PRIVACY PROTECTION-TYPE DATA PROVIDING SYSTEM

• US 20140351946A1
• Filed: 05/21/2014
• Published: 11/27/2014
• Est. Priority Date: 05/22/2013
• Status: Active Grant

• Current Assignee: Hitachi, Ltd.
• Original Assignee: Hitachi, Ltd.
• Inventors: SATO, Yoshinori, OIKAWA, Michio, FUJIWARA, Keisei, HARADA, Kunihiko, YOKOHARI, Yumiko, NAKAE, Tatsuya
• Granted Patent: US 9,317,716 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G16H 10/60 for patient-specific data, e.g. for electronic patient records

Abstract

An information providing apparatus for collecting data including personal information and distributing the data to a user terminal performs anonymization processing for converting data, which an individual who is an owner of personal information allows to use, into data with which the individual cannot be identified using multiple parameters, thus generating multiple anonymized data protecting the, privacy of the individual. Since each of the anonymized data is anonymized using a different parameter, the amount of information of each of the anonymized data is different. Then, when a request is received from a user terminal, anonymized data that can be provided to the user are identified from among multiple generated anonymized data on the basis of the reliability of the user who uses the user terminal.

Claims

1. An information providing apparatus connected to a plurality of first user terminals and a plurality of second user terminals, wherein the information providing apparatus applies anonymization processing, which is executed by designating a parameter and which is processing for converting data so that an individual is not identified, onto data including personal information collected from the plurality of first user terminals, and the information providing apparatus distributes anonymized data generated as a result of application of the anonymization processing to the second user terminal in response to a request from the second user terminal,

the information providing apparatus comprising:

a storage unit configured to store;

data including the personal information;

first information specifying the parameter of the anonymized data which are allowed to be provided, for each piece of data of an individual who is an owner of the personal information;

second information specifying the personal information which is a target to which the anonymization processing is applied;

third information specifying a level of reliability for each user who receives the provided anonymized data via the second user terminal; and

fourth information specifying the parameter of the anonymized, data which the user having the reliability can receive in accordance with the level of the reliability,

a processing unit configured to;

extract data which are to be allowed to be provided from among the data for each of a plurality of predetermined parameters on the basis of the first information, identify personal information which is a target of the anonymization processing from among personal information of the extracted data on the basis of the second information, and execute anonymization processing on the identified personal information with each of the plurality of predetermined parameters, thus generating a plurality of anonymized data of which amounts of information are different; and

identify the level of the reliability of the user of the second user terminal on the basis of the third information in response to a request from the second user terminal, and identify anonymized data that can be distributed to the second user terminal from among the plurality of anonymized data on the basis of the fourth information and the level of the reliability identified.

2. The information providing apparatus according to claim 1, wherein the anonymization processing is k-anonymization processing for abstracting the data so that one or more data field types included in the data, of which number is equal to or more than a number designated by the parameter, have a same value.

3. The information providing apparatus according to claim 2, wherein

the storage unit further stores log data indicating a history about providing of the anonymized data, and

in a case where the processing unit receives a distribution request of the identified anonymized data from the second user terminal, the processing unit refers to the log data, and by comparing anonymized data provided in a past to a user of the second user terminal and the anonymized data for which the distribution request is received, the processing unit determines whether there is a risk of identification of personal information included in the anonymized data for which the distribution request is received, and in a case where the processing unit determines that there is the risk, the processing unit rejects the distribution request.

4. The information providing apparatus according to claim 3, wherein the first information is set in response to a request from the first user terminal.

5. The information providing apparatus according to claim 4, wherein the fourth information is set so that when the level of the reliability becomes higher, the value of the parameter becomes smaller.

6. A control method for an information providing apparatus connected to a plurality of first user terminals and a plurality of second user terminals, wherein the control method for the information providing apparatus includes applying anonymization processing, which is executed by designating a parameter and which is processing for converting data so that an individual is not identified, onto data including personal information collected from the plurality of first user terminals, and distributing anonymized data generated as a result of application of the anonymization processing to the second user terminal in response to a request from the second user terminal,

wherein the control method of the information providing apparatus includes storing:

data including the personal information;

first information specifying the parameter of the anonymized data which are allowed to be provided, for each piece of data of an individual who is an owner of the personal information;

second information specifying the personal information which is a target to which the anonymization processing is applied;

third information specifying a level of reliability for each user who receives the provided anonymized data via the second user terminal; and

fourth information specifying the parameter of the anonymized data which the user having the reliability can receive in accordance with the level of the reliability, and

the control method of the information providing apparatus includes;

extracting data which are to be allowed to be provided from among the data for each of a plurality of predetermined parameters on the basis of the first information, identifying personal information which is a target of the anonymization processing from among personal information of the extracted data on the basis of the second information, and executing anonymization processing on the identified personal information with each of the plurality of predetermined parameters, thus generating a plurality of anonymized data of which amounts of information are different; and

identifying the level of the reliability of the user of the second user terminal on the basis of the third information in response to a request from the second user terminal, and identifying anonymized data that can be distributed to the second user terminal from among the plurality of anonymized data on the basis of the fourth information and the level of the reliability identified.

7. The control method for the information providing apparatus according to claim 6, wherein the anonymization processing is k-anonymization processing for abstracting the data so that one or more data field types included in the data, of which number is equal to or more than a number designated by the parameter, have a same value.

8. The control method for the information providing apparatus according to claim 7, wherein

a storage unit further stores log data indicating a history about providing of the anonymized data, and

in a case where a processing unit receives a distribution request of the identified anonymized data from the second user terminal, the processing unit refers to the log data, and by comparing anonymized data provided in a past to a user of the second user terminal and the anonymized data for which the distribution request is received, the processing unit determines whether there is a risk of identification of personal information included in the anonymized data for which the distribution request is received, and in a case where the processing unit determines that there is the risk, the processing unit rejects the distribution request.

9. The control method for the information providing apparatus according to claim 8, wherein the first information is set in response to a request from the first user terminal.

10. The control method for the information providing apparatus according to claim 9, wherein the fourth information is set so that when the level of the reliability becomes higher, the value of the parameter becomes smaller.