[go: up one dir, main page]
More Web Proxy on the site http://driver.im/

WO2016002086A1 - Anonymized data providing device and method - Google Patents

Anonymized data providing device and method Download PDF

Info

Publication number
WO2016002086A1
WO2016002086A1 PCT/JP2014/067983 JP2014067983W WO2016002086A1 WO 2016002086 A1 WO2016002086 A1 WO 2016002086A1 JP 2014067983 W JP2014067983 W JP 2014067983W WO 2016002086 A1 WO2016002086 A1 WO 2016002086A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
anonymized
anonymization
user
data set
Prior art date
Application number
PCT/JP2014/067983
Other languages
French (fr)
Japanese (ja)
Inventor
啓成 藤原
佐藤 嘉則
Original Assignee
株式会社日立製作所
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 株式会社日立製作所 filed Critical 株式会社日立製作所
Priority to PCT/JP2014/067983 priority Critical patent/WO2016002086A1/en
Priority to JP2016530796A priority patent/JP6263620B2/en
Publication of WO2016002086A1 publication Critical patent/WO2016002086A1/en

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60Protecting data
    • G06F21/62Protecting access to data via a platform, e.g. using keys or access control rules

Definitions

  • the present invention relates to an anonymized data providing apparatus and method, and is preferably applied to an anonymized data providing system that provides data after anonymizing or obscuring information related to privacy in order to use data secondarily. It is a thing.
  • the k-anonymization technology is a technology for anonymizing original data so that there are at least k (hereinafter referred to as k values) data having the same condition depending on a combination of obfuscation attributes.
  • priorities are set for each data at the time of data processing (during k-anonymization processing), and transformation is performed using a function.
  • a method is disclosed in which the data requested by the data user is retained as much as possible by evaluating the data, and the lack of the information requested by the data user is prevented.
  • Patent Document 2 discloses an anonymization database useful for testing in anonymizing a database (k-anonymization, I-diversification, etc.) used for testing a database-centric application. Discloses a method for ranking quasi-identifiers according to their impact on testing.
  • a data group for example, a data group of a diabetic patient or a hypertension patient, (This is called a data set) is k-anonymized.
  • priority attribute the attribute that the data user wants to prioritize in order to increase the evaluation index
  • the k-anonymization processing data set (Hereafter, this is called an anonymized data set), but it may not meet the needs of data users.
  • the present invention has been made in view of the above points, and intends to propose an anonymized data providing apparatus and method that can provide an anonymized data set that meets the needs of data users.
  • the anonymized data providing apparatus that anonymizes the original data and provides the data user with anonymization
  • the anonymization is performed on the data set of the original data.
  • a processing unit, an anonymized data selection processing unit that controls the anonymization processing unit, and the anonymized data set are managed as an anonymized data set, and in response to a request from the data user, the anonymization
  • a data providing unit for providing the data set to the data user, and the data user selects the desired data set, and an allowable significance level of a desired statistic of a desired attribute for the data set. Is set as a user requirement, and the anonymized data selection processing unit performs a plurality of times for the data set selected by the data user.
  • the anonymization processing unit is controlled to execute the anonymization process, and the statistics set by the data user are set for the plurality of anonymized data sets obtained by the anonymization process multiple times.
  • Each calculated, the calculated statistic of each anonymized data set is compared with the statistic of the data set of the original data, respectively, the difference of the statistic is the tolerance set by the data user.
  • the anonymized data set that satisfies the significance level is selected as the anonymized data set that satisfies the user requirements, and the data providing unit selects the anonymized data set selected by the anonymized data selection processing unit. Provided to users.
  • the anonymized data providing apparatus includes the data set of the original data.
  • the anonymization processing unit that executes the anonymization processing, the anonymization data selection processing unit that controls the anonymization processing unit, and the anonymized data set are managed as an anonymized data set, and the data
  • a data providing unit that provides the anonymized data set to the data user is provided, and the data user selects the desired data set, and An allowable significance level of a desired statistic of a desired attribute is set as a user requirement
  • the anonymized data selection processing unit provides the data user with A first step of controlling the anonymization processing unit to execute the anonymization processing a plurality of times on the selected data set, and the anonymization data selection processing unit performs the anonymization a plurality of times For each of the plurality of anonymized data sets obtained by processing, a second step of calculating the statistics set by the data user, and each
  • an anonymized data set that satisfies the user requirements set by the data user can be provided to the data user.
  • an anonymized data provision device and method that can provide anonymized data set that meets the needs of a data user to the data user.
  • reference numeral 1 denotes an information processing system according to this embodiment as a whole.
  • the data collection / management / provider 3 collects data provided by the original data provider 2 (hereinafter referred to as original data), and the collected original data is k-anonymized.
  • the original data managed and k-anonymized is provided by the data collection / management / provider 3 in response to a request from the data user 4.
  • the information processing system 1 includes an information processing device 20 of an original data provider 2 and a data preparation device 31 that constitutes an anonymized data providing system 30 of a data collection / management / provider 3.
  • the data providing apparatus 32 connected through the first network 10 and constituting the anonymized data providing system 30 is connected to the client terminal 40 of the data user 4 through the second network 11. ing.
  • the information processing apparatus 20 includes a personal computer including a CPU (Central Processing Unit) 21, a memory 22, a hard disk device (HDD: Hard Disc Drive) 23, an input device 24, a monitor 25, and the like.
  • Original data is accumulated in the hard disk device 23, and this original data is collected by the data preparation device 31 of the anonymized data providing system 30 via the first network 10.
  • the data preparation device 31 includes a personal computer including a CPU 33, a memory 34, a hard disk device 35, and the like.
  • the data preparation device 31 performs k-anonymization processing on the original data collected from the information processing device 20 of each original data provider 2.
  • the data preparation device 31 transmits the anonymized data obtained by the k-anonymization process to the data providing device 32.
  • the data provision device 32 includes a personal computer including a CPU 36, a memory 37, a hard disk device 38, and the like.
  • the data providing device 32 stores and holds the anonymized data transmitted from the data preparation device 31 in the hard disk device 38, and the held anonymized data in response to a request from the data user 4 using the client terminal 40.
  • the data user 4 is provided.
  • the client terminal 40 is also composed of a personal computer or the like provided with a CPU 41, a memory 42, a hard disk device 43, an input device 44, a monitor 45, and the like.
  • the client terminal 40 accesses the data providing device 32 of the anonymized data providing system 30 via the second network 11 according to the operation of the data user 4 and downloads the anonymized data provided from the data providing device 32. And stored in the hard disk device 43.
  • FIG. 2 shows a logical configuration of the information processing system 1.
  • healthcare data is assumed as the original data collected, managed, and provided by the data collection / management / provider 3, and the former data provider 2 is shown in FIG.
  • the data management hospitals, pharmacies, clinics, health insurance associations, biobanks and / or households are assumed.
  • the original data provider 2 may be assumed to be the individual itself and to collect the health care data directly from the individual.
  • the data user 4 is not only a hospital, an insurance station, an administrative organization such as the Ministry of Health, Labor and Welfare, or an organization having a public role such as a health insurance association, but also a pharmaceutical company or a food company. It also assumes private companies such as beauty companies.
  • the data preparation device 31 stores the data collection / name identification processing unit 50, the anonymization processing unit 51, the statistical quantity strengthened anonymization data selection processing unit 52, and the hard disk device 35 (FIG. 1) stored in the memory 34 (FIG. 1).
  • the stored original data database 53 and anonymization condition database 54 are provided.
  • the data collection / name identification processing unit 50 has a function of collecting original data (health care data) from the information processing apparatus 20 (FIG. 1) of the original data provider 2 and storing the collected original data in the original data database 53. It is a program. Further, the data collection / name identification processing unit 50 also executes a name identification process for collecting the original data as one original data when one original data exists across a plurality of original data providers 2.
  • the data preparation device 31 may collect data from the original data provider 2 every time the data is updated by the original data provider 2, or once a day for one day at night. Updates may be collected.
  • the original data may be transmitted from the information processing apparatus 20 to the data preparation apparatus 31 or may be retrieved from the data preparation apparatus 31 to each information processing apparatus 20.
  • the anonymization processing unit 51 has a function of anonymizing personal information with respect to the original data stored in the original data database 53 while referring to the privacy protection condition table 56 stored in the anonymization condition database 54. It is.
  • the anonymization processing unit 51 generates a single data set (hereinafter referred to as a pre-anonymization data set) 55 by collecting a plurality of related original data such as diabetes patient original data or hypertension patient original data, for example. Then, an anonymized data set 64 is generated by performing k-anonymization processing on the generated pre-anonymized data set 55. Then, the anonymization processing unit 51 transmits the data of the anonymization data set 64 generated in this way to the data providing device 32.
  • the statistic-enhanced anonymized data selection processing unit 52 sets the k value and anonymization process parameters for the pre-anonymization data set 55 specified by the data user 4.
  • This is a program having a function of causing the anonymization processing unit 51 to execute a plurality of k-anonymization processes while changing.
  • the statistic-enhanced anonymized data selection processing unit 52 selects the attribute (birth date, hospitalization date, discharge date, etc.) designated by the data user 4 from the plurality of anonymized data sets 64 thus obtained.
  • the statistic (average, variance, correlation coefficient, etc.) specified by the data user 4 is within the allowable significance level specified by the data user 4 (hereinafter referred to as the allowable significance level).
  • the anonymized data set having the highest safety for example, the anonymized data set having the largest k value
  • Details of the statistic strengthening anonymized data selection processing unit 52 will be described later.
  • the original data database 53 is a database used for holding and managing the original data, and the original data collected by the data preparation device 31 from each original data provider 2 is sequentially registered.
  • healthcare data is assumed as the original data. Therefore, as shown in FIG. 3, the individual original data includes the patient ID, the patient name, the patient birth date, and the hospitalization.
  • the attribute information of the person such as date and discharge date, the test value of the person, and the like are included.
  • one row corresponds to one person's original data, and the above-described pre-anonymization data set 55 is shown in FIG. 3 as a whole.
  • a privacy protection condition table 56 is stored in the anonymization condition database 54.
  • the privacy protection condition table 56 is used to manage conditions for protecting the privacy of the individual who is the owner of the personal information included in the original data, which is set in advance by the data collection / management / provider 3.
  • the table includes a personal information range column 56A, a deletion item column 56B, a change item column 56C, a protection item column 56D, and a k value minimum value column 56E.
  • the data preparation device 31 handles personal information such as ID, name, address, and telephone number among the information included in the original data collected from the information processing device 20 of the original data provider 2. All the names of individual data items (hereinafter referred to as item names) are stored.
  • deletion item column 56B among the data items that should be handled as such personal information, each data that is not provided to the data user 4 in order to protect personal privacy, that is, deleted in the k-anonymization process. Stores the item name of an item (hereinafter referred to as a deletion item).
  • the change item column 56C stores the item names of the respective data items (hereinafter referred to as change items) that can be provided to the data user 4 by changing the contents.
  • change items the respective data items
  • no change item is set. For example, if data can be provided in a state in which privacy is protected by converting an ID for identifying an individual into another ID, the ID is set as the change item.
  • the protection item column 56D stores the item name of a data item called a quasi-identifier (hereinafter referred to as a protection item) that can be the target of k-anonymization
  • the k value minimum value column 56E stores anonymization.
  • the minimum value of the k value in the k-anonymization process executed by the processing unit 51 (hereinafter referred to as the “k value minimum value”) is stored. This minimum k value is set in advance by the data collection / management / provider 3.
  • each data item set as the personal information range is set as one of a deletion item, a conversion item, and a protection item.
  • data items that are not set as personal information ranges may be set as deleted items, changed items, and / or protected items.
  • a plurality of privacy protection condition tables 56 may be prepared. For example, when providing the anonymization data set 64 stored in the anonymization database 60 of the data providing device 32 to the data user 4 existing in a plurality of countries as described later, the data user 4 accesses The privacy protection condition table 56 corresponding to the country in question may be selected and the anonymized data set 64 to be provided may be changed.
  • the data providing device 32 includes an anonymization database 60, data catalog information 61 and usage condition information 62 stored in the hard disk device 38 (FIG. 1), and a data provision management unit 63 stored in the memory 37 (FIG. 1). And is configured.
  • the anonymization database 60 is a database used for holding and managing the anonymization data set 64 created by the anonymization processing unit 51 of the data preparation device 31, and stores a plurality of anonymization data sets 64. .
  • the data catalog information 61 is information representing an outline of each anonymized data set 64 that can be provided to the data user 4 by the data providing device 32, and has, for example, a table configuration as shown in FIG.
  • one record (row) corresponds to one anonymized data set 64, and these records are a data set ID column 61A, an anonymized data item column 61B, and a general data item column 61C, respectively.
  • K value column 61D loss statistic column 61E, and the like.
  • an identifier (data set ID) unique to the anonymized data set 64 assigned to the corresponding anonymized data set 64 is stored, and in the anonymized data item column 61B, The item names of all data items that are anonymized in the corresponding anonymized data set 64 are stored.
  • the general data item column 61C stores the item names of all data items that are not anonymized in the corresponding anonymized data set 64, respectively, and the k value column 61D stores k in the corresponding anonymized data set 64.
  • the value value is stored.
  • the loss statistics column 61E stores the loss information amount (I.L) in the corresponding anonymized data set 64 and various statistics such as the average, variance, and correlation function of the anonymized data set 64.
  • the usage condition information 62 includes a user requirement table 65.
  • the requirements set by the data user 4 for any anonymized data set 64 set by the data user 4 using the statistics strengthening item designation screen 80 described later with reference to FIG. (Hereinafter referred to as user requirements) is registered.
  • the attribute specified by the data user 4 (the date of birth or hospital discharge date, etc., hereinafter referred to as a target attribute)
  • a user that a statistic specified by the data user 4 (mean, variance, correlation coefficient, etc., hereinafter referred to as a target statistic) should satisfy the allowable significance level specified by the data user 4 Set as a requirement.
  • the data provision management unit 63 is a program having a function of providing the data user 4 with the anonymized data set 64 designated by the data user 4 in response to a request from the data user 4.
  • the data provision management unit 63 causes the data user 4 to display a data set selection screen 70 described later with reference to FIG. .
  • the data provision management unit 63 transfers the data of the anonymized data set 64 from the anonymized database 60. It is read out and provided to the data user 4.
  • FIG. 7 shows the configuration of the data set selection screen 70 displayed on the client terminal 40 (FIG. 1) based on the screen data transmitted from the data providing device 32.
  • the data set selection screen 70 is a screen for selecting the anonymized data set 64 to be purchased when the data user 4 purchases the anonymized data set 64 from the data collection / management / provider 3.
  • the data set selection screen 70 includes an anonymized data set list 71 in which all anonymized data sets 64 that can be provided by the data providing device 32 are posted, a purchase button 72, a next button 73, and a cancel button 74. Composed.
  • one record (row) corresponds to one anonymized data set 64, and these records are respectively a check box column 71A, a data set ID column 71B, an anonymized data item column 71C, A general data item column 71D, a k value column 71E, a loss statistic column 71F, and the like are included.
  • a check box 71AX is displayed in the check box column 71A of each record.
  • the anonymized data item column 71C, the general data item column 71D, the k value column 71E, the loss statistic column 71F, etc. the corresponding data set ID of the data catalog information 61 described above with reference to FIG.
  • the same information as that stored in the column 61A, the anonymized data item column 61B, the general data item column 61C, the k value column 61D, the loss statistic column 61E, or the like is stored.
  • the anonymized data set 64 is clicked by clicking the check box 71AX corresponding to the desired anonymized data set 64 from the anonymized data sets 64 posted in the anonymized data set list 71. Can be selected for purchase. In this case, a check mark 71AY is displayed in the check box 71AX.
  • the anonymized data set 64 can be purchased by clicking the purchase button 72 after selecting the desired anonymized data set 64 as described above.
  • the data of the anonymized data set 64 purchased by the data user 4 is transmitted from the data providing device 32 to the client terminal 40 of the data user 4 (FIG. 1).
  • the data set selection screen 70 can be closed by clicking the cancel button 74.
  • the statistic strengthening item designation screen 80 is a screen for setting user requirements desired by the data user 4 for the anonymized data set 64 selected on the data set selection screen 70.
  • the statistics strengthening item designation screen 80 has a target data set ID display field 80A, and the data set ID of the anonymized data set 64 selected by the data user 4 on the data set selection screen 70 (FIG. 7). Is displayed in the target data set ID display field 80A.
  • the lower part of the target data set ID display column 80A includes target attributes that the data user 4 considers important (that is, the anonymized data set 64 that the data user 4 purchases from the data collection / management / provider 3).
  • target attribute designating text boxes 80B for designating the data items that are desired to be used in the information to be used.
  • a text box for designating a target statistic (hereinafter referred to as a target statistic designation text box) 80C and a text box for designating an allowable significance level (hereinafter referred to as this) corresponding to each of the boxes 80B. 80D) (referred to as an allowable significance level designation text box).
  • the data user 4 inputs the attribute name of the target attribute (the item name of the data item) in the target attribute specification text box 80B of the statistics strengthening item specification screen 80 and is associated with the target attribute specification text box 80B.
  • the target data set ID is entered by inputting the desired statistic and the allowable significance level into the target statistic specification text box 80C and the allowable significance level specification text box 80D (displayed at the lower side in the present embodiment). Desired user requirements for the anonymized data set 64 in which the data set ID is stored in the display field 80A can be set. For example, the example of FIG. 8 shows a state in which “average” should be set to satisfy the significance level of “5%” for the target attribute (data item) “birth date”.
  • the statistics enhancement item designation screen 80 is provided with two toggle switches 80EX and 80EY for selecting whether the k value is variable or fixed during the k-anonymization process.
  • One of these two toggle switches 80EX and 80EY is associated with a setting that makes the k value variable, and the other is associated with a setting that fixes the k value, and of these two toggle switches 80EX and 80EY, By clicking the desired toggle switches 80EX and 80EY, the corresponding setting (variable or fixed) can be selected.
  • the statistic strengthening item designation screen 80 is provided with a text box (hereinafter referred to as a k value maximum value designation text box) 80F for designating the maximum k value.
  • a text box hereinafter referred to as a k value maximum value designation text box
  • the data user 4 determines the maximum value of the k value in the k-anonymization process that is repeatedly executed while sequentially increasing the k value by 1 in the statistics-enhanced anonymized data selection process described later with reference to FIG. It can be set by inputting in the designated text box 80F.
  • an OK button 80G and a cancel button 80H are displayed in the lower part of the statistics strengthening item designation screen 80.
  • the statistics strengthening item designation screen 80 can be closed by clicking the cancel button 80H, and the desired user for the desired anonymized data set 64 as described above. Clicking the OK button 80G after setting the requirements causes the anonymized data providing system 30 (FIG. 2) to create an anonymized data set 64 according to the contents set on the statistics strengthening item designation screen 80. be able to.
  • FIG. 9 shows that the data user 4 sets desired user requirements for the desired anonymized data set 64 in the information processing system 1, and the user requirements An anonymized data set 64 that satisfies the above condition is created by the anonymized data providing system 30, and a flow of a series of processes until the data user 4 purchases the created anonymized data set 64 is shown.
  • the data user 4 accesses the data providing device 32 of the anonymized data providing system 30 using his / her client terminal 40 (FIG. 1), and data based on the data catalog information 61 (FIG. 2). It starts by requesting the presentation of a catalog (SP1).
  • SP1 a catalog
  • the data providing apparatus 32 Upon receiving such a request, the data providing apparatus 32 transmits the screen data of the data set selection screen 70 described above with reference to FIG. 7 to the client terminal 40 of the data user 4 so that the data set selection screen 70 is displayed on the client. It is displayed on the terminal 40 (SP2).
  • the client terminal 40 selects the anonymized data set 64 desired by the data user 4 on the data set selection screen 70 and clicks the next button 73 (FIG. 7), the anonymized data set 64 selected at that time is selected. Is notified from the client terminal 40 to the data providing device 32 (SP3).
  • the data providing device 32 Upon receiving such notification, the data providing device 32 transmits the screen data of the statistics enhancement item designation screen 80 described above with reference to FIG. 8 to the client terminal 40 that is the transmission source of the notification, thereby the statistics enhancement item designation screen. 80 is displayed on the client terminal 40 (SP4).
  • the client terminal 40 determines the OK button When (FIG. 8) is clicked, these setting contents are transmitted to the data providing apparatus 32 as user requirement information (SP5).
  • the data providing device 32 When receiving the user requirement information, the data providing device 32 updates the user requirement table 65 of the usage condition information 62 (FIG. 2) based on the received user requirement information (SP6). The data providing device 32 then instructs the data preparation device 31 to create an anonymized data set 64 that satisfies the user requirements requested by the data user 4.
  • the data preparation device 31 makes a transfer request for the original data necessary for creating the anonymized data set 64 that satisfies the user requirements set by the data user 4. Then, the data is transmitted to the information processing apparatus 20 (FIG. 2) of the corresponding original data provider 2 (SP7). Then, when the necessary original data is transferred in response to the transfer request (SP8), the data preparation device 31 generates the pre-anonymization data set 55 (FIG. 2) based on the transferred original data, The generated pre-anonymization data set 55 is stored in the original data database 53 (SP9).
  • the data preparation device 31 sequentially changes the value of the k value or the parameter at the time of the k-anonymization process, and the k-anonymization process for the pre-anonymization data set 55 stored in the original data database 53 in step SP9.
  • SP10 anonymized data sets 64
  • the data preparation device 31 determines whether or not the plurality of anonymized data sets 64 created in step SP10 satisfy the user requirement set by the data user 4 in step SP5 (that is, the value of the target statistic of the target attribute). Are determined whether or not the acceptable significance level set by the data user 4 in step SP5 is satisfied (SP11).
  • the data preparation apparatus 31 retries the process of step SP10 and step SP11, when none of the anonymized data sets 64 created in step SP10 satisfy the user requirements (SP12).
  • the data preparation device 31 selects the anonymized data set 64 having the largest k value among the data providing devices 32. Send to.
  • the data providing device 32 stores the anonymized data set 64 given from the data preparation device 31 in the anonymized database 60 and updates the data catalog information 61 so as to register the anonymized data set 64 in the data catalog. (SP13). Further, the data providing device 32 thereafter transmits the screen data of the data set selection screen 70 (FIG. 7) on which the updated data catalog information 61 is posted to the client terminal 40 of the data user 4, thereby the screen data. Is displayed on the client terminal 40 (SP14).
  • the client terminal 40 When the client terminal 40 selects the anonymized data set 64 desired by the data user 4 on the data set selection screen 70 and clicks the purchase button 72 (FIG. 7), the client terminal 40 notifies the data providing apparatus 32 to that effect. (SP15).
  • the data providing device 32 when receiving the notification, the data providing device 32 reads the data of the anonymized data set 64 selected by the data user 4 on the data set selection screen 70 from the anonymized database 60, and the client terminal 40 of the data user 4 (SP16).
  • FIG. 2 The process sequence of the statistics reinforcement
  • the statistic strengthening anonymized data selection processing unit 52 starts the statistic strengthening anonymized data selection process in step SP10.
  • the degree of freedom of the k value set by the data user 4 is acquired from the data providing device 32 using the designation screen 80 (SP20), and it is determined whether or not the degree of freedom of the acquired k value is “variable” (SP20). SP21).
  • the statistic strengthening anonymized data selection processing unit 52 obtains a positive result in this determination, it executes a k value variable statistic enhancing process that repeatedly executes the k-anonymization process while sequentially increasing the k value by one ( SP22), and thereafter, the statistics-strengthening anonymized data selection process is terminated.
  • the statistic-enhanced anonymized data selection processing unit 52 obtains a negative result in this determination, the k-anonymity is changed while changing the parameter at the k-anonymization process without changing the value of the k value.
  • the k-value fixed statistic enhancement process for repeatedly executing the quantification process is executed (SP23), and then the statistic reinforcement anonymized data selection process is terminated.
  • FIG. 11 shows the k value executed by the statistics enhancing anonymized data selection processing unit 52 in step SP22 of the statistics enhancing anonymized data selection processing described above with reference to FIG. The specific processing content of the variable statistic enhancement processing is shown.
  • the statistical value strengthening anonymization data selection processing unit 52 starts the k value variable statistical strength strengthening processing shown in FIG.
  • the minimum value Kmin of the preset k value is acquired from (FIG. 4) (SP30).
  • the statistic-enhanced anonymized data selection processing unit 52 acquires the maximum value Kmax of the k value set by the data user 4 from the data providing device 32 (SP31), and further preliminarily stores the anonymization condition database 54 (FIG.
  • the upper limit value Nmax of the number of trials of k-anonymization processing set in 2) is acquired via the anonymization processing unit 51 (SP32).
  • the statistic strengthening anonymization data selection processing unit 52 sets the value of the k value in the k-anonymization processing to the anonymization processing unit 51 so as to be the minimum value Kmin acquired in step SP30, and k-anonymization.
  • the value of the variable n for counting the number of trials of the digitizing process is set to “1” (SP33).
  • the statistic strengthening anonymized data selection processing unit 52 performs the anonymization process so as to execute the k-anonymization process on the pre-anonymization data set 55 that is the basis of the anonymization data set 64 specified by the data user 4.
  • An instruction is given to the unit 51 (SP34).
  • the anonymization processing unit 51 executes k-anonymization processing for the corresponding pre-anonymization data set 55.
  • the statistic enhancement anonymized data selection processing unit 52 temporarily stores the data of the anonymized data set 64 created by the k-anonymization process executed at this time in the hard disk device 35 (FIG. 1) (SP35). ).
  • the statistic strengthening anonymized data selection processing unit 52 determines whether or not the value of k set in the anonymization processing unit 51 is less than the maximum value Kmax acquired in step SP31, and the value of the variable n is step. It is sequentially determined whether or not the number of trials acquired at SP32 is less than the upper limit value Nmax (SP36, SP37).
  • step SP36 and step SP37 obtain a positive result
  • the statistic-enhanced anonymized data selection processing unit 52 increases the value of k and the value of variable n by 1 (SP38), Returning to SP34, thereafter, the processing from step SP34 to step SP38 is repeated until a negative result is obtained in step SP36 or step SP37.
  • the k value is sequentially changed from the minimum value Kmin to the maximum value Kmax in a range where the number of trials of k-anonymization processing (value of the variable n) does not exceed the upper limit value Nmax.
  • the anonymized data set 64 obtained by executing k-anonymization processing on the pre-anonymized data set 55 (FIG. 2) that is the basis of the anonymized data set 64 designated by the data user 4 Each is stored in the hard disk device 35.
  • the statistic strengthening anonymization data selection processing unit 52 eventually reaches the k value of the k-anonymization process reaching the maximum value Kmax set by the data user 4, or the number of trials of the k-anonymization process (variable n If a negative result is obtained at step SP36 or step SP37 when the value reaches the upper limit value Nmax, the data use of the pre-anonymization data set 55 that becomes the basis of the anonymization data set 64 designated by the data user 4
  • the target statistics of the anonymization data set 64 obtained by executing the k-anonymization process with the value of the target statistic specified by the data user 4 of the target attribute specified by the user 4 and the current k value The difference from the quantity value is calculated (SP39).
  • the statistic-enhanced anonymized data selection processing unit 52 determines whether or not the difference calculated in step SP39 satisfies the allowable significance level set by the data user 4 (SP40). If the statistic strengthening anonymized data selection processing unit 52 obtains a negative result in this determination, it determines whether or not the k value at that time is the minimum value Kmin (SP41).
  • the statistic strengthening anonymized data selection processing unit 52 obtains a negative result in this determination, it decreases the value of k by 1 (SP42). Then, the statistic strengthening anonymized data selection processing unit 52 returns to step SP39, and thereafter repeats the processing of step SP39 to step SP42.
  • the statistic-enhanced anonymized data selection processing unit 52 eventually obtains an affirmative result at step SP40, the anonymized data set 64 obtained by executing the k-anonymization process with the target k value at that time is obtained.
  • the data is output to the data providing device 32 as an anonymized data set 64 that satisfies the user requirements set by the data user 4 (SP44), and then the k-value variable statistic enhancement processing is terminated.
  • the value of the statistic (target statistic) specified by the data user 4 of the attribute (target attribute) specified by the data user 4 indicates the allowable significance level specified by the data user 4.
  • the data of the anonymized data set 64 having the largest k value that is, the anonymized data set 64 having the highest safety
  • the summary of the anonymized data set 64 is additionally displayed in the anonymized data set list 71 (FIG. 7) of the data set selection screen 70 described above with reference to FIG.
  • the statistic strengthening anonymized data selection processing unit 52 obtains a negative result in the determination at step SP41, the value of the statistic specified by the data user 4 of the attribute specified by the data user 4 is obtained.
  • the data providing apparatus 32 is notified of a warning that the allowable significance level set by the data user 4 is not satisfied (SP43).
  • the statistic-enhanced anonymization data selection processing unit 52 performs the anonymization data obtained by executing the k-anonymization process with the target k value (the value of the k value in this case is the minimum value Kmin).
  • the data of the set 64 is output to the data providing device 32 (SP44), and then the k-value variable statistic enhancement processing is terminated.
  • the value of the statistic (target statistic) specified by the data user 4 of the attribute (target attribute) specified by the data user 4 indicates the allowable significance level specified by the data user 4.
  • the data of the anonymized data set 64 having the smallest k value that is, the anonymized data set 64 considered to have the highest accuracy
  • the anonymized data set 64 is additionally displayed on the anonymized data set list 71 (FIG. 7) of the data set selection screen 70 described above with reference to FIG. Is displayed in association with the summary of the anonymized data set 64.
  • FIGS. 12A and 12B are executed by the statistics enhancing anonymized data selection processing unit 52 in step SP23 of the statistics enhancing anonymized data selection process described above with reference to FIG. The specific processing content of the k-value fixed statistic enhancement processing is shown.
  • the statistical value strengthening anonymized data selection processing unit 52 starts the k-value fixed statistical strength strengthening processing shown in FIGS. 12A and 12B.
  • the minimum value Kmin of the preset k value is acquired from the condition table 56 (SP50).
  • the statistic-enhanced anonymized data selection processing unit 52 acquires the maximum value Kmax of the k value set by the data user 4 from the data providing device 32 (SP51), and further preliminarily stores the anonymization condition database 54 (FIG.
  • the upper limit value Nmax of the number of trials of k-anonymization processing stored in 2) is acquired via the anonymization processing unit 51 (SP52).
  • the statistic strengthening anonymization data selection processing unit 52 generates the same number of different k-anonymization parameters as the upper limit value Nmax of the number of trials of k-anonymization processing (SP53).
  • This k-anonymization parameter is mainly composed of two combinations of k-anonymization target item and deletion record threshold.
  • the k-anonymization target item is a parameter for designating a protection item (see FIG. 4) to be k-anonymization target. Protection items that are not targeted for k-anonymization are not provided to the data user 4 because they are deleted and subjected to k-anonymization processing.
  • the target attribute (data item) specified on the statistics strengthening item specification screen 80 described above with reference to FIG. 8 is always included in the k-anonymization target item.
  • the deletion record threshold is a parameter that specifies an upper limit value of the number of original data that may be deleted when the pre-anonymization data set 55 is k-anonymized in the k-anonymization process. For example, when the deletion record threshold is “0”, the k-anonymization process is executed until all the original data satisfy the k-anonymity. On the other hand, when the deletion record threshold is “1000”, k-anonymity is reduced when the number of original data that does not satisfy k-anonymity becomes “1000” or less in the course of k-anonymization processing. The k-anonymization process is terminated after deleting the unsatisfied original data.
  • Nmax of the number of trials of k-anonymization processing is set to “8”
  • the protection items are “age”, “sex” and “address”
  • the data items specified on the statistics enhancement item screen are An example of a k-anonymization parameter group in the case of “age” is shown in FIG.
  • the statistic-enhanced anonymized data selection processing unit 52 sets the value of the k value in the k-anonymization process in the anonymization processing unit 51 so as to be the minimum value Kmin acquired in step SP50, and k-anonymization.
  • the value of the variable n for counting the number of times of the digitization process is set to “1” (SP54).
  • the statistic-enhanced anonymized data selection processing unit 52 selects one unselected k-anonymization parameter from the Nmax k-anonymization parameters generated in step SP53 (SP55), and selects it.
  • An instruction is given to the anonymization processing unit 51 to execute the k-anonymization process using the k-anonymization parameter (SP56).
  • the anonymization processing unit 51 executes the k-anonymization process for the corresponding pre-anonymization data set 55 (FIG. 2).
  • the statistic enhancement anonymized data selection processing unit 52 temporarily stores the data of the anonymized data set 64 created by the k-anonymization process executed at this time in the hard disk device 35 (FIG. 1) (SP57). ).
  • the statistic strengthening anonymized data selection processing unit 52 determines whether or not the value of k set in the anonymization processing unit 51 is less than the maximum value Kmax acquired in step SP51, and the value of the variable n is step. It is sequentially determined whether or not the number of trials acquired in SP52 is less than the upper limit value Nmax (SP58, SP59).
  • step SP58 and step SP59 obtain a positive result
  • the statistic-enhanced anonymized data selection processing unit 52 increases the value of the variable n by 1 (SP60), and then returns to step SP55. While the k-anonymization parameter selected in step SP55 is sequentially switched to another unprocessed k-anonymization parameter, the processes in steps SP55 to SP60 are repeated until a negative result is obtained in step SP58 or step SP59.
  • k-anonymization processing is executed for all Nmax k-anonymization parameters generated in step SP53, and the anonymization data obtained by these k-anonymization processing is executed.
  • Each set 64 is stored in the hard disk device 35.
  • the statistic strengthening anonymization data selection processing unit 52 eventually reaches the k value of the k-anonymization process reaching the maximum value Kmax set by the data user 4, or the number of trials of the k-anonymization process (variable n If a negative result is obtained at step SP58 or step SP59 when the value of the data) reaches the upper limit value Nmax, the data use of the pre-anonymization data set 55 that becomes the basis of the anonymization data set 64 designated by the data user 4 The difference between the value of the target statistic designated by the person 4 and the value of the target statistic of each anonymized data set 64 obtained by the repetition processing of step SP55 to step SP60 is calculated (SP61).
  • the statistic-enhanced anonymized data selection processing unit 52 determines the value of the target statistic of each anonymized data set 64 obtained by the repetition processing of step SP55 to step SP60.
  • the anonymized data set 64 having the smallest difference from the value of the target statistic specified by the data user 4 of the pre-anonymized data set 55 that is the source of the anonymized data set 64 specified by the data user 4 is identified. (SP62).
  • the statistic-enhanced anonymized data selection processing unit 52 selects the target statistic value designated by the data user 4 of the target attribute designated by the data user 4 of the anonymized data set 64 identified at step SP62. Then, it is determined whether or not the difference between the value of the target statistic specified by the data user 4 in the pre-anonymization data set 55 satisfies the allowable significance level set by the data user 4 (SP63).
  • fills the user requirement which the data user 4 set the anonymization data set 64 identified by step SP62.
  • the data is output to the data providing device 32 (SP69), and then the k-value fixed statistics enhancing process is terminated.
  • the value of the statistic (target statistic) specified by the data user 4 of the attribute (target attribute) specified by the data user 4 indicates the allowable significance level specified by the data user 4.
  • the data of the anonymized data set 64 that satisfies the data of the anonymized data set 64 that has the closest target statistic value of the target attribute to the original statistical value of the target statistical value 55 of the original anonymization data is output to the data providing device 32. Will be.
  • the summary of the anonymized data set 64 is additionally displayed in the anonymized data set list 71 (FIG. 7) of the data set selection screen 70 described above with reference to FIG.
  • the k-value at the time of the k-anonymization processing set in the anonymization processing unit 51 is It is determined whether or not the k value is the maximum value Kmax acquired in step SP51 (SP64).
  • the statistic strengthening anonymized data selection processing unit 52 obtains a positive result in this determination, the statistic (target statistic) designated by the data user 4 of the attribute (target attribute) designated by the data user 4 Is notified to the data providing device 32 that the value of does not satisfy the allowable significance level set by the data user 4 (SP65).
  • the statistic strengthening anonymization data selection processing unit 52 performs the anonymization specified in step SP62 out of the anonymization data set 64 obtained by executing the k-anonymization process with the k value set at that time.
  • the data of the data set 64 is output to the data providing device 32 (SP69), and then the k-value fixed statistics enhancing process is terminated.
  • the value of the statistic (target statistic) specified by the data user 4 of the attribute (target attribute) specified by the data user 4 indicates the allowable significance level specified by the data user 4.
  • the data of the anonymized data set 64 having the smallest difference in the target statistic value of the target attribute in the relationship with the original pre-anonymized data set 55 (FIG. 1) is the data providing device. 32 is output.
  • the anonymized data set 64 is additionally displayed on the anonymized data set list 71 (FIG. 7) of the data set selection screen 70 described above with reference to FIG. Is displayed in association with the summary of the anonymized data set 64.
  • the statistic strengthening anonymized data selection processing unit 52 obtains a negative result in the determination at step SP64, it confirms with the data user 4 whether or not to retry by incrementing the value of the k value by one.
  • the data providing apparatus 32 is requested to display the confirmation screen (not shown) on the client terminal 40 (SP66).
  • the data providing device 32 transmits predetermined screen data to the corresponding client terminal 40, so that the target statistic of the target attribute satisfies the allowable significance level specified by the data user 4 at the current k value.
  • the above-described confirmation screen on which a warning that the anonymized data set 64 cannot be created is displayed on the client terminal 40. Further, the data providing device 32 transfers an answer transmitted from the client terminal 40 as to whether or not to retry the data user 4 using the confirmation screen, to the data preparation device 31.
  • the statistic strengthening anonymized data selection processing unit 52 determines whether or not the data user has selected to retry based on the response transferred from the data providing device 32 (SP67). If the statistic strengthening anonymized data selection processing unit 52 obtains a positive result in this determination, it increments the value of k by 1 (SP68), and then returns to step SP55. Then, the statistic strengthening anonymized data selection processing unit 52 thereafter processes step SP55 and subsequent steps in the same manner as described above.
  • the statistic strengthening anonymized data selection processing unit 52 obtains a negative result in the determination at step SP67, the statistics specified by the data user 4 of the attribute (target attribute) specified by the data user 4 A warning that the value of the quantity (target statistic) does not satisfy the allowable significance level set by the data user 4 is sent to the data providing apparatus 32 (SP65).
  • the statistic strengthening anonymization data selection processing unit 52 performs the anonymization specified in step SP62 out of the anonymization data set 64 obtained by executing the k-anonymization process with the k value set at that time.
  • the data of the data set 64 is output to the data providing device 32 (SP69), and then the k-value fixed statistics enhancing process is terminated.
  • the value of the statistic (target statistic) specified by the data user 4 of the attribute (target attribute) specified by the data user 4 indicates the allowable significance level specified by the data user 4.
  • the data of the anonymized data set 64 having the smallest difference in the target statistic value of the target attribute in the relationship with the original pre-anonymized data set 55 (FIG. 1) is the data providing device. 32 is output.
  • the summary of the anonymized data set 64 is additionally displayed in the anonymized data set list 71 (FIG. 7) of the data set selection screen 70 described above with reference to FIG.
  • a plurality of k-anonymizations are performed while sequentially changing the k value or the anonymization parameter for the pre-anonymization data set 55.
  • An anonymized data set 64 that meets the needs of the data user 4 can be provided to the data user 4.
  • the anonymized data providing system 30 of the data collection / management / provider 3 is configured by two devices, the data preparation device 31 and the data providing device 32.
  • the present invention is not limited to this, and the functions of the data preparation device 31 and the data providing device 32 are mounted in one information processing device, and the anonymized data providing system 30 is provided as one information processing device. You may make it comprise by.
  • the present invention is applied to the information processing system 1 that anonymizes healthcare data and provides the data user 4 .
  • the present invention is not limited thereto.
  • the present invention can be widely applied to various information processing systems other than anonymizing data other than healthcare data and providing it to the data user 4.
  • the present invention can be widely applied to information processing systems that provide data after anonymizing or obscuring information related to privacy.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

[Problem] To propose an anonymized data providing device and method whereby an anonymized data set matching the need of a data user can be provided. [Solution] A data user sets an allowable significance level of a desired statistical amount of a desired attribute regarding a desired data set as a user requirement. An anonymization process is executed a plurality of times for the data set selected by the data user. With respect to each of a plurality of anonymized data sets obtained by the plurality of anonymization process, the statistical amount set by the data user is respectively calculated, the calculated statistical amount of each of the anonymized data sets and the statistical amount of the data set of original data are compared, the anonymized data set of which a difference in the statistical amount satisfies the allowable significance level set by the data user is selected as an anonymized data set satisfying the user requirement, and the selected anonymized data set is provided to the data user.

Description

匿名化データ提供装置及び方法Anonymized data providing apparatus and method
 本発明は、匿名化データ提供装置及び方法に関し、データを二次的に利活用するためにプライバシに関する情報を匿名化又は曖昧化した上でデータを提供する匿名化データ提供システムに適用して好適なものである。 The present invention relates to an anonymized data providing apparatus and method, and is preferably applied to an anonymized data providing system that provides data after anonymizing or obscuring information related to privacy in order to use data secondarily. It is a thing.
 近年、ストレージの低価格化・大規模化及びネットワークの整備といった様々な情報技術の発展に伴い、蓄積される情報量が爆発的に増大してきている。このような状況の下、いわゆるビックデータを利活用しようという動きが活発化している。 In recent years, the amount of information stored has increased explosively with the development of various information technologies such as lower storage costs, larger scale, and network development. Under such circumstances, a movement to utilize so-called big data is activated.
 ところで、ビックデータのうち個人に関する情報の二次的な利用については、プライバシの保護を施した上で利活用することが必要となる。この場合、例えば個人情報を単に削除したり、個人を特定するIDを別のIDに変換するだけでは、条件を組み合わせることによってその人が特定されるリスクが存在する。このため、より安全にプライバシを保護する技術としてk-匿名化技術が広く利用されている。k-匿名化技術は、曖昧化する属性の組み合わせによって、同じ条件となるデータが少なくともk(以下、これをk値と呼ぶ)個以上存在するように元のデータを匿名化する技術である。 By the way, the secondary use of personal information in the big data must be used with privacy protection. In this case, for example, simply deleting personal information or converting an ID that identifies an individual into another ID may cause a risk that the person is identified by combining conditions. For this reason, the k-anonymization technique is widely used as a technique for protecting privacy more safely. The k-anonymization technology is a technology for anonymizing original data so that there are at least k (hereinafter referred to as k values) data having the same condition depending on a combination of obfuscation attributes.
 なおk-匿名化技術を利用した匿名化方法について、例えば特許文献1には、データの加工時(k-匿名化処理時)に各データに対して優先順位を設定し、関数を用いて変形したデータを評価することにより、データ利用者が求める情報を可能な限り保持すると共に、データ利用者が求める情報の欠落を防止する方法が開示されている。 As for the anonymization method using the k-anonymization technology, for example, in Patent Document 1, priorities are set for each data at the time of data processing (during k-anonymization processing), and transformation is performed using a function. A method is disclosed in which the data requested by the data user is retained as much as possible by evaluating the data, and the lack of the information requested by the data user is prevented.
 また特許文献2には、データベース中心のアプリケーションをテストするのに用いられるデータベースの匿名化(k-匿名化、I-多様化など)において、テストへの有用性のある匿名化データベースを作成するために、テストへの影響に応じて準識別子をランク付けする方法が開示されている。 Patent Document 2 discloses an anonymization database useful for testing in anonymizing a database (k-anonymization, I-diversification, etc.) used for testing a database-centric application. Discloses a method for ranking quasi-identifiers according to their impact on testing.
特開2011-113285号公報JP 2011-113285 A 米国特許出願公開第2012/0036135号明細書US Patent Application Publication No. 2012/0036135
 ところで、k-匿名化技術を用いた匿名化処理(以下、適宜、これをk-匿名化処理と呼ぶ)では、k値が大きくなると個人情報の安全性が高くなるが、情報損失量が大きくなる。つまり、k-匿名化処理では、情報の安全性と精度との間にトレードオフの関係がある。 By the way, in the anonymization process using the k-anonymization technique (hereinafter referred to as k-anonymization process as appropriate), the safety of personal information increases as the k value increases, but the amount of information loss increases. Become. In other words, in the k-anonymization process, there is a trade-off relationship between information security and accuracy.
 この場合において、従来のk-匿名化処理では、k値及び情報損失量などの評価指数に基づいて、分析目的に応じたデータ群(例えば、糖尿病患者や高血圧患者のデータ群であり、以下、これをデータセットと呼ぶ)をk-匿名化処理している。このため、かかるk-匿名化処理において、評価指標を上げるためにデータ利用者が優先したい属性(以下、これを優先属性と呼ぶ)が匿名化されてしまい、k-匿名化処理されたデータセット(以下、これを匿名化データセットと呼ぶ)が、データ利用者のニーズに即さないことがあった。 In this case, in the conventional k-anonymization process, based on the evaluation index such as the k value and the amount of information loss, a data group (for example, a data group of a diabetic patient or a hypertension patient, (This is called a data set) is k-anonymized. For this reason, in such k-anonymization processing, the attribute that the data user wants to prioritize in order to increase the evaluation index (hereinafter referred to as priority attribute) is anonymized, and the k-anonymization processing data set (Hereafter, this is called an anonymized data set), but it may not meet the needs of data users.
 このような問題を解決するための1つの方法として、分析対象のデータ群について、データ利用者の優先属性を除いてk-匿名化処理を実行することが考えられる。しかしながら、このような方法によると、優先属性を含めざるを得ない場合に、分析目的により適した匿名化データセットを選択することができない。 As one method for solving such a problem, it is conceivable to perform k-anonymization processing on the data group to be analyzed, excluding the priority attribute of the data user. However, according to such a method, when a priority attribute must be included, an anonymized data set more suitable for analysis purposes cannot be selected.
 本発明は以上の点を考慮してなされたもので、データ利用者のニーズに合致した匿名化データセットを提供し得る匿名化データ提供装置及び方法を提案しようとするものである。 The present invention has been made in view of the above points, and intends to propose an anonymized data providing apparatus and method that can provide an anonymized data set that meets the needs of data users.
 かかる課題を解決するため本発明においては、元データを匿名化処理してデータ利用者に提供する匿名化データ提供装置において、前記元データのデータセットに対して前記匿名化処理を実行する匿名化処理部と、前記匿名化処理部を制御する匿名化データ選択処理部と、匿名化された前記データセットを匿名化データセットとして管理し、前記データ利用者からの要求に応じて、前記匿名化データセットを当該データ利用者に提供するデータ提供部とを設け、前記データ利用者が、所望する前記データセットを選択すると共に、当該データセットについての所望する属性の所望する統計量の許容有意水準を利用者要件として設定し、前記匿名化データ選択処理部が、前記データ利用者により選択された前記データセットに対して複数回の前記匿名化処理を実行するよう前記匿名化処理部を制御し、複数回の前記匿名化処理により得られた複数個の前記匿名化データセットについて、前記データ利用者により設定された前記統計量をそれぞれ算出し、算出した各前記匿名化データセットの前記統計量と、前記元データの前記データセットの当該統計量とをそれぞれ比較し、当該統計量の差異が前記データ利用者が設定した前記許容有意水準を満たす前記匿名化データセットを前記利用者要件を満たす前記匿名化データセットとして選択し、前記データ提供部が、前記匿名化データ選択処理部により選択された前記匿名化データセットを前記データ利用者に提供するようにした。 In order to solve such a problem, in the present invention, in the anonymized data providing apparatus that anonymizes the original data and provides the data user with anonymization, the anonymization is performed on the data set of the original data. A processing unit, an anonymized data selection processing unit that controls the anonymization processing unit, and the anonymized data set are managed as an anonymized data set, and in response to a request from the data user, the anonymization A data providing unit for providing the data set to the data user, and the data user selects the desired data set, and an allowable significance level of a desired statistic of a desired attribute for the data set. Is set as a user requirement, and the anonymized data selection processing unit performs a plurality of times for the data set selected by the data user. The anonymization processing unit is controlled to execute the anonymization process, and the statistics set by the data user are set for the plurality of anonymized data sets obtained by the anonymization process multiple times. Each calculated, the calculated statistic of each anonymized data set is compared with the statistic of the data set of the original data, respectively, the difference of the statistic is the tolerance set by the data user The anonymized data set that satisfies the significance level is selected as the anonymized data set that satisfies the user requirements, and the data providing unit selects the anonymized data set selected by the anonymized data selection processing unit. Provided to users.
 また本発明においては、元データを匿名化処理してデータ利用者に提供する匿名化データ提供装置において実行される匿名化データ提供方法において、前記匿名化データ提供装置に、前記元データのデータセットに対して前記匿名化処理を実行する匿名化処理部と、前記匿名化処理部を制御する匿名化データ選択処理部と、匿名化された前記データセットを匿名化データセットとして管理し、前記データ利用者からの要求に応じて、前記匿名化データセットを当該データ利用者に提供するデータ提供部とを設け、前記データ利用者が、所望する前記データセットを選択すると共に、当該データセットについての所望する属性の所望する統計量の許容有意水準を利用者要件として設定し、前記匿名化データ選択処理部が、前記データ利用者により選択された前記データセットに対して複数回の前記匿名化処理を実行するよう前記匿名化処理部を制御する第1のステップと、前記匿名化データ選択処理部が、複数回の前記匿名化処理により得られた複数個の前記匿名化データセットについて、前記データ利用者により設定された前記統計量をそれぞれ算出する第2のステップと、前記匿名化データ選択処理部が、算出した各前記匿名化データセットの前記統計量と、前記元データの前記データセットの当該統計量とをそれぞれ比較し、当該統計量の差異が前記データ利用者が設定した前記許容有意水準を満たす前記匿名化データセットを前記利用者要件を満たす前記匿名化データセットとして選択する第3のステップと、前記データ提供部が、前記匿名化データ選択処理部により選択された前記匿名化データセットを前記データ利用者に提供する第4のステップとを設けるようにした。 Further, in the present invention, in the anonymized data providing method executed in the anonymized data providing apparatus that anonymizes the original data and provides it to the data user, the anonymized data providing apparatus includes the data set of the original data. The anonymization processing unit that executes the anonymization processing, the anonymization data selection processing unit that controls the anonymization processing unit, and the anonymized data set are managed as an anonymized data set, and the data In response to a request from a user, a data providing unit that provides the anonymized data set to the data user is provided, and the data user selects the desired data set, and An allowable significance level of a desired statistic of a desired attribute is set as a user requirement, and the anonymized data selection processing unit provides the data user with A first step of controlling the anonymization processing unit to execute the anonymization processing a plurality of times on the selected data set, and the anonymization data selection processing unit performs the anonymization a plurality of times For each of the plurality of anonymized data sets obtained by processing, a second step of calculating the statistics set by the data user, and each of the anonymous data calculated by the anonymized data selection processing unit The anonymized data set that compares the statistic of the data set and the statistic of the data set of the original data, and the difference in the statistic satisfies the allowable significance level set by the data user A third step of selecting the anonymized data set satisfying the user requirements and the data providing unit selected by the anonymized data selection processing unit The anonymous data set was provided and a fourth step of providing the data user.
 本匿名化データ提供装置及び方法によれば、データ利用者が設定した利用者要件を満たす匿名化データセットをデータ利用者に提供することができる。 According to the anonymized data providing apparatus and method, an anonymized data set that satisfies the user requirements set by the data user can be provided to the data user.
 本発明によれば、データ利用者のニーズに合致した匿名化データセットを当該データ利用者に提供し得る匿名化データ提要装置及び方法を実現できる。 According to the present invention, it is possible to realize an anonymized data provision device and method that can provide anonymized data set that meets the needs of a data user to the data user.
本実施の形態による匿名化データ提供システムのハードウェア構成を示すブロック図である。It is a block diagram which shows the hardware constitutions of the anonymization data provision system by this Embodiment. 本実施の形態による匿名化データ提供システムの論理構成を示すブロック図である。It is a block diagram which shows the logic structure of the anonymization data provision system by this Embodiment. 元データ及び匿名化前データセットの構成を示す概念図である。It is a conceptual diagram which shows the structure of the original data and the data set before anonymization. プライバシ保護条件テーブルの構成を示す概念図である。It is a conceptual diagram which shows the structure of a privacy protection condition table. 匿名化データセットの構成を示す概念図である。It is a conceptual diagram which shows the structure of an anonymization data set. データカタログ情報の構成を示す概念図である。It is a conceptual diagram which shows the structure of data catalog information. データカタログ選択画面の構成を略線的に示す略線図である。It is an approximate line figure showing the composition of a data catalog selection screen roughly. 統計量強化項目指定画面の構成を略線的に示す略線図である。It is an approximate line figure showing the composition of a statistic strengthening item specification screen roughly. 匿名化データセットの提供に関する処理の流れを示すラダーチャートである。It is a ladder chart which shows the flow of the process regarding provision of an anonymization data set. 統計量強化匿名化データ選択処理の処理手順を示すフローチャートである。It is a flowchart which shows the process sequence of a statistic reinforcement | strengthening anonymization data selection process. k値可変統計量強化処理の処理手順を示すフローチャートである。It is a flowchart which shows the process sequence of k value variable statistics reinforcement | strengthening process. k値固定統計量強化処理の処理手順を示すフローチャートである。It is a flowchart which shows the process sequence of k value fixed statistics reinforcement | strengthening process. k値固定統計量強化処理の処理手順を示すフローチャートである。It is a flowchart which shows the process sequence of k value fixed statistics reinforcement | strengthening process. k-匿名化パラメータ群の一例を示す図表である。10 is a chart showing an example of a k-anonymization parameter group.
 以下図面について、本発明の一実施の形態を詳述する。 Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.
(1)本実施の形態による情報処理システムの構成
 図1において、1は全体として本実施の形態による情報処理システムを示す。この情報処理システム1は、元データ提供者2が提供するデータ(以下、これを元データと呼ぶ)をデータ収集・管理・提供者3が収集すると共に、収集した元データをk-匿名化処理した上で管理し、k-匿名化処理した元データをデータ利用者4からの要求に応じてデータ収集・管理・提供者3が提供するシステムである。
(1) Configuration of Information Processing System According to this Embodiment In FIG. 1, reference numeral 1 denotes an information processing system according to this embodiment as a whole. In this information processing system 1, the data collection / management / provider 3 collects data provided by the original data provider 2 (hereinafter referred to as original data), and the collected original data is k-anonymized. In this system, the original data managed and k-anonymized is provided by the data collection / management / provider 3 in response to a request from the data user 4.
 この情報処理システム1は、図1に示すように、元データ提供者2の情報処理装置20と、データ収集・管理・提供者3の匿名化データ提供システム30を構成するデータ準備装置31とが第1のネットワーク10を介して接続され、当該匿名化データ提供システム30を構成するデータ提供装置32と、データ利用者4のクライアント端末40とが第2のネットワーク11を介して接続されて構成されている。 As shown in FIG. 1, the information processing system 1 includes an information processing device 20 of an original data provider 2 and a data preparation device 31 that constitutes an anonymized data providing system 30 of a data collection / management / provider 3. The data providing apparatus 32 connected through the first network 10 and constituting the anonymized data providing system 30 is connected to the client terminal 40 of the data user 4 through the second network 11. ing.
 情報処理装置20は、CPU(Central Processing Unit)21、メモリ22及びハードディスク装置(HDD:Hard Disc Drive)23と、入力装置24及びモニタ25となどを備えたパーソナルコンピュータ等から構成される。そして、ハードディスク装置23には元データが蓄積されており、この元データが第1のネットワーク10を介して匿名化データ提供システム30のデータ準備装置31に収集される。 The information processing apparatus 20 includes a personal computer including a CPU (Central Processing Unit) 21, a memory 22, a hard disk device (HDD: Hard Disc Drive) 23, an input device 24, a monitor 25, and the like. Original data is accumulated in the hard disk device 23, and this original data is collected by the data preparation device 31 of the anonymized data providing system 30 via the first network 10.
 データ準備装置31は、CPU33、メモリ34及びハードディスク装置35などを備えたパーソナルコンピュータ等から構成される。データ準備装置31は、各元データ提供者2の情報処理装置20から収集した元データに対してk-匿名化処理を施す。そしてデータ準備装置31は、かかるk-匿名化処理により得られた匿名化データをデータ提供装置32に送信する。 The data preparation device 31 includes a personal computer including a CPU 33, a memory 34, a hard disk device 35, and the like. The data preparation device 31 performs k-anonymization processing on the original data collected from the information processing device 20 of each original data provider 2. The data preparation device 31 transmits the anonymized data obtained by the k-anonymization process to the data providing device 32.
 データ提供装置32は、データ準備装置31と同様に、CPU36、メモリ37及びハードディスク装置38などを備えたパーソナルコンピュータ等から構成される。データ提供装置32は、データ準備装置31から送信される匿名化データをハードディスク装置38に格納して保持し、保持した匿名化データをクライアント端末40を利用したデータ利用者4からの要求に応じてそのデータ利用者4に提供する。 As with the data preparation device 31, the data provision device 32 includes a personal computer including a CPU 36, a memory 37, a hard disk device 38, and the like. The data providing device 32 stores and holds the anonymized data transmitted from the data preparation device 31 in the hard disk device 38, and the held anonymized data in response to a request from the data user 4 using the client terminal 40. The data user 4 is provided.
 クライアント端末40も、CPU41、メモリ42及びハードディスク装置43と、入力装置44及びモニタ45となどを備えたパーソナルコンピュータ等から構成される。クライアント端末40は、データ利用者4の操作に応じて第2のネットワーク11を介して匿名化データ提供システム30のデータ提供装置32にアクセスし、データ提供装置32から提供される匿名化データをダウンロードしてハードディスク装置43に記憶する。 The client terminal 40 is also composed of a personal computer or the like provided with a CPU 41, a memory 42, a hard disk device 43, an input device 44, a monitor 45, and the like. The client terminal 40 accesses the data providing device 32 of the anonymized data providing system 30 via the second network 11 according to the operation of the data user 4 and downloads the anonymized data provided from the data providing device 32. And stored in the hard disk device 43.
 図2は、本情報処理システム1の論理構成を示す。本実施の形態においては、データ収集・管理・提供者3が収集、管理及び提供する元データとしてヘルスケアデータを想定しており、元データ提供者2として、図2に示すように、ヘルスケアデータを管理する病院や、薬局、診療所、健康保険組合、バイオバンク及び又は家庭などを想定している。ただし、ヘルスケアデータは、本来個人のものであるため、元データ提供者2としては、個人そのものを想定し、個人からヘルスケアデータを直接収集することを想定しても良い。 FIG. 2 shows a logical configuration of the information processing system 1. In the present embodiment, healthcare data is assumed as the original data collected, managed, and provided by the data collection / management / provider 3, and the former data provider 2 is shown in FIG. The data management hospitals, pharmacies, clinics, health insurance associations, biobanks and / or households are assumed. However, since the health care data is originally an individual, the original data provider 2 may be assumed to be the individual itself and to collect the health care data directly from the individual.
 また本実施の形態においては、データ利用者4として、病院や保険所、厚生労働省などの行政機関、健康保険組合などの主に公的な役割をもつ機関だけでなく、製薬企業や、食品企業及び美容企業などの私企業も想定している。 In this embodiment, the data user 4 is not only a hospital, an insurance station, an administrative organization such as the Ministry of Health, Labor and Welfare, or an organization having a public role such as a health insurance association, but also a pharmaceutical company or a food company. It also assumes private companies such as beauty companies.
 データ準備装置31は、メモリ34(図1)に格納されたデータ収集・名寄せ処理部50、匿名化処理部51及び統計量強化匿名化データ選択処理部52と、ハードディスク装置35(図1)に格納された元データデータベース53及び匿名化条件データベース54とを備えて構成される。 The data preparation device 31 stores the data collection / name identification processing unit 50, the anonymization processing unit 51, the statistical quantity strengthened anonymization data selection processing unit 52, and the hard disk device 35 (FIG. 1) stored in the memory 34 (FIG. 1). The stored original data database 53 and anonymization condition database 54 are provided.
 データ収集・名寄せ処理部50は、元データ提供者2の情報処理装置20(図1)から元データ(ヘルスケアデータ)を収集し、収集した元データを元データデータベース53に格納する機能を有するプログラムである。またデータ収集・名寄せ処理部50は、複数の元データ提供者2に跨って一人の元データが存在する場合に、これらの元データを一人の元データとして纏める名寄せ処理をも実行する。 The data collection / name identification processing unit 50 has a function of collecting original data (health care data) from the information processing apparatus 20 (FIG. 1) of the original data provider 2 and storing the collected original data in the original data database 53. It is a program. Further, the data collection / name identification processing unit 50 also executes a name identification process for collecting the original data as one original data when one original data exists across a plurality of original data providers 2.
 なおデータ準備装置31が元データ提供者2からデータを収集するタイミングは、元データ提供者2にてデータが更新されるごとに行っても良く、また一日に一度、夜間に1日分の更新分を収集するようにしても良い。また元データは情報処理装置20からデータ準備装置31に送信するようにしても、又は、データ準備装置31から各情報処理装置20に取りに行くようにしても良い。 The data preparation device 31 may collect data from the original data provider 2 every time the data is updated by the original data provider 2, or once a day for one day at night. Updates may be collected. The original data may be transmitted from the information processing apparatus 20 to the data preparation apparatus 31 or may be retrieved from the data preparation apparatus 31 to each information processing apparatus 20.
 匿名化処理部51は、匿名化条件データベース54に格納されたプライバシ保護条件テーブル56を参照しながら、元データデータベース53に格納された元データに対して個人情報の匿名化を行う機能を有するプログラムである。匿名化処理部51は、例えば糖尿病患者の元データ又は高血圧患者の元データなど、関連する複数の元データを纏めて1つのデータセット(以下、これを匿名化前データセットと呼ぶ)55を生成し、生成した匿名化前データセット55に対してk-匿名化処理を施すことにより、匿名化データセット64を生成する。そして匿名化処理部51は、このようにして生成した匿名化データセット64のデータをデータ提供装置32に送信する。 The anonymization processing unit 51 has a function of anonymizing personal information with respect to the original data stored in the original data database 53 while referring to the privacy protection condition table 56 stored in the anonymization condition database 54. It is. The anonymization processing unit 51 generates a single data set (hereinafter referred to as a pre-anonymization data set) 55 by collecting a plurality of related original data such as diabetes patient original data or hypertension patient original data, for example. Then, an anonymized data set 64 is generated by performing k-anonymization processing on the generated pre-anonymized data set 55. Then, the anonymization processing unit 51 transmits the data of the anonymization data set 64 generated in this way to the data providing device 32.
 統計量強化匿名化データ選択処理部52は、データ利用者4からの要求に応じて、そのデータ利用者4により指定された匿名化前データセット55について、k値や匿名化処理時のパラメータを変えながら複数回のk-匿名化処理を匿名化処理部51に実行させる機能を有するプログラムである。また統計量強化匿名化データ選択処理部52は、かくして得られた複数の匿名化データセット64の中から、データ利用者4が指定した属性(生年月日、入院日又は退院日など)についての当該データ利用者4が指定した統計量(平均、分散又は相関係数など)が当該データ利用者4が指定した許容される有意水準(以下、これを許容有意水準と呼ぶ)の範囲内にある匿名化データセット64のうち、安全性が最も高い匿名化データセット(例えばk値が最も大きい匿名化データセット)をデータ提供装置32に提供する。統計量強化匿名化データ選択処理部52の詳細については、後述する。 In response to a request from the data user 4, the statistic-enhanced anonymized data selection processing unit 52 sets the k value and anonymization process parameters for the pre-anonymization data set 55 specified by the data user 4. This is a program having a function of causing the anonymization processing unit 51 to execute a plurality of k-anonymization processes while changing. In addition, the statistic-enhanced anonymized data selection processing unit 52 selects the attribute (birth date, hospitalization date, discharge date, etc.) designated by the data user 4 from the plurality of anonymized data sets 64 thus obtained. The statistic (average, variance, correlation coefficient, etc.) specified by the data user 4 is within the allowable significance level specified by the data user 4 (hereinafter referred to as the allowable significance level). Of the anonymized data set 64, the anonymized data set having the highest safety (for example, the anonymized data set having the largest k value) is provided to the data providing device 32. Details of the statistic strengthening anonymized data selection processing unit 52 will be described later.
 元データデータベース53は、元データを保持及び管理するために利用されるデータベースであり、データ準備装置31が各元データ提供者2からそれぞれ収集した元データが順次登録される。上述のように本実施の形態においては、元データとしてヘルスケアデータを想定しており、このため個々の元データは、図3に示すように、患者ID、患者氏名、患者生年月日、入院日及び退院日などのその人の属性情報と、その人の検査値となどを含む。図3においては、1つの行が一人の元データに対応しており、図3全体で上述の匿名化前データセット55を表している。 The original data database 53 is a database used for holding and managing the original data, and the original data collected by the data preparation device 31 from each original data provider 2 is sequentially registered. As described above, in the present embodiment, healthcare data is assumed as the original data. Therefore, as shown in FIG. 3, the individual original data includes the patient ID, the patient name, the patient birth date, and the hospitalization. The attribute information of the person such as date and discharge date, the test value of the person, and the like are included. In FIG. 3, one row corresponds to one person's original data, and the above-described pre-anonymization data set 55 is shown in FIG. 3 as a whole.
 匿名化条件データベース54には、プライバシ保護条件テーブル56が格納される。プライバシ保護条件テーブル56は、予めデータ収集・管理・提供者3により設定された、元データに含まれる個人情報の所有者である個人のプライバシを保護するための条件を管理するために利用されるテーブルであり、図4に示すように、個人情報範囲欄56A、削除項目欄56B、変更項目欄56C、保護項目欄56D及びk値最小値欄56Eを備えて構成される。 In the anonymization condition database 54, a privacy protection condition table 56 is stored. The privacy protection condition table 56 is used to manage conditions for protecting the privacy of the individual who is the owner of the personal information included in the original data, which is set in advance by the data collection / management / provider 3. As shown in FIG. 4, the table includes a personal information range column 56A, a deletion item column 56B, a change item column 56C, a protection item column 56D, and a k value minimum value column 56E.
 そして個人情報範囲欄56Aには、データ準備装置31が元データ提供者2の情報処理装置20から収集した元データに含まれる情報のうち、ID、名前、住所及び電話番号等の個人情報として取り扱うべき個々のデータ項目の名称(以下、これを項目名と呼ぶ)がすべて格納される。 In the personal information range column 56A, the data preparation device 31 handles personal information such as ID, name, address, and telephone number among the information included in the original data collected from the information processing device 20 of the original data provider 2. All the names of individual data items (hereinafter referred to as item names) are stored.
 また削除項目欄56Bには、かかる個人情報として取り扱うべきデータ項目のうち、個人のプライバシを保護するためにデータ利用者4には提供しない、つまりk-匿名化処理の際に削除される各データ項目(以下、これを削除項目と呼ぶ)の項目名が格納される。 Further, in the deletion item column 56B, among the data items that should be handled as such personal information, each data that is not provided to the data user 4 in order to protect personal privacy, that is, deleted in the k-anonymization process. Stores the item name of an item (hereinafter referred to as a deletion item).
 さらに変更項目欄56Cには、内容を変更してデータ利用者4に提供可能な各データ項目(以下、これを変更項目と呼ぶ)の項目名が格納される。図4の例では変更項目が設定されていないが、例えば個人を特定するIDを別のIDに変換すればプライバシを保護した状態でデータを提供できる場合には、変更項目としてIDを設定する。 Further, the change item column 56C stores the item names of the respective data items (hereinafter referred to as change items) that can be provided to the data user 4 by changing the contents. In the example of FIG. 4, no change item is set. For example, if data can be provided in a state in which privacy is protected by converting an ID for identifying an individual into another ID, the ID is set as the change item.
 さらに保護項目欄56Dには、k-匿名化の対象となり得る準識別子と呼ばれるデータ項目(以下、これを保護項目と呼ぶ)の項目名が格納され、k値最小値欄56Eには、匿名化処理部51が実行するk-匿名化処理におけるk値の最小値(以下、これをk値最小値と呼ぶ)が格納される。このk値最小値は、予めデータ収集・管理・提供者3により設定される。 Furthermore, the protection item column 56D stores the item name of a data item called a quasi-identifier (hereinafter referred to as a protection item) that can be the target of k-anonymization, and the k value minimum value column 56E stores anonymization. The minimum value of the k value in the k-anonymization process executed by the processing unit 51 (hereinafter referred to as the “k value minimum value”) is stored. This minimum k value is set in advance by the data collection / management / provider 3.
 なお個人情報範囲として設定された各データ項目は、それぞれ削除項目、変換項目及び保護項目のいずれかに設定される。ただし、個人情報範囲として設定されていないデータ項目が削除項目、変更項目及び又は保護項目として設定されていても良い。 Note that each data item set as the personal information range is set as one of a deletion item, a conversion item, and a protection item. However, data items that are not set as personal information ranges may be set as deleted items, changed items, and / or protected items.
 また個人のプライバシを保護するための条件は、法律やガイドラインに依存するため、国によって定義が変わることがあるほか、時代によっても変化することがある。このような場合には、複数のプライバシ保護条件テーブル56を用意しておいても良い。例えば、複数の国に存在するデータ利用者4に対し、後述のようにデータ提供装置32の匿名化データベース60に格納された匿名化データセット64を提供する場合には、データ利用者4がアクセスしている国に対応するプライバシ保護条件テーブル56を選択して、提供する匿名化データセット64を変更するようにしても良い。 Also, the conditions for protecting personal privacy depend on laws and guidelines, so the definition may change depending on the country, and may change depending on the times. In such a case, a plurality of privacy protection condition tables 56 may be prepared. For example, when providing the anonymization data set 64 stored in the anonymization database 60 of the data providing device 32 to the data user 4 existing in a plurality of countries as described later, the data user 4 accesses The privacy protection condition table 56 corresponding to the country in question may be selected and the anonymized data set 64 to be provided may be changed.
 一方、データ提供装置32は、ハードディスク装置38(図1)に格納された匿名化データベース60、データカタログ情報61及び利用条件情報62と、メモリ37(図1)に格納されたデータ提供管理部63とを備えて構成される。 On the other hand, the data providing device 32 includes an anonymization database 60, data catalog information 61 and usage condition information 62 stored in the hard disk device 38 (FIG. 1), and a data provision management unit 63 stored in the memory 37 (FIG. 1). And is configured.
 匿名化データベース60は、データ準備装置31の匿名化処理部51により作成された匿名化データセット64を保持及び管理するために利用されるデータベースであり、複数の匿名化データセット64が格納される。なお匿名化データセット64のデータ構造の一例を図5に示す。図5は、患者ID・患者氏名等の削除項目を削除し、保護項目である患者住所及び患者年齢を匿名化するk-匿名化処理(k=2)が施された場合の一例である。 The anonymization database 60 is a database used for holding and managing the anonymization data set 64 created by the anonymization processing unit 51 of the data preparation device 31, and stores a plurality of anonymization data sets 64. . An example of the data structure of the anonymized data set 64 is shown in FIG. FIG. 5 shows an example in which a deletion item such as a patient ID and a patient name is deleted, and k-anonymization processing (k = 2) is performed to anonymize a patient address and a patient age as protection items.
 またデータカタログ情報61は、データ提供装置32がデータ利用者4に提供可能な各匿名化データセット64の概要を表す情報であり、例えば図6に示すようなテーブル構成を有する。図6に示すデータカタログでは、1つのレコード(行)が1つの匿名化データセット64に対応しており、これらレコードがそれぞれデータセットID欄61A、匿名化データ項目欄61B、一般データ項目欄61C、k値欄61D及び損失統計量欄61Eなどから構成される。 Further, the data catalog information 61 is information representing an outline of each anonymized data set 64 that can be provided to the data user 4 by the data providing device 32, and has, for example, a table configuration as shown in FIG. In the data catalog shown in FIG. 6, one record (row) corresponds to one anonymized data set 64, and these records are a data set ID column 61A, an anonymized data item column 61B, and a general data item column 61C, respectively. , K value column 61D, loss statistic column 61E, and the like.
 そしてデータセットID欄61Aには、対応する匿名化データセット64に対して付与されたその匿名化データセット64に固有の識別子(データセットID)が格納され、匿名化データ項目欄61Bには、対応する匿名化データセット64において匿名化されたすべてのデータ項目の項目名がそれぞれ格納される。 In the data set ID column 61A, an identifier (data set ID) unique to the anonymized data set 64 assigned to the corresponding anonymized data set 64 is stored, and in the anonymized data item column 61B, The item names of all data items that are anonymized in the corresponding anonymized data set 64 are stored.
 また一般データ項目欄61Cには、対応する匿名化データセット64において匿名化されていないすべてのデータ項目の項目名がそれぞれ格納され、k値欄61Dには、対応する匿名化データセット64におけるk値の値が格納される。さらに損失統計量欄61Eには、対応する匿名化データセット64における損失情報量(I.L)と、その匿名化データセット64の平均、分散及び相関関数などの各種統計量とがそれぞれ格納される。 The general data item column 61C stores the item names of all data items that are not anonymized in the corresponding anonymized data set 64, respectively, and the k value column 61D stores k in the corresponding anonymized data set 64. The value value is stored. Further, the loss statistics column 61E stores the loss information amount (I.L) in the corresponding anonymized data set 64 and various statistics such as the average, variance, and correlation function of the anonymized data set 64.
 利用条件情報62は、利用者要件テーブル65を備えて構成される。利用者要件テーブル65には、図8について後述する統計量強化項目指定画面80を用いてデータ利用者4により設定された、いずれかの匿名化データセット64についてそのデータ利用者4が設定した要件(以下、これを利用者要件と呼ぶ)が登録される。具体的には、データ利用者4が指定した匿名化データセット64について、そのデータ利用者4が指定した属性(生年月日又は入退院日などであり、以下、これを対象属性と呼ぶ)の当該データ利用者4が指定した統計量(平均、分散又は相関係数などであり、以下、これを対象統計量と呼ぶ)が当該データ利用者4が指定した許容有意水準を満たすべきことが利用者要件として設定される。 The usage condition information 62 includes a user requirement table 65. In the user requirement table 65, the requirements set by the data user 4 for any anonymized data set 64 set by the data user 4 using the statistics strengthening item designation screen 80 described later with reference to FIG. (Hereinafter referred to as user requirements) is registered. Specifically, for the anonymized data set 64 specified by the data user 4, the attribute specified by the data user 4 (the date of birth or hospital discharge date, etc., hereinafter referred to as a target attribute) A user that a statistic specified by the data user 4 (mean, variance, correlation coefficient, etc., hereinafter referred to as a target statistic) should satisfy the allowable significance level specified by the data user 4 Set as a requirement.
 データ提供管理部63は、データ利用者4からの要求に応じて、当該データ利用者4により指定された匿名化データセット64をそのデータ利用者4に提供する機能を有するプログラムである。実際上、データ提供管理部63は、データ利用者4からの要求に応じて、データカタログ情報61の内容が掲載された図7について後述するデータセット選択画面70をそのデータ利用者4に表示させる。そしてデータ提供管理部63は、そのデータセット選択画面70を用いてデータ利用者4により購入希望の匿名化データセット64が指定されると、その匿名化データセット64のデータを匿名化データベース60から読み出してそのデータ利用者4に提供する。 The data provision management unit 63 is a program having a function of providing the data user 4 with the anonymized data set 64 designated by the data user 4 in response to a request from the data user 4. In practice, in response to a request from the data user 4, the data provision management unit 63 causes the data user 4 to display a data set selection screen 70 described later with reference to FIG. . Then, when the anonymized data set 64 desired to be purchased is designated by the data user 4 using the data set selection screen 70, the data provision management unit 63 transfers the data of the anonymized data set 64 from the anonymized database 60. It is read out and provided to the data user 4.
(2)各種画面の構成
 図7は、データ提供装置32から送信される画面データに基づきクライアント端末40(図1)に表示されるデータセット選択画面70の構成を示す。このデータセット選択画面70は、データ利用者4がデータ収集・管理・提供者3から匿名化データセット64を購入するに際して、購入対象の匿名化データセット64を選択するための画面である。
(2) Configuration of Various Screens FIG. 7 shows the configuration of the data set selection screen 70 displayed on the client terminal 40 (FIG. 1) based on the screen data transmitted from the data providing device 32. The data set selection screen 70 is a screen for selecting the anonymized data set 64 to be purchased when the data user 4 purchases the anonymized data set 64 from the data collection / management / provider 3.
 このデータセット選択画面70は、データ提供装置32が提供可能な匿名化データセット64がすべて掲載された匿名化データセット一覧71と、購入ボタン72、次へボタン73及びキャンセルボタン74とを備えて構成される。 The data set selection screen 70 includes an anonymized data set list 71 in which all anonymized data sets 64 that can be provided by the data providing device 32 are posted, a purchase button 72, a next button 73, and a cancel button 74. Composed.
 匿名化データセット一覧71は、1つのレコード(行)が1つの匿名化データセット64に対応しており、これらレコードがそれぞれチェックボックス欄71A、データセットID欄71B、匿名化データ項目欄71C、一般データ項目欄71D、k値欄71E及び損失統計量欄71Fなどから構成される。 In the anonymized data set list 71, one record (row) corresponds to one anonymized data set 64, and these records are respectively a check box column 71A, a data set ID column 71B, an anonymized data item column 71C, A general data item column 71D, a k value column 71E, a loss statistic column 71F, and the like are included.
 そして各レコードのチェックボックス欄71Aには、それぞれチェックボックス71AXが表示される。またデータセットID欄71B、匿名化データ項目欄71C、一般データ項目欄71D、k値欄71E及び損失統計量欄71F等には、それぞれ図6について上述したデータカタログ情報61の対応するデータセットID欄61A、匿名化データ項目欄61B、一般データ項目欄61C、k値欄61D又は損失統計量欄61E等に格納された情報と同じ情報が格納される。 Then, a check box 71AX is displayed in the check box column 71A of each record. Further, in the data set ID column 71B, the anonymized data item column 71C, the general data item column 71D, the k value column 71E, the loss statistic column 71F, etc., the corresponding data set ID of the data catalog information 61 described above with reference to FIG. The same information as that stored in the column 61A, the anonymized data item column 61B, the general data item column 61C, the k value column 61D, the loss statistic column 61E, or the like is stored.
 そしてデータセット選択画面70では、匿名化データセット一覧71に掲載された匿名化データセット64の中から所望する匿名化データセット64に対応するチェックボックス71AXをクリックすることによりその匿名化データセット64を購入対象として選択することができる。この場合、そのチェックボックス71AX内にチェックマーク71AYが表示される。 On the data set selection screen 70, the anonymized data set 64 is clicked by clicking the check box 71AX corresponding to the desired anonymized data set 64 from the anonymized data sets 64 posted in the anonymized data set list 71. Can be selected for purchase. In this case, a check mark 71AY is displayed in the check box 71AX.
 またデータセット選択画面70では、上述のようにして所望する匿名化データセット64を選択した後に購入ボタン72をクリックすることによって、その匿名化データセット64を購入することができる。この場合、データ利用者4によって購入された匿名化データセット64のデータがデータ提供装置32からそのデータ利用者4のクライアント端末40(図1)に送信される。なおデータセット選択画面70は、キャンセルボタン74をクリックすることによって閉じることができる。 In the data set selection screen 70, the anonymized data set 64 can be purchased by clicking the purchase button 72 after selecting the desired anonymized data set 64 as described above. In this case, the data of the anonymized data set 64 purchased by the data user 4 is transmitted from the data providing device 32 to the client terminal 40 of the data user 4 (FIG. 1). The data set selection screen 70 can be closed by clicking the cancel button 74.
 一方、データセット選択画面70において、上述のようにして購入対象の匿名化データセット64を選択した上で次へボタン73をクリックすることによって、図8に示す統計量強化項目指定画面80を開くことができる。統計量強化項目指定画面80は、データセット選択画面70において選択した匿名化データセット64について、データ利用者4が希望する利用者要件を設定するための画面である。 On the other hand, on the data set selection screen 70, the anonymized data set 64 to be purchased is selected as described above, and the next button 73 is clicked to open the statistics strengthening item designation screen 80 shown in FIG. be able to. The statistic strengthening item designation screen 80 is a screen for setting user requirements desired by the data user 4 for the anonymized data set 64 selected on the data set selection screen 70.
 この統計量強化項目指定画面80には、対象データセットID表示欄80Aが設けられており、データセット選択画面70(図7)においてデータ利用者4が選択した匿名化データセット64のデータセットIDがこの対象データセットID表示欄80Aに表示される。 The statistics strengthening item designation screen 80 has a target data set ID display field 80A, and the data set ID of the anonymized data set 64 selected by the data user 4 on the data set selection screen 70 (FIG. 7). Is displayed in the target data set ID display field 80A.
 また対象データセットID表示欄80Aの下段には、データ利用者4が重要と考えている対象属性(つまりデータ利用者4がデータ収集・管理・提供者3から購入する匿名化データセット64に含まれる情報の中で得に利用したいと考えているデータ項目)を指定するための複数のテキストボックス(以下、これらを対象属性指定テキストボックスと呼ぶ)80Bが設けられると共に、これらの対象属性指定テキストボックス80Bにそれぞれ対応させて、対象統計量を指定するためのテキストボックス(以下、これらを対象統計量指定テキストボックスと呼ぶ)80Cと、許容有意水準を指定するためのテキストボックス(以下、これを許容有意水準指定テキストボックスと呼ぶ)80Dとが設けられている。 The lower part of the target data set ID display column 80A includes target attributes that the data user 4 considers important (that is, the anonymized data set 64 that the data user 4 purchases from the data collection / management / provider 3). Are provided with a plurality of text boxes (hereinafter referred to as target attribute designating text boxes) 80B for designating the data items that are desired to be used in the information to be used. A text box for designating a target statistic (hereinafter referred to as a target statistic designation text box) 80C and a text box for designating an allowable significance level (hereinafter referred to as this) corresponding to each of the boxes 80B. 80D) (referred to as an allowable significance level designation text box).
 かくしてデータ利用者4は、統計量強化項目指定画面80の対象属性指定テキストボックス80Bに対象属性の属性名(データ項目の項目名)を入力すると共に、その対象属性指定テキストボックス80Bと対応付けられた(本実施の形態においては下側に表示された)対象統計量指定テキストボックス80C及び許容有意水準指定テキストボックス80Dに所望する統計量及び許容有意水準をそれぞれ入力することによって、対象データセットID表示欄80AにデータセットIDが格納された匿名化データセット64についての所望する利用者要件を設定することができる。例えば図8の例では、「生年月日」という対象属性(データ項目)については、「平均」が「5%」の有意水準を満たすべきことが設定された状態を示している。 Thus, the data user 4 inputs the attribute name of the target attribute (the item name of the data item) in the target attribute specification text box 80B of the statistics strengthening item specification screen 80 and is associated with the target attribute specification text box 80B. The target data set ID is entered by inputting the desired statistic and the allowable significance level into the target statistic specification text box 80C and the allowable significance level specification text box 80D (displayed at the lower side in the present embodiment). Desired user requirements for the anonymized data set 64 in which the data set ID is stored in the display field 80A can be set. For example, the example of FIG. 8 shows a state in which “average” should be set to satisfy the significance level of “5%” for the target attribute (data item) “birth date”.
 また統計量強化項目指定画面80には、k-匿名化処理時においてk値を可変とするか又は固定とするかを選択するための2つのトグルスイッチ80EX,80EYが設けられている。これら2つのトグルスイッチ80EX,80EYのうち一方はk値を可変とする設定に対応付けられ、他方はk値を固定する設定に対応付けられており、これら2つのトグルスイッチ80EX,80EYのうちの所望するトグルスイッチ80EX,80EYをクリックすることによって、対応する設定(可変又は固定)を選択することができるようになされている。 Also, the statistics enhancement item designation screen 80 is provided with two toggle switches 80EX and 80EY for selecting whether the k value is variable or fixed during the k-anonymization process. One of these two toggle switches 80EX and 80EY is associated with a setting that makes the k value variable, and the other is associated with a setting that fixes the k value, and of these two toggle switches 80EX and 80EY, By clicking the desired toggle switches 80EX and 80EY, the corresponding setting (variable or fixed) can be selected.
 さらに統計量強化項目指定画面80には、k値の最大値を指定するためのテキストボックス(以下、これをk値最大値指定テキストボックスと呼ぶ)80Fが設けられている。かくしてデータ利用者4は、図10について後述する統計量強化匿名化データ選択処理においてk値を順次1ずつ増加させながら繰り返し実行されるk-匿名化処理におけるk値の最大値をk値最大値指定テキストボックス80Fに入力することにより設定することができる。 Further, the statistic strengthening item designation screen 80 is provided with a text box (hereinafter referred to as a k value maximum value designation text box) 80F for designating the maximum k value. Thus, the data user 4 determines the maximum value of the k value in the k-anonymization process that is repeatedly executed while sequentially increasing the k value by 1 in the statistics-enhanced anonymized data selection process described later with reference to FIG. It can be set by inputting in the designated text box 80F.
 さらに統計量強化項目指定画面80の下段には、OKボタン80G及びキャンセルボタン80Hが表示される。そして統計量強化項目指定画面80では、キャンセルボタン80Hをクリックすることによって、当該統計量強化項目指定画面80を閉じることができ、上述のようにして所望する匿名化データセット64ついて所望する利用者要件を設定した上でOKボタン80Gをクリックすることによって、当該統計量強化項目指定画面80において設定された内容に応じた匿名化データセット64を匿名化データ提供システム30(図2)に作成させることができる。 Furthermore, an OK button 80G and a cancel button 80H are displayed in the lower part of the statistics strengthening item designation screen 80. On the statistics strengthening item designation screen 80, the statistics strengthening item designation screen 80 can be closed by clicking the cancel button 80H, and the desired user for the desired anonymized data set 64 as described above. Clicking the OK button 80G after setting the requirements causes the anonymized data providing system 30 (FIG. 2) to create an anonymized data set 64 according to the contents set on the statistics strengthening item designation screen 80. be able to.
(3)匿名化データセットの提供に関する処理の流れ
 図9は、本情報処理システム1において、所望する匿名化データセット64について所望する利用者要件をデータ利用者4が設定し、その利用者要件を満たす匿名化データセット64を匿名化データ提供システム30が作成し、作成したその匿名化データセット64をデータ利用者4が購入するまでの一連の処理の流れを示す。
(3) Flow of processing relating to provision of anonymized data set FIG. 9 shows that the data user 4 sets desired user requirements for the desired anonymized data set 64 in the information processing system 1, and the user requirements An anonymized data set 64 that satisfies the above condition is created by the anonymized data providing system 30, and a flow of a series of processes until the data user 4 purchases the created anonymized data set 64 is shown.
 この一連の処理は、データ利用者4が、自己のクライアント端末40(図1)を用いて匿名化データ提供システム30のデータ提供装置32にアクセスし、データカタログ情報61(図2)に基づくデータカタログの提示をリクエストすることにより開始される(SP1)。 In this series of processing, the data user 4 accesses the data providing device 32 of the anonymized data providing system 30 using his / her client terminal 40 (FIG. 1), and data based on the data catalog information 61 (FIG. 2). It starts by requesting the presentation of a catalog (SP1).
 データ提供装置32は、かかるリクエストを受信すると、図7について上述したデータセット選択画面70の画面データをそのデータ利用者4のクライアント端末40に送信することにより、当該データセット選択画面70をそのクライアント端末40に表示させる(SP2)。 Upon receiving such a request, the data providing apparatus 32 transmits the screen data of the data set selection screen 70 described above with reference to FIG. 7 to the client terminal 40 of the data user 4 so that the data set selection screen 70 is displayed on the client. It is displayed on the terminal 40 (SP2).
 クライアント端末40は、データセット選択画面70においてデータ利用者4が所望する匿名化データセット64を選択した上で次へボタン73(図7)をクリックすると、そのとき選択された匿名化データセット64をクライアント端末40からデータ提供装置32に通知する(SP3)。 When the client terminal 40 selects the anonymized data set 64 desired by the data user 4 on the data set selection screen 70 and clicks the next button 73 (FIG. 7), the anonymized data set 64 selected at that time is selected. Is notified from the client terminal 40 to the data providing device 32 (SP3).
 データ提供装置32は、かかる通知を受信すると、図8について上述した統計量強化項目指定画面80の画面データをその通知の送信元のクライアント端末40に送信することにより、当該統計量強化項目指定画面80をそのクライアント端末40に表示させる(SP4)。 Upon receiving such notification, the data providing device 32 transmits the screen data of the statistics enhancement item designation screen 80 described above with reference to FIG. 8 to the client terminal 40 that is the transmission source of the notification, thereby the statistics enhancement item designation screen. 80 is displayed on the client terminal 40 (SP4).
 そしてクライアント端末40は、データ利用者4が統計量強化項目指定画面80において、対象属性、対象統計量、許容有意水準、k値の自由度及びk値の最大値などを設定した後にOKボタン80G(図8)をクリックすると、これらの設定内容を利用者要件情報としてデータ提供装置32に送信する(SP5)。 Then, after the data user 4 sets the target attribute, the target statistic, the allowable significance level, the degree of freedom of the k value, the maximum value of the k value, and the like on the statistics strengthening item designation screen 80, the client terminal 40 determines the OK button When (FIG. 8) is clicked, these setting contents are transmitted to the data providing apparatus 32 as user requirement information (SP5).
 データ提供装置32は、かかる利用者要件情報を受信すると、受信した利用者要件情報に基づいて利用条件情報62(図2)の利用者要件テーブル65を更新する(SP6)。またデータ提供装置32は、この後、データ利用者4が要求した利用者要件を満たす匿名化データセット64を作成するようデータ準備装置31に指示を与える。 When receiving the user requirement information, the data providing device 32 updates the user requirement table 65 of the usage condition information 62 (FIG. 2) based on the received user requirement information (SP6). The data providing device 32 then instructs the data preparation device 31 to create an anonymized data set 64 that satisfies the user requirements requested by the data user 4.
 かくして、データ準備装置31は、かかる指示がデータ提供装置32から与えられると、データ利用者4が設定した利用者要件を満たす匿名化データセット64を作成するために必要な元データの転送要求を、該当する元データ提供者2の情報処理装置20(図2)に送信する(SP7)。そしてデータ準備装置31は、かかる転送要求に応じて必要な元データが転送されてくると(SP8)、転送されてきた元データに基づいて匿名化前データセット55(図2)を生成し、生成した匿名化前データセット55を元データデータベース53に格納する(SP9)。 Thus, when such an instruction is given from the data providing device 32, the data preparation device 31 makes a transfer request for the original data necessary for creating the anonymized data set 64 that satisfies the user requirements set by the data user 4. Then, the data is transmitted to the information processing apparatus 20 (FIG. 2) of the corresponding original data provider 2 (SP7). Then, when the necessary original data is transferred in response to the transfer request (SP8), the data preparation device 31 generates the pre-anonymization data set 55 (FIG. 2) based on the transferred original data, The generated pre-anonymization data set 55 is stored in the original data database 53 (SP9).
 続いて、データ準備装置31は、k値の値又はk-匿名化処理時のパラメータを順次変更しながら、ステップSP9で元データデータベース53に格納した匿名化前データセット55に対するk-匿名化処理を繰り返すことにより複数の匿名化データセット64を作成する(SP10)。 Subsequently, the data preparation device 31 sequentially changes the value of the k value or the parameter at the time of the k-anonymization process, and the k-anonymization process for the pre-anonymization data set 55 stored in the original data database 53 in step SP9. To create a plurality of anonymized data sets 64 (SP10).
 そしてデータ準備装置31は、ステップSP10で作成した複数の匿名化データセット64について、ステップSP5においてデータ利用者4が設定した利用者要件を満たしているか否か(つまり対象属性の対象統計量の値がステップSP5でデータ利用者4が設定した許容有意水準を満たしているか否か)をそれぞれ判定する(SP11)。 Then, the data preparation device 31 determines whether or not the plurality of anonymized data sets 64 created in step SP10 satisfy the user requirement set by the data user 4 in step SP5 (that is, the value of the target statistic of the target attribute). Are determined whether or not the acceptable significance level set by the data user 4 in step SP5 is satisfied (SP11).
 そしてデータ準備装置31は、ステップSP10で作成したいずれの匿名化データセット64も利用者要件を満たしていない場合には、ステップSP10及びステップSP11の処理をリトライする(SP12)。またデータ準備装置31は、ステップSP10で作成したいずれかの匿名化データセット64が利用者要件を満たしている場合には、その中でk値が最も大きい匿名化データセット64をデータ提供装置32に送信する。 And the data preparation apparatus 31 retries the process of step SP10 and step SP11, when none of the anonymized data sets 64 created in step SP10 satisfy the user requirements (SP12). In addition, when any one of the anonymized data sets 64 created in step SP10 satisfies the user requirement, the data preparation device 31 selects the anonymized data set 64 having the largest k value among the data providing devices 32. Send to.
 かくしてデータ提供装置32は、データ準備装置31から与えられた匿名化データセット64を匿名化データベース60に格納すると共に、その匿名化データセット64をデータカタログに登録するようデータカタログ情報61を更新する(SP13)。またデータ提供装置32は、この後、更新後のデータカタログ情報61を掲載したデータセット選択画面70(図7)の画面データをデータ利用者4のクライアント端末40に送信することにより、当該画面データに基づくデータセット選択画面70をそのクライアント端末40に表示させる(SP14)。 Thus, the data providing device 32 stores the anonymized data set 64 given from the data preparation device 31 in the anonymized database 60 and updates the data catalog information 61 so as to register the anonymized data set 64 in the data catalog. (SP13). Further, the data providing device 32 thereafter transmits the screen data of the data set selection screen 70 (FIG. 7) on which the updated data catalog information 61 is posted to the client terminal 40 of the data user 4, thereby the screen data. Is displayed on the client terminal 40 (SP14).
 そしてクライアント端末40は、このデータセット選択画面70においてデータ利用者4が所望する匿名化データセット64を選択した上で購入ボタン72(図7)をクリックすると、その旨をデータ提供装置32に通知する(SP15)。 When the client terminal 40 selects the anonymized data set 64 desired by the data user 4 on the data set selection screen 70 and clicks the purchase button 72 (FIG. 7), the client terminal 40 notifies the data providing apparatus 32 to that effect. (SP15).
 かくしてデータ提供装置32は、かかる通知を受信すると、データセット選択画面70においてデータ利用者4が選択した匿名化データセット64のデータを匿名化データベース60から読み出してそのデータ利用者4のクライアント端末40に送信する(SP16)。 Thus, when receiving the notification, the data providing device 32 reads the data of the anonymized data set 64 selected by the data user 4 on the data set selection screen 70 from the anonymized database 60, and the client terminal 40 of the data user 4 (SP16).
(4)統計量強化匿名化データ選択処理
(4-1)統計量強化匿名化データセット作成処理
 図10は、図9について上述した一連の処理の流れのうち、ステップSP10においてデータ準備装置31の統計量強化匿名化データ選択処理部52(図2)により実行される統計量強化匿名化データ選択処理の処理手順を示す。
(4) Statistics-enhanced anonymized data selection process (4-1) Statistics-enhanced anonymized data set creation process FIG. The process sequence of the statistics reinforcement | strengthening anonymization data selection process performed by the statistics reinforcement | strengthening anonymization data selection process part 52 (FIG. 2) is shown.
 統計量強化匿名化データ選択処理部52は、かかるステップSP10においてこの統計量強化匿名化データ選択処理を開始し、まず、ステップSP4においてデータ提供装置32がクライアント端末40に表示させた統計量強化項目指定画面80を用いてデータ利用者4が設定したk値の自由度をデータ提供装置32から取得し(SP20)、取得したk値の自由度が「可変」であるか否かを判断する(SP21)。 The statistic strengthening anonymized data selection processing unit 52 starts the statistic strengthening anonymized data selection process in step SP10. First, the statistics strengthening item displayed on the client terminal 40 by the data providing device 32 in step SP4. The degree of freedom of the k value set by the data user 4 is acquired from the data providing device 32 using the designation screen 80 (SP20), and it is determined whether or not the degree of freedom of the acquired k value is “variable” (SP20). SP21).
 統計量強化匿名化データ選択処理部52は、この判断で肯定結果を得ると、k値を順次1ずつ増加させながらk-匿名化処理を繰り返し実行するk値可変統計量強化処理を実行し(SP22)、この後、この統計量強化匿名化データ選択処理を終了する。 If the statistic strengthening anonymized data selection processing unit 52 obtains a positive result in this determination, it executes a k value variable statistic enhancing process that repeatedly executes the k-anonymization process while sequentially increasing the k value by one ( SP22), and thereafter, the statistics-strengthening anonymized data selection process is terminated.
 これに対して、統計量強化匿名化データ選択処理部52は、この判断で否定結果を得ると、k値の値を変化させることなくk-匿名化処理時のパラメータを変化させながらk-匿名化処理を繰り返し実行するk値固定統計量強化処理を実行し(SP23)、この後、この統計量強化匿名化データ選択処理を終了する。 On the other hand, if the statistic-enhanced anonymized data selection processing unit 52 obtains a negative result in this determination, the k-anonymity is changed while changing the parameter at the k-anonymization process without changing the value of the k value. The k-value fixed statistic enhancement process for repeatedly executing the quantification process is executed (SP23), and then the statistic reinforcement anonymized data selection process is terminated.
(4-2)k値可変統計量強化処理
 図11は、図10について上述した統計量強化匿名化データ選択処理のステップSP22において、統計量強化匿名化データ選択処理部52により実行されるk値可変統計量強化処理の具体的な処理内容を示す。
(4-2) k Value Variable Statistics Enhancing Processing FIG. 11 shows the k value executed by the statistics enhancing anonymized data selection processing unit 52 in step SP22 of the statistics enhancing anonymized data selection processing described above with reference to FIG. The specific processing content of the variable statistic enhancement processing is shown.
 統計量強化匿名化データ選択処理部52は、統計量強化匿名化データ選択処理のステップSP22に進むと、この図11に示すk値可変統計量強化処理を開始し、まず、プライバシ保護条件テーブル56(図4)から予め設定されたk値の最小値Kminを取得する(SP30)。 When the statistical strength strengthening anonymized data selection processing unit 52 proceeds to step SP22 of the statistical strength strengthening anonymized data selection processing, the statistical value strengthening anonymization data selection processing unit 52 starts the k value variable statistical strength strengthening processing shown in FIG. The minimum value Kmin of the preset k value is acquired from (FIG. 4) (SP30).
 続いて、統計量強化匿名化データ選択処理部52は、データ利用者4により設定されたk値の最大値Kmaxをデータ提供装置32から取得し(SP31)、さらに予め匿名化条件データベース54(図2)に設定されているk-匿名化処理の試行回数の上限値Nmaxを匿名化処理部51を介して取得する(SP32)。 Subsequently, the statistic-enhanced anonymized data selection processing unit 52 acquires the maximum value Kmax of the k value set by the data user 4 from the data providing device 32 (SP31), and further preliminarily stores the anonymization condition database 54 (FIG. The upper limit value Nmax of the number of trials of k-anonymization processing set in 2) is acquired via the anonymization processing unit 51 (SP32).
 続いて、統計量強化匿名化データ選択処理部52は、k-匿名化処理におけるk値の値をステップSP30で取得した最小値Kminとするよう匿名化処理部51に設定すると共に、k-匿名化処理の試行回数をカウントするための変数nの値を「1」に設定する(SP33)。 Subsequently, the statistic strengthening anonymization data selection processing unit 52 sets the value of the k value in the k-anonymization processing to the anonymization processing unit 51 so as to be the minimum value Kmin acquired in step SP30, and k-anonymization. The value of the variable n for counting the number of trials of the digitizing process is set to “1” (SP33).
 この後、統計量強化匿名化データ選択処理部52は、データ利用者4が指定した匿名化データセット64の元となる匿名化前データセット55についてk-匿名化処理を実行するよう匿名化処理部51に指示を与える(SP34)。かくして、この指示に応じて、匿名化処理部51において、対応する匿名化前データセット55に対するk-匿名化処理が実行される。 Thereafter, the statistic strengthening anonymized data selection processing unit 52 performs the anonymization process so as to execute the k-anonymization process on the pre-anonymization data set 55 that is the basis of the anonymization data set 64 specified by the data user 4. An instruction is given to the unit 51 (SP34). Thus, in response to this instruction, the anonymization processing unit 51 executes k-anonymization processing for the corresponding pre-anonymization data set 55.
 そして統計量強化匿名化データ選択処理部52は、このとき実行されたk-匿名化処理により作成された匿名化データセット64のデータを一時的にハードディスク装置35(図1)に格納する(SP35)。 Then, the statistic enhancement anonymized data selection processing unit 52 temporarily stores the data of the anonymized data set 64 created by the k-anonymization process executed at this time in the hard disk device 35 (FIG. 1) (SP35). ).
 次いで、統計量強化匿名化データ選択処理部52は、匿名化処理部51に設定したk値の値がステップSP31で取得した最大値Kmax未満であるか否か、及び、変数nの値がステップSP32で取得した試行回数の上限値Nmax未満であるか否かを順次判断する(SP36,SP37)。 Next, the statistic strengthening anonymized data selection processing unit 52 determines whether or not the value of k set in the anonymization processing unit 51 is less than the maximum value Kmax acquired in step SP31, and the value of the variable n is step. It is sequentially determined whether or not the number of trials acquired at SP32 is less than the upper limit value Nmax (SP36, SP37).
 統計量強化匿名化データ選択処理部52は、これらステップSP36及びステップSP37の判断で共に肯定結果を得ると、k値の値及び変数nの値をそれぞれ1ずつ増加させた後に(SP38)、ステップSP34に戻り、この後、ステップSP36又はステップSP37において否定結果を得るまでステップSP34~ステップSP38の処理を繰り返す。 If both the determination of step SP36 and step SP37 obtain a positive result, the statistic-enhanced anonymized data selection processing unit 52 increases the value of k and the value of variable n by 1 (SP38), Returning to SP34, thereafter, the processing from step SP34 to step SP38 is repeated until a negative result is obtained in step SP36 or step SP37.
 以上のステップSP34~ステップSP38の繰返し処理により、k-匿名化処理の試行回数(変数nの値)が上限値Nmaxを超えない範囲でk値を最小値Kminから最大値Kmaxまで順次変化させながら、データ利用者4が指定した匿名化データセット64の元となる匿名化前データセット55(図2)に対してk-匿名化処理をそれぞれ実行することにより得られた匿名化データセット64がそれぞれハードディスク装置35に格納されることになる。 By repeating the above steps SP34 to SP38, the k value is sequentially changed from the minimum value Kmin to the maximum value Kmax in a range where the number of trials of k-anonymization processing (value of the variable n) does not exceed the upper limit value Nmax. The anonymized data set 64 obtained by executing k-anonymization processing on the pre-anonymized data set 55 (FIG. 2) that is the basis of the anonymized data set 64 designated by the data user 4 Each is stored in the hard disk device 35.
 そして統計量強化匿名化データ選択処理部52は、やがてk-匿名化処理のk値がデータ利用者4が設定した最大値Kmaxに到達し、又は、k-匿名化処理の試行回数(変数nの値)が上限値Nmaxに到達することによりステップSP36又はステップSP37で否定結果を得ると、データ利用者4が指定した匿名化データセット64の元となる匿名化前データセット55の当該データ利用者4が指定した対象属性の当該データ利用者4が指定した対象統計量の値と、現在のk値でk-匿名化処理を実行することにより得られた匿名化データセット64の当該対象統計量の値との差異を算出する(SP39)。 Then, the statistic strengthening anonymization data selection processing unit 52 eventually reaches the k value of the k-anonymization process reaching the maximum value Kmax set by the data user 4, or the number of trials of the k-anonymization process (variable n If a negative result is obtained at step SP36 or step SP37 when the value reaches the upper limit value Nmax, the data use of the pre-anonymization data set 55 that becomes the basis of the anonymization data set 64 designated by the data user 4 The target statistics of the anonymization data set 64 obtained by executing the k-anonymization process with the value of the target statistic specified by the data user 4 of the target attribute specified by the user 4 and the current k value The difference from the quantity value is calculated (SP39).
 続いて、統計量強化匿名化データ選択処理部52は、ステップSP39において算出した差異が、データ利用者4により設定された許容有意水準を満たすか否かを判断する(SP40)。そして統計量強化匿名化データ選択処理部52は、この判断で否定結果を得ると、そのときのk値の値が最小値Kminであるか否かを判断する(SP41)。 Subsequently, the statistic-enhanced anonymized data selection processing unit 52 determines whether or not the difference calculated in step SP39 satisfies the allowable significance level set by the data user 4 (SP40). If the statistic strengthening anonymized data selection processing unit 52 obtains a negative result in this determination, it determines whether or not the k value at that time is the minimum value Kmin (SP41).
 統計量強化匿名化データ選択処理部52は、この判断で否定結果を得ると、k値の値を1だけ減少させる(SP42)。そして統計量強化匿名化データ選択処理部52は、この後、ステップSP39に戻り、この後、ステップSP39~ステップSP42の処理を繰り返す。 If the statistic strengthening anonymized data selection processing unit 52 obtains a negative result in this determination, it decreases the value of k by 1 (SP42). Then, the statistic strengthening anonymized data selection processing unit 52 returns to step SP39, and thereafter repeats the processing of step SP39 to step SP42.
 そして統計量強化匿名化データ選択処理部52は、やがてステップSP40で肯定結果を得ると、そのとき対象としているk値でk-匿名化処理を実行することにより得られた匿名化データセット64を、データ利用者4が設定した利用者要件を満たす匿名化データセット64として、そのデータをデータ提供装置32に出力し(SP44)、この後、このk値可変統計量強化処理を終了する。 Then, when the statistic-enhanced anonymized data selection processing unit 52 eventually obtains an affirmative result at step SP40, the anonymized data set 64 obtained by executing the k-anonymization process with the target k value at that time is obtained. The data is output to the data providing device 32 as an anonymized data set 64 that satisfies the user requirements set by the data user 4 (SP44), and then the k-value variable statistic enhancement processing is terminated.
 従って、この場合には、データ利用者4が指定した属性(対象属性)の当該データ利用者4が指定した統計量(対象統計量)の値が当該データ利用者4が指定した許容有意水準を満たす匿名化データセット64のうち、最もk値の値が大きい匿名化データセット64(つまり安全性が最も高い匿名化データセット64)のデータがデータ提供装置32に出力されることになる。そしてこの場合には、図7について上述したデータセット選択画面70の匿名化データセット一覧71(図7)に、この匿名化データセット64の概要が追加表示される。 Therefore, in this case, the value of the statistic (target statistic) specified by the data user 4 of the attribute (target attribute) specified by the data user 4 indicates the allowable significance level specified by the data user 4. Of the anonymized data set 64 that satisfies, the data of the anonymized data set 64 having the largest k value (that is, the anonymized data set 64 having the highest safety) is output to the data providing device 32. In this case, the summary of the anonymized data set 64 is additionally displayed in the anonymized data set list 71 (FIG. 7) of the data set selection screen 70 described above with reference to FIG.
 これに対して、統計量強化匿名化データ選択処理部52は、ステップSP41の判断で否定結果を得ると、データ利用者4が指定した属性の当該データ利用者4が指定した統計量の値が当該データ利用者4が設定した許容有意水準を満たさない旨の警告をデータ提供装置32に通知する(SP43)。 On the other hand, if the statistic strengthening anonymized data selection processing unit 52 obtains a negative result in the determination at step SP41, the value of the statistic specified by the data user 4 of the attribute specified by the data user 4 is obtained. The data providing apparatus 32 is notified of a warning that the allowable significance level set by the data user 4 is not satisfied (SP43).
 さらに統計量強化匿名化データ選択処理部52は、そのとき対象としているk値(この場合のk値の値は最小値Kmin)でk-匿名化処理を実行することにより得られた匿名化データセット64のデータをデータ提供装置32に出力し(SP44)、この後、このk値可変統計量強化処理を終了する。 Further, the statistic-enhanced anonymization data selection processing unit 52 performs the anonymization data obtained by executing the k-anonymization process with the target k value (the value of the k value in this case is the minimum value Kmin). The data of the set 64 is output to the data providing device 32 (SP44), and then the k-value variable statistic enhancement processing is terminated.
 従って、この場合には、データ利用者4が指定した属性(対象属性)の当該データ利用者4が指定した統計量(対象統計量)の値が当該データ利用者4が指定した許容有意水準を満たさない匿名化データセット64のうち、最もk値の値が小さい匿名化データセット64(つまり精度が最も高いと考えられる匿名化データセット64)のデータがデータ提供装置32に出力されることになる。そしてこの場合には、図7について上述したデータセット選択画面70の匿名化データセット一覧71(図7)に、この匿名化データセット64の概要が追加表示されると共に、当該匿名化データセット64が利用者要件を満たしていない旨の警告が当該匿名化データセット64の概要と対応付けて表示される。 Therefore, in this case, the value of the statistic (target statistic) specified by the data user 4 of the attribute (target attribute) specified by the data user 4 indicates the allowable significance level specified by the data user 4. Among the unsatisfied anonymized data sets 64, the data of the anonymized data set 64 having the smallest k value (that is, the anonymized data set 64 considered to have the highest accuracy) is output to the data providing device 32. Become. In this case, the anonymized data set 64 is additionally displayed on the anonymized data set list 71 (FIG. 7) of the data set selection screen 70 described above with reference to FIG. Is displayed in association with the summary of the anonymized data set 64.
(4-3)k値固定統計量強化処理
 図12A及び図12Bは、図10について上述した統計量強化匿名化データ選択処理のステップSP23において、統計量強化匿名化データ選択処理部52により実行されるk値固定統計量強化処理の具体的な処理内容を示す。
(4-3) k Value Fixed Statistics Enhancing Process FIGS. 12A and 12B are executed by the statistics enhancing anonymized data selection processing unit 52 in step SP23 of the statistics enhancing anonymized data selection process described above with reference to FIG. The specific processing content of the k-value fixed statistic enhancement processing is shown.
 統計量強化匿名化データ選択処理部52は、統計量強化匿名化データ選択処理のステップSP23に進むと、この図12A及び図12Bに示すk値固定統計量強化処理を開始し、まず、プライバシ保護条件テーブル56から予め設定されたk値の最小値Kminを取得する(SP50)。 When the statistical strength strengthening anonymized data selection processing unit 52 proceeds to step SP23 of the statistical strength strengthening anonymized data selection processing, the statistical value strengthening anonymized data selection processing unit 52 starts the k-value fixed statistical strength strengthening processing shown in FIGS. 12A and 12B. The minimum value Kmin of the preset k value is acquired from the condition table 56 (SP50).
 続いて、統計量強化匿名化データ選択処理部52は、データ利用者4により設定されたk値の最大値Kmaxをデータ提供装置32から取得し(SP51)、さらに予め匿名化条件データベース54(図2)に格納されているk-匿名化処理の試行回数の上限値Nmaxを匿名化処理部51を介して取得する(SP52)。 Subsequently, the statistic-enhanced anonymized data selection processing unit 52 acquires the maximum value Kmax of the k value set by the data user 4 from the data providing device 32 (SP51), and further preliminarily stores the anonymization condition database 54 (FIG. The upper limit value Nmax of the number of trials of k-anonymization processing stored in 2) is acquired via the anonymization processing unit 51 (SP52).
 次いで、統計量強化匿名化データ選択処理部52は、k-匿名化処理の試行回数の上限値Nmaxと同じ個数の異なるk-匿名化パラメータをそれぞれ生成する(SP53)。 Next, the statistic strengthening anonymization data selection processing unit 52 generates the same number of different k-anonymization parameters as the upper limit value Nmax of the number of trials of k-anonymization processing (SP53).
 このk-匿名化パラメータは、主としてk-匿名化対象項目及び削除レコード閾値の2つの組み合わせから構成される。このうちk-匿名化対象項目は、k-匿名化の対象とすべき保護項目(図4参照)を指定するパラメータである。k-匿名化の対象としない保護項目については、削除された上でk-匿名化処理が行われるため、データ利用者4には提供されない。図8について上述した統計量強化項目指定画面80で指定された対象属性(データ項目)は必ずk-匿名化対象項目に含められる。 This k-anonymization parameter is mainly composed of two combinations of k-anonymization target item and deletion record threshold. Among these, the k-anonymization target item is a parameter for designating a protection item (see FIG. 4) to be k-anonymization target. Protection items that are not targeted for k-anonymization are not provided to the data user 4 because they are deleted and subjected to k-anonymization processing. The target attribute (data item) specified on the statistics strengthening item specification screen 80 described above with reference to FIG. 8 is always included in the k-anonymization target item.
 また削除レコード閾値は、k-匿名化処理において、匿名化前データセット55をk-匿名化処理する際に削除しても良い元データ数の上限値を指定するパラメータである。例えば、削除レコード閾値が「0」である場合、すべての元データがk-匿名性を満たすまでk-匿名化処理を実行する。これに対して、削除レコード閾値が「1000」である場合、k-匿名化処理の過程でk-匿名性を満たさない元データ数が「1000」以下になった時点で、k-匿名性を満たさない元データを削除した上でk-匿名化処理を終了する。 Further, the deletion record threshold is a parameter that specifies an upper limit value of the number of original data that may be deleted when the pre-anonymization data set 55 is k-anonymized in the k-anonymization process. For example, when the deletion record threshold is “0”, the k-anonymization process is executed until all the original data satisfy the k-anonymity. On the other hand, when the deletion record threshold is “1000”, k-anonymity is reduced when the number of original data that does not satisfy k-anonymity becomes “1000” or less in the course of k-anonymization processing. The k-anonymization process is terminated after deleting the unsatisfied original data.
 なおk-匿名化処理の試行回数の上限値Nmaxが「8」に設定され、保護項目が「年齢」、「性別」及び「住所」であり、統計量強化項目画面で指定されたデータ項目が「年齢」であった場合のk-匿名化パラメータ群の一例を図13に示す。 Note that the upper limit value Nmax of the number of trials of k-anonymization processing is set to “8”, the protection items are “age”, “sex” and “address”, and the data items specified on the statistics enhancement item screen are An example of a k-anonymization parameter group in the case of “age” is shown in FIG.
 続いて、統計量強化匿名化データ選択処理部52は、k-匿名化処理におけるk値の値をステップSP50で取得した最小値Kminとするよう匿名化処理部51に設定すると共に、k-匿名化処理の試行回数をカウントするための変数nの値を「1」に設定する(SP54)。 Subsequently, the statistic-enhanced anonymized data selection processing unit 52 sets the value of the k value in the k-anonymization process in the anonymization processing unit 51 so as to be the minimum value Kmin acquired in step SP50, and k-anonymization. The value of the variable n for counting the number of times of the digitization process is set to “1” (SP54).
 この後、統計量強化匿名化データ選択処理部52は、ステップSP53で生成したNmax個のk-匿名化パラメータの中から未選択のk-匿名化パラメータを1つ選択し(SP55)、選択したk-匿名化パラメータを利用したk-匿名化処理を実行するよう匿名化処理部51に指示を与える(SP56)。かくして、この指示に応じて、匿名化処理部51において、対応する匿名化前データセット55(図2)に対するk-匿名化処理が実行される。 Thereafter, the statistic-enhanced anonymized data selection processing unit 52 selects one unselected k-anonymization parameter from the Nmax k-anonymization parameters generated in step SP53 (SP55), and selects it. An instruction is given to the anonymization processing unit 51 to execute the k-anonymization process using the k-anonymization parameter (SP56). Thus, in response to this instruction, the anonymization processing unit 51 executes the k-anonymization process for the corresponding pre-anonymization data set 55 (FIG. 2).
 そして統計量強化匿名化データ選択処理部52は、このとき実行されたk-匿名化処理により作成された匿名化データセット64のデータを一時的にハードディスク装置35(図1)に格納する(SP57)。 Then, the statistic enhancement anonymized data selection processing unit 52 temporarily stores the data of the anonymized data set 64 created by the k-anonymization process executed at this time in the hard disk device 35 (FIG. 1) (SP57). ).
 次いで、統計量強化匿名化データ選択処理部52は、匿名化処理部51に設定したk値の値がステップSP51で取得した最大値Kmax未満であるか否か、及び、変数nの値がステップSP52で取得した試行回数の上限値Nmax未満であるか否かを順次判断する(SP58,SP59)。 Next, the statistic strengthening anonymized data selection processing unit 52 determines whether or not the value of k set in the anonymization processing unit 51 is less than the maximum value Kmax acquired in step SP51, and the value of the variable n is step. It is sequentially determined whether or not the number of trials acquired in SP52 is less than the upper limit value Nmax (SP58, SP59).
 統計量強化匿名化データ選択処理部52は、これらステップSP58及びステップSP59の判断で共に肯定結果を得ると、変数nの値を1増加させた後に(SP60)、ステップSP55に戻り、この後、ステップSP55で選択するk-匿名化パラメータを順次未処理の他のk-匿名化パラメータに切り替えながら、ステップSP58又はステップSP59において否定結果を得るまでステップSP55~ステップSP60の処理を繰り返す。 If both the determination of step SP58 and step SP59 obtain a positive result, the statistic-enhanced anonymized data selection processing unit 52 increases the value of the variable n by 1 (SP60), and then returns to step SP55. While the k-anonymization parameter selected in step SP55 is sequentially switched to another unprocessed k-anonymization parameter, the processes in steps SP55 to SP60 are repeated until a negative result is obtained in step SP58 or step SP59.
 以上のステップSP55~ステップSP60の繰返し処理により、ステップSP53で生成したNmax個のk-匿名化パラメータのすべてについてk-匿名化処理が実行され、これらk-匿名化処理により得られた匿名化データセット64がそれぞれハードディスク装置35に格納されることになる。 By repeating the above steps SP55 to SP60, k-anonymization processing is executed for all Nmax k-anonymization parameters generated in step SP53, and the anonymization data obtained by these k-anonymization processing is executed. Each set 64 is stored in the hard disk device 35.
 そして統計量強化匿名化データ選択処理部52は、やがてk-匿名化処理のk値がデータ利用者4が設定した最大値Kmaxに到達し、又は、k-匿名化処理の試行回数(変数nの値)が上限値Nmaxに到達することによりステップSP58又はステップSP59で否定結果を得ると、データ利用者4が指定した匿名化データセット64の元となる匿名化前データセット55の当該データ利用者4が指定した対象統計量の値と、ステップSP55~ステップSP60の繰返し処理により得られた各匿名化データセット64の当該対象統計量の値との差異をそれぞれ算出する(SP61)。 Then, the statistic strengthening anonymization data selection processing unit 52 eventually reaches the k value of the k-anonymization process reaching the maximum value Kmax set by the data user 4, or the number of trials of the k-anonymization process (variable n If a negative result is obtained at step SP58 or step SP59 when the value of the data) reaches the upper limit value Nmax, the data use of the pre-anonymization data set 55 that becomes the basis of the anonymization data set 64 designated by the data user 4 The difference between the value of the target statistic designated by the person 4 and the value of the target statistic of each anonymized data set 64 obtained by the repetition processing of step SP55 to step SP60 is calculated (SP61).
 そして統計量強化匿名化データ選択処理部52は、ステップSP61の算出結果に基づいて、ステップSP55~ステップSP60の繰返し処理により得られた各匿名化データセット64のうち、その対象統計量の値と、データ利用者4が指定した匿名化データセット64の元となる匿名化前データセット55の当該データ利用者4が指定した対象統計量の値との差異が最小の匿名化データセット64を特定する(SP62)。 Based on the calculation result of step SP61, the statistic-enhanced anonymized data selection processing unit 52 determines the value of the target statistic of each anonymized data set 64 obtained by the repetition processing of step SP55 to step SP60. The anonymized data set 64 having the smallest difference from the value of the target statistic specified by the data user 4 of the pre-anonymized data set 55 that is the source of the anonymized data set 64 specified by the data user 4 is identified. (SP62).
 続いて、統計量強化匿名化データ選択処理部52は、ステップSP62で特定した匿名化データセット64のデータ利用者4が指定した対象属性の当該データ利用者4が指定した対象統計量の値と、かかる匿名化前データセット55の当該データ利用者4が指定した対象統計量の値との差異が、データ利用者4により設定された許容有意水準を満たすか否かを判断する(SP63)。 Subsequently, the statistic-enhanced anonymized data selection processing unit 52 selects the target statistic value designated by the data user 4 of the target attribute designated by the data user 4 of the anonymized data set 64 identified at step SP62. Then, it is determined whether or not the difference between the value of the target statistic specified by the data user 4 in the pre-anonymization data set 55 satisfies the allowable significance level set by the data user 4 (SP63).
 そして統計量強化匿名化データ選択処理部52は、この判断で肯定結果を得ると、ステップSP62で特定した匿名化データセット64を、データ利用者4が設定した利用者要件を満たす匿名化データセット64として、そのデータをデータ提供装置32に出力し(SP69)、この後、このk値固定統計量強化処理を終了する。 And if the statistics reinforcement | strengthening anonymization data selection process part 52 obtains a positive result by this judgment, the anonymization data set which satisfy | fills the user requirement which the data user 4 set the anonymization data set 64 identified by step SP62. As 64, the data is output to the data providing device 32 (SP69), and then the k-value fixed statistics enhancing process is terminated.
 従って、この場合には、データ利用者4が指定した属性(対象属性)の当該データ利用者4が指定した統計量(対象統計量)の値が当該データ利用者4が指定した許容有意水準を満たす匿名化データセット64のうち、対象属性の対象統計量の値が元の匿名化前データセット55の対象統計量の値に最も近い匿名化データセット64のデータがデータ提供装置32に出力されることになる。そしてこの場合には、図7について上述したデータセット選択画面70の匿名化データセット一覧71(図7)に、この匿名化データセット64の概要が追加表示される。 Therefore, in this case, the value of the statistic (target statistic) specified by the data user 4 of the attribute (target attribute) specified by the data user 4 indicates the allowable significance level specified by the data user 4. Among the anonymized data set 64 that satisfies, the data of the anonymized data set 64 that has the closest target statistic value of the target attribute to the original statistical value of the target statistical value 55 of the original anonymization data is output to the data providing device 32. Will be. In this case, the summary of the anonymized data set 64 is additionally displayed in the anonymized data set list 71 (FIG. 7) of the data set selection screen 70 described above with reference to FIG.
 これに対して、統計量強化匿名化データ選択処理部52は、ステップSP63の判断で否定結果を得ると、匿名化処理部51に設定されているk-匿名化処理時のk値の値がステップSP51で取得したk値の最大値Kmaxであるか否かを判断する(SP64)。 On the other hand, if the statistic strengthening anonymization data selection processing unit 52 obtains a negative result in the determination at step SP63, the k-value at the time of the k-anonymization processing set in the anonymization processing unit 51 is It is determined whether or not the k value is the maximum value Kmax acquired in step SP51 (SP64).
 そして統計量強化匿名化データ選択処理部52は、この判断で肯定結果を得ると、データ利用者4が指定した属性(対象属性)の当該データ利用者4が指定した統計量(対象統計量)の値が当該データ利用者4が設定した許容有意水準を満たさない旨の警告をデータ提供装置32に通知する(SP65)。 Then, when the statistic strengthening anonymized data selection processing unit 52 obtains a positive result in this determination, the statistic (target statistic) designated by the data user 4 of the attribute (target attribute) designated by the data user 4 Is notified to the data providing device 32 that the value of does not satisfy the allowable significance level set by the data user 4 (SP65).
 さらに統計量強化匿名化データ選択処理部52は、そのとき設定されているk値でk-匿名化処理を実行することにより得られた匿名化データセット64のうち、ステップSP62で特定した匿名化データセット64のデータをデータ提供装置32に出力し(SP69)、この後、このk値固定統計量強化処理を終了する。 Further, the statistic strengthening anonymization data selection processing unit 52 performs the anonymization specified in step SP62 out of the anonymization data set 64 obtained by executing the k-anonymization process with the k value set at that time. The data of the data set 64 is output to the data providing device 32 (SP69), and then the k-value fixed statistics enhancing process is terminated.
 従って、この場合には、データ利用者4が指定した属性(対象属性)の当該データ利用者4が指定した統計量(対象統計量)の値が当該データ利用者4が指定した許容有意水準を満たさない匿名化データセット64のうち、元の匿名化前データセット55(図1)との関係において、対象属性の対象統計量値の差異が最も小さい匿名化データセット64のデータがデータ提供装置32に出力されることになる。そしてこの場合には、図7について上述したデータセット選択画面70の匿名化データセット一覧71(図7)に、この匿名化データセット64の概要が追加表示されると共に、当該匿名化データセット64が利用者要件を満たしていない旨の警告が当該匿名化データセット64の概要と対応付けて表示される。 Therefore, in this case, the value of the statistic (target statistic) specified by the data user 4 of the attribute (target attribute) specified by the data user 4 indicates the allowable significance level specified by the data user 4. Of the unsatisfied anonymized data set 64, the data of the anonymized data set 64 having the smallest difference in the target statistic value of the target attribute in the relationship with the original pre-anonymized data set 55 (FIG. 1) is the data providing device. 32 is output. In this case, the anonymized data set 64 is additionally displayed on the anonymized data set list 71 (FIG. 7) of the data set selection screen 70 described above with reference to FIG. Is displayed in association with the summary of the anonymized data set 64.
 これに対して統計量強化匿名化データ選択処理部52は、ステップSP64の判断で否定結果を得ると、k値の値を1増加させてリトライするか否かをデータ利用者4に確認するための確認画面(図示せず)をクライアント端末40に表示させるようデータ提供装置32に要求する(SP66)。 On the other hand, when the statistic strengthening anonymized data selection processing unit 52 obtains a negative result in the determination at step SP64, it confirms with the data user 4 whether or not to retry by incrementing the value of the k value by one. The data providing apparatus 32 is requested to display the confirmation screen (not shown) on the client terminal 40 (SP66).
 かくして、このときデータ提供装置32は、所定の画面データを対応するクライアント端末40に送信することにより、現在のk値では対象属性の対象統計量がデータ利用者4が指定した許容有意水準を満たす匿名化データセット64を作成できない旨の警告が表示された上述の確認画面をそのクライアント端末40に表示させる。またデータ提供装置32は、クライアント端末40から送信される、この確認画面を利用してデータ利用者4が指定したリトライするか否かの回答をデータ準備装置31に転送する。 Thus, at this time, the data providing device 32 transmits predetermined screen data to the corresponding client terminal 40, so that the target statistic of the target attribute satisfies the allowable significance level specified by the data user 4 at the current k value. The above-described confirmation screen on which a warning that the anonymized data set 64 cannot be created is displayed on the client terminal 40. Further, the data providing device 32 transfers an answer transmitted from the client terminal 40 as to whether or not to retry the data user 4 using the confirmation screen, to the data preparation device 31.
 そして統計量強化匿名化データ選択処理部52は、データ提供装置32から転送されるかかる回答に基づいて、リトライすることをデータ利用者が選択したか否かを判断する(SP67)。そして統計量強化匿名化データ選択処理部52は、この判断で肯定結果を得ると、k値の値を1増加させた後(SP68)、ステップSP55に戻る。そして統計量強化匿名化データ選択処理部52は、この後、ステップSP55以降を上述と同様に処理する。 Then, the statistic strengthening anonymized data selection processing unit 52 determines whether or not the data user has selected to retry based on the response transferred from the data providing device 32 (SP67). If the statistic strengthening anonymized data selection processing unit 52 obtains a positive result in this determination, it increments the value of k by 1 (SP68), and then returns to step SP55. Then, the statistic strengthening anonymized data selection processing unit 52 thereafter processes step SP55 and subsequent steps in the same manner as described above.
 これに対して、統計量強化匿名化データ選択処理部52は、ステップSP67の判断で否定結果を得ると、データ利用者4が指定した属性(対象属性)の当該データ利用者4が指定した統計量(対象統計量)の値が当該データ利用者4が設定した許容有意水準を満たさない旨の警告をデータ提供装置32に通知する(SP65)。 On the other hand, if the statistic strengthening anonymized data selection processing unit 52 obtains a negative result in the determination at step SP67, the statistics specified by the data user 4 of the attribute (target attribute) specified by the data user 4 A warning that the value of the quantity (target statistic) does not satisfy the allowable significance level set by the data user 4 is sent to the data providing apparatus 32 (SP65).
 さらに統計量強化匿名化データ選択処理部52は、そのとき設定されているk値でk-匿名化処理を実行することにより得られた匿名化データセット64のうち、ステップSP62で特定した匿名化データセット64のデータをデータ提供装置32に出力し(SP69)、この後、このk値固定統計量強化処理を終了する。 Further, the statistic strengthening anonymization data selection processing unit 52 performs the anonymization specified in step SP62 out of the anonymization data set 64 obtained by executing the k-anonymization process with the k value set at that time. The data of the data set 64 is output to the data providing device 32 (SP69), and then the k-value fixed statistics enhancing process is terminated.
 従って、この場合には、データ利用者4が指定した属性(対象属性)の当該データ利用者4が指定した統計量(対象統計量)の値が当該データ利用者4が指定した許容有意水準を満たさない匿名化データセット64のうち、元の匿名化前データセット55(図1)との関係において、対象属性の対象統計量値の差異が最も小さい匿名化データセット64のデータがデータ提供装置32に出力されることになる。そしてこの場合には、図7について上述したデータセット選択画面70の匿名化データセット一覧71(図7)に、この匿名化データセット64の概要が追加表示される。 Therefore, in this case, the value of the statistic (target statistic) specified by the data user 4 of the attribute (target attribute) specified by the data user 4 indicates the allowable significance level specified by the data user 4. Of the unsatisfied anonymized data set 64, the data of the anonymized data set 64 having the smallest difference in the target statistic value of the target attribute in the relationship with the original pre-anonymized data set 55 (FIG. 1) is the data providing device. 32 is output. In this case, the summary of the anonymized data set 64 is additionally displayed in the anonymized data set list 71 (FIG. 7) of the data set selection screen 70 described above with reference to FIG.
(5)本実施の形態の効果
 以上のように本実施の形態の情報処理システム1では、匿名化前データセット55に対してk値又は匿名化パラメータを順次変えながら複数回のk-匿名化処理を実行し、かくして得られた匿名化データセット64の中からデータ利用者4により予め設定された利用者要件を満たす匿名化データセット64を選択的にそのデータ利用者4に提供するため、データ利用者4のニーズに合致した匿名化データセット64をデータ利用者4に提供することができる。
(5) Effects of the present embodiment As described above, in the information processing system 1 of the present embodiment, a plurality of k-anonymizations are performed while sequentially changing the k value or the anonymization parameter for the pre-anonymization data set 55. In order to selectively provide the data user 4 with the anonymized data set 64 that satisfies the user requirements set in advance by the data user 4 from the anonymized data set 64 thus obtained, An anonymized data set 64 that meets the needs of the data user 4 can be provided to the data user 4.
(6)他の実施の形態
 なお上述の実施の形態においては、データ収集・管理・提供者3の匿名化データ提供システム30をデータ準備装置31及びデータ提供装置32の2つの装置により構成するようにした場合について述べたが、本発明はこれに限らず、データ準備装置31及びデータ提供装置32の各機能を1つの情報処理装置に搭載し、匿名化データ提供システム30を1つの情報処理装置により構成するようにしても良い。
(6) Other Embodiments In the above-described embodiment, the anonymized data providing system 30 of the data collection / management / provider 3 is configured by two devices, the data preparation device 31 and the data providing device 32. However, the present invention is not limited to this, and the functions of the data preparation device 31 and the data providing device 32 are mounted in one information processing device, and the anonymized data providing system 30 is provided as one information processing device. You may make it comprise by.
 また上述の実施の形態においては、本発明をヘルスケアデータを匿名化処理してデータ利用者4に提供する情報処理システム1に適用するようにした場合について述べたが、本発明はこれに限らず、ヘルスケアデータ以外のデータを匿名化処理してデータ利用者4に提供するこの他種々の情報処理システムに広く適用することができる。 In the above-described embodiment, the case where the present invention is applied to the information processing system 1 that anonymizes healthcare data and provides the data user 4 is described. However, the present invention is not limited thereto. In addition, the present invention can be widely applied to various information processing systems other than anonymizing data other than healthcare data and providing it to the data user 4.
 本発明は、プライバシに関する情報を匿名化又は曖昧化した上でデータを提供する情報処理システムに広く適用することができる。 The present invention can be widely applied to information processing systems that provide data after anonymizing or obscuring information related to privacy.
 1……情報処理システム、2……元データ提供者、3……データ収集・管理・提供者、4……データ利用者、20……情報処理装置、30……匿名化データ提供システム、31……データ準備装置、32……データ提供装置、33,36……CPU、34,37……メモリ、35,38……ハードディスク装置、40……クライアント端末、51……匿名化処理部、52……統計量強化匿名化データ選択処理部、53……元データデータベース、54……匿名化条件データベース、55……匿名化前データセット、56……プライバシ保護条件テーブル、60……匿名化データベース、61……データカタログ、62……利用条件情報、63……データ提供部、64……匿名化データセット、65……利用者要件テーブル、70……データカタログ選択画面、80……統計量強化項目指定画面。 1 ... Information processing system, 2 ... Original data provider, 3 ... Data collection / management / provider, 4 ... Data user, 20 ... Information processing device, 30 ... Anonymized data provision system, 31 Data preparation device 32 Data providing device 33, 36 CPU 34, 37 Memory 35, 38 Hard disk device 40 Client terminal 51 Anonymization processing unit 52 ...... Statistics strengthening anonymized data selection processing unit, 53 …… Original data database, 54 …… Anonymization condition database, 55 …… Pre-anonymization data set, 56 …… Privacy protection condition table, 60 …… Anonymization database 61 …… Data catalog, 62 …… Usage condition information, 63 …… Data provider, 64 …… Anonymized data set, 65 …… User requirement table, 70 …… Data Catalog selection screen, 80 ...... statistics strengthening items specified screen.

Claims (12)

  1.  元データを匿名化処理してデータ利用者に提供する匿名化データ提供装置において、
     前記元データのデータセットに対して前記匿名化処理を実行する匿名化処理部と、
     前記匿名化処理部を制御する匿名化データ選択処理部と、
     匿名化された前記データセットを匿名化データセットとして管理し、前記データ利用者からの要求に応じて、前記匿名化データセットを当該データ利用者に提供するデータ提供部と
     を備え、
     前記データ利用者は、
     所望する前記データセットを選択すると共に、当該データセットについての所望する属性の所望する統計量の許容有意水準を利用者要件として設定し、
     前記匿名化データ選択処理部は、
     前記データ利用者により選択された前記データセットに対して複数回の前記匿名化処理を実行するよう前記匿名化処理部を制御し、
     複数回の前記匿名化処理により得られた複数個の前記匿名化データセットについて、前記データ利用者により設定された前記統計量をそれぞれ算出し、
     算出した各前記匿名化データセットの前記統計量と、前記元データの前記データセットの当該統計量とをそれぞれ比較し、当該統計量の差異が前記データ利用者が設定した前記許容有意水準を満たす前記匿名化データセットを前記利用者要件を満たす前記匿名化データセットとして選択し、
     前記データ提供部は、
     前記匿名化データ選択処理部により選択された前記匿名化データセットを前記データ利用者に提供する
     ことを特徴とする匿名化データ提供装置。
    In the anonymized data providing device that anonymizes the original data and provides it to the data user,
    An anonymization processing unit that executes the anonymization process on the data set of the original data;
    An anonymization data selection processing unit for controlling the anonymization processing unit;
    A data providing unit that manages the anonymized data set as an anonymized data set and provides the anonymized data set to the data user in response to a request from the data user;
    The data user
    Selecting the desired data set and setting the acceptable significance level of the desired statistic of the desired attribute for the data set as a user requirement;
    The anonymized data selection processing unit
    Controlling the anonymization processing unit to execute the anonymization processing a plurality of times for the data set selected by the data user;
    For a plurality of anonymized data sets obtained by a plurality of anonymization processes, each of the statistics set by the data user is calculated,
    The calculated statistic of each anonymized data set is compared with the statistic of the data set of the original data, and the difference in the statistic satisfies the allowable significance level set by the data user. Select the anonymized data set as the anonymized data set that satisfies the user requirements,
    The data providing unit includes:
    The anonymized data providing apparatus that provides the data user with the anonymized data set selected by the anonymized data selection processing unit.
  2.  前記データ提供部は、
     前記データ利用者が選択した前記データセットについて当該データ利用者が所望する前記属性、前記統計量及び前記許容有意水準を設定するための画面を当該データ利用者に提示し、
     当該画面を用いて前記データ利用者により設定された当該データセットについての前記属性、前記統計量及び前記許容有意水準を前記匿名化データ選択部に通知する
     ことを特徴とする請求項1に記載の匿名化データ提供装置。
    The data providing unit includes:
    Presenting the data user with a screen for setting the attribute, the statistic and the allowable significance level desired by the data user for the data set selected by the data user;
    The said anonymized data selection part is notified to the said attribute about the said data set set by the said data user using the said screen, the said statistic, and the said allowable significance level. The Claim 1 characterized by the above-mentioned. Anonymized data providing device.
  3.  前記匿名化処理部は、
     前記匿名化処理としてk-匿名化処理を実行し、
     前記匿名化データ選択処理部は、
     前記k-匿名化処理におけるk値を順次変えながら前記データセットに対する前記k-匿名化処理を複数回実行するよう前記匿名化処理部を制御する
     ことを特徴とする請求項1に記載の匿名化データ提供装置。
    The anonymization processor
    Executing k-anonymization processing as the anonymization processing,
    The anonymized data selection processing unit
    2. The anonymization process according to claim 1, wherein the anonymization processing unit is controlled to execute the k-anonymization process for the data set a plurality of times while sequentially changing k values in the k-anonymization process. Data provision device.
  4.  前記匿名化データ選択処理部は、
     複数回の前記k-匿名化処理により得られた複数個の前記匿名化データセットの中から、前記利用者要件を満たし、かつk値の値が最も大きい前記匿名化データセットを選択する
     ことを特徴とする請求項3に記載の匿名化データ提供装置。
    The anonymized data selection processing unit
    Selecting the anonymized data set that satisfies the user requirements and has the largest k value value from the plurality of anonymized data sets obtained by the k-anonymization process multiple times. The anonymized data providing apparatus according to claim 3, wherein the apparatus is anonymized data providing apparatus.
  5.  前記匿名化処理部は、
     k-匿名化処理により前記元データの前記データセットを匿名化し、
     前記匿名化データ選択処理部は、
     前記k-匿名化処理時におけるパラメータを順次変えながら前記データセットに対する前記k-匿名化処理を複数回実行するよう前記匿名化処理部を制御する
     ことを特徴とする請求項1に記載の匿名化データ提供装置。
    The anonymization processor
    k-anonymize the data set of the original data by anonymization processing;
    The anonymized data selection processing unit
    The anonymization processing unit according to claim 1, wherein the anonymization processing unit is controlled to execute the k-anonymization processing for the data set a plurality of times while sequentially changing parameters at the time of the k-anonymization processing. Data provision device.
  6.  前記匿名化データ選択処理部は、
     複数回の前記k-匿名化処理により得られた複数個の前記匿名化データセットの中から、前記利用者要件を満たし、かつ前記データ利用者により設定された前記統計量について、前記元データの前記データセットの当該統計量との差異が最小の前記匿名化データセットを選択する
     ことを特徴とする請求項5に記載の匿名化データ提供装置。
    The anonymized data selection processing unit
    Among the plurality of anonymized data sets obtained by the k-anonymization process a plurality of times, the statistic that satisfies the user requirements and is set by the data user The anonymized data providing apparatus according to claim 5, wherein the anonymized data set having the smallest difference from the statistics of the data set is selected.
  7.  元データを匿名化処理してデータ利用者に提供する匿名化データ提供装置において実行される匿名化データ提供方法において、
     前記匿名化データ提供装置は、
     前記元データのデータセットに対して前記匿名化処理を実行する匿名化処理部と、
     前記匿名化処理部を制御する匿名化データ選択処理部と、
     匿名化された前記データセットを匿名化データセットとして管理し、前記データ利用者からの要求に応じて、前記匿名化データセットを当該データ利用者に提供するデータ提供部と
     を有し、
     前記データ利用者は、
     所望する前記データセットを選択すると共に、当該データセットについての所望する属性の所望する統計量の許容有意水準を利用者要件として設定し、
     前記匿名化データ選択処理部が、前記データ利用者により選択された前記データセットに対して複数回の前記匿名化処理を実行するよう前記匿名化処理部を制御する第1のステップと、
     前記匿名化データ選択処理部が、複数回の前記匿名化処理により得られた複数個の前記匿名化データセットについて、前記データ利用者により設定された前記統計量をそれぞれ算出する第2のステップと、
     前記匿名化データ選択処理部が、算出した各前記匿名化データセットの前記統計量と、前記元データの前記データセットの当該統計量とをそれぞれ比較し、当該統計量の差異が前記データ利用者が設定した前記許容有意水準を満たす前記匿名化データセットを前記利用者要件を満たす前記匿名化データセットとして選択する第3のステップと、
     前記データ提供部が、前記匿名化データ選択処理部により選択された前記匿名化データセットを前記データ利用者に提供する第4のステップと
     を備えることを特徴とする匿名化データ提供方法。
    In the anonymized data providing method executed in the anonymized data providing apparatus that anonymizes the original data and provides it to the data user,
    The anonymized data providing device is
    An anonymization processing unit that executes the anonymization process on the data set of the original data;
    An anonymization data selection processing unit for controlling the anonymization processing unit;
    A data providing unit that manages the anonymized data set as an anonymized data set, and provides the anonymized data set to the data user in response to a request from the data user;
    The data user
    Selecting the desired data set and setting the acceptable significance level of the desired statistic of the desired attribute for the data set as a user requirement;
    A first step of controlling the anonymization processing unit so that the anonymization data selection processing unit executes the anonymization processing a plurality of times for the data set selected by the data user;
    A second step in which the anonymized data selection processing unit calculates the statistics set by the data user for each of the plurality of anonymized data sets obtained by the anonymization process a plurality of times; ,
    The anonymized data selection processing unit compares the calculated statistic of each anonymized data set with the statistic of the data set of the original data, and the difference in the statistic is the data user. Selecting the anonymized data set that satisfies the allowable significance level set by the user as the anonymized data set that satisfies the user requirements;
    The anonymized data providing method, comprising: a fourth step in which the data providing unit provides the data user with the anonymized data set selected by the anonymized data selection processing unit.
  8.  前記データ提供部は、
     前記データ利用者が選択した前記データセットについて当該データ利用者が所望する前記属性、前記統計量及び前記許容有意水準を設定するための画面を当該データ利用者に提示し、
     当該画面を用いて前記データ利用者により設定された当該データセットについての前記属性、前記統計量及び前記許容有意水準を前記匿名化データ選択部に通知する
     ことを特徴とする請求項7に記載の匿名化データ提供方法。
    The data providing unit includes:
    Presenting the data user with a screen for setting the attribute, the statistic and the allowable significance level desired by the data user for the data set selected by the data user;
    The said anonymization data selection part is notified to the said attribute about the said data set set by the said data user using the said screen, the said statistic, and the said allowable significance level. Anonymized data provision method.
  9.  前記匿名化処理部は、
     前記匿名化処理としてk-匿名化処理を実行し、
     前記第1のステップにおいて、前記匿名化データ選択処理部は、
     前記k-匿名化処理におけるk値を順次変えながら前記データセットに対する前記k-匿名化処理を複数回実行するよう前記匿名化処理部を制御する
     ことを特徴とする請求項7に記載の匿名化データ提供方法。
    The anonymization processor
    Executing k-anonymization processing as the anonymization processing,
    In the first step, the anonymized data selection processing unit includes:
    The anonymization processing unit according to claim 7, wherein the anonymization processing unit is controlled to execute the k-anonymization processing for the data set a plurality of times while sequentially changing k values in the k-anonymization processing. Data provision method.
  10.  前記第3のステップにおいて、前記匿名化データ選択処理部は、
     複数回の前記k-匿名化処理により得られた複数個の前記匿名化データセットの中から、前記利用者要件を満たし、かつk値の値が最も大きい前記匿名化データセットを選択する
     ことを特徴とする請求項9に記載の匿名化データ提供方法。
    In the third step, the anonymized data selection processing unit
    Selecting the anonymized data set that satisfies the user requirements and has the largest k value value from the plurality of anonymized data sets obtained by the k-anonymization process multiple times. The anonymized data providing method according to claim 9, wherein the anonymized data is provided.
  11.  前記匿名化処理部は、
     k-匿名化処理により前記元データの前記データセットを匿名化し、
     前記第1のステップにおいて、前記匿名化データ選択処理部は、
     前記k-匿名化処理時におけるパラメータを順次変えながら前記データセットに対する前記k-匿名化処理を複数回実行するよう前記匿名化処理部を制御する
     ことを特徴とする請求項7に記載の匿名化データ提供方法。
    The anonymization processor
    k-anonymize the data set of the original data by anonymization processing;
    In the first step, the anonymized data selection processing unit includes:
    The anonymization processing unit according to claim 7, wherein the anonymization processing unit is controlled to execute the k-anonymization processing for the data set a plurality of times while sequentially changing parameters at the time of the k-anonymization processing. Data provision method.
  12.  前記第3のステップにおいて、前記匿名化データ選択処理部は、
     複数回の前記k-匿名化処理により得られた複数個の前記匿名化データセットの中から、前記利用者要件を満たし、かつ前記データ利用者により設定された前記統計量について、前記元データの前記データセットの当該統計量との差異が最小の前記匿名化データセットを選択する
     ことを特徴とする請求項11に記載の匿名化データ提供方法。
    In the third step, the anonymized data selection processing unit
    Among the plurality of anonymized data sets obtained by the k-anonymization process a plurality of times, the statistic that satisfies the user requirements and is set by the data user The anonymized data providing method according to claim 11, wherein the anonymized data set having the smallest difference from the statistics of the data set is selected.
PCT/JP2014/067983 2014-07-04 2014-07-04 Anonymized data providing device and method WO2016002086A1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
PCT/JP2014/067983 WO2016002086A1 (en) 2014-07-04 2014-07-04 Anonymized data providing device and method
JP2016530796A JP6263620B2 (en) 2014-07-04 2014-07-04 Anonymized data providing apparatus and method

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/JP2014/067983 WO2016002086A1 (en) 2014-07-04 2014-07-04 Anonymized data providing device and method

Publications (1)

Publication Number Publication Date
WO2016002086A1 true WO2016002086A1 (en) 2016-01-07

Family

ID=55018682

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/JP2014/067983 WO2016002086A1 (en) 2014-07-04 2014-07-04 Anonymized data providing device and method

Country Status (2)

Country Link
JP (1) JP6263620B2 (en)
WO (1) WO2016002086A1 (en)

Cited By (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2018128913A (en) * 2017-02-09 2018-08-16 日本電信電話株式会社 Data distribution mediation device, data distribution mediation system, and data distribution mediation method
JP2019046036A (en) * 2017-08-31 2019-03-22 株式会社日立製作所 Data distribution method and data distribution base apparatus
JP2019144723A (en) * 2018-02-19 2019-08-29 日本電気株式会社 Anonymity processing device and information anonymity method and program
JP2019153060A (en) * 2018-03-02 2019-09-12 株式会社日立製作所 System, method and apparatus for information management
WO2019202705A1 (en) * 2018-04-19 2019-10-24 株式会社ウフル Persona data providing system, persona data providing method, program, and persona data providing device
JP2020035066A (en) * 2018-08-28 2020-03-05 株式会社Ye Digital Information concealment method, information concealment program, information concealment device, and information providing system
JP2021503117A (en) * 2017-12-26 2021-02-04 マインドウェアワークス カンパニー リミテッド Query processing service provision system based on personal information protection
JP2021026415A (en) * 2019-08-02 2021-02-22 ミサワホーム株式会社 Anonymization system
JP2021197064A (en) * 2020-06-18 2021-12-27 株式会社日立製作所 Data provision server device and data provision method
WO2022056628A1 (en) * 2020-09-16 2022-03-24 Surgical Safety Technologies Inc. Systems and methods for configuring and operating de-identification systems
JP7542769B1 (en) 2024-03-28 2024-08-30 Kddi株式会社 Information processing device, information processing method, and program
JP7579478B1 (en) 2024-05-17 2024-11-07 Kddi株式会社 Information processing device, information processing system, and information processing method

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10740488B2 (en) * 2017-11-17 2020-08-11 International Business Machines Corporation Cognitive data anonymization
JP7431098B2 (en) * 2020-04-17 2024-02-14 株式会社Nttドコモ information processing equipment

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2011113285A (en) * 2009-11-26 2011-06-09 Kddi Corp Privacy protection device for disclosed information, privacy protection method for disclosed information and program
JP2011128862A (en) * 2009-12-17 2011-06-30 Kddi Corp Device and method for protecting privacy for public information, and program
JP2011133958A (en) * 2009-12-22 2011-07-07 Michio Kimura Information processing system for calculating index value of degree of anonymity and method for calculating index value of degree of anonymity
JP2013178637A (en) * 2012-02-28 2013-09-09 Nippon Telegr & Teleph Corp <Ntt> Data verification apparatus, data verification method and program

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2011113285A (en) * 2009-11-26 2011-06-09 Kddi Corp Privacy protection device for disclosed information, privacy protection method for disclosed information and program
JP2011128862A (en) * 2009-12-17 2011-06-30 Kddi Corp Device and method for protecting privacy for public information, and program
JP2011133958A (en) * 2009-12-22 2011-07-07 Michio Kimura Information processing system for calculating index value of degree of anonymity and method for calculating index value of degree of anonymity
JP2013178637A (en) * 2012-02-28 2013-09-09 Nippon Telegr & Teleph Corp <Ntt> Data verification apparatus, data verification method and program

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
RYO KIKUCHI ET AL.: "t-test for privacy-preserved data", IEICE TECHNICAL REPORT, vol. 111, no. 470, 1 March 2012 (2012-03-01), pages 171 - 176 *

Cited By (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2018128913A (en) * 2017-02-09 2018-08-16 日本電信電話株式会社 Data distribution mediation device, data distribution mediation system, and data distribution mediation method
JP2019046036A (en) * 2017-08-31 2019-03-22 株式会社日立製作所 Data distribution method and data distribution base apparatus
JP7054555B2 (en) 2017-12-26 2022-04-14 マインドウェアワークス カンパニー リミテッド Query processing service provision system for personal information protection platform
JP2021503117A (en) * 2017-12-26 2021-02-04 マインドウェアワークス カンパニー リミテッド Query processing service provision system based on personal information protection
JP2019144723A (en) * 2018-02-19 2019-08-29 日本電気株式会社 Anonymity processing device and information anonymity method and program
JP7201326B2 (en) 2018-02-19 2023-01-10 日本電気株式会社 Anonymous processing device, information anonymization method, and program
JP2019153060A (en) * 2018-03-02 2019-09-12 株式会社日立製作所 System, method and apparatus for information management
JP6995667B2 (en) 2018-03-02 2022-01-14 株式会社日立製作所 Information management system, information management method and information management device
WO2019202705A1 (en) * 2018-04-19 2019-10-24 株式会社ウフル Persona data providing system, persona data providing method, program, and persona data providing device
JP2020035066A (en) * 2018-08-28 2020-03-05 株式会社Ye Digital Information concealment method, information concealment program, information concealment device, and information providing system
JP7154884B2 (en) 2018-08-28 2022-10-18 株式会社Ye Digital Information anonymization method, information anonymization program, information anonymization device, and information providing system
JP7149905B2 (en) 2019-08-02 2022-10-07 ミサワホーム株式会社 anonymization system
JP2021026415A (en) * 2019-08-02 2021-02-22 ミサワホーム株式会社 Anonymization system
JP2021197064A (en) * 2020-06-18 2021-12-27 株式会社日立製作所 Data provision server device and data provision method
JP7382902B2 (en) 2020-06-18 2023-11-17 株式会社日立製作所 Data provision server device and data provision method
WO2022056628A1 (en) * 2020-09-16 2022-03-24 Surgical Safety Technologies Inc. Systems and methods for configuring and operating de-identification systems
JP7542769B1 (en) 2024-03-28 2024-08-30 Kddi株式会社 Information processing device, information processing method, and program
JP7579478B1 (en) 2024-05-17 2024-11-07 Kddi株式会社 Information processing device, information processing system, and information processing method

Also Published As

Publication number Publication date
JPWO2016002086A1 (en) 2017-04-27
JP6263620B2 (en) 2018-01-17

Similar Documents

Publication Publication Date Title
JP6263620B2 (en) Anonymized data providing apparatus and method
Bazemore et al. “Community vital signs”: incorporating geocoded social determinants into electronic records to promote patient and population health
Studdert et al. Prevalence and characteristics of physicians prone to malpractice claims
Amaral et al. Improving decision-making and management of hospital resources: An application of the PROMETHEE II method in an Emergency Department
McKenzie et al. Classifying external causes of injury: history, current approaches, and future directions
Menzies-Gow et al. Tezepelumab compared with other biologics for the treatment of severe asthma: a systematic review and indirect treatment comparison
Mekhjian et al. Development of a web-based event reporting system in an academic environment
Lin et al. Tuberculosis as a risk factor for systemic lupus erythematosus: results of a nationwide study in Taiwan
Alhajeri et al. Limitations in and solutions for improving the functionality of picture archiving and communication system: an exploratory study of PACS professionals’ perspectives
US20160306999A1 (en) Systems, methods, and computer-readable media for de-identifying information
Sendyk et al. Selective outcome reporting in randomized clinical trials of dental implants
McHugh et al. Changes in patient flow among five hospitals participating in a learning collaborative
Kerr et al. Waning of first-and second-dose ChAdOx1 and BNT162b2 COVID-19 vaccinations: a pooled target trial study of 12.9 million individuals in England, Northern Ireland, Scotland and Wales
Brookfield et al. Q fever—the superstition of avoiding the word “quiet” as a coping mechanism: randomised controlled non-inferiority trial
Labori et al. Cost-effectiveness analysis of left atrial appendage occlusion in patients with atrial fibrillation and contraindication to oral anticoagulation
Gallier et al. Infrastructure and operating processes of PIONEER, the HDR-UK Data Hub in Acute Care and the workings of the Data Trust Committee: a protocol paper
Ferroni et al. Intensity of integrated primary and specialist home-based palliative care for chronic diseases in Northeast Italy and its impact on end-of-life hospital access
Top Physicians’ views and assessments on picture archiving and communication systems (pacs) in two turkish public hospitals
Foster et al. A spoonful of math helps the medicine go down: an illustration of how healthcare can benefit from mathematical modeling and analysis
Holzmueller et al. Development of a cloud-based application for the Fracture Liaison Service model of care
Martin et al. Construction of a demand and capacity model for intensive care and hospital ward beds, and mortality from COVID-19
Platt et al. Evaluation as part of operations: reconciling the common rule and continuous improvement
King Jr et al. Disparities in rates of spine surgery for degenerative spine disease between HIV-infected and uninfected veterans
Seo et al. Status of emergency signal functions in Myanmar hospitals: a cross-sectional survey
Avanceña et al. Achieving malaria testing and treatment targets for children under five in Mozambique: a cost-effectiveness analysis

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14896475

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2016530796

Country of ref document: JP

Kind code of ref document: A

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 14896475

Country of ref document: EP

Kind code of ref document: A1