JP7579478B1 - Information processing device, information processing system, and information processing method - Google Patents

Abstract

[Problem] To suppress an increase in privacy risk when providing an anonymized data set. [Solution] An information processing device (1) has a receiving unit (131) that receives attribute number information indicating the number of attributes and update frequency information indicating the update frequency of data of each of the multiple attributes in a predetermined period from a first device (2) that manages a data set including data of each of multiple attributes, a determining unit (132) that determines a budget consumption amount, which is the amount of the privacy budget to be reduced for adding noise once to data of one attribute included in the data set, based on the number of attributes indicated by the received attribute number information, the update frequency indicated by the update frequency information, and a privacy budget indicating the amount of noise that can be added to the data set, and a transmitting unit (133) that transmits the privacy budget and the previous budget consumption amount determined by the determining unit (132) to the first device (2). [Selected Figure] Figure 2

Description

The present invention relates to an information processing device, an information processing system, and an information processing method.

Conventionally, user information, which is information about users, is collected and data analysis is performed. In this case, in order to protect the privacy of users, noise is added to at least a part of the user information to make the user information anonymous (see, for example, Patent Document 1).

JP 2011-117679 A

When performing data analysis, data analysis is often performed from various perspectives, and multiple requests to acquire the same data group may be made. When multiple requests to acquire the same data group are made, if user information is anonymized multiple times for the same data group, multiple variations of data groups corresponding to the same data group will be generated. In this case, by analyzing multiple variations of data groups, it becomes easier to guess the contents of the data group before anonymization, which gives rise to problems such as increased privacy risks such as increased user identifiability. The increased privacy risk is particularly noticeable when multiple businesses collaborate on data analysis.

The present invention has been made in consideration of these points, and aims to prevent an increase in privacy risks when providing anonymized data groups.

The information processing device according to the first aspect of the present invention has a receiving unit that receives attribute number information indicating the number of attributes and update frequency information indicating the update frequency of data of each of the multiple attributes in a predetermined period from a device that manages a data group including data of each of the multiple attributes, a determining unit that determines a budget consumption amount, which is the amount of the privacy budget to be reduced for adding the noise once to data of one attribute included in the data group, based on the number of attributes indicated by the received attribute number information, the update frequency indicated by the update frequency information, and a privacy budget indicating the amount of noise that can be added to the data group, and a transmitting unit that transmits the privacy budget and the budget consumption amount determined by the determining unit to the device.

The receiving unit may receive, from a plurality of devices that manage a plurality of different data groups, the attribute number information and the update frequency information corresponding to the data groups managed by the devices, and the determination unit may determine the budget consumption amount for each of the plurality of data groups managed by each of the plurality of devices based on the number of attributes indicated by the attribute number information received from each of the plurality of devices, the update frequency indicated by the update frequency information, and the privacy budget indicating the amount of noise that can be added to the plurality of data groups, and determine an individual privacy budget, which is a privacy budget corresponding to each of the plurality of data groups, based on the budget consumption amount for each of the plurality of data groups and the number of attributes for each of the plurality of data groups, and the transmission unit may transmit, to each of the plurality of devices, the individual privacy budget and the budget consumption amount determined by the determination unit for the data group corresponding to the device.

The determination unit may identify a maximum update frequency among the update frequencies of data for each of the multiple attributes indicated by the update frequency information, and determine the budget consumption amount based on the number of attributes indicated by the attribute count information, the identified maximum update frequency, and the privacy budget.

An information processing device according to a second aspect of the present invention is an information processing device that manages a data group including data for each of a plurality of attributes, and includes an identification unit that identifies the number of the attributes and the update frequency of the data for each of the plurality of attributes in a predetermined period of time, a transmission unit that transmits attribute number information indicating the number of the attributes identified by the identification unit and update frequency information indicating the update frequency to a management device that manages a privacy budget that indicates the amount of noise that can be added to the data group, and a privacy budget that is reduced relative to adding noise once to data for one attribute included in the data group, the privacy budget being determined from the management device based on the number of attributes indicated by the attribute number information, the update frequency indicated by the update frequency information, and the privacy budget. The data processing apparatus includes a receiving unit that receives budget information indicating a budget consumption amount, which is an amount of data, and the privacy budget; a storage control unit that stores the received privacy budget in a storage unit; a noise adding unit that, when adding noise to target data, which is data for one or more attributes included in the data group, specifies a subtraction amount of the privacy budget corresponding to the addition of the noise based on the budget consumption amount and adds noise to the target data on condition that the privacy budget stored in the storage unit is equal to or greater than the specified subtraction amount; and a subtraction unit that subtracts the subtraction amount corresponding to the addition of the noise from the privacy budget stored in the storage unit in response to the noise being added by the noise adding unit.

The information processing device may further include a reception unit that receives an acquisition request for the target data from the management device, and the noise adding unit, when adding noise to the target data corresponding to the acquisition request received by the reception unit, may specify the subtraction amount corresponding to the addition of noise, and add noise to the target data on condition that the privacy budget stored in the memory unit is equal to or greater than the specified subtraction amount, and the transmission unit may transmit noise-added data, which is the target data to which noise has been added by the noise adding unit, to the management device.

The memory control unit may store the noise-added data in the memory unit, and the transmission unit may transmit the noise-added data corresponding to the target data stored in the memory unit to the management device when the noise adding unit does not add noise to the target data corresponding to the acquisition request received by the reception unit.

The memory control unit stores the noise-added data in the memory unit, and when the noise adding unit adds noise to the target data corresponding to the acquisition request accepted by the accepting unit, the noise adding unit may add noise to the noise-added data corresponding to the target data stored in the memory unit, on condition that the privacy budget stored in the memory unit is equal to or greater than a specified subtraction amount.

The storage control unit stores the noise-added data in the storage unit, and when the noise-added data corresponding to the target data accepted by the accepting unit is stored in the storage unit, the noise adding unit may add noise to the target data stored in the storage unit when the target data is updated after the noise-added data is stored in the storage unit.

The noise adding unit may identify the subtraction amount when noise is added to the entire data group to which the noise is not added as a second subtraction amount, and when the privacy budget is equal to or greater than the second subtraction amount and the privacy budget after subtracting the subtraction amount corresponding to the acquisition request from the privacy budget is less than the second subtraction amount, add noise to the entire data group to which the noise is not added, and the subtraction unit may subtract the subtraction amount corresponding to the addition of the noise from the privacy budget stored in the storage unit in response to the noise adding unit adding noise to the entire data group to which the noise is not added.

The noise adding unit adds noise to the entire data group and determines a subtraction amount of the privacy budget corresponding to the addition of the noise based on the budget consumption amount, the subtraction unit subtracts the subtraction amount corresponding to the addition of the noise from the privacy budget stored in the memory unit in response to the noise adding unit adding noise to the entire data group, the memory control unit stores the data group to which noise has been added in the memory unit as a noise-added data group, the information processing device further has a reception unit that receives an acquisition request for the target data from the management device, and the transmission unit may transmit data from the noise-added data group corresponding to the target data indicated by the acquisition request received by the reception unit to the management device as noise-added data.

The noise adding unit may determine the amount of the privacy budget to be subtracted by multiplying the number of attributes possessed by the target data by the budget consumption amount.

An information processing system according to a third aspect of the present invention is an information processing system having a data management device that manages a data group including data for each of a plurality of attributes, and an information processing device, wherein the data management device has an identification unit that identifies the number of the attributes and the update frequency of the data for each of the plurality of attributes in a predetermined period, and a transmission unit that transmits attribute number information indicating the number of the attributes identified by the identification unit and update frequency information indicating the update frequency to a management device that manages a privacy budget that indicates the amount of noise that can be added to the data group, and the information processing device has a reception unit that receives the attribute number information and the update frequency information from the data management device, and reduces the amount of noise added to data of one attribute included in the data group, based on the number of attributes indicated by the received attribute number information, the update frequency indicated by the update frequency information, and the privacy budget that indicates the amount of noise that can be added to the data group, for example. The data management device may further include a determination unit that determines a budget consumption amount, which is an amount of a privacy budget, and a transmission unit that transmits budget information indicating the privacy budget and the budget consumption amount determined by the determination unit to the data management device. The data management device may further include a reception unit that receives the budget information from the information processing device, a storage control unit that stores the received privacy budget in a storage unit, a noise addition unit that, when adding noise to target data that is data of one or more attributes included in the data group, specifies a subtraction amount of the privacy budget corresponding to the addition of the noise based on the budget consumption amount, and adds noise to the target data on the condition that the privacy budget stored in the storage unit is equal to or greater than the specified subtraction amount, and a subtraction unit that subtracts the subtraction amount corresponding to the addition of the noise from the privacy budget stored in the storage unit in response to the addition of noise by the noise addition unit.

The information processing method according to the fourth aspect of the present invention includes the steps of receiving, from a device that manages a data set including data for each of a plurality of attributes, attribute number information indicating the number of the attributes and update frequency information indicating the update frequency of the data for each of the plurality of attributes in a predetermined period, determining a budget consumption amount, which is the amount of the privacy budget to be reduced for adding the noise once to data for one attribute included in the data set, based on the number of attributes indicated by the received attribute number information, the update frequency indicated by the update frequency information, and a privacy budget indicating the amount of noise that can be added to the data set, and transmitting the privacy budget and the determined budget consumption amount to the device.

An information processing method according to a fifth aspect of the present invention includes the steps of: identifying the number of attributes and the update frequency of data for each of the multiple attributes in a predetermined period, executed by a computer that manages a data set including data for each of the multiple attributes; transmitting attribute number information indicating the identified number of attributes and update frequency information indicating the update frequency to a management device that manages a privacy budget indicating the amount of noise that can be added to the data set; and transmitting from the management device an amount of privacy budget that is reduced per adding noise once to data for one attribute included in the data set, the amount being determined based on the number of attributes indicated by the attribute number information, the update frequency indicated by the update frequency information, and the privacy budget. The method includes the steps of receiving budget information indicating a certain budget consumption amount and the privacy budget, storing the received privacy budget in a storage unit, specifying a subtraction amount of the privacy budget corresponding to the addition of the noise based on the budget consumption amount when adding noise to target data that is data of one or more attributes included in the data group, and adding noise to the target data on condition that the privacy budget stored in the storage unit is equal to or greater than the specified subtraction amount, and subtracting the subtraction amount corresponding to the addition of the noise from the privacy budget stored in the storage unit in response to adding noise to the target data.

The present invention has the effect of preventing an increase in privacy risks when providing anonymized data groups.

FIG. 1 is a diagram illustrating an overview of an information processing system. FIG. 2 is a diagram illustrating a functional configuration of an information processing device. FIG. 2 is a diagram illustrating a functional configuration of a first device. 1 is a sequence diagram showing a flow of processing in an information processing system S until an information processing device 1 collects data from a first device and a second device. 10 is a flowchart showing a process flow in which the first device adds noise to target data.

[Overview of Information Processing System S]
1 is a diagram illustrating an overview of an information processing system S. The information processing system S has an information processing device 1, a first device 2 that manages a first data group, and a second device 3 that manages a second data group, and is a system for aggregating data groups in the information processing device 1.

The information processing device 1 is operated by an aggregation business that provides a service of aggregating data and providing the aggregated data, and is communicatively connected to external devices such as a first device 2 and a second device 3 via a communication network (not shown) such as the Internet or a mobile phone line.

The first device 2 is, for example, a computer operated by a first business operator. The first device 2 functions as a first data management device that manages a first data group including a plurality of first records that associate a data ID as data identification information for identifying data with the first data. The second device 3 is, for example, a computer operated by a second business operator. The second device 3 functions as a second data management device that manages a second data group including a plurality of second records that associate a data ID common to the data IDs included in the first data group with the second data. The first data group and the second data group each include data of a plurality of attributes.

When aggregating data from the first device 2 and the second device 3, the information processing device 1 functions as a budget management device that manages a privacy budget that indicates the amount of noise that can be added to a data group in order to suppress an increase in privacy risk of the aggregated data. The information processing device 1 then determines a budget consumption amount, which is the amount of the privacy budget that is reduced for adding noise once to data of one attribute included in the data group.

Specifically, the information processing device 1 receives, from each of the first device 2 and the second device 3, attribute number information indicating the number of attributes of the data included in the data group, and update frequency information indicating the update frequency of the data of each of the multiple attributes in a specified period. Then, based on the number of attributes indicated by the attribute number information, the update frequency indicated by the update frequency information, and the privacy budget, the information processing device 1 determines a budget consumption amount, which is the amount of the privacy budget to be reduced for adding noise once to data of one attribute included in the data group. The information processing device 1 transmits the determined budget consumption amount and privacy budget to the first device 2 and the second device 3.

The first device 2 and the second device 3 each add noise to the data group based on the privacy budget and budget consumption amount received from the information processing device 1 so that the privacy budget is not depleted, thereby generating noise-added data, which is a data group to which noise has been added. Then, the first device 2 and the second device 3 each transmit the generated noise-added data to the information processing device 1. In this way, the information processing system S can prevent the content of the data group before anonymization from being easily guessed due to the same data group being added multiple times, and can prevent an increase in privacy risks.

[Functional configuration of information processing device 1]
Next, a description will be given of the functional configuration of the information processing device 1. FIG.

As shown in FIG. 2 , the information processing device 1 includes a communication unit 11 , a storage unit 12 , and a control unit 13 .
The communication unit 11 is a communication interface for transmitting and receiving data to and from the first device 2, the second device 3, and the like via a communication network.

The storage unit 12 is a storage medium that stores various types of data, and includes a ROM (Read Only Memory), a RAM (Random Access Memory), a hard disk, an SSD (Solid State Drive), and a flash memory. The storage unit 12 stores programs executed by the control unit 13. The storage unit 12 stores programs that cause the control unit 13 to function as a receiving unit 131, a determining unit 132, and a transmitting unit 133.

The control unit 13 is, for example, a CPU (Central Processing Unit). The control unit 13 functions as a receiving unit 131, a determining unit 132, and a transmitting unit 133 by executing a program stored in the storage unit 12. The control unit 13 will be described in detail later.

[Functional configuration of first device 2 and second device 3]
Next, a description will be given of the functional configurations of the first device 2 and the second device 3. Fig. 3 is a diagram showing the functional configuration of the first device 2. The functional configuration of the second device 3 is the same as that of the first device 2, and therefore a description thereof will be omitted.

As shown in FIG. 3 , the first device 2 includes a communication unit 21 , a storage unit 22 , and a control unit 23 .
The communication unit 21 is a communication interface for transmitting and receiving data to and from the information processing device 1 and the like via a communication network.

The memory unit 22 is a storage medium that stores various types of data, and includes a ROM, a RAM, a hard disk, an SSD, and a flash memory. The memory unit 22 stores a program executed by the control unit 23. The memory unit 22 stores a program that causes the control unit 23 to function as an identification unit 231, a transmission unit 232, a reception unit 233, a memory control unit 234, a reception unit 235, a noise addition unit 236, and a subtraction unit 237.

The storage unit 22 also stores a first data group. The first data group is updated irregularly, and for example, a version of the first data group is associated with the first data group corresponding to that version and stored in the storage unit 22. The storage unit 22 also stores noise-added data in which noise is added to target data, which is data for each of one or more attributes included in the first data group, and which has been previously transmitted to the information processing device 1.

The control unit 23 is, for example, a CPU. The control unit 23 executes a program stored in the memory unit 22, thereby functioning as an identification unit 231, a transmission unit 232, a reception unit 233, a memory control unit 234, a reception unit 235, a noise adding unit 236, and a subtraction unit 237.

[Notification of Privacy Budget and Budget Consumption]
Next, details of the control unit 13 and the control unit 23 will be described with reference to a sequence diagram and a flowchart. First, a process flow in the information processing system S until the information processing device 1 collects data from the first device 2 and the second device 3 will be described.

FIG. 4 is a sequence diagram showing a flow of processing in the information processing system S until the information processing device 1 collects data from the first device 2 and the second device 3.
First, the identifying unit 231 of the first device 2 identifies the number of attributes in a first data group including data of each of a plurality of attributes, and the update frequency of the data of each of the plurality of attributes in a predetermined period (S1).

For example, the identification unit 231 identifies the number of attributes by identifying the attributes of data corresponding to each of the multiple columns constituting the first data group. Also, the storage unit 22 of the first device 2 stores different versions of the first data group over a specified period, and the identification unit 231 identifies the update frequency of data for each of the multiple attributes over a specified period by identifying the number of times data in the multiple first data groups of different versions has been updated.

The transmission unit 232 transmits attribute number information indicating the number of attributes identified by the identification unit 231 and update frequency information indicating the update frequency to the information processing device 1 that manages the privacy budget indicating the amount of noise that can be added to the data group (S2).

Similarly, the second device 3 identifies the number of attributes and the update frequency of the data for each of the multiple attributes during a specified period (S3), and transmits attribute number information and update frequency information to the information processing device 1 (S4).

The receiving unit 131 receives attribute number information indicating the number of attributes of the data included in the data group and update frequency information indicating the update frequency of the data of each of the multiple attributes during a specified period from each of the first device 2 and the second device 3, which are multiple devices that manage a data group including data of each of the multiple attributes.

The determination unit 132 determines the budget consumption amount, which is the amount of the privacy budget to be reduced for adding noise once to data of one attribute included in the data group managed by each of the first device 2 and the second device 3 (S5).

The determination unit 132 determines the budget consumption amount, which is the amount of the privacy budget to be reduced for adding noise once to data of one attribute included in the data group, based on the number of attributes corresponding to the data included in the data group indicated by the attribute number information received by the receiving unit 131, the update frequency of the data of each of the multiple attributes during a specified period indicated by the received update frequency information, and the privacy budget indicating the amount of noise that can be added to the data group.

Specifically, the determination unit 132 determines the budget consumption amount for each of the multiple data groups managed by each of the first device 2 and the second device 3 based on the number of attributes indicated by the attribute count information received from each of the first device 2 and the second device 3, the update frequency indicated by the update frequency information, and the total privacy budget indicating the total amount of noise that can be added to the multiple data groups.

For example, the determination unit 132 identifies the maximum update frequency among the update frequencies of data of each of the multiple attributes in a predetermined period. Then, the determination unit 132 determines the budget consumption amount based on the number of attributes indicated by the attribute number information received from each of the first device 2 and the second device 3, the identified maximum update frequency, and the total privacy budget. When the number of attributes of data included in the first data group managed by the first device 2 is n _A , the number of attributes of data included in the second data group managed by the second device 3 is n _B , the total privacy budget is ε, the budget consumption amount ε 1 when noise is added once to data of one attribute included in the multiple data groups is ε ₁ , and the maximum update frequency is k, the determination unit 132 determines the budget consumption amount ε ₁ by the following formula (1).

Furthermore, the determination unit 132 determines an individual privacy budget, which is a privacy budget corresponding to each of the multiple data groups, based on the budget consumption amount ε ₁ determined for each of the multiple data groups and the numbers of attributes n _A and n _B for each of the multiple data groups (S6). If the individual privacy budget corresponding to the first data group is ε _A and the individual privacy budget corresponding to the second data group is ε _B , the determination unit 132 determines the individual privacy budgets ε _A and ε _B by the following formulas (2) and (3).

Note that the determination unit 132 determines the individual privacy budget based on the maximum update frequency, but this is not limited to the above. The determination unit 132 may determine the average update frequency or the sum of the update frequencies based on the update frequency of the data of each of the multiple attributes during a specified period. The determination unit 132 may then determine the individual privacy budget based on the average update frequency or the sum of the update frequencies instead of the maximum update frequency.

The transmission unit 133 transmits the privacy budget and the budget consumption amount determined by the determination unit 132 to the device that manages the data group. Specifically, the transmission unit 133 transmits budget information indicating the individual privacy budget and the budget consumption amount determined by the determination unit 132 for the data group corresponding to these devices to the first device 2 and the second device 3, which are multiple devices (S7, S8).

The receiving unit 233 of the first device 2 receives budget information from the information processing device 1. The receiving unit 233 receives budget information from the information processing device 1 indicating the budget consumption amount and the individual privacy budget determined by the determination unit 132 for the first device 2. Similarly, the second device 3 also receives budget information from the information processing device 1.

The memory control unit 234 of the first device 2 stores the budget information received by the receiving unit 233 in the memory unit 12, thereby storing the budget consumption amount and the individual privacy budget in the memory unit 12 (S9). Similarly, the second device 3 stores the received budget information in its own memory, thereby storing the budget consumption amount and the individual privacy budget in its own memory (S10).

Then, the transmission unit 133 of the information processing device 1 makes a request to the first device 2 to acquire target data, which is data for each of one or more attributes included in the first data group managed by the first device 2 (S11). The request to acquire the target data includes a query to add noise to the target data and acquire the target data with the noise added.

The reception unit 235 of the first device 2 receives, from the information processing device 1, a request to acquire target data, which is data for each of one or more attributes included in the first data group. The noise addition unit 236 of the first device 2 acquires noise-added data, which is the target data to which noise has been added, by adding noise to the target data corresponding to the acquisition request received by the reception unit 235 (S12). Details of the noise addition unit 236 will be described later.

The transmission unit 232 of the first device 2 transmits the noise-added data acquired by the noise adding unit 236 to the information processing device 1 (S13). If the noise adding unit 236 fails to acquire the noise-added data, the transmission unit 232 of the first device 2 transmits error information indicating that the noise-added data could not be acquired to the information processing device 1. The reception unit 131 of the information processing device 1 receives the noise-added data from the first device 2 and stores it in the memory unit 12.

The transmitting unit 133 of the information processing device 1 also makes a request to the second device 3 to acquire target data, which is data for each of one or more attributes included in the second data group managed by the second device 3 (S14). The second device 3 acquires noise-added data, which is the target data to which noise has been added, by adding noise to the target data corresponding to the acquisition request received from the information processing device 1 (S15), and transmits the noise-added data to the information processing device 1 (S16). The receiving unit 131 of the information processing device 1 receives the noise-added data from the second device 3 and stores it in the memory unit 12.

[Details on adding noise to the target data]
Next, the flow of the process in which the first device 2 and the second device 3 add noise to the target data will be described. Fig. 5 is a flowchart showing the flow of the process in which the first device 2 adds noise to the target data. Note that the flow of the process in which the second device 3 adds noise to the target data is the same as the flow of the process in which the first device 2 adds noise to the target data, so the description will be omitted.

When adding noise to target data corresponding to an acquisition request received by the reception unit 235, the noise addition unit 236 determines the amount of subtraction from the privacy budget corresponding to the addition of the noise based on the budget consumption amount (S101).

For example, the noise adding unit 236 identifies the number of columns of the data to be extracted as the number of attributes to add noise to, based on the query included in the acquisition request received by the receiving unit 235. Then, the noise adding unit 236 multiplies the identified number of attributes by the budget consumption amount stored in the storage unit 22, thereby identifying the amount of deduction from the privacy budget due to adding noise to the target data.

The noise adding unit 236 adds noise to the target data on the condition that the privacy budget stored in the storage unit 22 is equal to or greater than the specified subtraction amount, and acquires the noise-added data. For example, the noise adding unit 236 determines whether the privacy budget stored in the storage unit 22 is equal to or greater than the specified subtraction amount (S102). If the noise adding unit 236 determines that the privacy budget is equal to or greater than the specified subtraction amount (YES in S102), it proceeds to S103. If the noise adding unit 236 determines that the privacy budget is less than the specified subtraction amount (NO in S102), it proceeds to S106, and performs control so as not to add noise to the target data corresponding to the acquisition request accepted by the acceptance unit 235.

In S103, the noise adding unit 236 adds noise to the target data to obtain noise-added data. Here, when adding noise to the target data corresponding to the acquisition request accepted by the accepting unit 235, if noise-added data corresponding to the target data is stored in the storage unit 22, the noise adding unit 236 may add noise to the noise-added data.

In addition, in a case where noise-added data corresponding to the target data accepted by the accepting unit 235 is stored in the storage unit 22, when the target data is updated after the noise-added data is stored in the storage unit 22, the noise adding unit 236 may add noise to the target data stored in the storage unit 22. In this way, the first device 2 can generate noise-added data corresponding to the latest target data.

Next, in response to the noise adding unit 236 adding noise to the target data and acquiring the noise-added data, the subtraction unit 237 subtracts the subtraction amount corresponding to the addition of the noise identified in S101 from the privacy budget stored in the memory unit 22 (S104).

Next, the memory control unit 234 stores in the memory unit 22 the noise-added data, which is the target data to which noise has been added by the noise adding unit 236 (S105). For example, the memory control unit 234 associates the query indicated by the acquisition request accepted by the acceptance unit 235 with the noise-added data corresponding to the query, and stores them in the memory unit 22.

In S106, the noise adding unit 236 determines whether or not noise-added data in which noise has been added to the target data corresponding to the acquisition request is stored in the storage unit 12. For example, the noise adding unit 236 determines whether or not noise-added data in which noise has been added to the target data corresponding to the acquisition request is stored by determining whether or not noise-added data is stored in the storage unit 22 in association with the query indicated by the acquisition request.

When the noise adding unit 236 determines that the noise-added data is stored in the storage unit 12 (YES in S106), the process proceeds to S107, and the noise adding unit 236 obtains the noise-added data stored in the storage unit 22.
Moreover, when the noise adding unit 236 determines that the noise-added data is not stored in the storage unit 12 (NO in S106), the noise adding unit 236 ends the process according to this flowchart.

If the privacy budget is less than the subtraction amount and the noise-added data is not stored in the memory unit 12, the noise-added data will not be transmitted to the information processing device 1. To prevent this, the noise adding unit 236 may add noise to the entire data group in advance to generate a noise-added data group, which is a data group to which noise has been added, and the memory control unit 224 may store the noise-added data group in the memory unit 22.

In this case, in response to the receiving unit 233 receiving budget information from the information processing device 1, the noise adding unit 236 adds noise to the entire data group to generate a noise-added data group, and determines the amount of subtraction from the individual privacy budget corresponding to the addition of the noise based on the budget consumption amount.

When the noise adding unit 236 adds noise to the entire data group, the subtraction unit 237 subtracts a subtraction amount corresponding to the addition of noise from the privacy budget stored in the storage unit 22. In addition, the storage control unit 234 stores the data group to which noise has been added in the storage unit 22 as a noise-added data group.

Then, the reception unit 235 receives a request to acquire the target data from the information processing device 1, and the transmission unit 232 transmits, from the group of noise-added data stored in the memory unit 22, data corresponding to the target data indicated by the acquisition request received by the reception unit 235 as noise-added data to the information processing device 1.

In addition, in response to the reception unit 235 receiving the request to acquire the target data, the noise adding unit 236 may specify, as the second subtraction amount, the amount of subtraction that would be obtained if noise were added to the entire data group to which no noise has been added, among the first data group. Then, when the privacy budget is equal to or greater than the second subtraction amount and the privacy budget after subtracting the subtraction amount corresponding to the acquisition request from the privacy budget is less than the second subtraction amount, the noise adding unit 236 may add noise to the entire data group to which no noise has been added.

Then, in response to the noise adding unit 236 adding noise to the entire data group to which noise has not been added, the subtraction unit 237 subtracts a second subtraction amount corresponding to the addition of the noise from the privacy budget stored in the storage unit 22. Furthermore, the storage control unit 234 stores in the storage unit 22 the noise-added data generated by adding noise to the entire data group to which noise has not been added. In this way, the information processing device 1 can prevent the noise-added data from not being transmitted to the information processing device 1, in the same way as in the case of generating a noise-added data group by adding noise to the entire first data group in advance.

[Effects of information processing device 1]
As described above, in the information processing system S of this embodiment, the information processing device 1 receives attribute number information indicating the number of attributes and update frequency information indicating the update frequency of data for each of the multiple attributes in a specified period from the first device 2 and the second device 3 that manage a data group including data for each of the multiple attributes, and determines a budget consumption amount, which is the amount of the privacy budget to be reduced for adding noise once to data of one attribute included in the data group, based on the number of attributes indicated by the attribute number information, the update frequency indicated by the update frequency information, and a privacy budget indicating the amount of noise that can be added to the data group, and transmits the privacy budget and the determined budget consumption amount to the first device 2 and the second device 3.

In the information processing system S according to the present embodiment, the first device 2 and the second device 3 transmit attribute number information and update frequency information to the information processing device 1, receive from the information processing device 1 budget information indicating the number of attributes indicated by the attribute number information, the update frequency indicated by the update frequency information, and the budget consumption amount determined based on the privacy budget, and store the budget in the storage unit 22. When adding noise to target data, which is data of one or more attributes included in a data group, the first device 2 and the second device 3 specify a subtraction amount of the privacy budget corresponding to the addition of the noise based on the budget consumption amount, add noise to the target data on the condition that the privacy budget stored in the storage unit 22 is equal to or greater than the specified subtraction amount, and subtract the subtraction amount corresponding to the addition of the noise from the privacy budget stored in the storage unit 22. In this way, the information processing system S can suppress an increase in privacy risk when providing an anonymized data group.

Furthermore, this invention will make it possible to contribute to Goal 9 of the United Nations' Sustainable Development Goals (SDGs), which is "Build resilient infrastructure, promote inclusive and sustainable industrialization, and promote innovation and infrastructure."

Although the present invention has been described above using an embodiment, the technical scope of the present invention is not limited to the scope described in the above embodiment, and various modifications and changes are possible within the scope of the gist of the present invention. For example, in the above embodiment, the information processing device 1 determines the budget consumption amount and individual privacy budget for two data groups managed by two devices, the first device 2 and the second device 3, but this is not limited to this. The information processing device 1 may determine the budget consumption amount and individual privacy budget for three or more devices.

In addition, all or part of the device can be configured in any unit, functionally or physically, distributed or integrated. New embodiments resulting from any combination of multiple embodiments are also included in the embodiments of the present invention. The effect of the new embodiment resulting from the combination also has the effect of the original embodiment.

Reference Signs List 1 Information processing device 2 First device 3 Second device 11 Communication unit 12 Memory unit 13 Control unit 21 Communication unit 22 Memory unit 23 Control unit 131 Receiving unit 132 Determining unit 133 Transmitting unit 231 Identifying unit 232 Transmitting unit 233 Receiving unit 234 Memory control unit 235 Receiving unit 236 Noise adding unit 237 Subtracting unit S Information processing system

Claims (14)

a receiving unit that receives attribute number information indicating the number of attributes and update frequency information indicating an update frequency of data of each of the plurality of attributes in a predetermined period from a device that manages a data group including data of each of the plurality of attributes;
a decision unit that decides a budget consumption amount, which is an amount of the privacy budget to be reduced for adding the noise once to data of one attribute included in the data group, based on the number of attributes indicated by the received attribute number information, the update frequency indicated by the update frequency information, and a privacy budget indicating an amount of noise that can be added to the data group; and
a transmitter for transmitting the privacy budget and the budget consumption amount determined by the determiner to the device;
An information processing device having the above configuration. The receiving unit receives, from a plurality of devices managing a plurality of different data groups, the attribute count information and the update frequency information corresponding to the data groups managed by the devices;
The determination unit determines the budget consumption for each of a plurality of data groups managed by each of the plurality of devices based on the number of attributes indicated by the attribute count information received from each of the plurality of devices, the update frequency indicated by the update frequency information, and the privacy budget indicating an amount of noise that can be added to the plurality of different data groups, and determines an individual privacy budget that is a privacy budget corresponding to each of the plurality of data groups based on the budget consumption for each of the plurality of data groups and the number of attributes for each of the plurality of data groups;
the transmission unit transmits, to each of the plurality of devices, the individual privacy budget determined by the determination unit for the data group corresponding to the device and the budget consumption amount;
The information processing device according to claim 1 . the determination unit identifies a maximum update frequency among update frequencies of data of each of a plurality of attributes indicated by the update frequency information, and determines the budget consumption amount based on the number of attributes indicated by the attribute number information, the identified maximum update frequency, and the privacy budget.
The information processing device according to claim 1 . An information processing device that manages a data group including data of each of a plurality of attributes,
An identification unit that identifies the number of the attributes and an update frequency of data of each of the plurality of the attributes in a predetermined period;
a transmission unit that transmits attribute number information indicating the number of the attributes identified by the identification unit and update frequency information indicating the update frequency to a management device that manages a privacy budget that indicates an amount of noise that can be added to the data group;
a receiving unit that receives from the management device budget information indicating a budget consumption amount, which is an amount of the privacy budget to be reduced for adding noise once to data of one attribute included in the data group, the budget consumption amount being determined based on the number of attributes indicated by the attribute number information, the update frequency indicated by the update frequency information, and the privacy budget, and the privacy budget;
a storage control unit that stores the received privacy budget in a storage unit;
a noise adding unit that, when adding noise to target data, which is data on one or more attributes included in the data group, specifies an amount to be subtracted from the privacy budget corresponding to the addition of the noise based on the budget consumption amount, and adds noise to the target data under the condition that the privacy budget stored in the storage unit is equal to or greater than the specified amount to be subtracted;
a subtraction unit that subtracts the subtraction amount corresponding to the addition of the noise from the privacy budget stored in the storage unit in response to the noise addition unit adding the noise;
An information processing device having the above configuration. a receiving unit that receives a request to acquire the target data from the management device,
the noise adding unit, when adding noise to the target data corresponding to the acquisition request accepted by the accepting unit, specifies the subtraction amount corresponding to the addition of the noise, and adds noise to the target data on condition that the privacy budget stored in the storage unit is equal to or greater than the specified subtraction amount;
The transmission unit transmits, to the management device, noise-added data, which is the target data to which noise has been added by the noise adding unit.
The information processing device according to claim 4. The storage control unit stores the noise-added data in the storage unit,
the transmission unit, when the noise adding unit has not added noise to the target data corresponding to the acquisition request accepted by the acceptance unit, transmits the noise-added data corresponding to the target data stored in the storage unit to the management device.
The information processing device according to claim 5 . The storage control unit stores the noise-added data in the storage unit,
the noise adding unit, when adding noise to the target data corresponding to the acquisition request accepted by the accepting unit, adds noise to the noise-added data corresponding to the target data stored in the storage unit, on condition that the privacy budget stored in the storage unit is equal to or greater than a specified subtraction amount;
The information processing device according to claim 5 . The storage control unit stores the noise-added data in the storage unit,
the noise adding unit, in a case where the noise-added data corresponding to the target data accepted by the accepting unit is stored in the storage unit, when the target data is updated after the noise-added data is stored in the storage unit, adds noise to the target data stored in the storage unit;
The information processing device according to claim 7. the noise adding unit specifies the subtraction amount in a case where noise is added to the entire data group to which the noise is not added among the data group as a second subtraction amount, and adds noise to the entire data group to which the noise is not added when the privacy budget is equal to or greater than the second subtraction amount and the privacy budget after subtracting the subtraction amount corresponding to the acquisition request from the privacy budget is less than the second subtraction amount;
the subtraction unit subtracts the subtraction amount corresponding to the addition of the noise from the privacy budget stored in the storage unit in response to the noise addition unit adding noise to the entire data group to which the noise has not been added.
The information processing device according to claim 5 . the noise adding unit adds noise to the entire data group, and determines a subtraction amount of the privacy budget corresponding to the addition of the noise based on the budget consumption amount;
the subtraction unit, in response to the noise adding unit adding noise to the entire data group, subtracts the subtraction amount corresponding to the addition of the noise from the privacy budget stored in the storage unit;
The storage control unit stores the data group to which noise has been added as a noise-added data group in the storage unit,
a receiving unit that receives a request to acquire the target data from the management device,
The transmission unit transmits, to the management device, data from the noise-added data group corresponding to the target data indicated by the acquisition request accepted by the acceptance unit as noise-added data.
The information processing device according to claim 4. The noise adding unit multiplies the number of attributes included in the target data by the budget consumption amount to identify the amount of subtraction from the privacy budget.
The information processing device according to claim 4. An information processing system having a data management device that manages a data group including data of each of a plurality of attributes, and an information processing device,
The data management device includes:
An identification unit that identifies the number of the attributes and an update frequency of data of each of the plurality of the attributes in a predetermined period;
a transmission unit that transmits attribute number information indicating the number of the attributes identified by the identification unit and update frequency information indicating the update frequency to a management device that manages a privacy budget that indicates an amount of noise that can be added to the data group;
having
The information processing device includes:
a receiving unit that receives the attribute number information and the update frequency information from the data management device;
a decision unit that decides a budget consumption amount, which is an amount of the privacy budget to be reduced for adding the noise once to data of one attribute included in the data group, based on the number of attributes indicated by the received attribute number information, the update frequency indicated by the update frequency information, and a privacy budget indicating an amount of noise that can be added to the data group; and
a transmission unit that transmits to the data management device budget information indicating the privacy budget and the budget consumption amount determined by the determination unit;
having
The data management device includes:
A receiving unit that receives the budget information from the information processing device;
a storage control unit that stores the received privacy budget in a storage unit;
a noise adding unit that, when adding noise to target data, which is data on one or more attributes included in the data group, specifies an amount to be subtracted from the privacy budget corresponding to the addition of the noise based on the budget consumption amount, and adds noise to the target data under the condition that the privacy budget stored in the storage unit is equal to or greater than the specified amount to be subtracted;
a subtraction unit that subtracts the subtraction amount corresponding to the addition of the noise from the privacy budget stored in the storage unit in response to the noise addition unit adding the noise;
Further comprising
Information processing system. The computer executes
receiving attribute number information indicating the number of attributes and update frequency information indicating an update frequency of data of each of the plurality of attributes in a predetermined period from a device that manages a data group including data of each of the plurality of attributes;
determining a budget consumption amount, which is an amount of the privacy budget to be reduced for adding the noise once to data of one attribute included in the data group, based on the number of attributes indicated by the received attribute number information, the update frequency indicated by the update frequency information, and a privacy budget indicating the amount of noise that can be added to the data group;
transmitting the privacy budget and the determined budget consumption to the device;
An information processing method comprising the steps of: A computer that manages a data group including data on each of a plurality of attributes executes the
determining a number of said attributes and a frequency of update of data for each of said plurality of attributes over a predetermined period of time;
transmitting attribute number information indicating the number of the identified attributes and update frequency information indicating the update frequency to a management device that manages a privacy budget indicating an amount of noise that can be added to the data group;
receiving, from the management device, budget information indicating a budget consumption amount, which is an amount of the privacy budget to be reduced for adding noise once to data of one attribute included in the data group, determined based on the number of attributes indicated by the attribute number information, the update frequency indicated by the update frequency information, and the privacy budget, and indicating the privacy budget;
storing the received privacy budget in a storage unit;
a step of, when adding noise to target data which is data of one or more attributes included in the data group, specifying a subtraction amount of the privacy budget corresponding to the addition of the noise based on the budget consumption amount, and adding noise to the target data under the condition that the privacy budget stored in the storage unit is equal to or greater than the specified subtraction amount;
In response to adding noise to the target data, subtracting the subtraction amount corresponding to the addition of the noise from the privacy budget stored in the storage unit;
An information processing method comprising the steps of:

Images