Privacy protection data association system
In a privacy protection data association system including devices ( 10 A, 10 B) which maintain user data including a user ID and personal information, each device includes: a de-identification processing unit ( 11 ) which performs an irreversible conversion process on the user ID and a privacy protection process on the personal information and generates de-identified data corresponding to the user data satisfying target user conditions; an encryption unit ( 12 ) which generates double-encrypted de-identified data using a self-encryption key and a partner encryption key in cooperation between its own device and a partner device without disclosing the keys; an aggregation processing unit ( 13 ) which compares data generated by the two devices and aggregates the number of data whose user ID parts match each other, as the number of target users; and a disclosure limitation processing unit ( 14 ) which generates disclosure limited statistical information by performing a disclosure limitation process for an aggregating result.
1 . A privacy protection data association system including a plurality of devices maintaining user data including a user ID and personal information relating to a user,
wherein each of the devices includes:
processing circuitry configured to
de-identify the user data to generate de-identified data;
perform first encryption targeting the de-identified data by using a self-encryption key maintained by its own device;
receive, from a partner device, de-identified data generated by a first encryption process separately performed by the partner device;
perform, by using the self-encryption key maintained by its own device, second encryption targeting the de-identified data received from the partner device;
receive, from the partner device, double-encrypted de-identified data generated by a second encryption process separately performed by the partner device; and
compare double-encrypted de-identified data generated by the own second encryption with the double-encrypted de-identified data received from the partner device to aggregate, as a number of target users, a number of pieces of the double-encrypted de-identified data of which user ID correspondence parts identified on a basis of pre-determined structure information of the user data match each other,
wherein the processing circuitry
performs de-identification processing including an irreversible conversion process on the user ID, and
performs the own first encryption and the own second encryption by means of a unidirectional commutative operation with a key.
2 . The privacy protection data association system according to claim 1 , wherein the processing circuitry extracts the user data based on a condition that the personal information needs to satisfy, and generates de-identified data corresponding to the extracted user data.
3 . The privacy protection data association system according to claim 2 , wherein, in a case in which the condition that the personal information needs to satisfy includes a plurality of conditions, the processing circuitry generates grouped de-identified data corresponding to a group of user data of which the personal information satisfies each of the plurality of conditions.
4 . The privacy protection data association system according to claim 1 , wherein the irreversible conversion process includes a hashing process.
5 . The privacy protection data association system according to claim 4 , wherein, after the hashing process on the user ID is performed, the processing circuitry discards salt used in the hashing process.
6 . The privacy protection data association system according to claim 1 , wherein the processing circuitry additionally performs a processing for privacy protection on the personal information.
7 . The privacy protection data association system according to claim 1 , wherein the processing circuitry of each of the devices is further configured to:
generate disclosure limited statistical information by performing a disclosure limitation process targeting an acquired aggregating result.
8 . A privacy protection data association system including a plurality of devices maintaining user data including a user ID and personal information relating to a user,
wherein each of the devices includes:
processing circuitry configured to
de-identify the user data to generate de-identified data;
perform first encryption targeting the de-identified data by using a first encryption key maintained by its own device which is a first device;
receive, from a second device, de-identified data generated by a first encryption process separately performed by the second device;
perform, by using the first encryption key, second encryption targeting de-identified data received from the second device;
receive, from the second device, double-encrypted de-identified data generated by a second encryption process separately performed by the second device; and
compare, as a third device, double-encrypted de-identified data generated by the own second encryption with the double-encrypted de-identified data received from the second device to aggregate, as a number of target users, a number of pieces of the double-encrypted de-identified data of which user ID correspondence parts identified on a basis of pre-determined structure information of the user data match each other,
wherein the processing circuitry
performs de-identification processing including an irreversible conversion process on the user ID, and
performs the own first encryption and the own second encryption by means of a unidirectional commutative operation with a key.
9 . The privacy protection data association system according to claim 8 , wherein the processing circuitry extracts the user data based on a condition that the personal information needs to satisfy, and generates de-identified data corresponding to the extracted user data.
10 . The privacy protection data association system according to claim 8 , wherein the irreversible conversion process includes a hashing process.
11 . The privacy protection data association system according to claim 8 , wherein the processing circuitry additionally performs a processing for privacy protection on the personal information.
12 . The privacy protection data association system according to claim 8 , wherein the processing circuitry each of the devices is further configured to:
generate disclosure limited statistical information by performing a disclosure limitation process targeting an acquired aggregating result.
13 . A privacy protection data association system including: an aggregation device; and a plurality of encryption devices maintaining and encrypting user data including a user ID and personal information relating to a user,
wherein each of the encryption devices includes:
processing circuitry configured to
de-identify the user data to generate de-identified data;
perform first encryption targeting the de-identified data by using a self-encryption key maintained by its own device;
receive, from a partner device of the encryption device, de-identified data generated by a first encryption process separately performed by the partner device; and
perform, by using the self-encryption key maintained by its own device, second encryption targeting the de-identified data received from the partner device,
wherein the aggregation device includes;
processing circuitry configured to
receive, from each of the encryption device and the partner device, double-encrypted de-identified data generated by a second encryption process separately performed by each of the encryption device and the partner device; and
compare the double-encrypted de-identified data received from the encryption device with the double-encrypted de-identified data received from the partner device of the encryption device to aggregate, as a number of target users, a number of pieces of the double-encrypted de-identified data of which user ID correspondence parts identified on a basis of pre-determined structure information of the user data match each other,
wherein the processing circuitry of the encryption device
performs de-identification processing including an irreversible conversion process on the user ID, and
performs the own first encryption and the own second encryption by means of a unidirectional commutative operation with a key.
14 . The privacy protection data association system according to claim 13 , wherein the processing circuitry of the aggregation device is further configured to:
generate disclosure limited statistical information by performing a disclosure limitation process targeting an acquired aggregating result.
15 . The privacy protection data association system according to claim 13 , wherein the processing circuitry of the encryption device extracts the user data based on a condition that the personal information needs to satisfy, and generates de-identified data corresponding to the extracted user data.
16 . The privacy protection data association system according to claim 13 , wherein the irreversible conversion process includes a hashing process.
17 . The privacy protection data association system according to claim 13 , wherein the processing circuitry of the encryption device additionally performs a processing for privacy protection on the personal information.