JP2017228255A - Evaluation device, evaluation method and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an evaluation device, an evaluation method and a program which may evaluate data to which k-anonymization processing is performed.SOLUTION: An evaluation device 10 is a device for evaluating data including pieces of personal information acquired from plural individuals, as pieces of target data. The evaluation device 10 comprises: an identification risk evaluation part 11 for evaluating possibility in which, existence of an individual who is an acquisition source of personal information, is grasped, from the target data, as individual identification risk; an individual specification risk evaluation part 12 for evaluating possibility in which, an individual who is an acquisition source of personal information is specified from the target data, as individual specification risk; and a utility evaluation part 13 for evaluating utility when anonymization processing is performed to the target data.SELECTED DRAWING: Figure 1

Description

  The present invention relates to an evaluation device and an evaluation method for evaluating anonymized information, and a program for realizing the evaluation method.

  In recent years, with the development of IT technology, personal information is very easily leaked. For this reason, the importance of protecting personal information has been screamed, and it has been proposed to apply processing to personal information that makes it difficult to identify the individual. As one of such processing processes, k anonymization processing is known.

  In k anonymization processing, data is processed so that there are k or more data having the same attribute in the target data. For example, it is assumed that k = 3 is set when there is personal data whose items are zip code, sex, age, and hobby. In this case, when k anonymization processing is executed, the last digits of the postal code are deleted or the age is rounded up so that the number of individuals in which all the items all match is k = 3 or more, Data processing is performed.

  In relation to this, for example, in Patent Document 1, when anonymization processing is performed on a database, it is determined whether excessive information loss has occurred, and information usefulness is calculated based on the determined determination result. Is disclosed.

  Patent Document 2 discloses an information anonymization system that analyzes a risk level at which an individual is uniquely identified from anonymized data including personal information. The disclosed information anonymization system quantitatively analyzes the risk for each record that makes up the anonymized data, and calculates the risk level of the anonymized data according to a specific measure based on the risk of each analyzed record And output the calculated risk level.

JP 2013-190838 A Japanese Patent Laying-Open No. 2015-17696

  Here, as the value of k is set higher, the risk of leakage of personal information is reduced, but usefulness when using personal information is reduced. On the other hand, the lower the value of k, the higher the usefulness when using personal information, but the risk of leakage of personal information increases.

  In Patent Literature 1, it is determined whether or not information loss is excessive for the anonymized personal anonymized data, and the usefulness of the anonymized personal information is calculated. Points that prevent the risk of leakage are not considered.

  In Patent Literature 2, the risk of personal information leakage is analyzed by using a risk analysis device and the risk level is analyzed to solve the personal information leakage risk. However, if the leakage risk is excessively prevented, the usefulness of the information is lost. It is not taken into consideration that there is a risk of being lost.

  Therefore, it is required to evaluate both information usefulness and leakage risk and set the value of k to an appropriate value.

  An example of the object of the present invention is to provide an evaluation device, an evaluation method, and a program that can solve the above-described problems and can evaluate data subjected to k anonymization processing.

In order to achieve the above object, an evaluation apparatus according to one aspect of the present invention is an evaluation apparatus that evaluates data including personal information acquired from a plurality of individuals as target data,
A personal identification risk evaluation unit that evaluates, as a personal identification risk, the possibility of grasping the presence of the individual from which the personal information is acquired from the target data;
A personal identification risk evaluation unit that evaluates the possibility of identifying the individual from which the personal information is obtained from the target data as a personal identification risk;
A usefulness evaluation unit that evaluates the usefulness when anonymization processing is performed on the target data;
It is characterized by having.

In order to achieve the above object, an evaluation method according to one aspect of the present invention is an evaluation method that evaluates data including personal information acquired from a plurality of individuals as target data,
(A) evaluating the possibility of grasping the presence of an individual from which the personal information is obtained from the target data as a personal identification risk;
(B) evaluating a possibility that an individual from which the personal information is obtained from the target data is identified as a personal identification risk;
(C) evaluating the usefulness when the anonymization process is performed on the target data.

In order to achieve the above object, a program according to one aspect of the present invention includes:
A program for evaluating, as target data, data including personal information acquired from a plurality of individuals by a computer,
In the computer,
(A) evaluating the possibility of grasping the presence of an individual from which the personal information is obtained from the target data as a personal identification risk;
(B) evaluating a possibility that an individual from which the personal information is obtained from the target data is identified as a personal identification risk;
(C) evaluating the usefulness when anonymization processing is performed on the target data; and
It is characterized by performing.

  As described above, according to the present invention, it is possible to evaluate data subjected to k anonymization processing.

FIG. 1 is a block diagram showing a schematic configuration of an evaluation apparatus according to Embodiment 1 of the present invention. FIG. 2 is a block diagram specifically showing the evaluation apparatus in the present embodiment. FIG. 3 is a flowchart showing the operation of the evaluation apparatus in the embodiment of the present invention. FIG. 4 is a diagram illustrating an example of evaluation of personal identification risk obtained in the embodiment of the present invention. FIG. 5 is a diagram for explaining an example of the personal identification risk evaluation process performed in the embodiment of the present invention. FIGS. 5A to 5C show a flow of a series of processes. FIG. 6 is a diagram for explaining another example of the personal identification risk evaluation process performed in the embodiment of the present invention. FIGS. 6A to 6D show a flow of a series of processes. FIG. 7 is a diagram for explaining another example of the personal identification risk evaluation process performed in the embodiment of the present invention. FIGS. 7A to 7E show a flow of a series of processes. FIG. 8 is a diagram for explaining the personal identification risk evaluation process performed in the embodiment of the present invention, and shows an example of personal information. FIG. 9 is a diagram showing an example of the usability evaluation performed in the embodiment of the present invention. FIG. 10 is a block diagram illustrating an example of a computer that implements the evaluation device according to the embodiment of the present invention.

(Embodiment)
Hereinafter, an evaluation apparatus, an evaluation method, and a program according to an embodiment of the present invention will be described with reference to FIGS.

[Device configuration]
Initially, the schematic structure of the evaluation apparatus in this Embodiment is demonstrated using FIG. FIG. 1 is a block diagram showing a schematic configuration of an evaluation apparatus according to Embodiment 1 of the present invention.

  An evaluation apparatus 10 according to the present embodiment shown in FIG. 1 is an apparatus that evaluates data including personal information of a plurality of individuals as target data. As shown in FIG. 1, the evaluation apparatus 10 in the present embodiment includes a personal identification risk evaluation unit 11, a personal identification risk evaluation unit 12, and a usability evaluation unit 13.

  The personal identification risk evaluation unit 11 evaluates the possibility that the presence of the individual from which the personal information is acquired from the target data as the personal identification risk. The individual identification risk evaluation unit 12 evaluates the possibility that the individual from which the personal information is acquired from the target data is identified as the individual identification risk. The usability evaluation unit 13 evaluates the usability when the anonymization process is performed on the target data.

  Here, “identification” is defined as knowing the information of each person. “Specific” is defined as knowing who the information is. “Identification” has a broader meaning than “specific”. If it is “specified”, it is naturally “identified”. It can be said that k anonymization is a technique that makes “identification” difficult in order to prevent “specification”.

  As described above, in the present embodiment, data is evaluated in terms of the three points of personal identification risk, personal identification risk, and usefulness. According to the present embodiment, it is possible to evaluate data subjected to k anonymization processing.

  Then, with reference to FIG. 2, the evaluation system 1 in this Embodiment is demonstrated more concretely. FIG. 2 is a block diagram specifically showing the evaluation apparatus in the present embodiment.

  As shown in FIG. 2, in the present embodiment, a database 20 for managing personal information and a terminal device 30 used by an evaluator are connected to the evaluation apparatus 10 via a network or the like.

  The database 20 stores personal information. The database 20 may store anonymized personal information. The personal information has a quasi-identifier having a possibility of specifying an individual, such as an address, name, telephone number, age, nationality, and is composed of a plurality of quasi-identifiers. Anonymization is performed, for example, by changing the content of the quasi-identifier so that there are A individuals who share the quasi-identifier when the set level value is A.

  As shown in FIG. 2, in this embodiment, the evaluation apparatus 10 includes a data acquisition unit in addition to the above-described individual identification risk evaluation unit 11, individual identification risk evaluation unit 12, and usability evaluation unit 13. 14 and a data output unit 15.

  The data acquisition unit 14 acquires personal information or anonymized personal information as target data from the database 20. The data output unit 15 includes the individual identification risk obtained from the individual identification risk evaluation unit 11, the individual identification risk obtained from the individual identification risk evaluation unit 12, and the usefulness obtained from the usability evaluation unit 13. It transmits to the terminal device 30. Thereby, each risk and usefulness of personal information are displayed on the screen of the terminal device 30.

  In this embodiment, the personal identification risk evaluation unit 11 calculates the number of records with the same quasi-identifier value constituting the personal information in the target data, and k anonymizes the target data from the calculated number. The individual identification risk is evaluated by obtaining the number of persons identified as k persons when the process is executed. That is, the personal identification risk evaluation unit 11 counts the number of records that can be identified from the quasi-identifier, and calculates how many records that can be identified by someone's record exist as the personal identification risk.

  In this embodiment, the individual identification risk evaluation unit 12 determines the individual identification risk obtained by the individual identification risk evaluation unit 12 and the risk that an individual is specified from each quasi-identifier preset for each quasi-identifier. Based on the indicated coefficient, the personal identification risk is evaluated. That is, the individual identification risk evaluation unit 12 calculates the individual identification risk in consideration of how much the attacker uses the quasi-identifier for the evaluation result of the risk of personal identification.

  In the present embodiment, the usability evaluation unit 13 evaluates usability by using the number of records of the target data and the number of records of the target data when the anonymization process is performed on the target data. Specifically, the usability evaluation unit 13 compares the number of records before anonymization of the target data with the number of records after anonymization, and evaluates how many records have been deleted by anonymization.

[Device operation]
Next, an example of the operation of the evaluation apparatus 10 in the present embodiment will be described with reference to FIG. FIG. 3 is a flowchart showing the operation of the evaluation apparatus in the embodiment of the present invention. In the following description, FIGS. 1 and 2 are referred to as appropriate. Moreover, in this Embodiment, the evaluation method is implemented by operating the evaluation apparatus 10. Therefore, the description of the evaluation method in the present embodiment is replaced with the following description of the operation of the evaluation apparatus 10.

  As shown in FIG. 3, first, the data acquisition unit 14 acquires personal information as target data from the database 20 (step A1). In addition, the data acquisition unit 14 inputs the acquired target data to the individual identification risk evaluation unit 11, the individual identification risk evaluation unit 12, and the usability evaluation unit 13.

  Next, the personal identification risk evaluation unit 11 evaluates, as a personal identification risk, the possibility that the existence of the individual from which the personal information is acquired is grasped from the target data acquired in step A1 (step A2). The personal identification risk evaluation unit 11 inputs the result to the data output unit 15.

  Next, the individual identification risk evaluation unit 12 evaluates the possibility that the individual from which the personal information is acquired from the target data is identified as the individual identification risk (step A3). Further, the individual identification risk evaluation unit 12 also inputs the result to the data output unit 15.

  Next, the usability evaluation unit 13 evaluates the usability when the anonymization process is performed on the target data (step A4). The usability evaluation unit 13 also inputs the result to the data output unit 15.

  Next, the data output unit 15 outputs the evaluation performed in Step A2 to Step A4 to the terminal measure 30 (Step A5).

  Subsequently, each of steps A2 to A4 described above will be described in more detail below.

[Step A2: Personal identification risk evaluation process]
First, the personal identification risk evaluation process by the personal identification risk evaluation unit 11 will be described with reference to FIGS. FIG. 4 is a diagram illustrating an example of evaluation of personal identification risk obtained in the embodiment of the present invention. FIG. 5 is a diagram for explaining an example of the personal identification risk evaluation process performed in the embodiment of the present invention. FIGS. 5A to 5C show a flow of a series of processes. FIG. 6 is a diagram for explaining another example of the personal identification risk evaluation process performed in the embodiment of the present invention. FIGS. 6A to 6D show a flow of a series of processes. FIG. 7 is a diagram for explaining another example of the personal identification risk evaluation process performed in the embodiment of the present invention. FIGS. 7A to 7E show a flow of a series of processes.

  As shown in FIG. 4, in the present embodiment, the personal identification risk evaluation unit 11 uses the data obtained by performing the k-anonymization process in the specific quasi-identifier part of the table in which the personal information is recorded as the target data It has become. That is, in FIG. 4, the first row is obtained by performing k anonymization processing at “k = 10” on the “age” and “gender” data of “post-anonymization table_pattern 1”. It shows that the data after anonymization is the target data.

  In addition, the personal identification risk evaluation unit 11 calculates the number of records in which the value of a specific quasi-identifier in the target data matches, and k when the k anonymization process is executed on the target data from the calculated number. Find the number of people identified by a person. As shown in FIG. 4, this “number of people” is an evaluation of the individual identification risk.

  Specifically, for example, in the target data, it is assumed that a specific quasi-identifier is a combination of single values. “Single value” is data of a single attribute, and is a quasi-identifier that an individual has only a single value, such as age and sex. In this case, as shown in FIG. 5, the personal identification risk evaluation unit 11 obtains the number of corresponding users (number of records) for each combination of the identifiers Ql1 and Ql2 from the target data (see FIG. 5A). (See FIG. 5 (b)). Next, the personal identification risk evaluation unit 11 obtains the number of users identified by k for each value of k (see FIG. 5C).

  For example, in the target data, it is assumed that a specific identifier is a set value. “Aggregate value” is data of composite attributes, and is a quasi-identifier that an individual may have a plurality of values, such as the type of illness and the region (place of work, residence). In this case, as shown in FIG. 6, the personal identification risk evaluation unit 11 specifies a combination of the corresponding identifier “region” for each user from the target data (see FIG. 6A) (FIG. 6B). )reference). Next, the individual identification risk evaluation unit 11 obtains the number of corresponding users (number of records) for each combination of identifiers “regions” (see FIG. 6C). Next, the individual identification risk evaluation unit 11 obtains the number of users identified as k for each value of k (see FIG. 6D).

  For example, in the target data, it is assumed that the specific identifier is a combination of a single value and a set value. In this case, as shown in FIG. 7, the individual identification risk evaluation unit 11 firstly sets the set value portion of the target data (see FIG. 7A) and the single value portion of the target data (see FIG. 7B). (See FIG. 7 (c)). Next, the individual identification risk evaluation unit 11 obtains the number of corresponding users (number of records) for each combination of the identifier qi1 and the identifier “region” (see FIG. 7C). Next, the personal identification risk evaluation unit 11 obtains the number of users identified as k for each value of k (see FIG. 7D).

[Step A3: Individual Specific Risk Evaluation Process]
Next, the personal identification risk evaluation process performed by the individual identification risk evaluation unit 12 will be described with reference to FIG. FIG. 8 is a diagram for explaining the personal identification risk evaluation process performed in the embodiment of the present invention, and shows an example of personal information.

  The individual identification risk evaluation unit 12 is based on the individual identification risk obtained by the individual identification risk evaluation unit 11 and a coefficient indicating the risk of identifying an individual from each quasi-identifier preset for each quasi-identifier. , Assess personal identification risk. Specifically, the individual identification risk evaluation unit 12 calculates the individual identification risk f by, for example, the following equation (1).

(Equation 1)
f = (1 / k) × r

  In the above equation 1, k is a personal identification risk calculated by the personal identification risk evaluation unit 11. r is a coefficient indicating the risk of identifying an individual from each quasi-identifier. Hereinafter, r is expressed as “evaluation parameter”.

  The evaluation parameter is appropriately set based on the content of the semi-identifier, the value of the semi-identifier, the usage destination of the target data, and the like. For example, assume that the personal information is as shown in FIG.

  In the example of FIG. 8, the quasi-identifiers such as age, sex, date of medical care, and injury and illness may be used in other external data. Of these, age and gender are different from those of injury and illness. It is likely that it exists in the data. Therefore, when the specific identifier in the target data is sick or sick, the possibility that an individual is specified is lower than when the specific identifier is age and gender, so the value of the evaluation parameter r is also set small.

  Further, when the specific identifier in the target data data is a sickness, it is considered that the heart disease is less likely to exist in other data than the common cold. Therefore, even when the specific identifier in the target data is sick and sick, if the number of cold records is relatively large, the value of the evaluation parameter r is set large, and if the number of cold records is relatively small, The value of the evaluation parameter r is set small.

  In addition, the individual identification risk evaluation unit 12 can also calculate the individual identification risk f by the following equation (2).

(Equation 2)
f = k × R

  In the above formula 2, k is the personal identification risk calculated by the personal identification risk evaluation unit 11 as in the case of the formula 1. R is a sharing rate. The sharing rate indicates the probability that the attacker knows the target identifier as prior knowledge, and is set in the range of 0 to 1. For example, when the identifier is only gender, it is easily known, so it is set to 0.9, and when it is only age, it is set to 0.7. Also, when the identifier is a combination of age and gender, it is somewhat difficult to know, so it is set to 0.5, for example.

[Step A4: Usability Evaluation Processing]
Next, usability evaluation processing by the usability evaluation unit 13 will be described with reference to FIG. FIG. 9 is a diagram showing an example of the usability evaluation performed in the embodiment of the present invention. In FIG. 9, the horizontal axis indicates the value of k in the k anonymization process, and the vertical axis indicates the record reduction rate before and after the k anonymization process.

  As illustrated in FIG. 9, the usability evaluation unit 13 evaluates usability using the number of records of the target data and the number of records of the target data when k anonymization processing is performed on the target data. doing. Specifically, the usefulness evaluation unit 13 changes the value of k, calculates the ratio (decrease rate) of the number of records after anonymization to the number of records before anonymization of the target data, and calculates the calculation result. Graph.

  Thus, according to the graph shown in FIG. 9, the evaluator can visually grasp how many records are deleted by the k anonymization process. As a result, the evaluator can grasp the usefulness of the evaluation target data after k anonymization.

[Effects of the embodiment]
As described above, according to this embodiment, it is possible to provide a tool for evaluating individual identification risk, individual identification risk, and usefulness, and it is possible to contribute to the formulation of a guideline that balances risk and usefulness. .

[program]
The program in the present embodiment may be a program that causes a computer to execute steps A1 to A5 shown in FIG. By installing and executing this program on a computer, the evaluation apparatus 10 and the evaluation method in the present embodiment can be realized. In this case, a central processing unit (CPU) of the computer functions as the individual identification risk evaluation unit 11, the individual identification risk evaluation unit 12, the usability evaluation unit 13, the data acquisition unit 14, and the data output unit 15, and performs processing. .

  The program in the present embodiment may be executed by a computer system constructed by a plurality of computers. In this case, for example, each computer may function as any one of the individual identification risk evaluation unit 11, the individual identification risk evaluation unit 12, the usability evaluation unit 13, the data acquisition unit 14, and the data output unit 15, respectively. good.

  Here, a computer that implements the evaluation apparatus 10 by executing the program according to the present embodiment will be described with reference to FIG. FIG. 10 is a block diagram illustrating an example of a computer that implements the evaluation device according to the embodiment of the present invention.

  As shown in FIG. 10, the computer 110 includes a CPU 111, a main memory 112, a storage device 113, an input interface 114, a display controller 115, a data reader / writer 116, and a communication interface 117. These units are connected to each other via a bus 121 so that data communication is possible.

  The CPU 111 performs various calculations by developing the program (code) in the present embodiment stored in the storage device 113 in the main memory 112 and executing them in a predetermined order. The main memory 112 is typically a volatile storage device such as a DRAM (Dynamic Random Access Memory). Further, the program in the present embodiment is provided in a state of being stored in a computer-readable recording medium 120. Note that the program in the present embodiment may be distributed on the Internet connected via the communication interface 117.

  Specific examples of the storage device 113 include a hard disk drive and a semiconductor storage device such as a flash memory. The input interface 114 mediates data transmission between the CPU 111 and an input device 118 such as a keyboard and a mouse. The display controller 115 is connected to the display device 119 and controls display on the display device 119.

  The data reader / writer 116 mediates data transmission between the CPU 111 and the recording medium 120, and reads a program from the recording medium 120 and writes a processing result in the computer 110 to the recording medium 120. The communication interface 117 mediates data transmission between the CPU 111 and another computer.

  Specific examples of the recording medium 120 include general-purpose semiconductor storage devices such as CF (Compact Flash (registered trademark)) and SD (Secure Digital), magnetic storage media such as a flexible disk, or CD- An optical storage medium such as ROM (Compact Disk Read Only Memory) can be used.

  Moreover, the evaluation apparatus 10 according to the present embodiment can be realized by using hardware corresponding to each unit instead of a computer in which a program is installed. Further, part of the evaluation device 10 may be realized by a program, and the remaining part may be realized by hardware.

  As described above, according to the present invention, it is possible to evaluate data subjected to k anonymization processing. The present invention is useful in various fields where anonymization of personal information is required.

DESCRIPTION OF SYMBOLS 10 Evaluation apparatus 11 Individual identification risk evaluation part 12 Individual specific risk evaluation part 13 Usability evaluation part 14 Data acquisition part 15 Data output part 20 Database 30 Terminal apparatus 110 Computer 111 CPU
112 Main Memory 113 Storage Device 114 Input Interface 115 Display Controller 116 Data Reader / Writer 117 Communication Interface 118 Input Device 119 Display Device 120 Recording Medium 121 Bus

Claims (12)

An evaluation apparatus that evaluates data including personal information acquired from a plurality of individuals as target data,
A personal identification risk evaluation unit that evaluates, as a personal identification risk, the possibility of grasping the presence of the individual from which the personal information is acquired from the target data;
A personal identification risk evaluation unit that evaluates the possibility of identifying the individual from which the personal information is obtained from the target data as a personal identification risk;
A usefulness evaluation unit that evaluates the usefulness when anonymization processing is performed on the target data;
An evaluation apparatus comprising: The personal identification risk evaluation unit calculates the number of records with the same quasi-identifier value constituting the personal information, and k persons when k anonymization processing is executed on the target data from the calculated number Assessing the personal identification risk by determining the number of persons identified in
The evaluation apparatus according to claim 1. The personal identification risk evaluation unit evaluates the personal identification risk based on the personal identification risk and a coefficient indicating a risk of identifying an individual from the quasi-identifier preset for each quasi-identifier,
The evaluation apparatus according to claim 2. The usability evaluation unit evaluates the usability by using the number of records of the target data and the number of records of the target data when anonymization processing is performed on the target data.
The evaluation apparatus in any one of Claims 1-3. An evaluation method for evaluating data including personal information acquired from a plurality of individuals as target data,
(A) evaluating the possibility of grasping the presence of an individual from which the personal information is obtained from the target data as a personal identification risk;
(B) evaluating a possibility that an individual from which the personal information is obtained from the target data is identified as a personal identification risk;
(C) evaluating the usefulness when anonymization processing is performed on the target data; and
The evaluation method characterized by having. In the step (a), the number of records having the same quasi-identifier value constituting the personal information is calculated, and k persons when k anonymization processing is executed on the target data from the calculated number Assessing the personal identification risk by determining the number of persons identified in
The evaluation method according to claim 5. In the step (b), the individual identification risk is evaluated based on the individual identification risk and a coefficient indicating a risk of identifying an individual from the quasi-identifier preset for each quasi-identifier. ,
The evaluation method according to claim 6. In the step (c), the usefulness is evaluated using the number of records of the target data and the number of records of the target data when anonymization processing is performed on the target data.
The evaluation method according to claim 5. A program for evaluating, as target data, data including personal information acquired from a plurality of individuals by a computer,
In the computer,
(A) evaluating the possibility of grasping the presence of an individual from which the personal information is obtained from the target data as a personal identification risk;
(B) evaluating a possibility that an individual from which the personal information is obtained from the target data is identified as a personal identification risk;
(C) evaluating the usefulness when anonymization processing is performed on the target data; and
A program that executes In the step (a), the number of records having the same quasi-identifier value constituting the personal information is calculated, and k persons when k anonymization processing is executed on the target data from the calculated number Assessing the personal identification risk by determining the number of persons identified in
The program according to claim 9. In the step (b), the individual identification risk is evaluated based on the individual identification risk and a coefficient indicating a risk of identifying an individual from the quasi-identifier preset for each quasi-identifier. ,
The program according to claim 10. In the step (c), the usefulness is evaluated using the number of records of the target data and the number of records of the target data when anonymization processing is performed on the target data.
The program according to any one of claims 9 to 11.

Images