WO2016013057A1

WO2016013057A1 - Information protection system, information protection method, and information protection program

Info

Publication number: WO2016013057A1
Application number: PCT/JP2014/069322
Authority: WO
Inventors: 紀宏津嶋; 雅之吉野
Original assignee: 株式会社日立システムズ
Priority date: 2014-07-22
Filing date: 2014-07-22
Publication date: 2016-01-28
Also published as: JP6046807B2; JPWO2016013057A1

Abstract

Provided is an information protection system capable of setting an appropriate generalization unit for a quasi-identifier even in the case of time evolution in a k-anonymization process for a data set of personal information having the quasi-identifier. For this purpose, the information protection system is provided with a means for calculating a future k-value according to a calculation formula for the quasi-identifier that evolves over time, a means for comparing the calculated k-value and a preset reference value, and a means for displaying a result of the comparison, whereby implementation of a time evolution simulation is enabled.

Description

Information protection system, information protection method, and information protection program

The present invention relates to an information protection system, an information protection method, and an information protection program.

In particular, the present invention provides a generalized unit of quasi-identifiers in an operational environment in which k-anonymization processing is performed on a time-dependent original data at a predetermined time interval using an information processing apparatus that performs k-anonymization processing. In the information protection system, the generalized unit of the quasi-identifier can be appropriately set by paying attention to the time dependency of the quasi-identifier. This information protection system is an information protection system having a k-anonymization simulation function that realizes optimization of generalized unit settings by managing time-correlation of quasi-identifiers and simulating time, and an information protection method And information protection programs.

In a server device that performs “k-anonymization” processing that realizes “k-anonymity” that makes it difficult to identify “k” or less people from the original data, the items of the original data are “identifier”, “quasi-identifier”, It is divided into “other information”. Anonymization is a process of processing personal information (privacy information) so that a user cannot be specified. Further, “k-anonymization” is known as an anonymity index. This is a combination of information that a user with a “quasi-identifier” does not want to be disclosed, and there are k or more people belonging to the same combination, thereby reducing the possibility that the user is specified to 1 / k or less. It is a technology that makes it difficult. As technologies related to this “k-anonymization”, there are Patent Literature 1 and Non-Patent Literature 1.

Also, “original data” is often a data set called “personal information”. “Personal information” is data that is not legalized but includes the idea of privacy in the personal information defined in the conventional personal information protection law.

The classification of “identifier”, “quasi-identifier”, and “other information” in “original data (personal information)” is, for example, a report on “development / improvement and verification of personal information protection / analysis infrastructure” shown in Non-Patent Document 1. Defined in the certificate. Among them, there is a process called “generalization process” of “quasi-identifier”. “Generalization” is a process that abstracts the value of “quasi-identifier” by converting “age” into “age” and “complete address” into “region”, and so on. This is a process for realizing “k-anonymity” by making it impossible to identify a person (for example, “age” and “region”) below “k” people.

PCT International Publication No. WO2012 / 090628

Conventionally, when the generalized unit of quasi-identifiers is determined in the “k-anonymization” process for time-evolving data sets as in the above document, the objective is to leave the maximum number of records and the amount of information at a certain time. It is processed with the algorithm. However, there is no idea of setting a generalized unit by predicting the state of a future data set, and no technology has been established.

In Patent Document 1, in order to prevent the generalized unit (abstraction level) from becoming too high with respect to the quasi-identifier of positioning data included in time-developing position information, the abstraction level exceeds a predetermined reference value. In this case, the positioning time is divided into ad hoc (limited purpose). That is, in Patent Document 1, a general unit (abstraction level) of a quasi-identifier (position information) that develops in time (added in real time) is expressed as “unit (abstraction level) as means for preventing the unit (abstraction level) from increasing. The method of dividing | segmenting "is disclosed. However, Patent Document 1 discloses a technique of “dividing the generalized unit when the generalized unit (abstraction level) increases”, but the technique of “setting (changing) the unit systematically” is disclosed. Not disclosed. Therefore, there is a possibility that the generalized unit does not match when the purpose is to leave only the information amount. Therefore, there is a problem that the analysis of the anonymized data set cannot be continued. Then, this invention is providing the information protection system which can continue the analysis of the anonymized data set.

In order to solve the above-mentioned problem, the information protection system of the present invention is capable of managing a time-evolving quasi-identifier calculation formula in a data set having a quasi-identifier and executing a time-development simulation of k-anonymization processing. Was provided. For example, the present invention is as follows.

The information protection system is a system that executes k-anonymization processing with time evolution for a data set (personal information) having a quasi-identifier, and has a calculation formula for calculating a distribution of k values according to the time evolution of the quasi-identifier, Generate a data set with time evolution using a calculation formula, determine whether the k value in the generated data set satisfies a preset reference value, and evaluate whether the generalized unit of the quasi-identifier is valid It is characterized by that.

The information protection system has a plurality of quasi-identifier calculation formulas that evolve in time in a data set having a quasi-identifier, selects a quasi-identifier correlated with the plurality of quasi-identifiers, and calculates the selected quasi-identifier calculation formula To generate a data set with time evolution, determine whether the k value in the generated data set satisfies a preset reference value, and evaluate whether the generalized unit of the quasi-identifier is valid It is characterized by.

The information protection system divides the quasi-identifier used in generating the data set with time development into generalized units, calculates the k value in the cell created by combining the divided areas, and sets the calculated k value in advance. The extracted reference value is compared, and a cell that does not satisfy the reference value is extracted.

The information protection system can execute two or more different time evolution simulations, and can set two or more quasi-identifier calculation formulas.

In the information protection system of the present invention, even if the generalized unit of the quasi-identifier set in the original data secures (satisfies) the value of “k”, the setting of the generalized unit becomes effective after several years. Can be evaluated.

In addition, even if the value of “k” required in the generalized unit set in the original data after several years cannot be satisfied, the generalized unit can be satisfied in the simulated data set several years after the original data in advance. By setting to, data unit inconsistency caused by the conventional method of changing the generalized unit after several years can be prevented in advance.

Furthermore, if inconsistencies occur in generalized units, there will be a problem that the comparison of the analysis results cannot be continued due to, for example, the unit of the analysis axis being different, but it is necessary to simulate a data set after several years. Thus, it becomes possible to set the generalized unit in advance so as not to change even after several years, and the data availability can be improved. Problems, configurations, and effects other than those described above will be clarified by the following description of embodiments.

FIG. 1 is a configuration diagram of an information protection system that realizes a k-value time-dependent evaluation simulation function in k-anonymization processing. FIG. 2 is a correspondence diagram showing the structure of each data and the relationship between the data. FIG. 3 is a diagram illustrating a configuration example of the original data table. FIG. 4 is a diagram illustrating a configuration example of a semi-identifier management master (JSM) table. FIG. 5 is a diagram illustrating a configuration example of a simulation definition master (SDM) table. FIG. 6 is a diagram illustrating a configuration example of a simulation journal table (SJT). FIG. 7 is a flowchart showing the entire process of the time-dependent evaluation simulation of the k value in the k-anonymization process. FIG. 8 is a flowchart showing the quasi-identifier selection / registration process. FIG. 9 is a flowchart showing a simulation content setting process to be executed. FIG. 10 is a flowchart showing the simulation execution process. FIG. 11 is a flowchart showing a data set generation process after n years. FIG. 12 is a diagram illustrating a simulation execution result when the generalized unit is 3 years old and the age is changed. FIG. 13 is a diagram showing a simulation execution result when the generalized unit is 5 years old and the age is changed. FIG. 14 is a diagram illustrating a state before the simulation is executed when the age and the age of residence are changed and the generalized unit is 5 years old. FIG. 15 is a diagram illustrating a state after the simulation is executed when the age and the number of years of residence are changed and the generalized unit is 5 years old.

Hereinafter, embodiments will be described with reference to the drawings. In the following description, various types of information may be described using an expression such as “management table”, but the various types of information may be expressed using a data structure other than a table. Further, the “management table” can be referred to as “management information” to indicate that it does not depend on the data structure.

Also, there are cases where the process is explained using “program” as the subject. The program is executed by a processor, for example, an MP (Micro Processor) or a CPU (Central Processing Unit), and performs a predetermined process. Note that the subject of processing may be a processor because the storage resource (for example, a memory) and a communication interface device (for example, a communication port) are used as appropriate. The processor may have dedicated hardware in addition to the CPU. The computer program may be installed on each computer from a program source. The program source may be provided by, for example, a program distribution server or a storage medium.

Further, each element, for example, the controller can be identified by a number or the like, but other types of identification information such as a name may be used as long as it is identifiable information. In the drawings and description of the present embodiment, the same reference numerals are given to the same parts. However, the present invention is not limited to the present embodiment, and any application examples that meet the idea of the present invention can be applied. Included in the scope. Further, unless specifically limited, each component may be plural or singular.

<System configuration> Fig. 1
FIG. 1 is a configuration diagram of an information protection system that realizes a k-value time-dependent evaluation simulation function in k-anonymization processing. The information protection system includes a k-value time-dependent evaluation simulation apparatus (abbreviated as an evaluation simulation apparatus) 1 and an operation terminal 100 connected to the evaluation simulation apparatus 1 via a network 101.

The evaluation simulation apparatus 1 also checks the simulation management apparatus 10, the CPU-a 11, the storage apparatus a 12, the communication apparatus 13 that controls communication connection with the network 101, the k-anonymization processing result, the determination result, and the simulation status. The display device 14 is provided.

Further, the CPU-a11 performs k-anonymization processing device 105 for performing k-anonymization processing on the original data or a data set with time t = t + n (n is an integer equal to or greater than 0), and k-anonymization processing device 105. Is provided with a determination device 114 that determines whether or not the processing result is valid. The storage device a12 includes a storage medium (memory or HDD) for storing original data (time t = t) for storing the original data (time t = t) 30.

The simulation management device 10 includes a CPU-b 15 and a storage device b16. The CPU-b 15 includes a data set (time t = t + n) generation device 107 that generates and manages a data set (time t = t + n) 108, a simulation definition device 109 that defines and manages simulation contents to be executed, and a defined quasi-identifier A quasi-identifier management device 112 for managing

The storage device b includes a storage medium for storing a data set (time t = t + n) that stores the data set (time t = t + n) 108, a storage medium for storing simulation definition master that stores information on the simulation definition master 50, and a simulation journal 60. A storage medium for storing a simulation journal for storing the above information, and a storage medium for storing a semi-identifier management master for storing information of the semi-identifier management master 40. These storage media are memory, HDD, and the like.

The simulation executor uses the operator terminal 100 to check the processing result of the k-anonymization processing device 105 on the display device 14 via the network 101. Whether the processing result is valid or not is determined by the determination device 114, and the determination result is also displayed on the display device 14. The processing result and the determination result may be acquired by the operator terminal 100 and displayed on a display unit (not shown) of the operator terminal 100.

In the prior art, the original data (time t = t) 30 was anonymized by the k-anonymization processing device 105 and the processing result was displayed on the display device 14. The k-anonymization processing device 105 may use the configuration described in Non-Patent Document 1 described above, or may have another configuration. The content of k-anonymization processing is generally known, and examples thereof include those described in Non-Patent Document 1 and Patent Document 1.

On the other hand, the simulation executor defines a quasi-identifier in the original data (time t = t) 30 using the operator terminal 100. The operator terminal 100 receives information on the defined quasi-identifier and transmits it to the evaluation simulation apparatus 1 via the network 101. The evaluation simulation apparatus 1 sends the received quasi-identifier information to the quasi-identifier management apparatus 112. The quasi-identifier management device 112 stores the received quasi-identifier information in the quasi-identifier management master 40 and sends it to the simulation definition device 109.

Also, the simulation executor examines the simulation contents. The examination results (calculation formula for what kind of calculation is used for time evolution, simulation period, reference value of k value, initial generalized unit, etc.) are transmitted to the evaluation simulation apparatus 1 via the operation terminal 100. The operation terminal 100 transmits the received simulation contents to the evaluation simulation apparatus 1, and the evaluation simulation apparatus 1 transmits the received simulation contents to the simulation definition apparatus 109. The simulation definition device 109 stores and manages information other than information related to the calculation formula in the received simulation contents in the simulation definition master 50. Information about the calculation formula is registered in the simulation journal 60.

The simulation executor determines a simulation to be actually executed from the registered simulation. For example, the simulation executor selects a simulation name to be executed from the registered simulation name and content displayed on the operation terminal 100 using a pull-down menu. The operation terminal 100 transmits the selected simulation name to the evaluation simulation apparatus 1.

The evaluation simulation apparatus 1 sends the received simulation name to the simulation definition apparatus 109, and the simulation definition apparatus 109 acquires detailed information (execution simulation detailed information) of the simulation actually executed from the simulation journal 60 and the simulation definition master 50.

Then, the simulation definition device 109 uses the data set (time t = t + n) generation device 107 to generate the data set (time t = t + n) 108 in which the acquired execution simulation detailed information is time-developed. The generated data set (time t = t + n) 108 is anonymized by the data set (time t = t + n) generation device 107 using the k-anonymization processing device 105, and the processing result is displayed on the display device 14. Is displayed. The validity of the processing result is determined by the determination device 114, and the determination result is also displayed on the display device 14.

Here, the expression “t = t + n” is a time when the time is developed from a certain time “t” to display the next simulation result (this is expressed as “t + n”), that is, the next simulation. The time of “t + n” that is the time of. The unit of time n is year, month, day, hour, minute, second, period, etc., and any unit can be used for simulation. Moreover, it may be a decimal number such as 0.5 years instead of an integer. By selecting such a unit, a temporally detailed simulation is possible. In addition, since long-term simulation can be performed, analysis efficiency can be improved.

<Data structure and relationship> Fig. 2
FIG. 2 is a correspondence diagram showing the structure of each data and the relationship between the data. As data used or managed by the evaluation simulation apparatus 1, an original data table 30, a semi-identifier management master (JSM) table 40, a simulation definition master (SDM) table 50, a simulation journal table (SJT). : Simulation Journal Table) 60.

For example, as shown in the figure, the original data table 30 has an identifier 1 (name) and an identifier 2 (member ID) as identifiers, and a quasi-identifier 1 (age) and a quasi-identifier 2 (address) as quasi-identifiers. , Quasi-identifier 3 (year of occupancy), quasi-identifier 4 (insurance discount stage), and other information (other 1) (annual income) and other 2 (car ownership). In the evaluation simulation apparatus 1, quasi-identifier candidates are determined in the original data table 30. In this example, “birth year (age)”, “address”, “year of residence”, and “insurance discount stage” are selected as quasi-identifiers.

The quasi-identifier management master table 40 is composed of the quasi-identifiers of the original data table 30. The semi-identifier management master table 40 has a JSM_quasi-identifier ID and a JSM_quasi-identifier. That is, the quasi-identifier of the original data table 30 corresponds to the JSM_quasi-identifier of the quasi-identifier management master (JSM) table 40.

The simulation definition master (SDM) table 50 has an SDM_simulation ID and an SDM_simulation name. The simulation journal table (SJT) 60 has SJT_simulation ID, SJT_quasi-identifier ID, and SJT_calculation formula. The SDM_simulation ID in the simulation definition master (SDM) table 50 corresponds to the SJT_simulation ID in the simulation journal table (SJT) 60. Further, the JSM_quasi-identifier ID of the semi-identifier management master table 40 corresponds to the SJT_quasi-identifier ID of the simulation journal table (SJT) 60. Using these data and tables, the evaluation simulation apparatus 1 executes a time-dependent evaluation simulation of the k value in the k-anonymization process.

<Data structure and relationship> Fig. 3
FIG. 3 is a diagram illustrating a configuration example of the original data table. The original data table 30 includes a number (#) 301, an identifier 302, a quasi-identifier 303, and other information 304. As described above, the identifier 302 has a column for storing information of name and member number (member ID), and the quasi-identifier 303 has age (birth year), address, years of occupancy (year of occupancy), and insurance discount stage information. The other information 304 has a column for storing annual income and vehicle ownership information.

<Quasi-identifier management master table> FIG.
FIG. 4 is a diagram illustrating a configuration example of a semi-identifier management master (JSM) table. The semi-identifier management master (JSM) table 40 has a JSM_quasi-identifier ID 401 and a JSM_quasi-identifier 402. The JSM_quasi-identifier ID 401 is an ID for uniquely identifying the JSM_quasi-identifier. The candidate of the selected semi-identifier is stored in the JSM_quasi-identifier 402 corresponding to the JSM_quasi-identifier ID 401.

In this example, the entries of JSM_quasi-identifier 402 corresponding to JSM_quasi-identifier ID 401 from “1” to “4” include “age (year of birth)”, “address”, “year of occupancy (year of occupancy)”, “insurance discount” Information “stage” is stored.

<Simulation Definition Master (SDM) Table> FIG.
FIG. 5 is a diagram illustrating a configuration example of a simulation definition master (SDM) table. The simulation definition master (SDM) table 50 has an SDM_ID 501 for uniquely identifying a simulation and an SDM_simulation name 502. Upon receiving simulation information to be executed from a simulation executor, the evaluation simulation apparatus 1 registers the simulation to be executed in the simulation definition master (SDM) table 50 and assigns an ID. Also, a calculation formula relating to the time evolution of the quasi-identifier in the assigned simulation is registered in the simulation journal table (SJT) 60.

In this example, the entries of SDM_simulation names 502 corresponding to SDM_IDs 501 from “1” to “3” include “Elapsed time evaluation by age”, “Elapsed time evaluation of age and residence years”, and “Insurance discount stage evaluation 1”. Is stored.

<Simulation journal table> FIG.
FIG. 6 is a diagram illustrating a configuration example of a simulation journal table (SJT). The simulation journal table (SJT) 60 is an example of a table that manages all simulation calculation formulas. The simulation journal table (SJT) 60 has a number (#) 601, an SJT_simulation ID 602 for uniquely identifying a simulation, an SJT_quasi-identifier ID 603 for uniquely identifying a quasi-identifier, and an SJT_calculation formula 604.

For example, the simulation with the SJT_simulation ID 602 of “1” is a simulation that executes “time-evaluation by age” from the simulation definition master 50 of FIG. Therefore, only the age (SJT_quasi-identifier ID 603 is “1”) develops time every year and can be expressed by the formula “(age (t + n) = age (t) + n)”, and other quasi-identifiers are “fixed”. It is said.

Further, the simulation with the SJT_simulation ID “2” is a simulation that executes “time-evaluation of age and age of residence” from the simulation definition master 50. For this reason, the age (SJT_quasi-identifier ID 603 is “1”) and the number of years of residence (SJT_quasi-identifier ID 603 is “2”) are time-developed every year as “(age (t + n) = age (t) + n)”, “ It can be expressed by the calculation formula (year of residence (t + n) = year of residence (t) + n), and other quasi-identifiers are “fixed”.

Furthermore, since the simulation with SJT_simulation ID “3” is a simulation that executes “insurance discount stage evaluation 1 (age, residence years, and time lapse evaluation of insurance discount stage)” from the simulation definition master 50, the age ( SJT_quasi-identifier ID 603 is “1”) and the number of years of residence (SJT_quasi-identifier ID 603 is “2”) develops time every year to “(age (t + n) = age (t) + n)”, “address (t + n)” = Address (t) + n ”,“ (residence years (t + n) = residence years (t) + n) ”, and“ insurance discount stage (t + n) ”
(1) Bronze: (age (t + n) + years of occupancy (t + n)) * 0.01 <0.4 (2) silver: (age (t + n) + years of occupancy (t + n)) * 0.01 <0 .5 case (3) Gold: (age (t + n) + years of occupancy (t + n)) * 0.01 <0.6 (4) platinum: (age (t + n) + years of occupancy (t + n)) * 0 .01 ≧ 0.6 (0.6 or more, insurance discount stage is platinum)
Is calculated by That is, in the present invention, a simulation for another quasi-identifier can be performed by calculating a correlation between quasi-identifiers (age and number of years of occupancy).

The above calculation formula is an example. For example, paying attention to the fact that the car accident rate changes with the age, the insurance premiums, insurance discount rates, incidental options, etc. of vehicle insurance (non-life insurance) can be changed. Good. Further, paying attention to the fact that the annual income changes (increased or decreased) depending on the age and age, the credit level in the credit information may be changed. The simulation may be executed by the evaluation simulation apparatus 1 by combining the remaining amount of the mortgage loan with the age or the like.

Next, the operation of the process will be described with the simulation management apparatus 10 as a main body that executes the process, but another apparatus, for example, the evaluation simulation apparatus 1 may be the main body.

<Overall Processing of Time-Dependent Evaluation Simulation of k Value> FIG.
FIG. 7 is a flowchart showing the entire process of the time-dependent evaluation simulation of the k value in the k-anonymization process.

In S701, the simulation management apparatus 10 loads the original data (t = t) table 30 from the storage device a12.

In S702, the simulation management apparatus 10 sets a reference value for the k value in S701. In S703, the simulation management apparatus 10 sets a simulation period. In S <b> 704, the simulation management apparatus 10 defines a quasi-identifier from the original data (t = t) table 30. The k-anonymization processing device 105 anonymizes the loaded original data (t = t) table 30 with a predetermined k value. If the result is determined by the determination device 114 and is appropriate, the simulation management device 10 adopts the k value subjected to the anonymization process and the k-anonymization process result.

In S705, the simulation management apparatus 10 registers the quasi-identifier defined in S704 in the quasi-identifier management master (JSM) table 40. In S706, the simulation management apparatus 10 registers the simulation name and the simulation method in the simulation definition master (SDM) table 50 and the simulation journal table (SJT) 60. In S707, the simulation management apparatus 10 executes a simulation.

The above processing is the entire processing of the time-dependent evaluation simulation of the k value in the k-anonymization processing. Next, detailed processing contents will be described with reference to FIG.

<Quasi-identifier selection / registration process> FIG.
FIG. 8 is a flowchart showing the quasi-identifier selection / registration process. This process corresponds to the processes of S704 and S705 in FIG.

In S801, the simulation management apparatus 10 selects a quasi-identifier from the original data (t = t) table 30.

In S802, the simulation management apparatus 10 registers the field names of the quasi-identifiers selected by the quasi-identifier management apparatus 112 in the quasi-identifier management master (JSM) table 40. That is, the quasi-identifier management device 112 assigns a number next to the maximum number in the JSM_quasi-identifier ID 401 of the quasi-identifier management master (JSM) table 40, and assigns a quasi-identifier to the JSM_quasi-identifier 402 corresponding to the number assigned. Stores the field name.

With the above processing, selection of the quasi-identifier and registration in the quasi-identifier management master (JSM) table 40 are completed. Next, a simulation content setting process to be executed will be described.

<Simulation Content Setting Processing> FIG.
FIG. 9 is a flowchart showing a simulation content setting process to be executed. This process corresponds to the process of S706 in FIG.

In S901, the simulation management apparatus 10 instructs the simulation definition apparatus 109 to register the name of the simulation to be executed in the simulation definition master (SDM) table 50 and to assign an SDM_simulation ID. The simulation definition device 109 registers a simulation name in the simulation definition master (SDM) table 50 and assigns an SDM_simulation ID.

In S <b> 902, the simulation management apparatus 10 instructs the simulation definition apparatus 109 to register in the simulation journal table (SJT) 60 a calculation formula for temporal development of each quasi-identifier. The simulation definition device 109 stores information of SDM_ID 501 of the simulation definition master (SDM) table 50 in SJT_simulation ID 602 of the simulation journal table (SJT) 60, information of SDM_ID 501 in SJT_quasi identifier 603, and JSM_quasi The information of the identifier ID 401 is stored in the SJT_calculation formula 604 as a calculation formula for developing each quasi-identifier over time.

In S903, the simulation management apparatus 10 instructs the simulation definition apparatus 109 to register the simulation IDs, quasi-identifier IDs, and calculation formulas of all quasi-identifiers in the simulation journal table (SJT) 60. Upon receiving the instruction, the simulation definition device 109 executes the process of S902 for all the quasi-identifiers and sets predetermined information in the simulation journal table (SJT) 60.

With the above processing, calculation formulas and simulation IDs necessary for the simulation to be executed can be determined. Next, the operation of the actual simulation execution process will be described.

<Simulation execution processing> FIG.
FIG. 10 is a flowchart showing the simulation execution process. This process corresponds to the process of S707 in FIG.

In S1001, the simulation management apparatus 10 sets a generalized unit of a quasi-identifier to be simulated. Here, the simulation management apparatus 10 sets the age generalization unit as “3 years old”, and sets the address generalization unit as “1 chome”.

In S1002, the simulation management apparatus 10 sets a “cell” by combining the set generalization units. That is, as shown in FIG. 12, the simulation management apparatus 10 first sets a rectangular area in which the address is arranged in increments of 1 in the vertical axis direction and the age in 1 year increments in the horizontal axis direction. One or more “cells” (portions surrounded by thick black lines in the figure) are set as generalized units of age from 1 to 1 at 1 to 11 at 1-chome. In FIG. 12, four “cells” are set.

In S1003, the simulation management apparatus 10 sets a simulation start year for i (i = simulation start year). For example, the simulation management apparatus 10 sets i = year 2015.

In S1004, the simulation management apparatus 10 refers to the simulation journal table (SJT) 60 and creates a data set for year i (= 2015).

In S1005, the simulation management apparatus 10 transmits the i-year data set to the k-anonymization processing apparatus 105 to execute the k-anonymization process.

In S1006, the simulation management apparatus 10 causes the determination apparatus 114 to determine whether the processing result of the k-anonymization process in S1005 is appropriate. And k value in each cell expressed with the combination of the generalized unit of the semi-identifier which performs the set simulation is calculated. That is, the simulation management apparatus 10 determines k value candidates determined to be appropriate.

In S1007, the simulation management apparatus 10 determines whether the k value is smaller than the set reference value as a result of calculating the k value. When the calculated k value is smaller than the set reference value (Yes), the simulation management apparatus 10 executes S1008. For example, if the calculated k value is “2” and the set reference value is “5”, the simulation management apparatus 10 determines that the anonymization standard is not satisfied (an individual is specified).

When the calculated k value is larger than the set reference value (No), the simulation management apparatus 10 executes S1009. That is, if the calculated k value is “7”, the set reference value is larger than “5”, and therefore the anonymization standard is satisfied (the possibility of specifying an individual is 1 / k (= 7)). The simulation management apparatus 10 determines that the following is true.

In S1008, the simulation management apparatus 10 displays the information of the cell having a value smaller than the reference value for which the k value is set on the screen of the display device 14, and notifies the simulation performer. In addition, the simulation management apparatus 10 may transmit information on a cell having a value smaller than the reference value to the operation terminal 100 and display it on the display screen of the operation terminal 100 to warn that the reference value is not satisfied.

In S1009, the simulation management apparatus 10 sets i = i + 1. That is, the year in which the simulation is executed is a year obtained by adding one year to the simulation start year. At this time, year i is 2016. In S1010, the simulation management apparatus 10 determines whether the value (year) of i is greater than or equal to the simulation end year. If the value (year) of i is greater than or equal to the simulation end year, the simulation management apparatus 10 ends the simulation. If the value (year) of i is less than the simulation end year, the simulation management apparatus 10 executes the processing from S1004 onwards.

By the above simulation, it can be determined whether or not the k value set in the future satisfies the reference value, so that anonymization can be ensured.

<Generation processing of data set after n years> FIG.
FIG. 11 is a flowchart showing a data set generation process after n years. This process is a process of calculating as i = i + n in S1004 of FIG.

In S1101, the simulation management apparatus 10 selects a simulation ID (information of SDM_ID 501) to be simulated from the simulation definition master (SDM) table 50.

In S1102, the simulation management apparatus 10 acquires, from the simulation journal table (JST) 60, all SJT_quasi-identifier IDs 603 and calculation formulas in the simulation ID selected in S1101 (information of SDM_ID 501). For example, when the simulation management apparatus 10 selects “Evaluation of age and age of residence over time” whose SDM_ID 501 is “2”, the corresponding SJT_simulation ID is the same “2” (number (#) 601 is “5”). SJT_quasi-identifier ID 603 and “SJT_calculation formula 604” are acquired.

In S1103, the simulation management apparatus 10 instructs the data set (time t = t + n) generation apparatus 107 to generate the data set (time t = t + n). The data set (time t = t + n) generation device 107 calculates the value of each quasi-identifier at time t = t + n using the obtained calculation formula, and generates the data set (time t = t + n) at time t = t + n. To do. The data set (time t = t + n) generation device 107 stores the generated data set (time t = t + n) as the data set (time t = t + n) 108 in the storage device b16. Then, the simulation management apparatus 10 ends the data set generation process after n years.

By the generation process of the data set after n years, the original data can exist without change, and the data set after n years (time t = t + n) can be generated, and the generated data set (time t = T + n) can be saved. Note that the value of n may be a year unit as in the simulation of this example, or a decimal number of 0.5 years may be used as described above. Furthermore, since it is possible in this embodiment to perform a simulation toward the past instead of the future, a negative value (−1 year, −0.5 year) can also be used.

<Simulation execution result 1> FIG.
FIG. 12 is a diagram illustrating a simulation execution result when the generalized unit is 3 years old and the age is changed. FIG. 12 shows an example of the result of a simulation of “time-evaluated by age”. Here, “k value is 5 or more” is set as a reference value. Further, in FIG. 12, the generalized unit is “starting from 0 years old and 3 years old”. The simulation for year is set to 2015, and the time course evaluation simulation is executed every year.

First, in 2015 (●: black circle represents a person of a predetermined age living at a predetermined address as of 2015), the reference value “k value is 5 or more in all cells. Satisfies certain things. For example, the k value of a person between the ages of 31 and 33 who lives at addresses 1 to 11 of 1-chome is “8”. Similarly, the k value of people aged 34 to 36 is “7”, the k value of people 37 to 39 is “13”, and the k value of people 40 to 42 is “9”. Therefore, as of 2015, each cell divided into three-year-old age (location surrounded by a black thick line) living at 1 to 11 at 1-chome is the reference value “k value is 5 You can see that you are satisfied that you are more than people.

On the other hand, in 2016 when one year has passed since 2015 (◎: double circle indicates a person of a predetermined age who lives at a predetermined address as of 2016), the reference value “k” The value is 5 or more. The k value of people aged 31 to 33 is “6”, and the k value of people aged 37 to 39 is “13”, satisfying the reference value “k value is 5 or more”. However, since the k value of people aged 34 to 36 is “4” and the k value of people aged 40 to 42 is also “4”, the standard value “k value is 5 or more” is satisfied. Not done.

Therefore, the result of the determination device 114 determining the anonymization processing result of the k-anonymization processing device 105 is that the k value is insufficiency (not healthy). Therefore, the determination device 114 notifies the screen of the display device 14 or the screen of the operation terminal 100 as an alert. Then, review the generalized unit based on the simulation results. The result is shown in FIG.

<Simulation execution result 2> FIG.
FIG. 13 is a diagram showing a simulation execution result when the generalized unit is 5 years old and the age is changed. As shown in FIG. 13, by setting the generalized unit to “starting from 0 years old and 5 years old”, in all cells (the part surrounded by the black thick line), 2015 (●: black circle) As for 2016 (◎: double circle), it is clear that the reference value “k value is 5 or more” can be cleared.

In other words, the k value for people aged 30 to 34 in 2015 is “10”, the k value for people aged 35 to 39 is “18”, and the k value for people aged 40 to 44 is “9”. Yes, the reference value “k value is 5 or more” is satisfied. Similarly, the k value for people aged 30 to 34 in 2016 is “12”, the k value for people aged 35 to 39 is “15”, and the k value for people aged 40 to 44 is “12”. Yes, the reference value “k value is 5 or more” is satisfied.

The generalized unit is changed by changing the start age to the member data with the minimum age of the quasi-identifier 303 of the original data table 30 shown in FIG. It is also possible to repeat the time lapse simulation with the number of division years of the cell, determine whether the reference value is satisfied, and select an appropriate number of years from among the plurality of satisfied division years. Even if the k value is changed by storing the simulation result including the calculated k value in the storage device b16 of the simulation management apparatus 10 (for example, k value = 5 to k value = 7), the k value Can determine the soundness of

Thus, by performing the time lapse simulation, the soundness of the set k value (a measure of whether or not anonymization can be maintained in the future) can be determined, so that a stable information protection system can be provided.

<Simulation execution result 3> FIGS. 14 and 15
FIG. 14 is a diagram showing a state before the simulation execution when the age and the age of residence are changed and the generalized unit is 5 years old (as of 2015). FIG. 15 is a diagram showing a state after the simulation is executed when the age and the age of residence are changed and the generalized unit is 5 years old (2016 prediction).

In the 2015 results (FIG. 14), the reference value “k value is 5 or more” is cleared in all cells (the portion surrounded by the black thick line). On the other hand, in 2016 (FIG. 15), a cell having a residence age of 5 to 9 years and an age of 35 to 39 years, and a cell having a residence age of 10 to 14 years and an age of 40 to 44 years (two The k value is “4” and “3” in the portion surrounded by a heavy line. Therefore, it can be determined that the reference value “k value is 5 or more” is not cleared.

In this case, consider increasing the generalized unit of any of the quasi-identifiers “age”, “year of residence”, or “address” in advance, and setting a unit that can be used as a multiple in anticipation of the future. The room is expanded, and the effects of improving data availability and suppressing information loss can be obtained.

As described above, in the information protection system of the present invention, the means for calculating the future k value using the time-evolving quasi-identifier calculation formula and the means for comparing the calculated k value with a preset reference value And means for displaying the result of comparison, enabling execution of a time evolution simulation. Therefore, an appropriate generalized unit of the quasi-identifier can be set even with time development by k-anonymization processing of the data set of personal information having the quasi-identifier. Moreover, the analysis of the anonymized data set can be continued.

In addition, this invention is not limited to the above-mentioned Example, Various modifications are included. The above-described embodiments have been described in detail for easy understanding of the present invention, and are not necessarily limited to those having all the configurations described. Further, a part of the configuration of one embodiment can be replaced with the configuration of another embodiment, and the configuration of another embodiment can be added to the configuration of one embodiment. Further, it is possible to add, delete, and replace other configurations for a part of the configuration of each embodiment. Each of the above-described configurations, functions, processing units, processing means, and the like may be realized by hardware by designing a part or all of them with, for example, an integrated circuit. Each of the above-described configurations, functions, and the like may be realized by software by interpreting and executing a program that realizes each function by the processor.

Information such as a program, a table, and a file for realizing each function may be stored in a memory, a hard disk, a recording device such as an SSD (SolID State Drive), or a recording medium such as an IC card, an SD card, or a DVD. Further, the control lines and information lines indicate what is considered necessary for the explanation, and not all the control lines and information lines on the product are necessarily shown. Actually, it may be considered that almost all the components are connected to each other.

1: Time-dependent evaluation simulation device for k value 10: Simulation management device 11: CPUa
12: Storage device a
13: Communication device 14: Display device 15: CPUb
16: Storage device b
30: Original data (t = t) table 40: Semi-identifier management master (JSM) table 50: Simulation definition master (SDM) table 60: Simulation journal table (SJT)
100: operator terminal 101: network 105: k-anonymization processing device 107: data set (time t = t + n) generation device 108: data set (time t = t + n)
109: Simulation definition device 112: Semi-identifier management device 114: Determination device

Claims

An information protection system connected to an operation terminal via a network,
The information protection system includes:
A storage device that stores the result of classifying personal information into identifier information, quasi-identifier information, the identifier information, and other information not belonging to the quasi-identifier information, as an original data set;
The quasi-identifier information, and a k-anonymization processing device that performs k-anonymization in a generalized unit of the quasi-identifier information;
A determination device for determining whether a k value of anonymized data k-anonymized by the k-anonymization processing device satisfies an anonymization reference value;
A simulation management device for performing time evolution simulations,
The simulation management device includes:
A quasi-identifier information management device for managing the quasi-identifier information used in the time evolution simulation;
Quasi-identifier information for time development, a calculation formula for the quasi-identifier for time development, and a simulation definition device for managing a time development simulation execution condition including at least a time development start year,
A time evolution data set generating device that generates a time evolution data set indicating a state of time evolution with respect to the original data set by a calculation formula of a quasi-identifier that is time evolution;
With
The simulation management device performs k-anonymization on the time evolution data set generated by the time evolution data set generation device by the k-anonymization processing device using a generalized unit of the semi-identifier information, The information protection system, wherein the determination device determines whether the k value for each generalized unit calculated by k-anonymization satisfies a preset reference value.
The information protection system according to claim 1, wherein the simulation management device has a plurality of quasi-identifier calculation formulas that develop over time,
Select a quasi-identifier that is correlated with multiple quasi-identifiers,
Generate a data set with time evolution with the selected quasi-identifier formula,
Determine whether the k value in the generated data set satisfies a preset reference value,
An information protection system characterized by evaluating whether a generalized unit of a quasi-identifier is valid.
The information protection system according to claim 1, wherein the simulation management device includes:
Divide into generalized units of quasi-identifiers used in the generation of datasets with time evolution,
Calculate the k value in the cell created by combining the divided areas,
A cell that does not satisfy the reference value is extracted by comparing the calculated k value with a preset reference value.
2. The information protection system according to claim 1, wherein the simulation management device executes two or more different time development simulations.
5. The information protection system according to claim 4, wherein the simulation management apparatus can set two or more quasi-identifier calculation formulas.
The information protection system according to claim 1, wherein the information protection system further includes a display device, and the display device includes any one of the original data set, the time development data set, and a determination result of the determination device. An information protection system characterized by displaying the above.
2. The information protection system according to claim 1, wherein when the k value does not satisfy the reference value, the information protection system performs a time evolution simulation by changing the time development start year or the generalized unit. An information protection system characterized by
An information protection method for an information protection system connected to an operation terminal via a network,
The information protection system includes:
A storage device that stores the result of classifying personal information into identifier information, quasi-identifier information, the identifier information, and other information not belonging to the quasi-identifier information, as an original data set;
The quasi-identifier information, and a k-anonymization processing device that performs k-anonymization in a generalized unit of the quasi-identifier information;
A determination device for determining whether a k value of anonymized data k-anonymized by the k-anonymization processing device satisfies an anonymization reference value;
A simulation management device for performing time evolution simulations,
The simulation management device includes:
A quasi-identifier information management device for managing the quasi-identifier information used in the time evolution simulation;
Quasi-identifier information for time development, a calculation formula for the quasi-identifier for time development, and a simulation definition device for managing a time development simulation execution condition including at least a time development start year,
A time evolution data set generating device that generates a time evolution data set indicating a state of time evolution with respect to the original data set by a calculation formula of a quasi-identifier that is time evolution;
With
The simulation management device performs k-anonymization on the time evolution data set generated by the time evolution data set generation device by the k-anonymization processing device using a generalized unit of the semi-identifier information; ,
An information protection method for an information protection system, comprising: determining by the determination device whether the k value for each generalized unit calculated by the k-anonymization satisfies a preset reference value .
An information protection program that operates on an information protection system connected to an operation terminal via a network,
The information protection system includes:
A storage device that stores the result of classifying personal information into identifier information, quasi-identifier information, the identifier information, and other information not belonging to the quasi-identifier information, as an original data set;
The quasi-identifier information, and a k-anonymization processing device that performs k-anonymization in a generalized unit of the quasi-identifier information;
A determination device for determining whether a k value of anonymized data k-anonymized by the k-anonymization processing device satisfies an anonymization reference value;
A simulation management device for performing time evolution simulations,
The simulation management device includes:
A quasi-identifier information management device for managing the quasi-identifier information used in the time evolution simulation;
Quasi-identifier information for time development, a calculation formula for the quasi-identifier for time development, and a simulation definition device for managing a time development simulation execution condition including at least a time development start year,
A time evolution data set generating device that generates a time evolution data set indicating a state of time evolution with respect to the original data set by a calculation formula of a quasi-identifier that is time evolution;
With
The information protection program is
A function for causing the simulation management apparatus to perform k-anonymization on the time-developed data set generated by the time-expanded data set generating apparatus by the k-anonymization processing apparatus using a generalized unit of the quasi-identifier information; When,
An information protection program, comprising: a function for causing the determination device to determine whether the k value for each generalized unit calculated by k-anonymization satisfies a preset reference value.