KR20100008532A - Method of privacy preserving in dynamic datasets publication and privacy preserving system using the same - Google Patents

Abstract

PURPOSE: A method of privacy preserving in dynamic dataset publication and a privacy preserving system using thereof are provided to prevent privacy intrusion by the repeated distribution of data. CONSTITUTION: A protection table generating unit(720) reads out the table T from the first storage. The protection table generating unit gets the predetermined piracy level value(P) as an input. The protection table generating unit creates the table QIT having schema and the table PT equipped with record having schema. The number of records having the Row_ID in the table PT is p. The sum of the PROB column of the records having the Row_ID in the table PT is 1.0.

Description

Personal information protection method in the distribution of dynamic data and personal information protection system using the same {METHOD OF PRIVACY PRESERVING IN DYNAMIC DATASETS PUBLICATION AND PRIVACY PRESERVING SYSTEM USING THE SAME}

The present invention relates to a method of protecting personal information, and more particularly, dynamic data distribution to prevent sensitive information of a person from being leaked during distribution of data containing personal information, particularly dynamic data in which addition or deletion of data occurs. It relates to a personal information protection method of the city and a personal information protection system using the same.

The development of database technology and information and communication technology makes it easier to collect, manage, and share large amounts of information, and organizations or institutions collect large amounts of information containing personal information for research or statistical analysis. Is becoming frequent. At this time, it is important to prevent sensitive information of the individual included in the data from being leaked.

1A is a diagram illustrating medical record data of a patient generated at a hospital.

For example, assuming the medical record data of the patient illustrated in FIG. 1A (data in the form of a table not pre-aggregated and summarized as in FIG. 1A can be defined as micro data-micro data), the table includes a name, age, zip code, and There are four attributes, including the name of the bottle. Here, the name is an identifier that uniquely distinguishes an individual (actually, the name cannot be the only identifier because a person with the same name exists, but is assumed to be the only identifier here), and the disease name must be protected. This is a sensitive property. In this case, when micro data such as FIG. 1A is disclosed for research or statistical purposes, the simplest method for protecting the privacy of an individual is to remove an identifier (a name in the table of FIG. 1A) that uniquely identifies an individual. To distribute the table. However, this method does not provide sufficient protection for the privacy of the individual.

Because if an attacker knows the age and postal code of Bob's, and that Bob is treated in a hospital, he can easily infer that Bob's illness is hepatitis. As such, an attribute that can be used to identify an individual when several attributes are combined with each other and linked to external information (the fact that 'Pullum' has received hospital care) is called a quasi-identifier.

The k-anonymity model and l-diversity model have been proposed to solve these privacy violations. The k-anonymity model is a technique that provides privacy by providing anonymity by making the sub-identifier less specific generalization or suppression so that each record is not distinguished from at least k-1 other records.

FIG. 1B is a diagram illustrating an example in which a 2-anonymity model is applied to the micro data illustrated in FIG. 1A.

Referring to FIG. 1B, there is shown an example in which the records constituting the micro data of FIG. 1A are grouped so as not to be distinguished from each other by generalizing age and postal code. In this case, a set of records grouped so as not to be distinguished from each other is called an equivalent class. Although the k-anonymity model provides anonymity, it does not take into account the distribution of sensitive attributes within the equivalence class, and the l-diversity model has the highest probability of the most frequently occurring sensitive attributes (bottle names) addressing these problems. It is a way to solve this problem by making 1 / l.

For example, FIG. 1B is a table satisfying 2-anonymity and 2-diversity. As the value of k or l increases, the degree of privacy protection increases. However, as the degree of privacy protection increases, the usefulness of the data decreases due to information loss due to generalization.

Such a conventional privacy protection technique has no problem in the situation of distributing static data, that is, in a situation in which all data is prepared and distributed only once at the time of distributing data, but in an environment in which data is continuously changed. Problems arise when data is inserted or deleted to provide recent information.

FIG. 2A is a diagram illustrating a situation in which an added record and a deleted record are generated in the table illustrated in FIG. 1A.

For example, FIG. 2A shows four records ('Miyeon', 'Minseok', 'Hyeonseok', 'Jeongmin') added in the diagram illustrated in FIG. 1A, and four records ('Youngho', 'Minjae', 'Sujin'). ',' Eugene ') is an example of a deleted table.

FIG. 2B is a diagram illustrating an example in which a 2-anonymity model is applied for redistribution to the micro data illustrated in FIG. 2A.

At this time, an attacker who has obtained the information of FIG. 1B and FIG. 2B may obtain the sensitive information of the individual through the following inference using the relation between the two tables. If the attacker knows in the background that the sub-identifier value of 'withdrawal' and 'withdrawal' are included in both tables, he knows from FIG. 1a that the disease of 'withdrawal' is hepatitis or cold, It can be seen from 1b that the disease withdrawal is hepatitis or pneumonia. Thus, combining the two facts, he decides that the name of his illness is hepatitis. Alternatively, in FIG. 1B, the disease names that can be withdrawn are two cases of hepatitis and cold, but in FIG. 2B, since there is no record having the disease name cold, it can be seen that the disease of withdrawal is hepatitis. . This phenomenon is called critical absence.

In order to solve this problem, an m-invariance model has been proposed for dynamic data privacy protection where data insertion / deletion occurs. The m-invariance model replaces the deleted record with the inserted record and generalizes it again if the deleted and equal records have the same sensitive attributes, and inserts counterfeits when a fatal deficit occurs. However, in the m-invariance technique, the loss of information due to generalization occurs, and it affects other records belonging to the same class when the sensitive property of one record is exposed to the attacker. Therefore, there is a need for a dynamic data privacy method that can be applied to dynamic data and prevents loss of information due to generalization of sub-identifiers.

An object of the present invention for solving the above problems, in the distribution of data that is dynamically added and deleted, while preventing the invasion of privacy by the distribution of repeated data, while the loss of information due to the generalization of the sub-identifier It is to provide a data protection method of data that can be prevented.

Another object of the present invention for solving the above problems is, in the distribution of data that is dynamically added and deleted, while preventing the invasion of privacy by the distribution of repeated data, while the information of the generalization of the sub-identifier The present invention provides a personal information protection device that protects personal information by generalizing data to prevent loss.

The present invention to achieve the above object, the categorical sensitive attribute S belonging to the sub-identifier attribute (QI ₁ , ..., QI _m ) and the domain {S ₁ , ..., S _l } A method of protecting information of a table T having _n records {t ₁ , ..., t _n }, comprising: (QI ₁ , ..., QI _m , Row_ID) from the table T Generating a table QIT having a schema and a table PT having a schema including (Row_ID, S, PROB) that is a target of a join operation with the table QIT from the table T; Records having the same Row_ID in the table PT are generated by a predetermined privacy level value (p, p is a natural number of 2 or more), and the sum of PROB columns of the records having the same Row_ID is 1.0. Provide privacy methods.

Here, the PROB column of the records having the same Row_ID may be configured to have an equal value (1 / p).

Herein, in the case of generating the QIT 'and PT' for the table T 'in which the record is added and / or deleted in the table T, the records corresponding to T∩T' (there is no change). Records) are copied from the table QIT and the table PT to the table QIT 'and the table PT' as it is, and for the records corresponding to T'-T (added records), (QI ₁ , ..., A corresponding record having a schema including QI _m , Row_ID) is created in the table QIT ', and a schema including (Row_ID, S, PROB) that is a target of a join operation with the table QIT'. And generating records in the table PT ', wherein records having the Row_ID generated in the table PT' are generated by a predetermined privacy level value (p, p is a natural number of 2 or more), and the same Row_ID. The sum of the PROB columns of records with That may be configured.

The present invention for achieving the above another object, the categorical sensitive attribute S belonging to the sub-identifier attribute (QI ₁ , ..., QI _m ) and the domain {S ₁ , ..., S _l } Reads the table T from the first storage unit storing the table T having _n records {t ₁ , ..., t _n } with the first storage unit, and the predetermined privacy level values (p, p A table QIT having a schema containing (QI ₁ , ..., QI _m , Row_ID), and (Row_ID, which is the target of a join operation with the table QIT). S, PROB) including a record with a schema including the schema, the number of records having the same Row_ID is p, the protected table generation unit for creating a table PT that the sum of PROB columns of records having the same Row_ID is 1.0 And a second storage unit for storing the table QIT and the table PT output from the protection table generator. Provide privacy for data, characterized in that a.

Here, in the table PT generated by the protection table generating unit, PROB columns of records having the same Row_ID may be configured to have equal values.

The personal information protection device may further include: a third storage unit storing a table T 'in which records are added and / or deleted in the table T; The table T, the table QIT, the table PT, and the table T 'are read from the first storage unit, the second storage unit, and the third storage unit, and predetermined privacy level values p and p are two or more. Natural records), and records corresponding to T ∩ T '(records without change) are copied from table QIT and table PT to table QIT' and table PT 'as they are, and records corresponding to T'-T (Added records), records having a schema containing corresponding (QI ₁ , ..., QI _m , Row_ID) are created in the table QIT ', and the table QIT' is joined to ( join) has a schema including (Row_ID, S, PROB) that is the target of the operation, and the sum of the PROB columns of records with the same Row_ID is 1.0 and creates p records with the same Row_ID in the table PT '. A change protection table generation unit; And a fourth storage unit for storing the table QIT 'and the table PT' outputted from the change protection table generator.

In the case of using the personal information protection method and the personal information protection device according to the present invention as described above, in the case of distributing data including personal sensitive information, by adding noise to the sensitive information field containing sensitive information You can protect your information.

In particular, when redistributing dynamic data in which addition / deletion of data is performed, when the personal information protection method and the personal information protection device according to the present invention are used, by contrasting previous distribution data and recent distribution data with each other. Protection against attackers' attempts to infer personal information is possible.

As the invention allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention. In describing the drawings, similar reference numerals are used for similar elements.

Terms such as first, second, A, and B may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as the second component, and similarly, the second component may also be referred to as the first component. The term and / or includes a combination of a plurality of related items or any item of a plurality of related items.

When a component is referred to as being "connected" or "connected" to another component, it may be directly connected to or connected to that other component, but it may be understood that other components may be present in between. Should be. On the other hand, when a component is said to be "directly connected" or "directly connected" to another component, it should be understood that there is no other component in between.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, the terms "comprise" or "have" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in the commonly used dictionaries should be construed as having meanings consistent with the meanings in the context of the related art and shall not be construed in ideal or excessively formal meanings unless expressly defined in this application. Do not.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Personal information protection method according to the present invention

The privacy method according to the present invention has a sub-identifier attribute (QI ₁ , ..., QI _m ) and a categorical sensitive attribute S belonging to the domain {S ₁ , ..., S _l } Table QIT and table PT are constructed and distributed so that personal information is protected from table T having _n records {t ₁ , ..., t _n }.

First, the configuration of the micro data to which the personal information protection method according to the present invention is applied will be described.

Table T containing _n records (t ₁ , ..., t _n ) containing personal information can be expressed through the following [Expression 1].

[Expression 1]

T = {t ₁ , ..., t _n }

At this time, the cardinality of the table T can be expressed through Expression 2 below.

[Expression 2]

| T | = n

In addition, if the table T has a quasi-identifier attribute, and m fields of the table T have the sub-identifier attribute, the table T may be expressed through Expression 3 below. For example, referring to the tables illustrated in FIGS. 1A and 2A, the sub-identifier attributes of the tables illustrated in FIGS. 1A and 2A are 'age' and 'zip code', and m is 2.

[Expression 3]

Corrosive properties of table T: QI ₁ , ..., QI _m

In addition, table T has a sensitive attribute S (assuming there is one sensitive attribute), S is categorical data with discrete values, and the value is domain D as shown in Equation 4 below. It has one of l values in it. In addition, as shown in Expression 5, the size of the domain is defined as l.

For example, referring to the table illustrated in FIG. 1A, the sensitive attribute of the table illustrated in FIG. 1A becomes' disease name ', and the sensitive attribute is' hepatitis',' cold ',' pneumonia ',' gastric ulcer ',' Categorical data with values such as gastritis and diabetes.

[Expression 4]

D = {s ₁ , ..., s _l }

[Expression 5]

| D | = l

3 is a flowchart illustrating a personal information protection method according to the present invention.

Referring to FIG. 3, in the privacy protection method according to the present invention, generating a table QIT having a schema including (QI ₁ , ..., QI _m , Row_ID) from the table T (S310). And a table PT having a schema including (Row_ID, S, PROB) that is a target of a join operation with the table QIT from the table T (S320).

That is, the table QIT generated in step S310 is (t _i [QI ₁ ], ..., t _i [QI _m ], Row_ID for all t _i (i is 1 or more and n or less) included in the table T. ) Will have tuples.

FIG. 4A is a diagram illustrating a table QIT generated when the privacy protection method according to the present invention is applied to the data illustrated in FIG. 1A.

Next, the table PT generated in step S320 has a Row_ID column commonly included in the table QIT to allow a join operation with the table QIT, and is a tuple having a schema of (Row_ID, S, PROB). It is composed.

FIG. 4B is a diagram illustrating a table PT generated when the data illustrated in FIG. 1A is applied to the privacy protection method according to the present invention.

At this time, the table PT is generated according to a predetermined privacy level value (p, p is a natural number of 2 or more). In response to the privacy level value p, p records having the same Row_ID value are generated. In addition, the sum of the probability value PROB columns of records having the same Row_ID value is 1.0.

That is, the privacy protection method according to the present invention adds noise to the sensitive attribute values instead of generalizing the sub-identifier attributes as mentioned in the prior art in order to prevent the exposure of the sensitive attribute values. Noise record is added to the table PT). For example, by generating p-1 random values with equal probability in domain D of S, generating additional records and including them in the table PT so that an attacker cannot distinguish which values are originally sensitive attributes. can do.

Data redistribution method in the personal information protection method according to the present invention

5 is a flowchart illustrating a personal information protection method that can be applied at the time of redistribution of data according to the present invention.

In the data redistribution method illustrated in FIG. 5, a table T 'in which records are added and / or deleted with respect to the table T described with reference to FIG. 3 is generated, and the table T' is obtained from the table T '. It is assumed that a situation occurs that requires redistribution to an organization or organization.

According to the privacy protection method according to the present invention, when data is redistributed, records corresponding to T ∩ T '(records without modification) remain as table QIT' and table PT 'from table QIT and table PT, respectively. For the step of copying (S510) and the records (added records) corresponding to T'-T, a corresponding scheme having a schema including (QI ₁ , ..., QI _m , Row_ID) is included. Creating a record in the table QIT ', and generating records in the table PT' having a schema including (Row_ID, S, PROB) to be joined to the table QIT '(S520). Your privacy is protected.

At this time, in step S520, records having the Row_ID generated in the table PT 'are generated by a predetermined privacy level value (p, p is a natural number of 2 or more), and the sum of the PROB columns of the records having the same Row_ID. Is 1.0.

6A and 6B illustrate tables QIT 'and Table PT' generated by applying the privacy method according to the present invention for the data illustrated in FIG. 1B in which addition and deletion of records are performed on the data illustrated in FIG. 1A. This is a diagram to explain.

Referring to FIG. 6A, a table QIT 'corresponding to the data illustrated in FIG. 2A, in which four records are added and four records are deleted for the data illustrated in FIG. 1A, is illustrated.

Referring to FIG. 6B, a table PT 'that is a join operation on the table QIT' illustrated in FIG. 6A is illustrated, and since 2 (p = 2) is specified as the privacy level value, records having the same Row_ID are 2. It illustrates the case where there exists one by one. In this case, records having the same Row_ID have an original sensitive attribute value and noise value with an equal probability (0.5, 1/2).

Through this, unlike the case of using the privacy protection method through the generalization of the sub-identifier as shown in Fig. 1b and 2b as mentioned in the prior art, even when the data is redistributed, It is possible to prevent the phenomenon of inferring a sensitive attribute of an individual and a fatal lack of a sensitive attribute missing from one side data.

That is, comparing FIG. 4A and FIG. 4B with FIG. 6A and FIG. 6B, respectively, the sub-identifier value of a specific person is known, and that the specific person (eg, 'withdrawal') is included in both tables (FIGS. 4A and 6A). Even if we know the facts, we can see that the sensitive properties of certain people ('hepatitis') still have the same noise ('fractures'), so their privacy is protected.

Personal information protection device to which the personal information protection method according to the present invention is applied

7 is a block diagram showing an example of the configuration of a personal information protection device according to the present invention.

Referring to FIG. 7, a configuration example 700 of the personal information protection device according to the present invention may include a first storage unit 710, a protection table generator 720, and a second storage unit 730. have.

The personal information protection device 720 illustrated in FIG. 7 is a personal information protection device that may be included in a conventional database management system (DBMS) or may be used in addition to a conventional database management system. It may be implemented in software.

For example, the first storage unit 710 is a component for storing a table T including original data to be distributed with personal information protected, and includes an optical recording medium, a magnetic recording medium, a semiconductor memory, and the like. Refers to the component. The table T included in the first storage unit 710 may be a table managed in a relational database. Here, the table T is assigned to the sub-identifier attribute (QI ₁ , ..., QI _m ) and the domain {S ₁ , ..., S _l } to which the privacy protection method according to the present invention described above is applied. It is described as a table T with n records {t ₁ , ..., t _n } with the categorical sensitive attribute S belonging to it.

The protection table generator 720 is a component accessible to the first storage unit 710 and the second storage unit 730 which will be described later. It may be a component.

The protection table generating unit 720 reads the table T from the first storage unit, receives a predetermined privacy level value (p, p is a natural number of two or more), and receives (QI ₁ ,..., QI _m ,). Table QIT having a schema including Row_ID), and a record having a schema including (Row_ID, S, PROB) that is a target of a join operation with the table QIT, and having the same Row_ID. The number of records becomes p, and the component that creates the table PT becomes the sum of PROB columns of records having the same Row_ID.

Accordingly, the protection table generator 720 receives the privacy level value p from the outside (user), adds noise corresponding to the privacy level value (p-1 noise records are added to the table PT), and the table QIT. Will create the table PT. The higher the privacy level value, the more noise is added to the sensitive property, which increases the protection of the personal information, but the lower the usefulness of the data. Conversely, the lower the privacy level value is, the less noise is added to the sensitive property. Is less protected, but the data is more useful.

Lastly, the second storage unit 730 is a component for storing the table QIT and the table PT output from the protection table generating unit 720. Like the first storage unit, the optical recording medium and the magnetic recording unit are stored. Comprehensive element, including a medium, a semiconductor memory, and the like. Here, the first storage unit 710 and the second storage unit 730 are only described functionally separated, and may refer to physically identical storage devices.

In addition, referring back to FIG. 7, the configuration 700 of the personal information protection device according to the present invention includes a third storage unit 740, a change protection table generation unit 750, and a fourth storage unit 760. It can be configured to include.

That is, the personal information protection device according to the present invention may further include a third storage unit 740 as an additional component in order to execute a personal information protection method applicable to redistribution of data according to the present invention illustrated in FIG. The change protection table generator 750 and the fourth storage unit 760 may be included.

The third storage unit 740 is a component in which the table T 'in which records are added and / or deleted in the table T is stored. Similarly, the third storage unit 740 includes an optical recording medium, a magnetic recording medium, and a semiconductor memory. Element.

The change protection table generation unit 750 may generate the table T, the table QIT, the table PT, and the table from the first storage unit 710, the second storage unit 730, and the third storage unit 740. T 'is read out, and a predetermined privacy level value (p, p is a natural number of 2 or more) is input, and records corresponding to T ∩ T' (records without change) are table QIT from table QIT and table PT, respectively. Copies directly to 'and table PT' and, for records corresponding to T'-T (added records), schema with corresponding (QI ₁ , ..., QI _m , Row_ID) Create records in the table QIT ', have a schema including (Row_ID, S, PROB) that is the target of a join operation with the table QIT', and the sum of the PROB columns of the records having the same Row_ID A component that creates p records in table PT 'with a value of 1.0 and having the same Row_ID .

The change protection table generator 750 is a component accessible to the first, second, and third storage units 710, 730, and 740 and the fourth storage unit 760, which will be described later. The protection table generation unit 730 is described above. ), May be a software-implemented component included in or added to a database management system.

The fourth storage unit 760 is a component for storing the table QIT 'and the table PT' outputted from the change protection table generating unit. Similarly, the fourth storage unit 760 includes an optical recording medium, a magnetic recording medium, a semiconductor memory, and the like. Refers to the component.

Although described above with reference to a preferred embodiment of the present invention, those skilled in the art will be variously modified and changed within the scope of the invention without departing from the spirit and scope of the invention described in the claims below I can understand that you can.

FIG. 1A is a diagram illustrating medical record data of a patient generated at a hospital, and FIG. 1B is a diagram illustrating an example in which a 2-anonymity model is applied to the micro data illustrated in FIG. 1A.

FIG. 2A is a diagram illustrating a situation in which added and deleted records are generated in the diagram illustrated in FIG. 1A, and FIG. 2B illustrates an example in which a 2-anonymity model is applied for redistribution of micro data illustrated in FIG. 2A. It is a chart.

3 is a flowchart illustrating a personal information protection method according to the present invention.

4A and 4B are tables for explaining the table QIT and the table PT generated when the personal information protection method according to the present invention is applied to the data illustrated in FIG. 1A.

5 is a flowchart illustrating a personal information protection method that can be applied at the time of redistribution of data according to the present invention.

6A and 6B illustrate tables QIT 'and Table PT' generated by applying the privacy method according to the present invention for the data illustrated in FIG. 1B in which addition and deletion of records are performed on the data illustrated in FIG. 1A. This is a diagram to explain.

7 is a block diagram showing an example of the configuration of a personal information protection device according to the present invention.

Claims (6)

N records with sub-identifier attributes (QI ₁ , ..., QI _m ) and categorical sensitive attributes S belonging to domain {S ₁ , ..., S _l } {t ₁ , .. In the information protection method of a table T having., t _n }, Generating a table QIT having a schema including (QI ₁ ,..., QI _m , Row_ID) from the table T; And Generating a table PT having a schema including (Row_ID, S, PROB) that is a target of a join operation with the table QIT from the table T; Records having the same Row_ID in the table PT are generated by a predetermined privacy level value (p, p is a natural number of 2 or more), and the sum of PROB columns of the records having the same Row_ID is 1.0. How we protect your privacy. The method of claim 1, PROB column of the records having the same Row_ID has an equal value (1 / p). The method of claim 1, In the case of generating QIT 'and PT' for the table T 'having records added and / or deleted in the table T, Copying records corresponding to T ∩ T '(records without modification) from the table QIT and the table PT to the table QIT' and the table PT 'as they are; And For records corresponding to T'-T (added records), create a corresponding record in table QIT 'with a schema containing (QI ₁ , ..., QI _m , Row_ID) Generating records in a table PT 'having a schema including (Row_ID, S, PROB) that is a target of a join operation with the table QIT', Records having a Row_ID generated in the table PT 'are generated by a predetermined privacy level value (p, p is a natural number of 2 or more), and the sum of PROB columns of the records having the same Row_ID is 1.0. How we protect your data. N records {t1, ..., tn} with sub-identifier attributes (QI1, ..., QIm) and categorical sensitive attributes S belonging to domains {S1, ..., Sl} A first storage unit having a table T stored therein; The table T is read from the first storage unit, a predetermined privacy level value (p, p is a natural number of two or more), and a schema including (QI ₁ , ..., QI _m , Row_ID) is included. and a record having a table QIT having a schema) and a schema including (Row_ID, S, PROB) that is a target of a join operation with the table QIT, and the number of records having the same Row_ID is p. A protection table generating unit generating a table PT of which the sum of PROB columns of records having the same Row_ID is 1.0; And And a second storage unit for storing the table QIT and the table PT outputted from the protection table generating unit. The method of claim 4, wherein In the table PT generated by the protection table generating unit, PROB columns of records having the same Row_ID have an equal value. The method of claim 4, wherein A third storage unit storing a table T 'in which records are added and / or deleted in the table T; The table T, the table QIT, the table PT, and the table T 'are read from the first storage unit, the second storage unit, and the third storage unit, and predetermined privacy level values p and p are two or more. Natural records), and records corresponding to T ∩ T '(records without change) are copied from table QIT and table PT to table QIT' and table PT 'as they are, and records corresponding to T'-T (Added records), create records in the table QIT 'with a schema containing the corresponding (QI ₁ , ..., QI _m , Row_ID), and join with the table QIT'. (join) It has a schema including (Row_ID, S, PROB) that is the target of the operation, and the sum of the PROB columns of records having the same Row_ID is 1.0 and p records having the same Row_ID are created in the table PT '. A change protection table generation unit; And And a fourth storage unit for storing the table QIT 'and the table PT' outputted from the change protection table generating unit.

Images