JP2021163014A - Generation method, generation program, and generation device - Google Patents

Abstract

To provide a generation device capable of obtaining useful anonymous data.SOLUTION: A generation device 100 identifies one or more pieces of personal data whose degree of anonymity does not meet certain criteria out of multiple personal data by using a first anonymization model 110 based on the anonymizing result of personal data contained in multiple personal data. The generation device 100 learns a second anonymization model 120 based on the identified one or more personal data. The generation device 100 generates one or more pieces of anonymous data having higher anonymity than each personal data of one or more pieces of personal data based on the identified one or more pieces of personal data. The generation device 100 outputs a piece of new anonymous data obtained by anonymizing each anonymous data of one or more pieces of generated anonymous data using the learned second anonymization model 120.SELECTED DRAWING: Figure 1

Description

The present invention relates to a generation method, a generation program, and a generation device.

Conventionally, in order to protect privacy, there is an anonymization method for anonymizing and outputting personal data (PII: Personally Identity Information). For example, after processing personal data to generate anonymous data, the generated anonymous data is subjected to a privacy test, and it is generated only when it is determined that anonymity is ensured for the original personal data. There is an anonymization method that outputs anonymous data.

As the prior art, for example, with respect to the data included in the first data group, when the number of data having a predetermined relationship is N or more, a plurality of data having a predetermined relationship may be output.

Japanese Unexamined Patent Publication No. 2014-016675

However, in the prior art, the usefulness of the output anonymous data may be impaired. For example, when a privacy test is performed, only anonymous data generated based on some personal data among a plurality of personal data may be output. As a result, a plurality of output anonymous data may become unfavorable data in statistical processing. Specifically, the histogram showing the feature distribution of a plurality of personal data and the histogram showing the feature distribution of a plurality of output anonymous data may not be similar.

In one aspect, the invention aims to obtain useful anonymous data.

According to one embodiment, the degree of anonymity among the plurality of personal data is determined based on the result of anonymizing the personal data contained in the plurality of personal data by the first anonymization model for anonymizing the information. One or more personal data that do not meet a predetermined criterion are specified, and based on the specified one or more personal data, a second anonymization model for anonymizing information is learned, and the specified one or more personal data is specified. Based on the above, one or more anonymous data having a higher degree of anonymity than each personal data of the one or more personal data is generated, and the one or more anonymous data generated by the second anonymization model learned is generated. A generation method, a generation program, and a generation device for outputting new anonymous data obtained by anonymizing each of the anonymous data of the above are proposed.

According to one aspect, it is possible to obtain useful anonymous data.

FIG. 1 is an explanatory diagram (No. 1) showing an embodiment of the generation method according to the embodiment. FIG. 2 is an explanatory diagram (No. 2) showing an embodiment of the generation method according to the embodiment. FIG. 3 is an explanatory diagram showing an example of the data utilization system 300. FIG. 4 is a block diagram showing a hardware configuration example of the generation device 100. FIG. 5 is an explanatory diagram showing an example of the stored contents of the data management table 500. FIG. 6 is a block diagram showing a functional configuration example of the generator 100. FIG. 7 is an explanatory diagram showing a first operation example of the generator 100. FIG. 8 is an explanatory diagram showing a second operation example of the generator 100. FIG. 9 is an explanatory diagram showing a third operation example of the generator 100. FIG. 10 is an explanatory diagram showing an example of a membership inclusion attack. FIG. 11 is an explanatory diagram (No. 1) showing a first example of the shape of the histogram to be compared. FIG. 12 is an explanatory diagram (No. 2) showing a first example of the shape of the histogram to be compared. FIG. 13 is an explanatory diagram (No. 3) showing a first example of the shape of the histogram to be compared. FIG. 14 is an explanatory diagram (No. 4) showing a first example of the shape of the histogram to be compared. FIG. 15 is an explanatory diagram (No. 1) showing a second example of the shape of the histogram to be compared. FIG. 16 is an explanatory diagram (No. 2) showing a second example of the shape of the histogram to be compared. FIG. 17 is an explanatory diagram (No. 3) showing a second example of the shape of the histogram to be compared. FIG. 18 is a flowchart showing an example of the preparatory processing procedure. FIG. 19 is a flowchart showing an example of the test processing procedure. FIG. 20 is a flowchart showing an example of the branch processing procedure. FIG. 21 is a flowchart showing an example of the reuse processing procedure.

Hereinafter, embodiments of a generation method, a generation program, and a generation apparatus according to the present invention will be described in detail with reference to the drawings.

(An example of a generation method according to an embodiment)
1 and 2 are explanatory views showing an embodiment of the generation method according to the embodiment. In FIG. 1, the generation device 100 is a computer that generates and outputs anonymous data based on the personal data while ensuring the anonymity of the personal data.

Conventionally, when anonymity data is generated and output by processing personal data, a privacy test may be carried out in order to ensure the anonymity of the personal data. For example, the anonymous data generated based on the personal data will be output only when the privacy test determines that the anonymity of the personal data is ensured.

Specifically, a safety called (k, γ) PD (Plausible Deniability) that sets the criteria for the usefulness of anonymous data and the anonymity of personal data by conducting a privacy test on personal data. There is a sexual index. Here, the description shifts to FIG. 2, and the flow of processing performed by the conventional (k, γ) PD will be described.

In FIG. 2, (k, γ) PD obtains anonymous data y = M (d) by applying a probabilistic differential privacy algorithm M to personal data d randomly selected from personal data group D. Generate. (K, γ) PD performs a privacy test on the generated anonymous data y. Privacy tests may have usefulness requirements set.

The (k, γ) PD is generated anonymously if, for example, other personal data d containing the same attribute value as the personal data d exists in the personal data group D by k or more (k> 1). It is determined that the data y can be output, and the data y is added to the release data set. On the other hand, in the (k, γ) PD, for example, if there is no other personal data d containing the same attribute value as the personal data d in the personal data group D by k or more (k> 1), It is determined that the generated anonymous data y cannot be output and is discarded.

Further, the (k, γ) PD may use a randomized parameter k + Lap (1 / ε ⁰ ) instead of the parameter k in order to prevent an attack that estimates the parameter k. Lap (・) is a random number generation mechanism based on the Laplace distribution.

k is a parameter indicating how many or more other personal data d having the same attribute value as the personal data d is preferable from the viewpoint of anonymity. The larger the value of k, the more difficult it is to identify the individual corresponding to the personal data d.

γ is a parameter of the stochastic differential privacy algorithm M. γ is a parameter that defines the noise value stochastically given to the personal data d. The smaller the value of γ, the larger the noise value given to the personal data d. The smaller the noise value, the higher the risk of identifying which personal data d the anonymous data y was generated from.

ε ⁰ is a parameter that defines a random noise value given to k. The ^{smaller the value of ε 0} , the stronger the resistance to membership inclusion attacks. An example of a membership inclusion attack will be specifically described later with reference to FIG.

Further, for (k, γ) PD, for example, the following Non-Patent Document 1 can be referred to. In addition to (k, γ) PD, there is also a safety index called (k, δ) PD. For (k, δ) PD, for example, the following Non-Patent Document 2 can be referred to.

Non-Patent Document 1: Bindschaedler, Vincent, Reza Shokri, and Carl A. et al. Gunter. “Plausible deniaviity for privacy-preserving data synthesis.” ArXiv preprint arXiv: 1708.07975 (2017).

Non-Patent Document 2: Bindschaedler, Vincent, and Reza Shokri. “Synthesis symposium privacy-preserving location races.” 2016 IEEE Symposium on Security and Privacy (SP). IEEE, 2016.

However, in the past, the usefulness of anonymous data may be impaired. For example, when a privacy test is performed, only anonymous data generated based on some personal data among a plurality of personal data may be output. As a result, a plurality of output anonymous data may become unfavorable data in statistical processing. Specifically, the histogram showing the feature distribution of a plurality of personal data and the histogram showing the feature distribution of a plurality of output anonymous data may not be similar. Specifically, the histogram will be described later with reference to FIGS. 11 to 17.

More specifically, in (k, γ) PD, it is difficult to adjust the ^{parameters k, γ, ε 0} so as to balance the usefulness of anonymous data and the anonymity of personal data in a well-balanced manner. Here, in (k, γ) PD, no matter how the parameters k, γ, ε ⁰ are adjusted, either the usefulness of the anonymous data or the anonymity of the personal data tends to be impaired.

In particular, if the value of the parameter k is increased in order to ensure the anonymity of the personal data, the number of personal data that is the source of generating the anonymous data that can be output decreases, and the plurality of output anonymous data are statistically processed. It becomes unfavorable data in. For example, the histogram showing the feature distribution of a plurality of personal data and the histogram showing the feature distribution of a plurality of output anonymous data become dissimilar, and the plurality of output anonymous data becomes unfavorable data in statistical processing. ..

In addition, the user may arbitrarily perform a privacy test in order to improve the usefulness of anonymous data in consideration of the histogram. For example, the user repeatedly performs a privacy test for specific personal data until the parameter k + Lap (1 / ε ⁰ ) happens to take a large value, and outputs anonymous data generated based on the specific personal data. I may try. In this case, the anonymity of personal data may be impaired.

Further, as a result of the histogram showing the feature distribution of a plurality of personal data and the histogram showing the feature distribution of a plurality of output anonymous data becoming dissimilar, the anonymity of the personal data may be impaired. Since anonymous data is generated in a relatively large amount based on a relatively small amount of personal data, there is a tendency that the risk of identifying an individual based on anonymous data is high.

Therefore, in the present embodiment, a generation method that can improve the usefulness of the output anonymous data will be described.

Returning to the description of FIG. 1, the generation device 100 stores a plurality of personal data in the DB (DataBase) 101. Personal data includes, for example, values that indicate some characteristic of the individual. The generation device 100 stores the first anonymization model 110. The first anonymization model 110 is a model for anonymizing information. Anonymization corresponds to processing. The first anonymization model 110 is, for example, a model that generates one or more anonymous data obtained by adding a random noise value to a value included in personal data. The first anonymization model 110 is, for example, a stochastic differential privacy algorithm.

(1-1) The generation device 100 is based on the result of anonymizing the personal data included in the plurality of personal data by the first anonymization model 110, and the degree of anonymity is a predetermined criterion among the plurality of personal data. Identify one or more personal data that does not meet. The predetermined criteria are, for example, privacy test criteria. In the following description, satisfying the predetermined criteria may be described as "OK", and not satisfying the predetermined criteria may be described as "NG". One or more personal data whose degree of anonymity does not meet a predetermined criterion is stored in, for example, NG-DB102.

The generation device 100 randomly selects, for example, personal data included in a plurality of personal data. For example, each time the personal data is selected, the generation device 100 generates one or more anonymous data by the first anonymization model 110 based on the selected personal data. The generation device 100 conducts a privacy test based on, for example, one or more anonymous data, and determines whether or not the degree of anonymity of the personal data from which the one or more anonymous data is generated satisfies a predetermined criterion. judge. The generation device 100 identifies, for example, one or more personal data whose anonymity degree does not satisfy a predetermined criterion among a plurality of personal data based on the determination result.

(1-2) The generation device 100 learns the second anonymization model 120 based on one or more specified personal data. The second anonymization model 120 is a model for anonymizing information. The second anonymization model 120 is a model for anonymizing information. The second anonymization model 120 is a model that generates one or more new anonymity data obtained by adding a random noise value to the value included in the anonymity data. The second anonymization model 120 is, for example, a stochastic differential privacy algorithm. The second anonymization model 120 is, for example, the same algorithm as the first anonymization model 110. The generator 100 learns a second anonymization model 120, for example, based on the variance and average of the values contained in one or more identified personal data.

(1-3) The generation device 100 generates one or more anonymous data having a higher degree of anonymity than each personal data of the one or more personal data based on the specified one or more personal data. One or more anonymous data is stored in, for example, MA-DB103. MA means microaggregation. The generator 100 performs, for example, microaggregation to generate one or more anonymous data.

Specifically, the generation device 100 calculates a statistical value regarding a value included in each personal data of one or more specified personal data. The statistic is, specifically, an average value, a maximum value, a minimum value, a median value, a mode value, or the like. Specifically, the generation device 100 generates one or more anonymous data by replacing the value included in each personal data of the specified one or more personal data with the calculated statistical value.

(1-4) The generation device 100 outputs new anonymous data obtained by anonymizing each anonymous data of one or more generated anonymous data by the learned second anonymization model 120. The output destination is, for example, release DB 104. The generation device 100 generates and outputs new anonymous data by the second anonymization model 120 based on each anonymous data of one or more anonymous data, for example. At this time, the generation device 100 may also output the anonymity data generated by the first anonymization model 110 based on the personal data satisfying a predetermined criterion among the plurality of personal data, for example. ..

As a result, the generation device 100 can obtain useful anonymous data, and can achieve both the usefulness of the anonymous data and the anonymity of the personal data.

The generation device 100 can generate new anonymity data based on personal data whose degree of anonymity is determined not to meet a predetermined criterion by, for example, a privacy test. Therefore, the generation device 100 can, for example, convert a plurality of output anonymous data into preferable data in statistical processing. Specifically, the generation device 100 can bring the histogram showing the feature distribution of a plurality of personal data and the histogram showing the feature distribution of a plurality of output anonymous data close to each other.

Further, for example, the generation device 100 converts personal data for which the degree of anonymity is determined not to satisfy a predetermined criterion into anonymous data in a format having a higher degree of anonymity, and then uses the second anonymization model 120. , New anonymous data can be generated. Therefore, the generation device 100 can facilitate, for example, ensuring the anonymity of personal data.

The generation device 100 can learn the second anonymization model 120 based on, for example, one or more personal data whose anonymity degree does not satisfy a predetermined criterion among a plurality of personal data. The generation device 100 can generate new anonymized data by, for example, the second anonymization model 120. Therefore, the generation device 100 can, for example, convert a plurality of output anonymous data into preferable data in statistical processing. Specifically, the generation device 100 specifically displays, for example, a histogram showing a feature distribution of personal data whose anonymity degree does not meet a predetermined criterion, and a feature distribution of new anonymous data generated by the second anonymization model 120. It can be brought closer to the histogram shown.

The generation device 100 can generate and output anonymous data based on personal data that can be normally determined to be NG. Therefore, the generation device 100 can prevent the user from arbitrarily performing the privacy test in order to improve the usefulness of the anonymous data, and can ensure the anonymity of the personal data. can.

As described above, the generation device 100 has both the usefulness of anonymous data and the anonymity of personal data, and provides a DB of anonymous data that is considered to cause no problem even if it is distributed to the outside and referred to by a third party. Can be generated. Therefore, the generator 100 can be used in the field of statistical analysis or machine learning.

In addition, the generation device 100 can improve the method of performing the privacy test. The generator 100 can improve the method such as (k, γ) PD or (k, δ) PD. The generator 100 can improve the method of performing the privacy test other than (k, γ) PD and (k, δ) PD.

(Example of data utilization system 300)
Next, an example of the data utilization system 300 to which the generation device 100 shown in FIG. 1 is applied will be described with reference to FIG.

FIG. 3 is an explanatory diagram showing an example of the data utilization system 300. In FIG. 3, the data utilization system 300 includes a generation device 100, a data provider device 301, and a data utilization side device 302.

In the data utilization system 300, the generation device 100 and the data provider device 301 are connected via a wired or wireless network 310. The network 310 is, for example, a LAN (Local Area Network), a WAN (Wide Area Network), the Internet, or the like. Further, the generation device 100 and the data utilization side device 302 are connected via a wired or wireless network 310.

The generation device 100 collects personal data from the data provider device 301. The collected personal data is stored in, for example, the data management table 500 described later in FIG. The generation device 100 generates a plurality of anonymous data based on the collected personal data and transmits the plurality of anonymous data to the data user side device 302. Specific examples of generating a plurality of anonymous data will be described later with reference to, for example, FIGS. 7 to 9. The generation device 100 is, for example, a server, a PC (Personal Computer), or the like.

The data providing side device 301 acquires personal data and transmits it to the generating device 100. The data providing side device 301 acquires personal data based on the operation input of the operator and transmits it to the generating device 100. The data providing side device 301 acquires personal data from, for example, a tablet terminal, a smartphone, a wearable terminal, an IoT (Internet of Things) device, and transmits the personal data to the generating device 100. The data providing side device 301 is, for example, a server, a PC, or the like.

The data utilization side device 302 receives a plurality of anonymous data from the generation device 100. The data utilization side device 302 executes a data utilization task based on a plurality of anonymous data. The data utilization task is, for example, a task such as statistical analysis or machine learning. The data utilization side device 302 is, for example, a server or a PC.

Here, the case where the generation device 100 is a device different from the data providing side device 301 has been described, but the present invention is not limited to this. For example, the generation device 100 may be integrated with the data providing side device 301 and may also operate as the data providing side device 301.

Here, the case where the generation device 100 is a device different from the data utilization side device 302 has been described, but the present invention is not limited to this. For example, the generation device 100 may be integrated with the data utilization side device 302 and may also operate as the data utilization side device 302.

Here, the case where the data providing side device 301 is a server, a PC, or the like has been described, but the present invention is not limited to this. For example, the data providing side device 301 may be a tablet terminal, a smartphone, a wearable terminal, an IoT device, or the like.

(Example of hardware configuration of generator 100)
Next, a hardware configuration example of the generator 100 will be described with reference to FIG.

FIG. 4 is a block diagram showing a hardware configuration example of the generation device 100. In FIG. 4, the generation device 100 includes a CPU (General Processing Unit) 401, a memory 402, a network I / F (Interface) 403, a recording medium I / F 404, and a recording medium 405. Further, each component is connected by a bus 400.

Here, the CPU 401 controls the entire generation device 100. The memory 402 includes, for example, a ROM (Read Only Memory), a RAM (Random Access Memory), a flash ROM, and the like. Specifically, for example, a flash ROM or ROM stores various programs, and the RAM is used as a work area of the CPU 401. The program stored in the memory 402 is loaded into the CPU 401 to cause the CPU 401 to execute the coded process.

The network I / F 403 is connected to the network 310 through a communication line, and is connected to another computer via the network 310. Then, the network I / F 403 controls the internal interface with the network 310 and controls the input / output of data from another computer. The network I / F 403 is, for example, a modem or a LAN adapter.

The recording medium I / F 404 controls data read / write to the recording medium 405 according to the control of the CPU 401. The recording medium I / F404 is, for example, a disk drive, an SSD (Solid State Drive), a USB (Universal General Bus) port, or the like. The recording medium 405 is a non-volatile memory that stores data written under the control of the recording medium I / F404. The recording medium 405 is, for example, a disk, a semiconductor memory, a USB memory, or the like. The recording medium 405 may be detachable from the generation device 100.

The generation device 100 may include, for example, a keyboard, a mouse, a display, a printer, a scanner, a microphone, a speaker, and the like, in addition to the above-described components. Further, the generation device 100 may have a plurality of recording media I / F 404 and recording media 405. Further, the generation device 100 does not have to have the recording medium I / F 404 or the recording medium 405.

(Stored contents of data management table 500)
Next, an example of the stored contents of the data management table 500 will be described with reference to FIG. The data management table 500 is realized, for example, by a storage area such as a memory 402 or a recording medium 405 of the generation device 100 shown in FIG.

FIG. 5 is an explanatory diagram showing an example of the stored contents of the data management table 500. As shown in FIG. 5, the data management table 500 has fields for name, gender, age, and height. In the data management table 500, personal data is stored as a record 500-a by setting information in each field for each individual. a is an arbitrary integer.

In the name field, a name that identifies an individual is set. In the gender field, the gender of the individual is set as the attribute value of the individual. In the age field, the age of the individual is set as the attribute value of the individual. In the height field, the height of the individual is set as an attribute value of the individual. The personal data does not have to include any of the individual's name, gender, age, and height as individual attribute values. The personal data may include other than the attribute values of the individual's name, gender, age, and height as the attribute values of the individual.

(Example of hardware configuration of data provider device 301)
Since the hardware configuration example of the data providing side device 301 is the same as the hardware configuration example of the generation device 100 shown in FIG. 4, the description thereof will be omitted.

(Example of hardware configuration of device 302 on the data utilization side)
Since the hardware configuration example of the data utilization side device 302 is the same as the hardware configuration example of the generation device 100 shown in FIG. 4, the description thereof will be omitted.

(Example of functional configuration of generator 100)
Next, a functional configuration example of the generator 100 will be described with reference to FIG.

FIG. 6 is a block diagram showing a functional configuration example of the generator 100. The generation device 100 includes a storage unit 600, an acquisition unit 601, a first anonymization unit 602, a determination unit 603, a specific unit 604, a learning unit 605, a generation unit 606, and a second anonymization unit. 607 and an output unit 608 are included.

The storage unit 600 is realized by, for example, a storage area such as the memory 402 or the recording medium 405 shown in FIG. Hereinafter, the case where the storage unit 600 is included in the generation device 100 will be described, but the present invention is not limited to this. For example, the storage unit 600 may be included in a device different from the generation device 100, and the storage contents of the storage unit 600 may be referenceable from the generation device 100.

The acquisition unit 601 to the output unit 608 function as an example of the control unit. Specifically, the acquisition unit 601 to the output unit 608 may, for example, cause the CPU 401 to execute a program stored in a storage area such as the memory 402 or the recording medium 405 shown in FIG. 4, or the network I / F 403. To realize the function. The processing result of each functional unit is stored in a storage area such as the memory 402 or the recording medium 405 shown in FIG. 4, for example.

The storage unit 600 stores various information referred to or updated in the processing of each functional unit. The storage unit 600 stores a plurality of personal data. Personal data includes, for example, values that indicate some characteristic of the individual. The value is, for example, an attribute value. Personal data is acquired by, for example, acquisition unit 601. The storage unit 600 stores a plurality of anonymous data. The anonymized data is generated, for example, by the first anonymization unit 602 or the second anonymization unit 607.

The storage unit 600 stores the first anonymization model. The first anonymization model is a model for anonymizing information. Anonymization corresponds to processing. The first anonymization model is, for example, a model that generates one or more anonymous data obtained by adding a random noise value to a value included in personal data. The first anonymization model is, for example, a stochastic differential privacy algorithm. The first anonymization model is generated, for example, by the generation unit 606.

The storage unit 600 stores the second anonymization model. The second anonymization model is a model for anonymizing information. The second anonymization model is, for example, a model that generates one or more new anonymous data obtained by adding a random noise value to a value included in the anonymous data. The second anonymization model is, for example, a stochastic differential privacy algorithm. The second anonymization model is, for example, the same algorithm as the first anonymization model.

The acquisition unit 601 acquires various information used for processing of each functional unit. The acquisition unit 601 stores various acquired information in the storage unit 600 or outputs the acquired information to each function unit. Further, the acquisition unit 601 may output various information stored in the storage unit 600 to each function unit. The acquisition unit 601 acquires various information based on, for example, a user's operation input. The acquisition unit 601 may receive various information from a device different from the generation device 100, for example.

The acquisition unit 601 acquires a plurality of personal data. The acquisition unit 601 acquires, for example, by receiving a plurality of personal data from the data providing side device 301. The acquisition unit 601 acquires a plurality of personal data based on, for example, a user's operation input. The acquisition unit 601 may acquire, for example, the first anonymization model.

The acquisition unit 601 may accept a start trigger to start processing of any of the functional units. The start trigger is, for example, that there is a predetermined operation input by the user. The start trigger may be, for example, the receipt of predetermined information from another computer. The start trigger may be, for example, that any functional unit outputs predetermined information. The acquisition unit 601 accepts, for example, the acquisition of a plurality of personal data as a start trigger for starting the processing of the first anonymization unit 602 to the second anonymization unit 607.

The first anonymization unit 602 anonymizes the personal data included in the plurality of personal data by the first anonymization model and generates one or more anonymous data. The first anonymization unit 602 randomly selects personal data included in a plurality of personal data a plurality of times. For example, each time the personal data is selected, the first anonymization unit 602 generates one or more anonymous data by the first anonymization model based on the selected personal data. As a result, the first anonymization unit 602 can generate anonymous data and improve the anonymity of personal data.

The determination unit 603 determines whether or not the degree of anonymity of the personal data satisfies a predetermined criterion based on the result of anonymizing the personal data contained in the plurality of personal data by the first anonymization model. .. The predetermined criteria are, for example, privacy test criteria. For example, the determination unit 603 conducts a privacy test based on one or more anonymous data, and whether the degree of anonymity of the selected personal data that is the source of generating one or more anonymous data meets a predetermined criterion. Judge whether or not.

Specifically, the determination unit 603 includes a plurality of personal data including values that are the same as or similar to the personal data when the personal data contained in the plurality of personal data is anonymized by the first anonymization model. Calculate the number of other personal data of. In addition, each personal data may include a plurality of values. In this case, the determination unit 603 may specifically calculate the number of other personal data whose value of the specific item is the same as or similar to the personal data targeted for anonymization.

Here, if the calculated number is equal to or less than a predetermined number, the determination unit 603 determines that the predetermined criterion is not satisfied. The predetermined number is, for example, a fixed value. The predetermined number may be, for example, a variable value. The variable value is, for example, k + Lap (1 / ε ⁰ ). On the other hand, if the calculated number is larger than the predetermined number, the determination unit 603 determines that the predetermined criterion is satisfied. As a result, the determination unit 603 can determine whether or not the anonymity of the personal data is ensured.

Specifically, when the personal data included in the plurality of personal data is anonymized by the first anonymization model, the determination unit 603 determines that the representative value of the added noise value is equal to or less than a predetermined threshold value. , Judge that the predetermined criteria are not met. Specifically, the representative value is an average value, a maximum value, a minimum value, a median value, a mode value, or the like. As a result, the determination unit 603 can determine whether or not the anonymity of the personal data is ensured.

Specifically, the determination unit 603 may determine with a predetermined probability that the predetermined criteria are not satisfied regardless of the actual degree of anonymity of the selected personal data. The predetermined probability is set by the user, for example. As a result, the determination unit 603 can increase the number of personal data that the learning unit 605 can refer to, and the learning unit 605 can easily generate the second anonymization model.

The specific unit 604 identifies one or more personal data whose anonymity degree does not meet a predetermined criterion among the plurality of personal data. The identification unit 604 identifies one or more personal data based on the determination result, for example. Specifically, the specific unit 604 specifies one or more personal data whose determination result is NG. As a result, the identification unit 604 can identify one or more personal data whose anonymity degree does not meet a predetermined criterion, which is the source of generating the anonymous data destroyed by the privacy test.

The specific unit 604 may divide the specified one or more personal data into one or more clusters. The specific unit 604 divides the specified one or more personal data into one or more clusters, for example, based on the value included in each personal data of the specified one or more personal data.

Specifically, the specific unit 604 sorts the specified one or more personal data based on the magnitude relation of the values included in the respective personal data of the specified one or more personal data. Specifically, the specific unit 604 divides one or more personal data into one or more clusters so that each k personal data belongs to the same cluster from the upper rank of one or more sorted personal data. .. k may be a variable value. As a result, the specific unit 604 can easily associate the histogram showing the feature distribution of one or more anonymous data generated by the generation unit 606 with the histogram showing the feature distribution of one or more personal data.

The learning unit 605 learns the second anonymization model based on one or more identified personal data. The learning unit 605 determines the range of noise values used in the second anonymization model, for example, based on the variance and average of the values contained in each personal data of one or more identified personal data. Learn the anonymization model of. As a result, the learning unit 605 can easily associate the histogram showing the feature distribution of one or more anonymous data generated by the second anonymization unit 607 with the histogram showing the feature distribution of a plurality of personal data.

The learning unit 605 learns the second anonymization model corresponding to the cluster based on the personal data divided into the clusters for each cluster. As a result, the learning unit 605 can easily associate the histogram showing the feature distribution of one or more anonymous data generated by the second anonymization unit 607 with the histogram showing the feature distribution of a plurality of personal data.

The generation unit 606 generates one or more anonymous data having a higher degree of anonymity than each personal data of the one or more personal data based on the specified one or more personal data. The generation unit 606, for example, performs microaggregation to generate one or more anonymous data.

Specifically, the generation unit 606 calculates a statistical value regarding a value included in each personal data of one or more specified personal data. The statistic is, specifically, an average value, a maximum value, a minimum value, a median value, a mode value, or the like. The generation unit 606 replaces the value included in each personal data of the specified one or more personal data with the calculated statistical value, and generates one or more anonymous data. As a result, the generation unit 606 can improve the anonymity of the personal data.

The generation unit 606 generates anonymous data corresponding to the cluster, which has a higher degree of anonymity than each of the personal data divided into the clusters, based on the personal data divided into the clusters for each cluster. As a result, the generation unit 606 can generate the anonymous data referred to by the second anonymization model for each cluster.

The second anonymization unit 607 anonymizes each anonymized data of one or more generated anonymous data by the learned second anonymization model, and generates new anonymized data. As a result, the second anonymization unit 607 has one or more new anonymities so that the histogram showing the feature distribution of one or more new anonymous data generated corresponds to the histogram showing the feature distribution of a plurality of personal data. Data can be generated.

The second anonymization unit 607 anonymizes the anonymized data corresponding to the generated cluster for each cluster by the second anonymization model corresponding to the learned cluster, and generates new anonymized data. As a result, the second anonymization unit 607 has one or more histograms showing the feature distributions of one or more new anonymous data generated for each cluster so as to correspond to the histograms showing the feature distributions of a plurality of personal data. New anonymous data can be generated.

The output unit 608 outputs the processing result of any of the functional units. The output format is, for example, display on a display, print output to a printer, transmission to an external device by the network I / F 403, or storage in a storage area such as a memory 402 or a recording medium 405. As a result, the output unit 608 can notify the user of the processing result of any of the functional units, and can improve the convenience of the generation device 100.

The output unit 608 outputs new anonymized data generated by the second anonymization unit 607. The output unit 608 further outputs the anonymous data generated by the first anonymization unit 602. The output unit 608 outputs, for example, the anonymous data generated by the first anonymization unit 602 and the new anonymity data generated by the second anonymization unit 607. As a result, the output unit 608 can make useful anonymous data available.

(First operation example of the generator 100)
Next, a first operation example of the generator 100 will be described with reference to FIG. 7.

FIG. 7 is an explanatory diagram showing a first operation example of the generator 100. In FIG. 7, (7-1) the generation device 100 acquires the personal data group 701 after deleting the attribute value of the name from the data management table 500.

(7-2) The generation device 100 clusters the personal data group 701 based on the value included in each personal data of the acquired personal data group 701. Clustering is performed on attributes that are likely to produce a histogram. The attributes that are likely to create a histogram are specified in advance by the user, for example. As the clustering, for example, the clustering defined in the K-anonymization process is used.

In the example of FIG. 7, the generator 100 divides the personal data group 701 into a cluster 702 containing personal data having a gender value of "female" and a cluster 703 containing personal data having a gender value of "male". do. Here, the gender value is treated as a quasi-identifier. Values other than gender are treated as sensitive attributes. The generation device 100 stores the cluster 702 containing the personal data whose gender value is "female" in the DB 710. The generation device 100 stores the cluster 703 including the personal data whose gender value is "male" in the DB 720.

In the following description, a case where the generation device 100 targets the DB 710 as a processing target will be described. The case where the generation device 100 targets the DB 720 as the processing target is the same as the case where the generation device 100 targets the DB 710, and thus the description thereof will be omitted.

(7-3) The generation device 100 performs noise addition and a privacy test on the DB 710. The generation device 100 acquires, for example, the personal data group 711 stored in the DB 710. The generation device 100 randomly selects, for example, the personal data included in the acquired personal data group 711 a predetermined number of times.

For example, the generation device 100 generates one or more anonymous data by the generation model 730 based on the selected personal data each time the personal data is selected. The generative model 730 is a probabilistic generative model. The generative model 730 is, for example, a generative model having a differential privacy mechanism. The generative model 730 may be generated based on, for example, the personal data group 711.

The generation device 100, for example, conducts a privacy test based on one or more generated anonymous data, and the degree of anonymity of the personal data from which the generated one or more anonymous data is generated satisfies a predetermined criterion. Judge whether or not. Here, for example, if the determination result is OK, the generation device 100 stores the generated one or more anonymous data in the release DB 740. OK means that the degree of anonymity of personal data meets certain criteria and has passed the privacy test. On the other hand, if the determination result is NG, the generation device 100 discards the generated one or more anonymous data, and converts the generated personal data that is the source of generating the one or more anonymous data into the NG-DB750. save. NG means that the degree of anonymity of personal data did not meet the prescribed criteria and did not pass the privacy test.

(7-4) The generator 100 performs microaggregation on the NG-DB750. The generation device 100 acquires, for example, the personal data group 751 stored in the NG-DB750. The generation device 100 performs microaggregation on, for example, the acquired personal data group 751. Microaggregation is a method of replacing the value contained in each personal data of the personal data group 751 with a statistical value relating to the value contained in each personal data of the personal data group 751. The statistic is, specifically, an average value, a maximum value, a minimum value, a median value, a mode value, or the like.

In the example of FIG. 7, the generator 100 replaces the value contained in each personal data of the personal data group 751 with the average value of the values contained in each personal data of the personal data group 751 to obtain anonymous data. Generate group 761. The generation device 100 stores, for example, the anonymous data group 761 obtained from the personal data group 751 by microaggregation in the MA-DB760.

Here, the generation device 100 generates anonymous data by replacing the value contained in each personal data of the personal data group 751 with the average value of the values contained in each personal data of the personal data group 751. The case has been described, but it is not limited to this. In this case, the anonymous data may be mistaken for the individual corresponding to the personal data containing a value relatively close to the average value. Therefore, for example, the generation device 100 replaces the value included in each personal data of the personal data group 751 with a value separated from the value contained in each personal data of the personal data group 751 by a certain amount or more. Anonymous data may be generated.

(7-5) The generation device 100 learns the generation model 770 based on the NG-DB750. The generation device 100 acquires, for example, the personal data group 751 stored in the NG-DB750. The generation device 100 learns the generation model 770 by using, for example, each personal data of the acquired personal data group 751 as the training data. The generative model 770 is a probabilistic generative model. The generative model 770 is, for example, a generative model having a differential privacy mechanism. The generative device 100 learns the generative model 770, for example, based on the variance and average of the values contained in each personal data of the acquired personal data group 751.

(7-6) The generation device 100 applies noise to the MA-DB760. The generation device 100 acquires, for example, the anonymous data group 761 stored in the MA-DB760. The generation device 100 randomly selects, for example, the anonymous data included in the acquired anonymous data group 761 a predetermined number of times. The generation device 100 may select each anonymous data of the acquired anonymous data group 761.

For example, the generation device 100 generates one or more new anonymous data by the learned generation model 770 based on the selected anonymous data each time the anonymous data is selected. The generation device 100 stores, for example, the anonymous data group 771 including the generated new anonymous data in the release DB 740. The generation device 100 may perform a privacy test when one or more new anonymous data are generated.

In this way, when the generation device 100 targets the DB 710 as a processing target, the release DB 740 is obtained. On the other hand, when the generation device 100 targets the DB 720 as a processing target, it is assumed that the release DB 781 is obtained.

(7-7) The generation device 100 combines the release DB 740 obtained with the DB 710 as the processing target and the release DB 781 obtained with the DB 720 as the processing target to generate the DB 780. As a result, the generation device 100 can obtain useful anonymous data, and can achieve both the usefulness of the anonymous data and the anonymity of the personal data.

The generation device 100 can generate new anonymous data based on personal data determined to be NG by, for example, a privacy test. Therefore, the generation device 100 can, for example, convert a plurality of output anonymous data into preferable data in statistical processing. Specifically, the generation device 100 can bring the histogram showing the feature distribution of a plurality of personal data and the histogram showing the feature distribution of a plurality of output anonymous data close to each other.

Further, for example, the generation device 100 converts personal data for which the degree of anonymity is determined not to satisfy a predetermined criterion into anonymous data in a format having a higher degree of anonymity, and then uses the generation model 770 to perform new anonymity. Data can be generated. Therefore, the generation device 100 can facilitate, for example, ensuring the anonymity of personal data.

The generation device 100 learns a generation model 770 based on one or more personal data determined to be NG among a plurality of personal data, and generates new anonymous data by the learned generation model 770. Can be done. Therefore, the generation device 100 can, for example, convert a plurality of output anonymous data into preferable data in statistical processing. Specifically, the generation device 100 can bring, for example, a histogram showing the feature distribution of personal data determined to be NG and a histogram showing the feature distribution of new anonymous data generated by the generative model 770 close to each other. ..

As described above, the generation device 100 has both the usefulness of anonymous data and the anonymity of personal data, and it is considered that no problem will occur even if the data is distributed to the outside and referred to by a third party. Can be generated. Therefore, the generator 100 can be used in the field of statistical analysis or machine learning.

Here, the case where the generator 100 simply performs the privacy test in (7-3) has been described, but the present invention is not limited to this. For example, when the generator 100 performs the privacy test in (7-3), it is NG with a certain probability regardless of the degree of anonymity of the personal data that is the source of generating one or more generated anonymous data. It may operate so as to determine that there is.

As a result, the generation device 100 can avoid a situation in which the anonymity of the personal data may be impaired because the number of personal data stored in the NG-DB 750 is small. The operation example of the generation device 100 in this case corresponds to the second operation example described later with reference to FIG.

Here, the case where the generator 100 performs microaggregation on the entire personal data group 751 stored in the NG-DB750 in (7-4) has been described, but the present invention is not limited to this. For example, in (7-4), the generation device 100 may perform microaggregation for each k personal data in the personal data group 751 stored in the NG-DB750. In this case, the generation device 100 learns the generation model 770 for each k personal data.

As a result, the generation device 100 can make it easier to bring the histogram showing the feature distribution of the personal data determined to be NG and the histogram showing the feature distribution of the new anonymous data generated by the generative model 770 closer to each other. .. The operation example of the generation device 100 in this case corresponds to the third operation example described later with reference to FIG.

(Second operation example of the generator 100)
Next, a second operation example of the generator 100 will be described with reference to FIG.

FIG. 8 is an explanatory diagram showing a second operation example of the generator 100. In the second operation example, when the generation device 100 carries out the privacy test, it is determined that the generation device 100 is NG with a certain probability regardless of the degree of anonymity of the personal data from which the generated one or more anonymous data is generated. Corresponds to the case where it operates to judge.

In FIG. 8, the (8-1) generator 100 performs the same operation as (7-1) and (7-2) to generate personal data having a gender value of "female" based on the data management table 500. The personal data group 801 including the personal data group 801 is stored in the DB 800.

In the following description, a case where the generation device 100 targets the DB 800 as a processing target will be described. When the generation device 100 targets another DB or the like that stores a personal data group including personal data whose gender value is "male", it is the same as when the generation device 100 targets the DB 800. Therefore, the description thereof will be omitted.

(8-2) The generation device 100 performs noise addition and a privacy test on the DB 800. The generation device 100 acquires, for example, the personal data group 801 stored in the DB 800. The generation device 100 randomly selects, for example, the personal data included in the acquired personal data group 801 a predetermined number of times.

For example, the generation device 100 generates one or more anonymous data by the generation model 810 based on the selected personal data each time the personal data is selected. The generative model 810 is a probabilistic generative model. The generative model 810 is, for example, a generative model having a differential privacy mechanism. The generative model 810 may be generated based on, for example, the personal data group 801.

The generation device 100, for example, conducts a privacy test based on one or more generated anonymous data, and the degree of anonymity of the personal data from which the generated one or more anonymous data is generated satisfies a predetermined criterion. Judge whether or not. At this time, the generation device 100 determines with a certain probability that the predetermined criteria are not satisfied regardless of the degree of anonymity of the personal data from which the generated one or more anonymous data is generated.

Here, for example, if the determination result is OK, the generation device 100 stores the generated one or more anonymous data in the release DB 820. On the other hand, if the determination result is NG, the generation device 100 discards the generated one or more anonymous data, and converts the generated personal data that is the source of generating the one or more anonymous data into the NG-DB830. save.

(8-3) The generator 100 performs microaggregation on the NG-DB830. The generation device 100 acquires, for example, the personal data group 831 stored in the NG-DB830. The generation device 100 performs microaggregation on the acquired personal data group 831, for example.

In the example of FIG. 8, the generator 100 replaces the value contained in each personal data of the personal data group 831 with the average value of the value contained in each personal data of the personal data group 831, thereby causing anonymous data. Generate group 841. The generation device 100 stores, for example, the anonymous data group 841 obtained from the personal data group 831 by microaggregation in the MA-DB840.

Here, the generation device 100 generates anonymous data by replacing the values included in each personal data of the personal data group 831 with the average values of the values included in each personal data of the personal data group 831. The case has been described, but it is not limited to this. In this case, the anonymous data may be mistaken for the individual corresponding to the personal data containing a value relatively close to the average value. Therefore, for example, the generation device 100 replaces the value included in each personal data of the personal data group 831 with a value separated from the value contained in each personal data of the personal data group 831 by a certain amount or more. Anonymous data may be generated.

(8-4) The generation device 100 learns the generation model 850 based on the NG-DB 830. The generation device 100 acquires, for example, the personal data group 831 stored in the NG-DB830. The generation device 100 learns the generation model 850 by using, for example, each personal data of the acquired personal data group 831 as training data. The generative model 850 is a probabilistic generative model. The generative model 850 is, for example, a generative model having a differential privacy mechanism. The generative device 100 learns the generative model 850, for example, based on the variance and average of the values contained in each personal data of the acquired personal data group 831.

(8-5) The generation device 100 applies noise to the MA-DB840. The generation device 100 acquires, for example, the anonymous data group 841 stored in the MA-DB840. The generation device 100 randomly selects, for example, the anonymous data included in the acquired anonymous data group 841 a predetermined number of times. The generation device 100 may select each anonymous data of the acquired anonymous data group 841.

For example, the generation device 100 generates one or more new anonymous data by the learned generation model 850 based on the selected anonymous data each time the anonymous data is selected. The generation device 100 selects, for example, any one of the acquired anonymous data groups 841 and uses the generated generation model 850 to learn new anonymous data based on the selected anonymous data to generate new anonymous data in the anonymous data group. The same number as the number of anonymous data of 841 may be generated. The generation device 100 stores, for example, an anonymous data group 851 including the generated new anonymous data in the release DB 820. The generation device 100 may perform a privacy test when one or more new anonymous data are generated.

As described above, when the generation device 100 targets the DB 800 as a processing target, the release DB 820 is obtained. On the other hand, when the generation device 100 targets another DB that stores the personal data group including the personal data whose gender value is "male", it is assumed that the release DB 861 is obtained.

(8-6) The generation device 100 combines the release DB 820 and the release DB 861 to generate the DB 860. As a result, the generation device 100 can obtain useful anonymous data, and can achieve both the usefulness of the anonymous data and the anonymity of the personal data.

When carrying out the privacy test, the generation device 100 can store personal data, which can be normally determined to be OK, in the NG-DB 830 with a certain probability. Therefore, since the number of personal data stored in the NG-DB 830 is small, the generation device 100 can avoid a situation in which the anonymity of the personal data may be impaired by the statistical analysis.

Further, the generation device 100 may set a predetermined threshold value for the number of personal data determined to be OK by the privacy test. The predetermined threshold is set in advance by the user, for example. Then, the generation device 100 determines that the personal data that can be normally determined to be OK is NG with a certain probability while the number of personal data determined to be OK is equal to or less than a predetermined threshold value, and NG-DB830. The operation of saving to is performed. On the other hand, the generation device 100 determines that the personal data that can be normally determined to be OK is NG with a certain probability after the number of personal data determined to be OK becomes larger than a predetermined threshold value, and is NG. -Stops the operation of saving to DB830. As a result, the generation device 100 can reduce the bias between the number of personal data determined to be OK and the number of personal data determined to be NG, and can easily improve the anonymity of the data. can.

Further, the generation device 100 determines that the personal data that can be normally determined to be OK is NG with a certain probability after the number of personal data determined to be OK becomes larger than a predetermined threshold value, and NG-. The operation of saving in the DB 830 may be started. As a result, the generation device 100 can reduce the bias between the number of personal data determined to be OK and the number of personal data determined to be NG, and can easily improve the anonymity of the data. can.

Further, the generation device 100 may set a predetermined threshold value for the number of personal data stored in the NG-DB 830. The predetermined threshold is set in advance by the user, for example. Then, the generation device 100 determines that the personal data stored in the NG-DB 830 is NG or NG with a certain probability while the number of personal data stored in the NG-DB 830 is equal to or less than a predetermined threshold value. -The operation of saving in DB830 is performed. On the other hand, the generation device 100 determines that the personal data stored in the NG-DB 830 is NG with a certain probability after the number of personal data stored in the NG-DB 830 becomes larger than a predetermined threshold value. , The operation of saving in NG-DB830 is stopped. As a result, the generation device 100 can reduce the bias between the number of personal data determined to be OK and the number of personal data determined to be NG, and can easily improve the anonymity of the data. can.

(Third operation example of the generator 100)
Next, a third operation example of the generator 100 will be described with reference to FIG.

FIG. 9 is an explanatory diagram showing a third operation example of the generator 100. The third operation example corresponds to the case where the generation device 100 performs microaggregation for each of k personal data among the plurality of personal data determined to be NG by the privacy test.

In FIG. 9, the (9-1) generator 100 performs the same operation as (7-1) and (7-2) to generate personal data having a gender value of "female" based on the data management table 500. The personal data group including the personal data group is stored in the DB 900.

In the following description, a case where the generation device 100 targets the DB 900 as a processing target will be described. When the generation device 100 targets another DB or the like that stores a personal data group including personal data whose gender value is "male", it is the same as when the generation device 100 targets the DB 900. Therefore, the description thereof will be omitted.

(9-2) The generation device 100 performs noise addition and a privacy test on the DB 900. The generation device 100 acquires, for example, a personal data group stored in the DB 900. The generation device 100 randomly selects, for example, personal data included in the acquired personal data group a predetermined number of times.

For example, the generation device 100 generates one or more anonymous data by the generation model 910 based on the selected personal data each time the personal data is selected. The generative model 910 is a probabilistic generative model. The generative model 910 is, for example, a generative model having a differential privacy mechanism. The generative model 910 may be generated based on, for example, the acquired personal data group.

The generation device 100, for example, conducts a privacy test based on one or more generated anonymous data, and the degree of anonymity of the personal data from which the generated one or more anonymous data is generated satisfies a predetermined criterion. Judge whether or not. Here, for example, if the determination result is OK, the generation device 100 stores the generated one or more anonymous data in the release DB 920. On the other hand, if the determination result is NG, the generation device 100 discards the generated one or more anonymous data, and transfers the generated personal data that is the source of generating the one or more anonymous data to the NG-DB930. save.

(9-3) The generation device 100 performs clustering on the NG-DB930. The generation device 100 acquires, for example, the personal data group 940 stored in the NG-DB 930. The generation device 100 sorts the personal data group 940 in descending order of the values included in the personal data of the personal data group 940, for example.

For example, the generation device 100 selects k personal data from the top of the sorted personal data group 940 and divides them into the same cluster to perform clustering on the sorted personal data group 940. implement. k may be, for example, a variable value. In other words, each cluster may contain a different number of personal data. In the example of FIG. 9, the generation device 100 divides the personal data group 940 into the personal data group 941 as the same cluster and the personal data group 942 into the same cluster.

(9-4) The generator 100 performs microaggregation for each cluster. The generation device 100 acquires, for example, a personal data group 941 divided into a certain cluster. The generation device 100 performs microaggregation on, for example, the acquired personal data group 941. In the example of FIG. 9, the generator 100 replaces the value contained in each personal data of the personal data group 941 with the average value of the value contained in each personal data of the personal data group 941 to obtain anonymous data. Generate group 961.

The generation device 100 acquires, for example, a personal data group 942 divided into a certain cluster. The generation device 100 performs microaggregation on the acquired personal data group 942, for example. In the example of FIG. 9, the generator 100 replaces the value contained in each personal data of the personal data group 942 with the average value of the value contained in each personal data of the personal data group 942, thereby causing anonymous data. Generate group 962. For example, the generator 100 uses the MA-, which is a combination of the anonymous data group 961 obtained from the personal data group 941 and the anonymous data group 962 obtained from the personal data group 942 by microaggregation. Save in DB950.

(9-5) The generation device 100 learns the generation models 971 and 972 for each cluster. The generative models 971 and 972 are probabilistic generative models. The generative models 971 and 972 are, for example, generative models having a differential privacy mechanism.

The generation device 100 acquires, for example, a personal data group 941 divided into a certain cluster. The generation device 100 learns the generation model 971 by using, for example, each personal data of the acquired personal data group 941 as the training data. The generation device 100 learns the generation model 971 based on, for example, the variance and average of the values contained in each personal data of the acquired personal data group 941.

The generation device 100 acquires, for example, a personal data group 942 divided into a certain cluster. The generation device 100 learns the generation model 972 by using, for example, each personal data of the acquired personal data group 942 as the training data. The generation device 100 learns the generation model 972 based on, for example, the variance and average of the values contained in each personal data of the acquired personal data group 942.

(9-6) The generation device 100 adds noise to each cluster. The generation device 100 acquires, for example, an anonymous data group 961 divided into a certain cluster. The generation device 100 randomly selects, for example, the anonymous data included in the acquired anonymous data group 961 a predetermined number of times. The generation device 100 may select each anonymous data of the acquired anonymous data group 961.

For example, the generation device 100 generates one or more new anonymous data by the learned generation model 971 based on the selected anonymous data each time the anonymous data is selected. The generation device 100 stores, for example, an anonymous data group including the generated new anonymous data in the release DB 920. The generation device 100 may perform a privacy test when one or more new anonymous data are generated.

The generation device 100 acquires, for example, an anonymous data group 962 divided into a certain cluster. The generation device 100 randomly selects, for example, the anonymous data included in the acquired anonymous data group 962 a predetermined number of times. The generation device 100 may select each anonymous data of the acquired anonymous data group 962.

For example, the generation device 100 generates one or more new anonymous data by the learned generation model 972 based on the selected anonymous data each time the anonymous data is selected. The generation device 100 stores, for example, an anonymous data group including the generated new anonymous data in the release DB 920. The generation device 100 may perform a privacy test when one or more new anonymous data are generated.

As described above, when the generation device 100 targets the DB 900 as a processing target, the release DB 920 is obtained. On the other hand, when the generation device 100 targets another DB that stores the personal data group including the personal data whose gender value is "male", it is assumed that the release DB 981 is obtained.

(9-7) The generation device 100 combines the release DB 920 and the release DB 981 to generate the DB 980. As a result, the generation device 100 can obtain useful anonymous data, and can achieve both the usefulness of the anonymous data and the anonymity of the personal data. Further, the generation device 100 can make it easier to bring the histogram showing the feature distribution of the personal data determined to be NG and the histogram showing the feature distribution of the new anonymous data generated by the generation models 971 and 972 closer to each other. can.

As described above, the generator 100 can improve the usefulness of the output anonymous data for the anonymized data generation algorithm including the privacy test such as (k, γ) PD, and the usefulness of the anonymous data. , Anonymity of personal data can be compatible.

(Effect of generator 100)
Next, the effect of the generator 100 will be described with reference to FIGS. 10 to 17.

FIG. 10 is an explanatory diagram showing an example of a membership inclusion attack. The generation device 100 can prevent the membership inclusion attack according to the operation examples 1 to 3.

A membership inclusion attack is an attack that is possible when it is assumed that one or more individuals having the same attributes as the individual related to the personal data d have colluded with the attacker. For example, if the privacy test parameter k = 3, the attacker can estimate the remaining one personal data d if he / she knows two individuals who have the same attributes as the individual related to the personal data d. Is.

In the example of FIG. 10, Alice exists, and Becky, Chlis, and Dazzy having the same attributes “female” and “teen” as Alice exist. Then, the personal data of each individual is stored in the data management table 500. Conventionally, based on the data management table 500, the release data set 1001 including the data in which noise is added to the personal data of each individual is output.

Here, the attacker knows the background information of Alice, Becky, Chlis, and Dazzy, and by observing the release data set 1001, it is estimated that the release data set 1001 contains data based on Alice's personal data. It is possible. If the attacker knows that there are Becky, Chlis, and Dazzy having the same attributes "female" and "teen" as Alice, the attacker can obtain personal data close to the true value of Alice.

On the other hand, the generation device 100 outputs a release data set 1002 including data in which noise is added to randomly selected personal data based on the data management table 500. Therefore, the generation device 100 can ensure the anonymity of the personal data of each individual and prevent the membership inclusion attack.

The generation device 100 can generate and output anonymous data based on personal data that can be normally determined to be NG. Therefore, the generator 100 can prevent the user from arbitrarily performing the privacy test in order to improve the usefulness of the anonymous data, and makes it easier to prevent the membership inclusion attack. Can be done.

11 to 14 are explanatory views showing a first example of the shape of the histogram to be compared. The generator 100 can bring the histogram showing the feature distribution of a plurality of personal data and the histogram showing the feature distribution of a plurality of output anonymous data close to each other according to the operation examples 1 to 3, and is useful anonymous data. Can be obtained.

Here, as a comparison target with the generation device 100, a histogram showing the feature distribution of a plurality of anonymous data output by the conventional privacy test will be described. Table 1100 in FIG. 11 is based on personal data having any value from January to December when ^{ε 0 is fixed at 100 and k fluctuates from 1 to 1000 in a conventional privacy test.} Indicates the number of anonymous data to be output. Here, the explanation shifts to FIG. 12, and an example in which Table 1100 is graphed will be described.

Graph 1200 in FIG. 12 is an example of graphing Table 1100. As shown in Table 1100 and Graph 1200, in order to improve the anonymity of personal data, increasing k causes a bias in the number of output anonymous data. For example, in the case of k = 1000, the anonymous data based on the personal data having any value from January to September is not output as compared with the case of k = 1.

On the other hand, in the conventional privacy test, it is conceivable to reduce ^{ε 0 to reduce the bias.} Table 1300 in FIG. 13 shows ^{personal data having any value from January to December when ε 0} is fixed at 0.1 and k is changed from 1 to 1000 in the conventional privacy test. Indicates the number of anonymous data to be output based on. Here, the explanation shifts to FIG. 14, and an example in which Table 1300 is graphed will be described.

Graph 1400 in FIG. 14 is an example of graphing Table 1300. As shown in Table 1300 and Graph 1400, ^{even if ε 0} is made small, the number of output anonymous data will be biased. For example, in the case of k = 1000, the number of anonymous data based on personal data having the value in November is reduced by about 80% as compared with the case of k = 1, whereas the number of personal data having the value in April is reduced. The number of anonymous data based on it will decrease by about 50%.

On the other hand, the generation device 100 can generate and output new anonymous data based on the personal data determined to be NG by the privacy test. Therefore, the generation device 100 can make it difficult for the number of output anonymous data to be biased, and shows a histogram showing the feature distribution of a plurality of personal data and a feature distribution of the plurality of output anonymous data. It can be brought closer to the histogram. Then, the generation device 100 can obtain useful anonymous data.

Further, the generation device 100 can generate and output anonymous data based on personal data that can be normally determined to be NG. Therefore, the generation device 100 can prevent the user from arbitrarily performing the privacy test in order to improve the usefulness of the anonymous data, and can improve the anonymity of the personal data. can.

15 to 17 are explanatory views showing a second example of the shape of the histogram to be compared. The generator 100 can bring the histogram showing the feature distribution of a plurality of personal data and the histogram showing the feature distribution of a plurality of output anonymous data close to each other according to the operation examples 1 to 3, and is useful anonymous data. Can be obtained.

Here, as a comparison target with the generation device 100, a histogram showing the feature distribution of a plurality of anonymous data output by the conventional privacy test will be described. Graph 1500 in FIG. 15 is an example of graphing the number of personal data having any value from January to December. Next, the description shifts to FIG.

Graphs 1601 to 1603 of FIG. 16 show any value from January to December when k is fixed to the average value k1 and ε ^{0 fluctuates from 0.001 to 100 in the conventional privacy test.} This is an example of graphing the number of anonymous data output based on the personal data possessed by the user. Graph 1601 of FIG. 16 corresponds to the case where ^{ε 0 is 0.001.} Graph 1602 in FIG. 16 corresponds to the case where ^{ε 0 is set to 1.} Graph 1603 of FIG. 16 corresponds to the case where ^{ε 0 is set to 100.}

As shown in graphs 1601 to 1603, if ε ⁰ is increased in order to improve the anonymity of personal data, the number of output anonymous data will be biased. For example, when ε ⁰ = 100, anonymous data based on personal data having a value of January to April, June, or August is not output. Next, the description shifts to FIG.

Graphs 1701 to 1703 in FIG. 17 show any value from January to December when k is fixed at the minimum value k2 and ε ^{0 fluctuates from 0.001 to 100 in the conventional privacy test.} This is an example of graphing the number of anonymous data output based on the personal data possessed by the user. Graph 1701 in FIG. 17 corresponds to the case where ^{ε 0 is set to 0.001.} Graph 1702 in FIG. 17 corresponds to the case where ^{ε 0 is set to 1.} Graph 1703 of FIG. 17 corresponds to the case where ^{ε 0 is set to 100.}

As shown in Graphs 1701 to 1703, when ε ⁰ is increased, the value of k is easily estimated based on the number of output anonymous data. For example, when ε ⁰ = 100, only the number of anonymous data based on personal data having the April value has decreased by about 50%, and based on the number of anonymous data based on the personal data having the April value. , K values are easy to estimate.

On the other hand, the generation device 100 can generate and output new anonymous data based on the personal data determined to be NG by the privacy test. Therefore, the generation device 100 can make it difficult for the number of output anonymous data to be biased, and shows a histogram showing the feature distribution of a plurality of personal data and a feature distribution of the plurality of output anonymous data. It can be brought closer to the histogram. Then, the generation device 100 can obtain useful anonymous data. In addition, the generator 100 can make it difficult to estimate the parameters of the privacy test.

As described above, it is difficult to adjust the parameters k, γ, and ε ⁰ of the conventional privacy test so as to balance the usefulness of anonymous data and the anonymity of personal data in a well-balanced manner. On the other hand, the generation device 100 can balance the usefulness of anonymous data and the anonymity of personal data in a well-balanced manner without appropriately adjusting the privacy test parameters k, γ, and ε ^0. ..

The generator 100 balances the usefulness of anonymous data and the anonymity of personal data in a well-balanced manner even if the number of personal data determined to be NG increases due to the privacy test parameters k, γ, and ε ^0. can do. As a result, the generator 100 can resemble the quantity and ratio of the histogram showing the feature distribution of the plurality of personal data and the histogram showing the feature distribution of the plurality of output anonymous data, and the individual. Data anonymity can be ensured.

(Preparation procedure)
Next, an example of the preparatory processing procedure executed by the generation device 100 will be described with reference to FIG. The preparatory process is realized, for example, by the CPU 401 shown in FIG. 4, a storage area such as a memory 402 or a recording medium 405, and a network I / F 403.

FIG. 18 is a flowchart showing an example of the preparatory processing procedure. In FIG. 18, first, the generation device 100 acquires the target attribute that makes the usefulness of the histogram constant (step S1801). The target attribute is preset by the user, for example. For example, the user sets the priority of the attribute that makes the usefulness of the histogram constant in the order of gender and height.

Next, the generation device 100 acquires the stored contents of the DB (step S1802). Then, the generation device 100 divides the stored contents of the DB for any of the attributes according to the priority (step S1803). The generation device 100 divides the stored contents of the DB into, for example, female and male genders according to the priority.

Next, the generation device 100 stores each of the divided stored contents as DBn (step S1804). Then, the generation device 100 determines whether or not there is an unprocessed attribute (step S1805).

Here, if an unprocessed attribute exists (step S1805: Yes), the generation device 100 returns to the process of step S1802. On the other hand, when there is no unprocessed attribute (step S1805: No), the generation device 100 ends the preparatory process.

(Test processing procedure)
Next, an example of a test processing procedure executed by the generator 100 will be described with reference to FIG. The test process is realized, for example, by the CPU 401 shown in FIG. 4, a storage area such as a memory 402 or a recording medium 405, and a network I / F 403.

FIG. 19 is a flowchart showing an example of the test processing procedure. In FIG. 19, the generator 100 acquires a safety standard (step S1901). Safety criteria include, for example, privacy test parameters k, γ, ε ⁰ .

Next, the generation device 100 acquires the stored contents of the DBn (step S1902). Then, the generation device 100 generates a mechanism M for generating data based on the stored contents of the DBn (step S1903).

Mechanism M is an algorithm that generates data that guarantees differential privacy. The generation device 100 calculates, for example, the _{average and variance regarding the values included in each record r i} of the stored contents of DBn, and generates the mechanism M based on the calculated average and variance and the safety standard.

_{Next, the generation device 100 extracts one of the unprocessed records r i} from the stored contents of the DBn and sets it as an input to the mechanism M (step S1904). Then, generator 100, by a mechanism M, the data M (r _i) plus noise record r _i, to generate a predetermined number (step S1905).

Next, the generation device 100 performs a randomization process of k (step S1906). The generation device 100 performs the randomization process of k by, for example, the mechanism M'related to k. At this time, the generation device 100 may generate a plurality of randomized k's. Then, the generation device 100 acquires the randomized k'(step S1907).

Next, the generation device 100 performs a _{privacy test on the record r i} and determines whether or not it is OK (step S1908). At this time, the generation device 100 may determine that it is NG with a certain probability. Here, if it is NG (step S1908: No), the generation device 100 shifts to the process of step S1910. On the other hand, if it is OK (step S1908: Yes), the generator 100 shifts to the process of step S1909.

In step S1909, generator 100, data M a (r _i) as release data set is stored in RL-DB (Step S1909). RL-DB is a release DB. Then, the generation device 100 shifts to the process of step S1911.

In step S1910, the generation device 100 stores the record r _i in the NG-DB (step S1910). Then, the generation device 100 shifts to the process of step S1911.

In step S1911, the generation device 100 determines whether or not a predetermined number of _{records r i have been extracted (step S1911).} Here, when a predetermined number has not been extracted (step S1911: No), the generation device 100 returns to the process of step S1904. On the other hand, when a predetermined number is extracted (step S1911: Yes), the generation device 100 ends the test process.

(Branch processing procedure)
Next, an example of the branch processing procedure executed by the generation device 100 will be described with reference to FIG. The branching process is realized, for example, by the CPU 401 shown in FIG. 4, a storage area such as a memory 402 or a recording medium 405, and a network I / F 403.

FIG. 20 is a flowchart showing an example of the branch processing procedure. In FIG. 20, the generator 100 acquires a safety standard (step S2001). Safety criteria include, for example, privacy test parameters k, γ, ε ⁰ .

Next, the generation device 100 acquires the stored contents of the RL-DB (step S2002). Then, the generation device 100 acquires the number of records in the stored contents of the RL-DB (step S2003).

Next, the generation device 100 determines whether or not the number of records is equal to or greater than the upper limit (step S2004). Here, when the number of records is equal to or greater than the upper limit (step S2004: Yes), the generation device 100 shifts to the process of step S2005. On the other hand, when the number of records is less than the upper limit (step S2004: No), the generation device 100 shifts to the process of step S2007.

In step S2005, the generator 100 changes the privacy test option PTOP (step S2005). Next, the generator 100 re-executes the test process shown in FIG. 19 (step S2006). Then, the generation device 100 ends the branching process.

In step S2007, the generation device 100 determines whether or not the number of records is equal to or less than the lower limit (step S2007). Here, when the number of records is equal to or less than the lower limit (step S2007: Yes), the generation device 100 shifts to the process of step S2008. On the other hand, when the number of records is larger than the lower limit (step S2007: No), the generation device 100 shifts to the process of step S2009.

In step S2008, the generator 100 changes the optional MAOP for microaggregation (step S2008). Then, the generation device 100 shifts to the process of step S2009.

In step S2009, the generator 100 executes the reuse process described later in FIG. 21 (step S2009). Then, the generation device 100 ends the branching process.

(Reuse processing procedure)
Next, an example of the reuse processing procedure executed by the generation device 100 will be described with reference to FIG. The reuse process is realized, for example, by the CPU 401 shown in FIG. 4, a storage area such as a memory 402 or a recording medium 405, and a network I / F 403.

FIG. 21 is a flowchart showing an example of the reuse processing procedure. In FIG. 21, the generator 100 acquires a safety standard (step S2101). Safety criteria include, for example, privacy test parameters k, γ, ε ⁰ .

Next, the generation device 100 acquires the stored contents of the NG-DB (step S2102). Then, the generation device 100 acquires the MAOP and executes the microaggregation process on the stored contents of the NG-DB (step S2103).

Next, the generation device 100 extracts k pieces of data from the upper level of the stored contents of the NG-DB (step S2104). The generator 100 based on the extracted k pieces of data to generate a mechanism M _i for generating data (step S2105).

Mechanism M _i is an algorithm to generate the data that guarantees the difference privacy. The generator 100 calculates, for example, the average and variance for the values contained in the extracted k pieces of data, and generates the _{mechanism M i based on the calculated average and variance and the safety standard.}

Next, the generation device 100 averages k pieces of data and stores them in the MA-DB as the i-th processing target (step S2106). Then, the generation device 100 determines whether or not all the data of the stored contents of the NG-DB have been extracted (step S2107). Here, if unextracted data remains (step S2107: No), the generation device 100 returns to the process of step S2104. On the other hand, when all the data is extracted (step S2107: Yes), the generation device 100 shifts to the process of step S2108.

_{In step S2108, the generation device 100 extracts the i-th processing target record mi, k} from the stored contents of the MA-DB (step S2108). Next, the generation device 100 converts the records _{mi, k} by _{the mechanism M i , and generates the record M i} ( _{mi, k} ) (step S2109). The generator 100 generates record M _i (m _{i, k)} to be stored in the RL-DB (Step S2110).

Next, the generation device 100 determines whether or not all the records of the stored contents of the MA-DB have been extracted (step S2111). Here, when an unextracted record remains (step S211: No), the generation device 100 returns to the process of step S2108. On the other hand, when all the records are extracted (step S211: Yes), the generation device 100 ends the reuse process.

Here, the generation device 100 may execute the processes in the partial steps of the flowcharts of FIGS. 18 to 21 by changing the order of processing. For example, the order of the processes of steps S1904 and 1905 and the processes of steps S1906 and 1907 can be exchanged. Further, the generation device 100 may omit the processing of a part of the steps of each flowchart of FIGS. 18 to 21. For example, the processes of steps S1801 to S1805 can be omitted.

As described above, according to the generation device 100, the degree of anonymity is determined among the plurality of personal data based on the result of anonymizing the personal data contained in the plurality of personal data by the first anonymization model. It is possible to identify one or more personal data that do not meet the criteria of. According to the generator 100, the second anonymization model can be learned based on one or more specified personal data. According to the generation device 100, it is possible to generate one or more anonymous data having a higher degree of anonymity than each personal data of the one or more personal data based on the specified one or more personal data. According to the generation device 100, it is possible to output new anonymous data obtained by anonymizing each anonymous data of one or more generated anonymous data by the learned second anonymization model. As a result, the generation device 100 can obtain useful anonymous data, and can achieve both the usefulness of the anonymous data and the anonymity of the personal data.

According to the generation device 100, whether or not the degree of anonymity of the personal data satisfies a predetermined criterion based on the result of anonymizing the personal data contained in the plurality of personal data by the first anonymization model. Can be determined. According to the generation device 100, in determining whether or not the degree of anonymity of personal data included in a plurality of personal data satisfies a predetermined criterion, it is determined with a predetermined probability that the degree of anonymity does not satisfy the predetermined criterion. can. According to the generation device 100, one or more personal data can be specified based on the determination result. As a result, the generator 100 avoids a situation in which the anonymity of the personal data may be impaired by the statistical analysis because the number of personal data determined not to satisfy the predetermined criteria is small. Can be done.

According to the generator 100, when the personal data included in the plurality of personal data is anonymized by the first anonymization model, the personal data including the same or similar values as the personal data is included in the plurality of personal data. The number of other personal data can be calculated. According to the generator 100, if the calculated number is equal to or less than a predetermined number, it can be determined that the predetermined criterion is not satisfied. Thereby, the generation device 100 can determine whether or not the anonymity of the personal data is ensured.

According to the generator 100, variable values can be adopted for a predetermined number. As a result, the generation device 100 can easily prevent the membership inclusion attack.

According to the generation device 100, a model that generates one or more anonymous data obtained by adding a random noise value to a value included in personal data can be adopted as the first anonymization model. According to the generation device 100, when the personal data included in the plurality of personal data is anonymized by the first anonymization model, if the representative value of the added noise value is equal to or less than a predetermined threshold value, it is predetermined. It can be determined that the criteria are not met. Thereby, the generation device 100 can determine whether or not the anonymity of the personal data is ensured.

According to the generator 100, one or more specified personal data can be divided into one or more clusters. According to the generator 100, it is possible to learn the second anonymization model corresponding to the cluster based on the personal data divided into the clusters for each cluster. According to the generation device 100, it is possible to generate anonymous data corresponding to a cluster, which has a higher degree of anonymity than each of the personal data divided into clusters, based on the personal data divided into clusters for each cluster. According to the generator 100, it is possible to output new anonymous data obtained by anonymizing the anonymous data corresponding to the generated cluster by the second anonymization model corresponding to the learned cluster for each cluster. can. As a result, the generation device 100 makes it easy to make the histogram showing the feature distribution of one or more new anonymous data obtained by anonymization by the second anonymization model similar to the histogram showing the feature distribution of a plurality of personal data. be able to.

According to the generation device 100, it is possible to calculate a statistical value regarding a value included in each personal data of one or more specified personal data. According to the generation device 100, the value included in each personal data of one or more specified personal data can be replaced with the calculated statistical value, and one or more anonymous data can be generated. As a result, the generation device 100 can improve the anonymity of personal data.

According to the generation device 100, it is possible to further output the anonymous data obtained by anonymizing the personal data whose degree of anonymity satisfies a predetermined criterion among the plurality of personal data by the first anonymization model. This allows the generator 100 to make useful anonymous data available to the user.

According to the generation device 100, as the second anonymization model, it is possible to adopt a model that generates one or more new anonymous data obtained by adding a random noise value to the value included in the anonymous data. .. As a result, the generation device 100 can adopt a second anonymization model capable of improving the anonymity of personal data.

According to the generator 100, the range of noise values used in the second anonymization model is determined based on the variance and average of the values contained in each personal data of one or more identified personal data, and the second You can learn the anonymization model of. As a result, the generation device 100 makes it easy to make the histogram showing the feature distribution of one or more new anonymous data obtained by anonymization by the second anonymization model similar to the histogram showing the feature distribution of a plurality of personal data. be able to.

The generation method described in this embodiment can be realized by executing a program prepared in advance on a computer such as a PC or a workstation. The generation program described in this embodiment is recorded on a computer-readable recording medium and executed by being read from the recording medium by the computer. The recording medium is a hard disk, a flexible disk, a CD (Compact Disc) -ROM, an MO (Magnet Optical disc), a DVD (Digital Versaille Disc), or the like. Further, the generation program described in the present embodiment may be distributed via a network such as the Internet.

The following additional notes are further disclosed with respect to the above-described embodiment.

(Appendix 1) Anonymization of information Based on the result of anonymizing personal data contained in a plurality of personal data by the first anonymization model, the degree of anonymity of the plurality of personal data is set as a predetermined criterion. Identify one or more personal data that does not meet and
Based on the identified one or more personal data, learn a second anonymization model that anonymizes information.
Based on the specified one or more personal data, one or more anonymous data having a higher degree of anonymity than each personal data of the one or more personal data is generated.
A new anonymous data obtained by anonymizing each anonymized data of the one or more generated anonymous data by the learned second anonymization model is output.
A generation method characterized by the processing being performed by a computer.

(Appendix 2) Whether or not the degree of anonymity of the personal data satisfies the predetermined criteria based on the result of anonymizing the personal data included in the plurality of personal data by the first anonymization model. judge,
The computer executes the process,
The determination process is
In determining whether or not the degree of anonymity of the personal data satisfies the predetermined criteria based on the result of anonymizing the personal data included in the plurality of personal data by the first anonymization model. With a predetermined probability, it is determined that the predetermined criteria are not met,
The specific process is
The generation method according to Appendix 1, wherein one or more personal data is specified based on the determination result.

(Appendix 3) The determination process is
When personal data contained in the plurality of personal data is anonymized by the first anonymization model, other personal data among the plurality of personal data including values that are the same as or similar to the personal data. The generation method according to Appendix 2, wherein it is determined that the predetermined number or less is not satisfied with the predetermined number.

(Appendix 4) The generation method according to Appendix 3, wherein the predetermined number is a variable value.

(Appendix 5) The first anonymization model is a model that generates one or more anonymous data obtained by adding a random noise value to a value included in the personal data.
The determination process is
When the personal data included in the plurality of personal data is anonymized by the first anonymization model, if the representative value of the added noise value is equal to or less than a predetermined threshold value, the predetermined criterion is not satisfied. The generation method according to any one of Supplementary note 2 to 4, wherein the method is determined to be.

(Appendix 6) The specified one or more personal data is divided into one or more clusters.
The computer executes the process,
The learning process is
For each cluster, the second anonymization model corresponding to the cluster is learned based on the personal data divided into the clusters.
The process to be generated is
For each of the clusters, based on the personal data divided into the clusters, anonymous data corresponding to the clusters having a higher degree of anonymity than each of the personal data divided into the clusters is generated.
The output process is
Each of the clusters is characterized in that new anonymous data obtained by anonymizing the generated anonymous data corresponding to the cluster by the second anonymization model corresponding to the learned cluster is output. The generation method according to any one of Supplementary note 1 to 5.

(Appendix 7) Calculate the statistical value regarding the value included in each personal data of the specified one or more personal data.
The computer executes the process,
The process to be generated is
Any one of Appendix 1 to 6, characterized in that the value included in each of the specified personal data of 1 or more is replaced with the calculated statistical value to generate 1 or more anonymous data. The generation method described in 1.

(Appendix 8) The output process is
Further, of the plurality of personal data, the personal data whose degree of anonymity satisfies the predetermined criterion is anonymized by the first anonymization model, and the anonymized data obtained is output. The generation method according to any one of 7 to 7.

(Appendix 9) The second anonymization model is characterized in that one or more new anonymous data obtained by adding a random noise value to the value included in the anonymous data is generated. The generation method according to any one of Supplementary note 1 to 7.

(Appendix 10) The learning process is
The range of noise values used in the second anonymization model is determined based on the variance and average of the values contained in each of the specified one or more personal data, and the second anonymization model is used. The generation method according to Appendix 9, wherein the method is learned.

(Appendix 11) Anonymization of information Based on the result of anonymizing personal data contained in a plurality of personal data by the first anonymization model, the degree of anonymity of the plurality of personal data is set as a predetermined criterion. Identify one or more personal data that does not meet and
Based on the identified one or more personal data, learn a second anonymization model that anonymizes information.
Based on the specified one or more personal data, one or more anonymous data having a higher degree of anonymity than each personal data of the one or more personal data is generated.
A new anonymous data obtained by anonymizing each anonymized data of the one or more generated anonymous data by the learned second anonymization model is output.
A generator characterized by having a computer perform processing.

(Appendix 12) Anonymization of information Based on the result of anonymizing personal data contained in a plurality of personal data by the first anonymization model, the degree of anonymity of the plurality of personal data is set as a predetermined criterion. Identify one or more personal data that does not meet and
Based on the identified one or more personal data, learn a second anonymization model that anonymizes information.
Based on the specified one or more personal data, one or more anonymous data having a higher degree of anonymity than each personal data of the one or more personal data is generated.
A new anonymous data obtained by anonymizing each anonymized data of the one or more generated anonymous data by the learned second anonymization model is output.
A generator characterized by having a control unit.

100 Generator 102,750,830,930 NG-DB
103,760,840,950 MA-DB
104,740,781,820,861,920,981 release DB
110 First anonymization model 120 Second anonymization model 300 Data utilization system 301 Data provider device 302 Data user side device 310 Network 400 Bus 401 CPU
402 Memory 403 Network I / F
404 Recording medium I / F
405 Recording medium 500 Data management table 600 Storage unit 601 Acquisition unit 602 First anonymization unit 603 Judgment unit 604 Specific unit 605 Learning unit 606 Generation unit 607 Second anonymization unit 608 Output unit 701,711,751,801 831,842,940-942 Personal data group 702,703 cluster 710,720,780,800,860,900,980 DB
730,770,810,850,910,971,972 Generative model 761,771,841,851,960-962 Anonymous data group 1001,1002 Release dataset 1100,1300 Table 1200,1400,1500,1601-16031701 ~ 1703 Graph

Claims (8)

Based on the result of anonymizing personal data contained in a plurality of personal data by the first anonymization model for anonymizing information, one or more of the plurality of personal data whose degree of anonymity does not meet a predetermined standard. Identify your personal data
Based on the identified one or more personal data, learn a second anonymization model that anonymizes information.
Based on the specified one or more personal data, one or more anonymous data having a higher degree of anonymity than each personal data of the one or more personal data is generated.
A new anonymous data obtained by anonymizing each anonymized data of the one or more generated anonymous data by the learned second anonymization model is output.
A generation method characterized by the processing being performed by a computer. Based on the result of anonymizing the personal data included in the plurality of personal data by the first anonymization model, it is determined whether or not the degree of anonymity of the personal data satisfies the predetermined criterion.
The computer executes the process,
The determination process is
In determining whether or not the degree of anonymity of the personal data satisfies the predetermined criteria based on the result of anonymizing the personal data included in the plurality of personal data by the first anonymization model. With a predetermined probability, it is determined that the predetermined criteria are not met,
The specific process is
The generation method according to claim 1, wherein one or more personal data is specified based on the determination result. The determination process is
When personal data contained in the plurality of personal data is anonymized by the first anonymization model, other personal data among the plurality of personal data including values that are the same as or similar to the personal data. The generation method according to claim 2, wherein if the number of is equal to or less than a predetermined number, it is determined that the predetermined number is not satisfied. The first anonymization model is a model that generates one or more anonymous data obtained by adding a random noise value to a value included in the personal data.
The determination process is
When the personal data included in the plurality of personal data is anonymized by the first anonymization model, if the representative value of the added noise value is equal to or less than a predetermined threshold value, the predetermined criterion is not satisfied. The generation method according to claim 2 or 3, wherein the determination is made. Divide the specified one or more personal data into one or more clusters.
The computer executes the process,
The learning process is
For each cluster, the second anonymization model corresponding to the cluster is learned based on the personal data divided into the clusters.
The process to be generated is
For each of the clusters, based on the personal data divided into the clusters, anonymous data corresponding to the clusters having a higher degree of anonymity than each of the personal data divided into the clusters is generated.
The output process is
Each of the clusters is characterized in that new anonymous data obtained by anonymizing the generated anonymous data corresponding to the cluster by the second anonymization model corresponding to the learned cluster is output. The generation method according to any one of claims 1 to 4. Calculate the statistical value regarding the value included in each personal data of the specified one or more personal data.
The computer executes the process,
The process to be generated is
Any of claims 1 to 5, wherein the value included in each of the specified personal data of one or more personal data is replaced with the calculated statistical value to generate one or more anonymous data. The generation method described in one. Based on the result of anonymizing personal data contained in a plurality of personal data by the first anonymization model for anonymizing information, one or more of the plurality of personal data whose degree of anonymity does not meet a predetermined standard. Identify your personal data
Based on the identified one or more personal data, learn a second anonymization model that anonymizes information.
Based on the specified one or more personal data, one or more anonymous data having a higher degree of anonymity than each personal data of the one or more personal data is generated.
A new anonymous data obtained by anonymizing each anonymized data of the one or more generated anonymous data by the learned second anonymization model is output.
A generator characterized by having a computer perform processing. Based on the result of anonymizing personal data contained in a plurality of personal data by the first anonymization model for anonymizing information, one or more of the plurality of personal data whose degree of anonymity does not meet a predetermined standard. Identify your personal data
Based on the identified one or more personal data, learn a second anonymization model that anonymizes information.
Based on the specified one or more personal data, one or more anonymous data having a higher degree of anonymity than each personal data of the one or more personal data is generated.
A new anonymous data obtained by anonymizing each anonymized data of the one or more generated anonymous data by the learned second anonymization model is output.
A generator characterized by having a control unit.

Images