De-identification device and de-identification method

Abstract

The present invention allows suitable generalization even in a case in which there is a possibility that a dataset may be repeatedly provided, wherein attribute information of a data entry added afterward may deviate significantly from a range of values taken by a known data entry. For each data entry of a dataset having a plurality of data entries including at least one attribute datum constituting a quasi-identifier which is information which can identify a person and at least one attribute datum other than the quasi-identifier, at least one attribute data value constituting the quasi-identifier is generalized on the basis of a predetermined generalization rule, whereupon among a plurality of data entries included in the dataset, a data entry which upon being generalized on the basis of the generalization rule causes the dataset to not satisfy a predetermined standard of anonymity, and at least one data entry which as a result of attribute data values being shared between the data entry and the object of generalization causes the dataset to satisfy the predetermined standard of anonymity, are selected, whereupon for the selected data entries, the attribute data value of the object of generalization is modified to a predetermined shared value regardless of the predetermined generalization rule.

Description

technical field [0001] The invention relates to an anonymization device and an anonymization method. Background technique [0002] In recent years, technologies for privacy-preserving data disclosure to allow secondary use of personal information (microdata) owned by companies while protecting user privacy have attracted attention. Non-Patent Document 1 proposes a technique for privacy-preserving data disclosure. Among various user information (microdata), a collection of attribute information that can identify an individual by combining it with other background knowledge is called a quasi-identifier. Attribute information that users do not want to be disclosed is called sensitive data. In anonymization, one of the techniques used for privacy-preserving data disclosure, not only are explicit user identifiers removed, but also attribute information forming quasi-identifiers is made ambiguous in order to avoid identifying individuals from combinations of these kinds of attri...

AI Technical Summary

Problems solved by technology

resulting in loss of information

[0010] There is also a problem: whenever a change occurs in a data set, anonymization suitable for the characteristics of the data set is performed, at this time the method of quasi-identifier generalization is different for each data set, and the individual data entries belong to The groupings are quite different and it is difficult to observe the characteristics of the data set in the time series and track specific data items in the time series

There is a problem: when rule-based generalization is performed to preserve k=2 anonymity and I=2 diversity, as Figure 33 As shown, the birthplace value of all data entries is "Earth" and the birthplace value is meaningless

However, there is a problem: when the optimal generalization process is performed independently each time, similar to the eighth data entry, the group to which the same entry belongs is different for each snapshot, and it is difficult to track the characteristics of the dataset in time series

Images