KR102418984B1 - A pseudonymization system for data-set according to risks to an environment and a control method thereof - Google Patents

Abstract

An embodiment of the present invention provides a control method of a system for pseudonymizing an information set according to a risk to a use environment, the process comprising: obtaining a source information set; obtaining a variable of the source information set; confirming the representative names of the variables of the source information set; a process of confirming the type of personal information for the variable of the source information set; confirming the level of pseudonymization for the type of personal information of the source information set; and obtaining metadata of personal information for changing the variable of the source information set to the representative name. have.

Description

A system for pseudonymization processing information sets according to risks to the environment and a control method thereof {A pseudonymization system for data-set according to risks to an environment and a control method thereof}

To a system for pseudonymizing an information set according to a risk to the use environment and a control method therefor, according to an embodiment of the present invention It relates to a system for processing pseudonyms and a method for controlling the same.

Recently, with the passage of the Data 3 Act, the concept of pseudonymous information, an intermediate concept between personal information and anonymous information, was introduced for the first time in the Personal Information Protection Act. Information that can identify a specific data subject is personal information, non-identifiable information is anonymous information, and pseudonymized information that cannot identify a specific data subject without additional information is pseudonymous information.

The processing of pseudonymous information for certain purposes such as statistical preparation, scientific research, and preservation of records in the public interest is permitted, and pseudonymous information can be used without the consent of the data subject. Pseudonymized information is information that cannot identify a specific data subject without the use or combination of additional information to restore the original state by pseudonymizing it.

However, there is a problem in that different pseudonym information is derived for each handler because the pseudonymization standard is set by the subjective judgment of each handler of the pseudonym processing.

Republic of Korea Patent Publication No. 10-2016-0108993 (2016.09.21.)

The present invention can provide reliable pseudonymous information by standardizing the level of pseudonymization according to the risk of exposure of personal information, quantitatively measuring the risk of exposure of personal information, determining the level of pseudonymization appropriate to the risk, and pseudonymizing it. .

The present invention can derive the same pseudonymized information according to the handler by measuring the risk of re-identification and determining the level of pseudonymization regardless of the expert knowledge of the handler of the information set.

The present invention can report the privacy of a data subject and provide a reliable data utilization platform by proposing a method for evaluating the identification risk of a specific data subject in pseudonymous information.

The present invention can provide a system for pseudonymizing an information set including personal information and a method for controlling the same for an information set that can derive the same pseudonymized information result for the same usage environment.

The present invention can block the misuse of personal information and provide reliable pseudonymous information.

An embodiment of the present invention provides a control method of a system for pseudonymizing an information set according to a risk to a use environment, the process comprising: obtaining a source information set; obtaining a variable of the source information set; confirming the representative names of the variables of the source information set; a process of confirming the type of personal information for the variable of the source information set; confirming the level of pseudonymization for the type of personal information of the source information set; and obtaining metadata of personal information for changing the variable of the source information set to the representative name. have.

In an embodiment of the present invention, when there is no representative name for the variable of the source information set, the information set according to the risk to the use environment further includes the step of generating a new representative name for the variable of the source information set It is possible to provide a method for controlling a system for pseudonymizing water.

An embodiment of the present invention, when there is no type of personal information for the variable of the source information set, further comprising the process of creating a new type of personal information for the variable of the source information set, risk to the use environment It is possible to provide a control method of a system that processes an information set according to the pseudonym.

In an embodiment of the present invention, when there is no pseudonymization level for the type of personal information of the source information set, the use environment includes the process of creating a new level of pseudonymization for the type of personal information of the source information set It is possible to provide a control method for a system that processes an information set according to the risk of a pseudonym.

An embodiment of the present invention includes the steps of: obtaining an actual value of the data of the source information set; obtaining a representative name of the variable of the data based on the actual value of the data; and changing the variable of the data to the representative name, it is possible to provide a control method of a system for pseudonymizing an information set according to a risk to a use environment.

The present invention standardizes the level of pseudonymization according to the risk of exposure of personal information, quantitatively measures the risk of exposure of personal information, determines the level of pseudonymization appropriate to the risk, and performs pseudonymization, thereby providing reliable pseudonymous information. have

The present invention has the effect of deriving the same pseudonymized information according to the handler by measuring the risk of re-identification and determining the level of pseudonymization regardless of the expert knowledge of the handler of the information set.

The present invention has the effect of reporting the privacy of a data subject and providing a reliable data utilization platform by proposing a method for evaluating the identification risk of a specific data subject in pseudonymous information.

The present invention has the effect of providing a system for pseudonymizing an information set including personal information and a method for controlling the same for an information set that can derive the result of the same pseudonymous information for the same use environment.

The present invention has the effect of blocking the misuse of personal information and providing reliable pseudonymous information.

1 is a block diagram of a system for pseudonymizing an information set according to a risk to a use environment according to an embodiment of the present invention.
2 is a detailed block diagram of a system for pseudonymizing an information set according to a risk to a use environment according to an embodiment of the present invention.
3 is a diagram illustrating a control method of a system for pseudonymizing an information set according to a risk to a use environment according to an embodiment of the present invention.
4 is a flowchart of a method for standardizing metadata according to an embodiment of the present invention.
5 is a flowchart of a method for standardizing metadata according to another embodiment of the present invention.

Since the embodiments according to the concept of the present invention may have various changes and may have various forms, the embodiments will be illustrated in the drawings and described in detail herein. However, this is not intended to limit the embodiments according to the concept of the present invention to specific disclosed forms, and includes all modifications, equivalents, or substitutes included in the spirit and scope of the present invention.

The technical terms used herein are used only to describe specific embodiments, and are not intended to limit the present invention. The singular expression includes the plural expression unless the context clearly dictates otherwise. In this specification, terms such as “comprise” or “have” are intended to designate that a feature, number, step, operation, component, part, or combination thereof described herein is present, but one or more other features It is to be understood that it does not preclude the possibility of the presence or addition of numbers, steps, operations, components, parts, or combinations thereof.

The suffixes "module" and "part" for components used in this specification are given or mixed in consideration of ease of writing the specification, and do not have distinct meanings or roles per se, and this It may refer to a functional or structural combination of hardware for performing a method according to an embodiment of the invention or software capable of driving the hardware.

Hereinafter, a system for pseudonymizing an information set according to a risk to a use environment and a control method thereof according to an embodiment of the present invention will be described with reference to the accompanying drawings.

1 is a block diagram of a system for pseudonymizing an information set according to a risk to a use environment according to an embodiment of the present invention.

A system for pseudonymizing an information set according to a risk to a use environment according to an embodiment of the present invention may be the electronic device 1000 . The electronic apparatus 1000 may be referred to as a terminal, a device, an electronic device, or the like. The electronic device 1000 is a smart phone, a tablet PC, a PC, a smart TV, a mobile phone, a personal digital assistant (PDA), a laptop, a media player, a server, a micro server, a global positioning system (GPS) device, an e-book terminal, a digital It may be a broadcasting terminal, a navigation device, a kiosk, an MP3 player, a digital camera, a home appliance, and other computing devices, but is not limited thereto. In addition, the present invention is not limited thereto, and the electronic device 100 may include all kinds of devices capable of processing data and providing the processed data.

1 , an electronic device 1000 according to an embodiment includes a storage unit 1100 , an output unit 1200 , a control unit 1300 , a communication unit 1500 , and a user input unit 1700 . You may. Not all illustrated components are essential components of the electronic device 1000 , and the electronic device 1000 may be implemented by more components, and the electronic device 1000 may be implemented by fewer components. may be

The storage unit 1100 may be referred to as a memory, may store a program for processing and control of the controller 1300 , and may store information input to the electronic device 1000 or information output from the electronic device 1000 . may be

The output unit 1200 may output an audio signal, a video signal, or a vibration signal, and the output unit 1200 displays and outputs information processed by the electronic device 1000 . In response to a user's input, the display 1210 may display a user interface for executing an operation related to the response.

The controller 1300 may be referred to as a processor, and generally controls the overall operation of the electronic device 1000 . For example, the control unit 1300 may control the user input unit 1700, the output unit 1200, the communication unit 1500, the user input unit 1700, etc. as a whole by executing the programs stored in the storage unit 1100. can

The communication unit 1500 may include one or more components that allow the electronic device 1000 to communicate with another device (not shown) and a server (not shown). The other device (not shown) may be a computing device such as the electronic device 1000 or a sensing device, but is not limited thereto.

The user input unit 1700 means a means for a user to input data for controlling the electronic device 1000 .

2 is a detailed block diagram of a system for pseudonymizing an information set according to a risk to a use environment according to an embodiment of the present invention.

The system for pseudonymizing an information set according to a risk to a use environment according to an embodiment of the present invention may be the electronic device 1000 described above. The system for pseudonymizing the information set according to the risk to the use environment according to the embodiment of the present invention is a standardization unit 100, a risk measurement unit 200, a pseudonym processing unit 300, a review unit 400. may include.

At least one of the standardization unit 100, the risk measurement unit 200, the pseudonym processing unit 300, and the review unit 400 is hardware for performing the method according to an embodiment of the present invention or software capable of driving the hardware. It may mean a functional or structural combination of For example, at least one of the standardization unit 100 , the risk measurement unit 200 , the pseudonym processing unit 300 , and the review unit 400 may be a part of the control unit ( ) that performs a corresponding function. In addition, as another example, at least one of the standardization unit 100 , the risk measurement unit 200 , the pseudonym processing unit 300 , and the review unit 400 may be a part of the software stored in the memory ( ) performed by the control unit ( ) have.

The standardization unit 100 , the risk measurement unit 200 , the pseudonym processing unit 300 , and the review unit 400 may be processors that perform each of the processes S100 , S200 , S300 , and S400 of FIG. 3 to be described later, or each It may be software stored in the storage unit ( ) that performs the process of

3 is a diagram illustrating a control method of a system for pseudonymizing an information set according to a risk to a use environment according to an embodiment of the present invention. 4 is a flowchart of a method for standardizing metadata according to an embodiment of the present invention. 5 is a flowchart of a method for standardizing metadata according to another embodiment of the present invention.

As shown in FIG. 3, the control method of the system for pseudonymizing the information set according to the risk to the use environment according to the embodiment of the present invention is a process of standardizing (S100), a process of measuring the risk (S200) , a process of performing pseudonymization (S300), and a process of reviewing pseudonymized information (S400).

The control method of a system for pseudonymizing an information set according to a risk to the use environment according to an embodiment of the present invention minimizes the risk that a specific information subject can be identified from pseudonymous information, thereby protecting individual privacy. have.

In step S100 , the system may perform a standardization process. The standardization process ( S100 ) may include a process of standardizing metadata constituting the information set ( S110 ) and a process of standardizing the use environment of the information set ( S120 ).

In the process S110, the system may standardize the metadata for personal information of the source information set (Raw Data-Set) and generate it as an information set (Data-Set).

Referring to FIG. 4 , a description will be given of a method for the system to standardize metadata for personal information. The system can standardize the metadata of personal information before acquiring the metadata of personal information through the storage unit ( ) or communication unit ( ).

The system may acquire the source information set including personal information through the storage unit ( ) or the communication unit ( ) ( S511 ).

Raw Data-Set may include personal information of individuals who are information subjects. For example, it refers to a collection of data related to an individual, such as 'name', 'age', 'resident registration number', 'phone number' of the information subject. Source information set refers to a set of data that is systematically arranged or organized according to certain rules so that data can be easily retrieved. A data-set is also called a data set or data set.

The source information set may mean the contents of a table in a database or a matrix of statistical data. The names of all fields (columns) of the table mean variables for an object, and each record (row) can mean an object defined by the actual values of the variables. For example, variables for a specific object may include a person's 'name', 'age', 'resident registration number', 'phone number', and the like. The actual values of the variables are called information, data, and data, and may have values such as 'Gildong Hong', '29', '200101-112233', and '010-2222-3333'.

The source information set may consist of data (data, information) that are actual values of at least one or more variables. The number of source information sets may be identical to the number of records other than the records of variable names in the information set.

The system may acquire the variables of the source information set (S512). The system may obtain the names of the variables from the source dataset. The names of variables of personal information may include 'name', 'age', 'resident registration number', 'phone number', and the like.

The system may check whether representative names for the names of variables exist (S513). The system may check whether the variables obtained from the source information set are representative names based on the information on the representative names of the variables obtained through the storage unit ( ) or the communication unit ( ).

The information on the representative names of variables may include a name set of variables indicating the same type of data and a representative name representing the name set. For example, a set of names of variables for age is ['age', 'age', 'Yeonsei', 'old' ], and a representative name for this may be 'age'. Alternatively, the information on the representative names of the variables may be matching information including the representative names mapped to each variable. For example, it has the structure of [variable-representative name], and you can see 'age'-'age', 'yonsei'-'age', 'age'-'age'. Information on representative names of variables is included in the metadata of personal information, and the personal information metadata may be stored in the storage unit ( ).

Also, the information on the representative names of the variables may include information on the representative names of the variables of the data in the source information set and information defining which variables each object has. For example, the representative name information is the standardized name ['name', 'age', 'resident registration number', 'mobile number'], and information on which personal information among ['name', 'age', 'resident registration number', 'mobile number'] will be included can

When the representative name of the variable does not exist, the system may generate information about the representative name of the variable and store it in the storage unit ( S514 ). The system can perform the following process when a representative name of a variable exists.

The system may check whether the type of personal information for the variable exists (S515).

Personal information stored in the source information set is the actual value of the data (the value of the field), and depending on the ease of identification of the data subject (or object), ① direct identifier (unique identifier), ② indirect identifier (quasi-identifier) , ③ attribute information, and ④ specific information.

“Direct identifier” is information that is uniquely assigned only to the data subject and is highly personally identifiable by itself. When combined with information, it is information that can easily identify a specific individual, and “attribute information” is mainly possessed by the personal information controller, so it is difficult for a person other than the personal information controller to identify a specific individual even when combined with other information. ” means information that is not uniquely assigned to the data subject, but is information that is only applicable to the data subject and can be easily identified by anyone.

The system may acquire type classification information of a plurality of personal information through the storage unit ( ) or the communication unit ( ).

The type classification information of a plurality of personal information informs whether the personal information belongs to at least one type of direct identifier, quasi-identifier, attribute information, and specific information. Type classification information may include personal information for all types of direct identifiers, quasi-identifiers, attribute information, and specific information, and includes only personal information for at least one type of direct identifier, quasi-identifier, attribute information, and specific information. can do.

For example, in the classification information of a plurality of types of personal information, lists of personal information belonging to direct identifiers, quasi-identifiers, attribute information, and specific information are configured differently according to risk levels. For example, specific personal information may be information about a quasi-identifier in Level 1, but may belong to specific information in Level 2. As another example, in the classification information of a plurality of personal information, the list of personal information belonging to the direct identifier, quasi-identifier, attribute information, and specific information is configured differently based on at least one of the sensitivity of the information set, the user level, and the information protection level. .

As an example of type classification information of personal information, name, photo, resident registration number, phone number, e-mail address, IP address, and vehicle license plate information among personal information belong to direct identifiers, and among personal information, date of birth, date of death, wedding anniversary, Occupation, gender, credit rating, address, postal code, etc. belong to quasi-identifiers, and among personal information, product purchase history, monthly phone usage, total loan amount, total deposit, number of insurance accounts, customer identification number, etc. belong to attribute information. , persons with special diseases, very high-income earners, super-aged persons, special occupations, and movement routes among personal information may belong to special information.

As another example of other personal information classification information, names, photos, resident registration numbers, phone numbers, email addresses, IP addresses, and vehicle license plate information among personal information belong to direct identifiers, and among personal information, date of birth, date of death, wedding anniversary, Occupation, gender, credit rating, address, postal code, etc. may belong to quasi-identifiers, and there may be no personal information belonging to attribute information or special information.

The system can confirm what type of personal information the variable of the source information set is based on the type classification information of personal information, and can create a new type of personal information if there is no corresponding type of personal information. For example, if the classification information includes personal information for direct identifiers and quasi-identifiers, but does not include personal information belonging to attribution information, a new type of attribution information is created and the newly created type of attribution information is included. It is possible to create and store new type classification information (S516).

When the variable of the source information set belongs to the type classification information of personal information, the system can check whether there is a level of pseudonymization by type as the next process (S517). The system may acquire information on the level of pseudonymization by type through the storage unit ( ) or the communication unit. The system may check whether there is a pseudonymization level for the type of personal information based on the information on the level of pseudonymization for each type. Alternatively, the system may check whether the pseudonymization level of the types included in the classification information exists based on the information on the pseudonymization level for each type.

When the pseudonymization level for each type does not exist, the system may generate and store information on a new pseudonymization level for each type (S518). Information on the level of pseudonymization for each new type may include pseudonymization processing techniques for each type according to data types and attributes, and identifiers of pseudonymization information assigned to each type of personal information.

The system may acquire metadata of personal information when there is a level of pseudonymization for each type (S519).

Metadata of personal information may include information on the purpose of creation and use of an information set (including personal information) and attribute classification information that enables the information set to identify a subject of personal information.

Metadata of personal information includes information on variables of the source information set, information on representative names of variables, information on types of personal information, type classification information, pseudonymization level information by type, and pseudonymization level information according to type classification information. may include

Metadata of personal information may include information about actual values (eg, data values) of variables. Information about the actual value of a variable may include information about the type and characteristics of data. Data types may be classified into numbers, characters, and dates, and in the case of numbers, continuous and discrete types may be included. The characteristics of the data may have characteristics of the corresponding variable. For example, in the case of gender, a binary characteristic in which only two variables exist, and in the case of age, characteristics of a minimum value and a maximum value may be given.

The system may identify the variables of the data based on the metadata of the personal information.

As an example, the system checks the actual value (data value) of the variable in order to change the variable (name of field) of the data of the source information set to the metadata of personal information, and the variable of the data based on the type and characteristics of the data name can be derived. Based on the information about the actual value of the variable, it is possible to check which variable the actual value of the variable corresponds to. For example, looking at the data value of 'male' or 'male', it can be determined as the data of the ['gender'] variable because it corresponds to a character and belongs to a binary characteristic that means gender.

The system may acquire an information set by using the metadata of personal information (S520). The system may change the variable to the representative name if it does not match after confirming that the variable of the data of the source information set matches the representative name of the variable based on the metadata about personal information. The set of data generated through this is called a data-set.

A data-set can be composed of a table or a matrix in the same way as a source information set, and each record in the table means an object of the proposed information set, and all fields are variables (or variables) for the object. properties) can be

The data-set created in the standardization process refers to a set of standardized information by changing the source information set to the representative name of the variable corresponding to the type of personal information using the metadata of personal information. do. Alternatively, the information set refers to a combined information set of at least two or more information sets.

In the process S110, as another example, the system may standardize metadata for personal information of a raw data-set and generate it as a data-set.

Referring to FIG. 5 , as another example, a method for standardizing metadata for personal information by a system will be described. The system can standardize the metadata of personal information before acquiring the metadata of personal information through the storage unit ( ) or communication unit ( ).

The system may acquire the source information set through the storage unit ( ) or the communication unit ( ) ( S611 ).

The system may obtain actual values (values of fields) of a specific variable of the source information set ( S612 ). For example, values of the 'date of birth' field may include '990211', '001212', '880102', and the like.

The system may check the data type that is the actual value of the variable based on the data type contrast information acquired through the storage unit ( ) or the communication unit ( ). Data types refer to information such as numbers, characters, and dates, and in the case of numbers, it can be divided into continuous and discrete types, and in the case of characters, it can be divided into word, sentence, and paragraph types.

When the type of data that is the actual value of the variable of the source information set does not exist in the contrast information of the data type, the system may create and store a new data type defining the actual value of the data of the variable of the source information set (S614).

When the data type for the actual value of the variable of the source information set exists, the system may check the characteristics of the data (S615). The system may acquire contrast information of data characteristics through the storage unit ( ) or the communication unit ( ). The system can check whether the data characteristic, which is the actual value of the source information set, belongs to the data characteristic contrast information.

Characteristics of data is information possessed by a specific variable (field). The 'age' variable is a number and has a minimum and maximum value. In the case of a 'gender' variable, there are only two types of data: 'male' or 'female'. characteristics that can be possessed.

When there is no data characteristic for the actual value of the variable of the source dataset, the system may create and store a new data characteristic defining the actual value of the data of the variable of the source dataset (S616).

The system may confirm the representative name of the variable of the case source information set based on the data type and characteristics of the actual value of the variable of the source information set (S617). The system may generate a representative name of a new variable when there is no representative name of the variable of the source information set (S618).

The system may acquire metadata of personal information (S519). Metadata of personal information may include information on the purpose of creation and use of an information set (including personal information) and attribute classification information that enables the information set to identify a subject of personal information.

Metadata of personal information may include information about actual values (eg, data values) of variables. The information about the actual value of the variable may include information about the type and characteristics of data. Data types may be classified into numbers, characters, and dates, and in the case of numbers, continuous and discrete types may be included. The characteristics of the data may have characteristics of the corresponding variable. For example, in the case of gender, a binary characteristic in which only two variables exist, and in the case of age, characteristics of a minimum value and a maximum value may be given.

If there is a representative name, the system may change the variable of the corresponding source information set to the representative name (S620). The system may obtain an information set by using the metadata of personal information. The system may change the variable of the data of the source information set to the representative name based on the metadata about personal information. The set of data generated through this is called a data-set.

Through this, the system confirms the type and characteristics of data by analyzing the data values of the source information set, checks the data variables based on the identified data types and characteristics, and then changes the names of the variables to the representative names of the variables. Regardless, you can change the variable with the representative name using the data value.

For reference, the source information set is an information set before standardization, and may be different source information sets if the names of variables expressing the same data value (actual value) are different. However, even different source information sets can become the same information sets through standardization. For example, the first source information set and the second source information set have actual values for the same object, such as 'Gildong Hong', '29', '200101-112233', and '010-2222-3333'. However, in the first source information set, the terms of the variables for the object are 'name', 'age', 'resident registration number', and 'phone number', and in the second source information set, the terms of the variables for the object are In the case of 'name', 'age', 'resident registration number', and 'phone number', the first source information set and the second source information set are classified as different source information sets.

As shown in FIG. 3 , in step S120 , the system may standardize the use environment of the information set.

The system may obtain standardization information of the usage environment of the information set from the input of the handler of the information set, the storage unit ( ), or the communication unit ( ). The use environment of the information set may include all elements of the processing process in which the information set is used and utilized.

A specific data subject existing in the pseudonymous information may be re-identified by the background knowledge of the user using the data set or by other data sets used together with the pseudonymous information. Therefore, the present invention can control the possibility of re-identification of data subjects from pseudonymous information by standardizing the usage environment in which pseudonymous information is used.

Standardization of the use environment of information aggregates may include standardization of sensitivity level for information aggregates, standardization of user level, and standardization of information protection level when using information aggregates.

Sensitivity level for information sets refers to the standardized and graded level of evaluation of the sensitivity of information sets, the source data of pseudonymized information. It can include the level of comprehensive evaluation of the data type of the data type, the existence of unique identifiers and quasi-identifiers, etc.

In addition, the user level refers to the level at which the user's data-related abilities are graded, and is the user's data analysis ability using information sets. level may be included.

The storage unit ( ) may store stored information about users who will use the information set. The system may standardize the user level based on the information about the users stored in the storage unit ( ). For example, the stored information about users may include information on a plurality of user levels classified based on the user's technical area, occupation, expert status, existence of a company, company type, work area, and the like. When the system receives user information to use the information set, it can determine the user level of the corresponding user in comparison with the stored information about the user.

In addition, the information protection level refers to the level graded to control users and unauthorized persons, and technical, physical, and administrative information protection is evaluated to protect internal information such as access control and usage history collection analysis targeting information sets. It can contain one level.

The storage unit ( ) may store stored information about the protection level of personal information when using the information set. The system can standardize the protection level of personal information based on the information about the protection level stored in the storage unit ( ). For example, information stored on the level of protection when using an information set is information about the level of evaluation of technical, physical, and administrative information protection to protect internal information such as access control and usage history collection and analysis targeting the information set. may include. When the system receives an information set, it can determine the protection level when using the information set in comparison with the stored information about the protection level.

In the process S200, the system may acquire a risk (risk). The process of acquiring a risk (S200) may include a process of acquiring a use environment (S210) and a process of determining a risk level (S220).

In step S210 , the system may acquire at least one of information on the sensitivity, user level, and protection level of the information set from the input of the handler of the information set or the storage unit ( ) in order to measure the use environment. The environment in which the information set will be used is created according to the level of sensitivity of personal information in pseudonymous information, the level of people who actually use the information set, and information on access or use rights to pseudonymous information, and the environment in which pseudonymous information is used. it means.

In step S220 , the system may determine the level of risk. The system may determine a risk score or a risk class based on the obtained information about the use environment. The system compares the sensitivity level, user level, and protection level of the user environment standardized in the S120 process by at least one of the previously measured sensitivity level of personal information, the user level using pseudonymous information, and the level of protection against pseudonymous information. can determine the level of risk.

Also, in step S300 , the system may perform pseudonymization. The process of performing pseudonymization processing ( S300 ) may include a process of determining a processing level for the information set ( S310 ) and a process of performing pseudonymization processing ( S320 ).

In step S310, the system may determine information on the processing level of the information set based on the acquired use environment itself or the risk score (grade). The information on the processing level for the information set may include information on the basic processing level and information on the weight level.

Information on the basic processing level may include mapping information to pseudonymize personal information (actual value of data). In this case, the personal information may be information corresponding to a quasi-identifier. The mapping information includes information that can change data of a specific variable or a specific data structure (type, characteristic) into other data of a specific type. That is, the information on the basic processing level includes information on how to pseudonymize personal information so that re-identification is impossible without using additional information.

For example, information on the basic processing level for the date of birth is '2011', 'Born in 1999', 'based on the first two digits when the data on the date of birth is '110101', '990112', and '031212', respectively. It may include information or algorithms capable of deriving 'born in 2003'.

The weight level information means a weight additionally applied to the basic processing level applied to personal information. Weight level information may be additionally applied according to the acquired use environment or risk level. For example, the weight level information may include information that can increase the degree of identification by increasing the weight of the pseudonym applied to specific personal information according to the risk level, and lower the weight to increase the degree of identification. .

The system can determine the level of pseudonymization for the dataset according to the risk class.

As an example, the system may determine the level of removal of outliers according to the risk class. Specifically, continuous numbers have a normal distribution, and in this case, outliers in the sigma distribution are removed, and the 3 sigma distribution is the lowest risk. It can be treated to remove cases, 2 sigma is removed for medium risk, and 1 sigma is removed for the most dangerous case. The system can determine the risk class according to the sigma distribution of the normal distribution, and can remove outlier data according to the determined risk class.

As another example, the system may determine the sensitivity generation level of differential privacy according to the risk level. The sensitivity generation level can be based on the number of elements constituting the class (average or specific K value) when forming a class composed of the same information (K-anonymity K value) by grouping indirect identifiers. The system may determine the degree of differential privacy protection according to the risk class based on the sensitivity generation level.

In step S320, the system may perform pseudonymization. The system can generate pseudonymous information by performing pseudonymization on the information set based on information about the processing environment, usage environment, processing purpose, nature of information, etc. have. The system may generate pseudonym information by performing pseudonymization on the information set based on the information on the basic processing level and the weight level information.

Pseudonymized information means information that cannot identify a specific individual without the use or combination of additional information to restore the original state by pseudonymizing personal information. Pseudonymization refers to processing a specific individual so that it cannot be identified without additional information, such as by deleting part of personal information or replacing part or all of it.

There are heuristic pseudonymization, encryption, and exchange methods as pseudonymization methods. Heuristic pseudonymization hides personal information by processing the value corresponding to the identifier according to a preset rule. Encryption is a method of replacing personal information by encrypting it by applying an algorithm of a certain rule. Exchange is a method of replacing records in an existing database by linking them with predetermined external variable (item) values. The method of pseudonymization can be determined by the information on the processing level for the information set.

Also, in step S400 , the system may review the pseudonym information after the pseudonymization process. The process of examining the pseudonymized pseudonym information (S400) may include a process of reviewing the adequacy of the pseudonym information and performing additional pseudonymization processing (S410) and a step of performing follow-up management of the pseudonymous information (S420).

In step S410, the system may review whether pseudonymization has been performed at an appropriate level for the purpose of the pseudonymous information, and may determine whether there is any possibility of re-identification of the data subject. If there is a possibility of re-identification of the data subject, the system can perform additional pseudonymization by raising the list level. In this way, it is possible to minimize the risk of re-identification of a specific subject and to compensate for weaknesses.

In step S420, when it is determined that it is appropriate because there is no possibility of re-identification of the data subject as a result of the review in step S410, the system acquires actual use information for pseudonym information and compares it with a preset standard for actual use of pseudonym information. You can determine if there is a problem. The preset standards may include physical standards such as technical standards for using pseudonymous information to comply with laws related to the Personal Information Protection Act, administrative standards for users using pseudonymous information, and the environment in which pseudonymous information is used.

Although the present invention has been described with reference to the embodiment shown in the drawings, which is merely exemplary, those skilled in the art will understand that various modifications and equivalent other embodiments are possible therefrom. Accordingly, the true technical protection scope of the present invention should be determined by the technical spirit of the appended claims.

standardization unit (100)
Risk measurement unit (200)
pseudonym processing unit (300)
review unit 400

Claims (5)

In the control method of the system for pseudonymizing the information set according to the risk to the use environment,
the process of acquiring the source information set;
obtaining a variable of the source information set;
a process of confirming a representative name for a variable of the source information set;
a process of confirming the personal information type for the variable of the source information set;
a process of confirming information on a level of pseudonymization including a pseudonymization processing technique determined for each type of personal information;
obtaining metadata of personal information for changing the variable of the source information set to the representative name;
obtaining a data value of a variable of the source information set;
obtaining a representative name for the variable of the source information set based on the data value of the variable using the metadata of the personal information; and
A method of controlling a system for pseudonymizing an information set according to a risk to a use environment, comprising acquiring an information set in which the variable of the source information set is changed to the representative name.
According to claim 1,
When there is no representative name for the variable of the source information set, the system for processing the information set according to the risk to the use environment as a pseudonym, further comprising the step of generating a new representative name for the variable of the source information set control method.
According to claim 1,
When there is no personal information type for the variable of the source information set, the process of generating a new personal information type for the variable of the source information set further comprises the process of pseudonymizing the information set according to the risk to the use environment How to control the system.
According to claim 1,
If there is no information on the level of pseudonymization for a specific type of personal information in the information on the level of pseudonymization, including the process of generating information on a new level of pseudonymization for the specific type of personal information, A control method of a system that pseudonymizes information sets according to risk.
delete

Images