WO2023286968A1

WO2023286968A1 - Method and device for de-identifying location information

Info

Publication number: WO2023286968A1
Application number: PCT/KR2022/003170
Authority: WO
Inventors: 유정범; 김명환; 정진우
Original assignee: 주식회사 메쉬코리아
Priority date: 2021-07-12
Filing date: 2022-03-07
Publication date: 2023-01-19
Also published as: KR102507480B1; KR20230010485A

Abstract

A method and a device for de-identifying location information are disclosed. A method for de-identifying location information, according to one embodiment of the present invention, may comprise the steps of: identifying an anonymity threshold value and an entire area including location information about users; dividing the entire area into a plurality of unit areas; determining the number of pieces of location information included in each of the unit areas; and generating de-identified areas by grouping the unit areas on the basis of the anonymity threshold value and the number of pieces of location information included in each of the unit areas.

Description

Location information de-identification method and device

The present invention relates to a method and apparatus for de-identifying location information, and more particularly, to a technique for maximizing anonymity and usability of de-identified data in de-identifying individual location information.

Recently, services provided using the results of analyzing big data are increasing. For example, the types of services using big data can provide convenience to users, and the types can be infinite.

However, since information such as address information, medical records, and personal information of users used as big data is personal information, legal restrictions such as individual consent may follow when using it. Therefore, a technique for de-identifying personal information is required.

In the technology of de-identifying personal information, if the degree of de-identification becomes excessively large, the utilization of de-identified data may decrease, and if the degree of de-identification is excessively low, personal information may not be identified. possibility, such usability and anonymity should be properly considered.

In the present invention, in de-identifying location information such as a user's address among personal information of users, the entire area is divided into a plurality of unit areas, and adjacent unit areas are grouped according to an anonymity threshold, thereby improving usability and anonymity. Provides a de-identification method and device that can maximize

In addition, the present invention provides a de-identification method and apparatus that enable multi-dimensional analysis by de-identifying location information to which different types of personal information are mapped to create a multi-dimensional de-identification area.

In addition, the present invention provides a de-identification method and apparatus capable of adjusting usability and anonymity by setting a unit area or an anonymity threshold differently according to embodiments.

A method for de-identifying location information according to an embodiment of the present invention includes identifying an entire region including location information of users and an anonymity threshold; Dividing the entire area into a plurality of unit areas; determining the number of location information included in each of the unit areas; and generating non-identified regions by grouping the unit regions based on the anonymity threshold and the number of location information included in each of the unit regions.

The number of generated de-identification regions may increase as the anonymity threshold is lower, and may decrease as the anonymity threshold is higher.

The generating of the non-identification areas may include grouping with a unit area adjacent to the random unit area when the number of pieces of location information included in any one of the unit areas is lower than the anonymity threshold. Identification area can be determined.

In the generating of the non-identification regions, when the number of location information included in the non-identification region is lower than the anonymity threshold, a unit region adjacent to the non-identification region and the non-identification region may be grouped. there is.

The number of location information included in each of the generated non-identification areas may be greater than or equal to the anonymity threshold.

The generating of the non-identification regions may include grouping the unit regions in a plurality of different ways to create combinations of a plurality of non-identification regions, and a usability evaluation result of the combinations of the generated non-identification regions The method may further include determining a combination of highest de-identification regions as a final de-identification result.

The generating of the non-identification regions may include generating combinations of a plurality of non-identification regions by grouping the unit regions in a plurality of different ways, and generating the non-identification regions among the combinations of the generated non-identification regions. The method may include determining a combination of de-identification regions whose number of regions is equal to or less than a predetermined reference number as a final de-identification result.

A method for de-identifying location information according to an embodiment of the present invention includes identifying a geographic area including location information of users belonging to a certain category; dividing the geographic area into a plurality of unit areas for each dimension; comparing the number of pieces of location information included in each of the unit areas with a preset anonymity threshold; generating a non-identification area by grouping the unit areas based on the comparison result; and i) combining the de-identification area and ii) a de-identification area generated from a geographic area including location information of users belonging to the arbitrary category and other categories to obtain a multi-dimensional non-identification area. can include

In the de-identification device for location information according to an embodiment of the present invention, the de-identification device includes a processor, the processor identifies an entire region including location information of users and an anonymity threshold; Dividing the entire area into a plurality of unit areas, determining the number of location information included in each of the unit areas, and based on the anonymity threshold and the number of location information included in each of the unit areas, Non-identification regions may be created by grouping the unit regions.

The processor, when the number of pieces of location information included in any unit area among the unit areas is lower than the anonymity threshold, may determine the non-identification area by grouping with a unit area adjacent to the arbitrary unit area. .

The processor may group the non-identification region with a unit region adjacent to the non-identification region when the number of pieces of location information included in the non-identification region is lower than the anonymity threshold.

The processor groups the unit regions in a plurality of different ways to generate combinations of a plurality of non-identification regions, and selects non-identification regions having the highest usability evaluation result among the generated combinations of non-identification regions. The combination can be determined as the final de-identification result.

The processor groups the unit regions in a plurality of different ways to generate a plurality of combinations of non-identification regions, and the number of non-identification regions among the generated combinations of non-identification regions is a preset reference number. and determining a combination of the following de-identification regions as a final de-identification result.

In an apparatus for de-identifying location information according to an embodiment of the present invention, the de-identification device includes a processor, wherein the processor identifies a geographic area including location information of users belonging to an arbitrary category; , Dividing the geographic area into a plurality of unit areas for each dimension, comparing the number of location information included in each of the unit areas with a preset anonymity threshold, and based on the result of the comparison, the unit area By grouping them, a de-identification area is created, i) the de-identification area and ii) a de-identification area created from a geographic area including location information of users belonging to the category different from the arbitrary category. By combining, it is possible to obtain a multi-dimensional non-identified area.

According to an embodiment of the present invention, in de-identifying location information such as the user's address among personal information of users, the entire area is divided into a plurality of unit areas and adjacent unit areas are grouped according to an anonymity threshold. , can maximize usability and anonymity.

In addition, according to an embodiment of the present invention, location information to which different types of personal information is mapped is de-identified to create a multi-dimensional de-identification area, thereby enabling multi-dimensional analysis of location information.

Further, according to an embodiment of the present invention, personal information may be de-identified by adjusting usability and anonymity by setting a unit area or an anonymity threshold differently according to embodiments. In addition, according to one embodiment of the present invention, location information of non-identified users may be used in analyzing the required time for each delivery distance.

1 is a diagram illustrating a de-identification device according to an embodiment of the present invention.

2 illustrates an example of the entire region and location information subject to de-identification according to an embodiment of the present invention.

3 illustrates an example of unit areas according to an embodiment of the present invention.

4 illustrates a process of grouping unit regions according to an embodiment of the present invention.

5 shows a result of de-identifying location information of users belonging to different categories according to an embodiment of the present invention.

6 is a flowchart illustrating a de-identification method according to an embodiment of the present invention.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. However, since various changes can be made to the embodiments, the scope of the patent application is not limited or limited by these embodiments. It should be understood that all changes, equivalents or substitutes to the embodiments are included within the scope of rights.

Terms used in the examples are used only for descriptive purposes and should not be construed as limiting. Singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, terms such as "include" or "have" are intended to designate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, but one or more other features It should be understood that the presence or addition of numbers, steps, operations, components, parts, or combinations thereof is not precluded.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by a person of ordinary skill in the art to which the embodiment belongs. Terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning in the context of the related art, and unless explicitly defined in the present application, they should not be interpreted in an ideal or excessively formal meaning. don't

In addition, in the description with reference to the accompanying drawings, the same reference numerals are given to the same components regardless of reference numerals, and overlapping descriptions thereof will be omitted. In describing the embodiment, if it is determined that a detailed description of a related known technology may unnecessarily obscure the gist of the embodiment, the detailed description will be omitted.

In the present invention, in de-identifying location information 105 such as the user's address among personal information of users, the entire area 103 is divided into a plurality of unit areas, and adjacent unit areas are divided according to an anonymity threshold. By grouping, it relates to a technique capable of maximizing usability and anonymity of de-identified location information (105).

Referring to FIG. 1 , the de-identification device 101 may include a processor 102 . The processor 102 of the de-identification device 101 may perform de-identification methods according to various embodiments of the present invention. Referring to FIG. 1 , the processor 102 may generate de-identification areas by de-identifying the entire area 103 including location information 105 of individuals.

The location information 105 means information about a user's location on a map. For example, the location information 105 may include the user's address, and may include latitude, longitude, and height of the user's location in 3D space. The location information 105 may have different meanings depending on the type or embodiment of the service.

For example, the user's location information 105 collected in relation to delivery and delivery services may include an address. The user's location information 105 collected from the application used by the rider handling the delivery may include the latitude and longitude of the parking location relative to the delivery address. Accordingly, the location information 105 is not limited to a specific example, and may mean a user's location on a 2D map or 3D space.

Users may refer to people who use services provided by an application or web. Location information 105 of users belonging to a certain category may be de-identified by a de-identification method according to an embodiment.

For example, users belonging to a certain category may mean users belonging to a category in which some items of personal information are common, such as men in their 20s and women in their 30s. When the location information 105 for several categories is de-identified, a multi-dimensional de-identification area in which de-identification areas for each category are combined may be created.

The entire area 103 may mean a 2-dimensional or 3-dimensional geographical area of a certain range. The range of the entire area 103 is determined based on the range of location information 105 to be de-identified, and the range of the entire area 103 may not be limited to a specific example. A specific example of the entire area 103 will be described later with reference to FIG. 2 .

Referring to FIG. 1 , an entire area 103 may include location information 105 of various uses. The de-identification device 101 may de-identify location information 105 of users to create a de-identification area. The non-identification area may refer to an area in which location information 105 of users has a certain range on the entire area 104, such as Zone 1 and Zone 2, in the entire area 104 of FIG. 1 .

In each non-identification area, location information 105 of several users may be included, but location information 105 of each user cannot be specified. According to one embodiment, as the number of location information 105 included in the non-identification area increases, it becomes difficult to identify each user, so anonymity may increase.

According to one embodiment, the non-identification area may include location information 105 equal to or greater than a preset anonymity threshold. The anonymity threshold may mean a numerical value representing the degree of de-identification. As an example, the anonymity threshold may be set to a positive natural number.

That is, the higher the anonymity threshold, the higher the anonymity of the de-identified location information 105, and the lower the de-identification and intensity, the lower the anonymity of the de-identified location information 105. Accordingly, the anonymity threshold may be set differently according to embodiments or utilization purposes, and is not limited to a specific example.

For example, when the anonymity threshold is 4, the non-identification area may be created such that the number of pieces of location information 105 included in the non-identification area is 4. A detailed process of generating the non-identification area by the de-identification device 101 will be described later with reference to FIG. 3 .

As an example, the de-identified location information 105 may be used for big data analysis. For example, in providing a delivery service, it is possible to predict the required time according to the delivery distance when a new delivery service occurs by analyzing de-identified data and delivery times of the addresses of users who have used the delivery service.

In other words, in the above example, if the addresses of users are de-identified by the same unit, it is difficult to predict the specific time required, and if the user's address is de-identified as it is, the user can be identified because the location is specified, and personal information issues may arise. Therefore, the non-identification method of the present invention, which can maximize usability and anonymity, can be used.

2 is a diagram showing an example of the entire area 200 including location information 201 . The entire area 200 may mean a 2-dimensional or 3-dimensional geographical area. In the case of FIG. 2 , the entire region 200 may be expressed as a two-dimensional map.

For example, in FIG. 2 , the location information 201 may include addresses of users, and may include latitude, longitude, and height of the user's location in 3D space. The location information 201 may have different meanings depending on the type or embodiment of the service. The location information 201 may be de-identified according to various embodiments of the present invention because the user's personal information such as address may be exposed.

The de-identification device may identify the entire area 200 including the location information 201 of users and divide the entire area 200 into a plurality of unit areas. An example of the separated unit area will be described later with reference to FIG. 3 .

As an example, in (a)-(c) of FIG. 3 , on the 2D map 300, the entire area 301-303 is divided into unit areas 311-313 of different shapes according to various embodiments. It may be a drawing showing that. According to various embodiments, the non-identification device may divide the entire area 301 to 303 including location information into unit areas of various types.

(a) of FIG. 3 may show a case in which the entire area 301 is divided into unit areas 311 having a square shape. (b) of FIG. 3 may show a case in which the entire area 302 is divided into unit areas 312 having regular hexagonal shapes. (c) of FIG. 3 may show a case in which the entire area 303 is divided into polygonal unit areas 313 .

For example, the de-identification device may separate all ranges of the entire area 301-303 into unit areas 311-313. That is, the de-identification device may divide the entire area 301-303 into unit areas 311-313 without gaps. However, the widths or volumes of all unit areas 311 to 313 may not be the same.

The de-identification device may divide the entire region 301 to 303 into unit regions 311 to 313 so that the adjacent unit regions 311 to 313 share one or more edges or faces. Depending on embodiments, unit regions 311 to 313 of various shapes may be used within the condition that one or more edges or faces are shared between adjacent unit regions 311 to 313 . As another example, when the entire area in the 3D space is identified, the de-identification device may separate the entire area into unit areas of 3D polyhedrons.

Each of the unit areas 311 to 313 may include location information about several users. Location information included in each unit area 311 to 313 may be de-identified as a non-identification area. The de-identification device generates non-identification areas by grouping the unit areas 311 to 313 based on the anonymity threshold and the number of location information included in each of the unit areas 311 to 313. can A detailed de-identification process of location information will be described later with reference to FIG. 4 .

As an example, referring to FIG. 4 , the non-identification device may identify the entire region 410 including location information of users on the 2D map 400 . As an example, the processor of the de-identification device may load map data corresponding to the entire region 410 and data about location information of users from the memory of the de-identification device.

The de-identification device may divide the entire area 410 into a plurality of unit areas 411 . As an example, referring to FIG. 4 , the de-identification device may divide the entire area 410 into square unit areas 411 .

The non-identification device may determine the number of pieces of location information included in each unit area 411 . For example, the non-identification device may determine the number of pieces of location information belonging to each unit area 411 by considering the boundary of each unit area 411 and the latitude and longitude included in the pieces of location information.

For example, the number of pieces of location information included in the unit area 411 to which a residential area, such as an apartment or a residential area, where users may be concentrated is included, is the location included in the unit area 411 to which a natural area, such as a river or a mountain, belongs. It can be greater than the number of pieces of information.

Referring to FIG. 4 , the number of pieces of location information included in each unit area 411 of the entire area 420 may be determined. The non-identification device may identify a preset anonymity threshold 401 . The de-identification device generates non-identified regions 431-441 by grouping the unit regions 411 based on the anonymity threshold 401 and the number of location information included in each of the unit regions 411. can do.

When the number of location information included in any unit area 411 among the unit areas 411 is lower than the anonymity threshold 401, the unit area adjacent to the arbitrary unit area 411 ( 411) and non-identification areas 431 to 441 may be determined.

When the number of location information included in the non-identification area 431-441 is lower than the anonymity threshold 401, the non-identification device identifies the unit area 411 adjacent to the non-identification area 431-441 and the non-identification area 431-441. Identification areas 431-441 can be grouped.

That is, when the number of location information included in the grouped unit areas 411 is equal to or higher than the anonymity threshold 401, the non-identification device sets the grouped unit area 411 to the non-identification area 431. -441) can be determined.

For example, the non-identification device may compare the number of location information included in each of the unit areas 411 with a preset anonymity threshold 401 . For example, the non-identification device may first select an arbitrary unit area 411 and compare the number of location information included in the arbitrary unit area 411 with the anonymity threshold 401 .

For example, the non-identification device selects the unit area 411 that includes the most location information among the unit areas 411, and sets the number of location information included in the selected unit area 411 to the anonymity threshold 401. ) can be compared with

When the number of location information included in the selected unit area 411 is greater than or equal to the anonymity threshold 401, the de-identification device divides the selected unit area 411 into non-identified areas 431-441 without separate grouping. ) can be determined.

For example, when the number of location information included in the selected unit area 411 is smaller than the anonymity threshold 401, the de-identification device determines whether unit areas 411 adjacent to the selected unit area 411 or non-identification Any one of the unit regions 411 or non-identified regions 431 to 441 of the regions 431 to 441 may be determined.

For example, when the number of location information included in the selected unit area 411 is smaller than the anonymity threshold 401, the de-identification device determines whether unit areas 411 adjacent to the selected unit area 411 or non-identification Among the regions 431 to 441 , a unit region 411 or a non-identified region 431 to 441 having the largest number of location information may be determined.

The de-identification device may create a new non-identified area 431-441 by grouping the selected unit area 411 and the determined unit area 411 or non-identified areas 431-441. Then, the de-identification device, until the number of location information included in the grouped unit areas 411 is greater than or equal to the anonymity threshold 401, the generated de-identification areas 431-441, adjacent It can be combined with the unit area 411 or non-identified areas 431-441.

For example, a breadth-first search may be used for grouping the unit areas 411 . For example, the non-identification device, based on a random unit area 411, until the number of location information is equal to or higher than the anonymity threshold 401, the adjacent unit area 411 or non-identification area 431 -441).

In determining the grouping of the unit area 411, a greedy algorithm may be used. That is, in the process of grouping the unit area 411, when the number of location information included in the grouped unit areas 411 is greater than or equal to the anonymity threshold 401, the non-identification device sets the anonymity threshold ( 401) may be satisfied, and the grouped unit regions 411 may be determined as non-identified regions 431 to 441.

Then, the de-identification device performs a breadth-first search again on an arbitrary unit area 411 among the unit areas 411 not determined as non-identified areas 431 to 441 to find the unit areas 411. can be grouped.

Accordingly, the non-identified regions 431 to 441 may group the unit regions 411 such that all unit regions 411 belong to one of the non-identified regions 431 to 441 . The number of location information included in each of the generated non-identification areas 431 to 441 may be greater than or equal to the anonymity threshold 401 . Referring to FIG. 4 , the entire area 430 may include a plurality of non-identified areas 431-441.

For example, the non-identification device may generate a graph in which each unit region 411 is a vertex and a corner shared between adjacent unit regions 411 is an edge. The value of each vertex may be determined by the number of location information included in the unit area 411 corresponding to the vertex.

The de-identification device performs a breadth-first search on the basis of a random vertex in the generated graph until the sum of the values of the selected vertices is greater than the anonymity threshold 401 to group vertices that satisfy the condition. can

The de-identification device may generate de-identification areas 431-441 such that the number of de-identification areas 431-441 increases as the anonymity threshold 401 decreases. That is, the number of finally determined non-identified regions 431 to 441 may increase as the anonymity threshold 401 decreases.

The de-identification device may generate de-identification areas 431-441 such that the number of de-identification areas 431-441 decreases as the anonymity threshold 401 increases. That is, the number of finally determined non-identified regions 431 to 441 may decrease as the anonymity threshold 401 increases.

For example, in the grouping of the unit areas 411, different combinations of non-identified areas 431 to 441 may be generated according to the starting position of the initially selected unit area 411 or the direction of breadth-first search. there is. That is, under the condition that the number of location information included in all de-identification areas 431-441 is greater than or equal to the anonymity threshold 401, various combinations of de-identification areas 431-441 may be generated.

The de-identification device groups the unit regions 411 in a plurality of different ways to generate combinations of a plurality of non-identification regions 431-441, and combinations of the generated non-identification regions 431-441. Among them, a combination of de-identification regions 431 to 441 having the highest usability evaluation result may be determined as the final de-identification result.

For example, a data usability index function may be used for usability evaluation. As an example, the de-identification device determines the value of the data usability index function for each combination of a plurality of non-identification regions 431-441, and the non-identification region having the largest value of the data usability index function ( 431-441) can be determined as the final de-identification result.

Alternatively, as an example, a data usability index function may be used for usability evaluation. As an example, the non-identification device determines the value of the data availability index function for each combination of a plurality of non-identification regions 431-441, and the case where the argmax value of the value of the data availability index function is the largest. A combination of the de-identification regions 431 to 441 may be determined as a final de-identification result.

Alternatively, the de-identification device groups the unit regions 411 in a plurality of different ways to generate combinations of a plurality of non-identification regions 431 to 441, and generates combinations of the non-identification regions 431 to 441. A combination of non-identified regions 431 to 441 in which the number of non-identified regions 431 to 441 is equal to or less than a predetermined reference number among combinations of , may be determined as a final de-identification result.

The de-identification device may generate non-identification regions 431 to 441 such that the number of non-identification regions 431 to 441 is less than or equal to a preset reference number. That is, the resolution of de-identified data can be guaranteed due to the number limitation.

For example, users belonging to a category may refer to users belonging to a category in which some items of personal information are common, such as a man in his twenties and a woman in her thirties. When location information of users for several categories is de-identified, de-identification areas 501 to 503 for each category may be determined. Also, the de-identification device may generate a multi-dimensional de-identification area 504 by combining the de-identification areas 501 to 503 for each category.

According to one embodiment of the present invention, various types of personal information can be comprehensively used together with location information. The de-identification process for each category may be the same as the de-identification process described above. The multi-dimensional non-identification area 504 according to an embodiment of the present invention can be used for big data analysis for various services.

In step 601, the de-identification device may identify the entire area including location information and an anonymity threshold. In step 602, the non-identification device may divide the entire area into a plurality of unit areas.

The de-identification device may divide the entire area into unit areas without gaps. However, the width or volume of all unit areas may not be the same. The de-identification device may divide the entire area into unit areas so that adjacent unit areas share one or more edges or faces. Depending on embodiments, unit regions of various shapes may be used within the condition that one or more edges or faces are shared between adjacent unit regions.

In step 603, the non-identification device may determine the number of location information included in each of the unit areas. In step 604, the de-identification device may generate non-identification areas by grouping the unit areas based on the anonymity threshold and the number of location information included in each unit area.

When the number of location information items included in any unit area among unit areas is lower than the anonymity threshold, the de-identification device may determine the non-identification area by grouping the unit area adjacent to the arbitrary unit area.

When the number of location information included in the non-identification area is lower than the anonymity threshold, the non-identification device may group the unit area adjacent to the non-identification area and the non-identification area.

That is, the de-identification device may determine the grouped unit area as a non-identification area when the number of location information included in the grouped unit area is equal to or higher than the anonymity threshold.

For example, the de-identification device may compare the number of pieces of location information included in each of the unit areas with a preset anonymity threshold. For example, the non-identification device may first select an arbitrary unit area and compare the number of location information included in the arbitrary unit area with an anonymity threshold.

For example, the non-identification device may select a unit area including the most location information among unit areas and compare the number of location information included in the selected unit area with an anonymity threshold. When the number of location information included in the selected unit area is greater than or equal to the anonymity threshold, the de-identification device may determine the selected unit area as a non-identification area without separate grouping.

The de-identification device groups the unit areas in a plurality of different ways to generate combinations of a plurality of de-identification areas, and selects non-identification areas having the highest usability evaluation result among the generated combinations of de-identification areas. The combination can be determined as the final de-identification result.

For example, a data usability index function may be used for usability evaluation. For example, the de-identification device determines the value of the data usability index function for each combination of a plurality of non-identification regions, and determines the combination of the non-identification regions having the largest value of the data usability index function as the final ratio. It can be determined as a result of identification.

Meanwhile, the method according to the present invention is written as a program that can be executed on a computer and can be implemented in various recording media such as magnetic storage media, optical reading media, and digital storage media.

Implementations of the various techniques described herein may be implemented in digital electronic circuitry, or in computer hardware, firmware, software, or combinations thereof. Implementations may be a computer program product, i.e., an information carrier, e.g., a machine-readable storage, for processing by, or for controlling, the operation of a data processing apparatus, e.g., a programmable processor, computer, or plurality of computers. It can be implemented as a computer program tangibly embodied in a device (computer readable medium) or a radio signal. A computer program, such as the computer program(s) described above, may be written in any form of programming language, including compiled or interpreted languages, and may be written as a stand-alone program or in a module, component, subroutine, or computing environment. It can be deployed in any form, including as other units suitable for the use of. A computer program can be deployed to be processed on one computer or multiple computers at one site or distributed across multiple sites and interconnected by a communication network.

Processors suitable for processing a computer program include, by way of example, both general and special purpose microprocessors, and any one or more processors of any kind of digital computer. Generally, a processor will receive instructions and data from read only memory or random access memory or both. Elements of a computer may include at least one processor that executes instructions and one or more memory devices that store instructions and data. In general, a computer may include, receive data from, send data to, or both, one or more mass storage devices that store data, such as magnetic, magneto-optical disks, or optical disks. It can also be combined to become. Information carriers suitable for embodying computer program instructions and data include, for example, semiconductor memory devices, for example, magnetic media such as hard disks, floppy disks and magnetic tapes, compact disk read only memory (CD-ROM) ), optical media such as DVD (Digital Video Disk), magneto-optical media such as Floptical Disk, ROM (Read Only Memory), RAM (RAM) , Random Access Memory), flash memory, EPROM (Erasable Programmable ROM), EEPROM (Electrically Erasable Programmable ROM), and the like. The processor and memory may be supplemented by, or included in, special purpose logic circuitry.

In addition, computer readable media may be any available media that can be accessed by a computer, and may include both computer storage media and transmission media.

Although this specification contains many specific implementation details, they should not be construed as limiting on the scope of any invention or what is claimed, but rather as a description of features that may be unique to a particular embodiment of a particular invention. It should be understood. Certain features that are described in this specification in the context of separate embodiments may also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable subcombination. Further, while features may operate in particular combinations and are initially depicted as such claimed, one or more features from a claimed combination may in some cases be excluded from that combination, and the claimed combination is a subcombination. or sub-combination variations.

Similarly, while actions are depicted in the drawings in a particular order, it should not be construed as requiring that those actions be performed in the specific order shown or in the sequential order, or that all depicted actions must be performed to obtain desired results. In certain cases, multitasking and parallel processing can be advantageous. Further, the separation of various device components in the embodiments described above should not be understood as requiring such separation in all embodiments, and the program components and devices described may generally be integrated together into a single software product or packaged into multiple software products. You have to understand that you can.

On the other hand, the embodiments of the present invention disclosed in this specification and drawings are only presented as specific examples to aid understanding, and are not intended to limit the scope of the present invention. In addition to the embodiments disclosed herein, it is obvious to those skilled in the art that other modified examples based on the technical idea of the present invention can be implemented.

Claims

In the non-identification method of location information,

identifying a total region containing location information of users and an anonymity threshold;

Dividing the entire area into a plurality of unit areas;

determining the number of location information included in each of the unit areas; and

Generating non-identification regions by grouping the unit regions based on the anonymity threshold and the number of location information included in each of the unit regions.

Non-identification method comprising a.
According to claim 1,

The number of generated non-identification regions is

The method of de-identification, which increases as the anonymity threshold is lower and decreases as the anonymity threshold is higher.
According to claim 1,

The step of creating the non-identified areas,

When the number of pieces of location information included in an arbitrary unit area among the unit areas is lower than the anonymity threshold, determining the non-identification area by grouping with a unit area adjacent to the arbitrary unit area, the de-identification method .
According to claim 1,

The step of creating the non-identified areas,

When the number of location information included in the non-identification region is lower than the anonymity threshold, grouping the non-identification region with a unit region adjacent to the non-identification region.
According to claim 1,

The number of location information included in each of the generated de-identification areas is greater than or equal to the anonymity threshold.
According to claim 5,

The step of creating the non-identified areas,

generating combinations of a plurality of non-identification regions by grouping the unit regions in a plurality of different ways;

The de-identification method further comprises determining a combination of de-identification regions having the highest usability evaluation result among the generated combinations of de-identification regions as a final de-identification result.
According to claim 5,

The step of creating the non-identification areas,

generating combinations of a plurality of non-identification regions by grouping the unit regions in a plurality of different ways;

And determining a combination of de-identification regions in which the number of de-identification regions is equal to or less than a predetermined reference number among the generated combinations of de-identification regions as a final de-identification result.
In the non-identification method of location information,

identifying a geographic area containing location information of users belonging to a certain category;

dividing the geographic area into a plurality of unit areas for each dimension;

comparing the number of pieces of location information included in each of the unit areas with a preset anonymity threshold;

generating a non-identification area by grouping the unit areas based on the comparison result; and

obtaining a multi-dimensional non-identification area by combining i) the de-identification area and ii) a de-identification area generated from a geographic area including location information of users belonging to the arbitrary category and other categories;

Non-identification method comprising a.
According to claim 8,

The number of generated non-identification regions is

The method of de-identification, which increases as the anonymity threshold is lower and decreases as the anonymity threshold is higher.
According to claim 8,

The step of creating the non-identification areas,

When the number of pieces of location information included in an arbitrary unit area among the unit areas is lower than the anonymity threshold, determining the non-identification area by grouping with a unit area adjacent to the arbitrary unit area, the de-identification method .
According to claim 8,

The step of creating the non-identified areas,

When the number of location information included in the non-identification region is lower than the anonymity threshold, grouping the non-identification region with a unit region adjacent to the non-identification region.
According to claim 8,

The number of location information included in each of the generated de-identification areas is greater than or equal to the anonymity threshold.
In the non-identification device of location information,

The de-identification device includes a processor,

the processor,

Identifying an entire area including location information of users and an anonymity threshold, dividing the entire area into a plurality of unit areas, determining the number of location information included in each of the unit areas, and determining the anonymity threshold and generating non-identification regions by grouping the unit regions based on the number of location information included in each of the unit regions.

de-identification device.
According to claim 13,

The number of generated non-identification regions is

The de-identification device increases as the anonymity threshold is lower and decreases as the anonymity threshold is higher.
According to claim 13,

the processor,

When the number of pieces of location information included in an arbitrary unit area among the unit areas is lower than the anonymity threshold, the de-identification device determines the non-identification area by grouping with a unit area adjacent to the arbitrary unit area. .
According to claim 13,

the processor,

When the number of location information included in the non-identification region is lower than the anonymity threshold, grouping the non-identification region with a unit region adjacent to the non-identification region, the non-identification device.
According to claim 13,

The number of location information included in each of the generated de-identification areas is greater than or equal to the anonymity threshold.
According to claim 17,

the processor,

Combinations of a plurality of non-identification regions are created by grouping the unit regions in a plurality of different ways, and a combination of non-identification regions having the highest usability evaluation result among the combinations of the generated non-identification regions is selected as a final result. A de-identification device determined by the de-identification result.
According to claim 17,

the processor,

Combinations of a plurality of de-identification regions are created by grouping the unit regions in a plurality of different ways, and de-identification in which the number of de-identification regions among the generated combinations of de-identification regions is equal to or less than a preset reference number and determining a combination of regions as a final de-identification result.
In the non-identification device of location information,

The de-identification device includes a processor,

the processor,

A geographic area including location information of users belonging to a certain category is identified, the geographic area is divided into a plurality of unit areas for each dimension, the number of location information items included in each of the unit areas and a preset anonymity A gender threshold is compared, and based on the result of the comparison, the unit regions are grouped to generate a non-identified region, i) the non-identified region and ii) a category different from the arbitrary category Obtaining a multi-dimensional non-identification area by combining de-identification areas generated from geographical areas including location information of belonging users,

de-identification device.