data corresponding to the distribution request signal from among genome data stored in a marker reference database and transmits the output data to a data request terminal; A genetic data de-identification processing device that generates de-identified genetic data. According to claim 1,
The genetic data is
A genomic data de-identification processing device that generates de-identified genetic data obtained by de-identifying genomic data, including potential genetic information capable of individual inferential identification. According to claim 1,
The de-identification processing decision unit
Genomic data de-identification processing device for generating de-identified genetic data by de-identifying genomic data, calculating an allele frequency for each marker included in the genomic data. According to claim 1,
The anonymous score is
Genomic data de-identification processing device for generating non-identified genetic data by de-identifying genetic data, which is a value determined in proportion to the ratio of the number of samples distinguishable by a designated marker within the genetic data. delete delete According to claim 1,
The de-identification processing decision unit
A genomic data de-identification processing device for generating de-identified genetic data by de-identifying genomic data, selecting markers corresponding to personal identification markers among markers included in genomic data. According to claim 1,
The de-identification processing decision unit
Among one or more markers included in the genomic data, markers corresponding to personal identification markers are selected, but markers with high importance as markers for the disease are excluded from the personal identification markers based on the disease information of the genomic data. Genomic data de-identification processing device for generating de-identified genetic data. The genome data de-identification processing device includes receiving genome data of a target cell from an external electronic device;
The genomic data de-identification processing device calculates an anonymity score based on whether the sequences of markers corresponding to a homogeneous class are identical among samples among the genomic data,
Among the genomic data, a diversity score is calculated based on the degree of difference between samples for marker sequences corresponding to a homogeneous class,
determining whether to process de-identification for each marker included in the genomic data in consideration of the anonymity score and the diversity score for each marker included in the genomic data;
Generating de-identification genetic data in which the marker for which the de-identification process is true is de-identified, and calculating a proximity score proportional to the degree of equality between the genetic data and the de-identification genetic data, so that the proximity score is set in advance. Determine whether the proximity score is greater than or equal to the reference proximity value, store the non-identified genetic data if the proximity score is greater than or equal to the reference proximity value, and regenerate the non-identified genetic data if the proximity score is less than the reference proximity value doing; and
In response to a distribution request signal, generating output data corresponding to the distribution request signal from among dielectric data stored in a storage unit, and transmitting the output data to a requesting terminal; including, de-identifying the dielectric data How to generate processed de-identified genetic data. According to claim 9,
The genetic data is
A method of generating de-identified genetic data by de-identifying genomic data, including potential genetic information capable of individual inference identification. According to claim 9,
The step of determining whether the de-identification process is
A method of generating de-identified genetic data by de-identifying genomic data, calculating an allele frequency for each marker included in the genomic data. According to claim 9,
The anonymous score is
A method of generating non-identified genetic data by de-identifying genetic data, which is a value determined in proportion to the ratio of the number of samples distinguishable by a designated marker within the genetic data. delete delete According to claim 9,
The step of determining whether the de-identification process is
A method of generating de-identified genetic data by de-identifying genomic data, selecting markers requiring de-identification processing from among markers included in genomic data through data mining. According to claim 9,
The step of determining whether the de-identification process is
Among one or more markers included in the genomic data, markers corresponding to personal identification markers are selected, but markers with high importance as markers for the disease are excluded from the personal identification markers based on the disease information of the genomic data. A method for generating de-identified genetic data that has been de-identified. A computer program stored in a computer readable storage medium to execute the method of any one of claims 9 to 12, 15 and 16 using a computer.

Images