Abstract:
A judgment apparatus includes a processor that executes a procedure, the procedure including obtaining a plurality of pieces of data having a certain relationship with a specific number or more of pieces of data included in a first data group, in the case that a piece of data included in a second data group different from the first data group does not have the certain relationship with the specific number or more of pieces of data included in the second data group, judging whether the piece of data has the certain relationship with the specific number or more of pieces of data included in the obtained plurality of pieces of data, and storing the piece of data in a storage device in the case that the piece of data is judged to have the given relationship with the specific number or more pieces of data.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application is based upon and claims the benefit of priority of the prior Japanese Patent Application No. 2011-212062, filed on Sep. 28, 2011, the entire contents of which are incorporated herein by reference. 
       FIELD 
       [0002]    The embodiments discussed herein are related to concealment of data. 
       BACKGROUND 
       [0003]    There are technologies that process collected personal information into anonymized information in order to inhibit an individual from being identified. Even when personal information is generally processed into anonymized information, the anonymized information is classified as personal information if an individual can be identified by a comparison of that anonymized information with other information (referred to as “easy comparability”). Unfortunately, there is no objective criterion for judging whether there is “easy comparability”, and it is difficult, for this reason, to judge whether anonymized information can be safely used. This “easy comparability” involves the following viewpoints. (1) Is anonymized information placed in circumstances where the anonymized information can be easily compared to other information? (2) As a result of a comparison of the anonymized information with other information, can an individual be identified? 
         [0004]    With regard to viewpoint (1), measures that include data management (reference authority, a reference range, and measures against information leakages) are taken, and, as a result, easy comparability may be inhibited. A judgment is therefore impossible only by software. With regard to viewpoint (2), which is also referred to as personal identifiability, information is processed in such a manner that records by which an individual may be identified are removed, so that safer anonymized information may be generated. In this way, an individual is not identified even if anonymized information may be easily compared to other information, and even if information by which an individual is identified leaks elsewhere. Anonymized information may therefore be used safely. 
         [0005]    The technologies that process personal information into anonymized information include, for example, a technology that compares information to personal information, and, as a result, judges the information as being information that may lead to identification of an individual and removes the information, thereby turning the information into anonymized information. 
         [0006]    There is also a technology that verifies personal identifiability using duplication of records in anonymized information, so that data processing is performed. This technology uses a rule indicating that if the number of duplications of records in anonymized information is N or more (where N is an integer that is set to be greater than or equal to 2), since the number of results obtained by comparing the anonymized information to personal information is N or more, and an individual is unable to be identified by the anonymized information. 
         [0007]    Specifically, processing as illustrated in  FIG. 1  is performed. The anonymized information illustrated on the left of  FIG. 1  includes three records. Records in two rows from the top are identical, and it has been verified that there is no identifiability when the number of identical records is two or more. Therefore, these records are judged to be [OK] and are added to verified, anonymized information. However, a record consisting of ABCD is placed in only one row, and therefore there is personal identifiability. Accordingly, this record is judged to be [Failed]. Then, for example, attribute values B and C, which are part of the record consisting of ABCD, are each converted into X, and a record consisting of AXXD is added to the verified, anonymized information. The record consisting of ABCD itself is discarded. The above processing method is effective for processing records that have already been accumulated in one database. 
         [0008]    Unfortunately, a problem arises where data appropriately collected from various business systems is anonymized, and the anonymized data is output to other systems that utilize that anonymized data. Specifically, when firstly the three records as illustrated on the left of  FIG. 1  are collected, then processing of the three records is performed as described above, and data illustrated on the right of  FIG. 1  is output to other systems. Thereafter, when three new records as illustrated on the left of  FIG. 2  are collected, and processing of the three new records is performed as described above, it is verified that two rows from the top of the three new records are identical and there is no personal identifiability. These records are therefore judged to be [OK] and are added to verified, anonymized information. However, a record consisting of ABCD is placed in only one row, and therefore there is personal identifiability. Accordingly, this record is judged to be [Failed]. Then, attribute values B and C, which are part of the record consisting of ABCD, are each converted into X, and a record consisting of AXXD is added to the verified, anonymized information. The record consisting of ABCD itself is discarded. In this manner, although the record consisting of ABCD appears twice, the collection timings are different, and therefore the record “AXXD” is twice registered in the verified, anonymized information. As a result of this, however, information of ABCD is lost, which leads to an obstacle to statistical processing or the like in other systems. 
       SUMMARY 
       [0009]    According to an aspect of the invention, a judgment apparatus includes a processor that executes a procedure, the procedure including obtaining a plurality of pieces of data having a certain relationship with a specific number or more of pieces of data included in a first data group, in the case that a piece of data included in a second data group different from the first data group does not have the certain relationship with the specific number or more of pieces of data included in the second data group, judging whether the piece of data has the certain relationship with the specific number or more of pieces of data included in the obtained plurality of pieces of data, and storing the piece of data in a storage device in the case that the piece of data is judged to have the given relationship with the specific number or more pieces of data. 
         [0010]    The object and advantages of the invention will be realized and attained by means of the elements and combinations particularly pointed out in the claims. 
         [0011]    It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are not restrictive of the invention, as claimed. 
     
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         [0012]      FIG. 1  is an explanatory illustration of the related art. 
           [0013]      FIG. 2  is an explanatory illustration of the related art. 
           [0014]      FIG. 3  illustrates an outline of processing of a first embodiment. 
           [0015]      FIG. 4  illustrates an outline of a system according to the first embodiment. 
           [0016]      FIG. 5  illustrates an example of a functional block of an information processing apparatus according to the first embodiment. 
           [0017]      FIG. 6  illustrates an example of a processing flow of the information processing apparatus according to the first embodiment. 
           [0018]      FIG. 7  illustrates an example of collected data. 
           [0019]      FIG. 8  illustrates an example of definition data according to the first embodiment. 
           [0020]      FIG. 9  illustrates an example of converted data. 
           [0021]      FIG. 10  illustrates an example of a processing flow for first verification processing. 
           [0022]      FIG. 11  is a table that illustrates a verification result in the first verification processing. 
           [0023]      FIG. 12  illustrates an example of a group of verification success records in the first verification processing. 
           [0024]      FIG. 13  illustrates an example of a group of verification failure records in the first verification processing. 
           [0025]      FIG. 14  illustrates an example of a processing flow for second verification processing. 
           [0026]      FIG. 15  illustrates an example of data stored in a verification success data storage unit in a first round of processing. 
           [0027]      FIG. 16  illustrates an example of data processing in a target system. 
           [0028]      FIG. 17  illustrates an example of data that is collected next and converted. 
           [0029]      FIG. 18  is an example of a table that illustrates a verification result in a second round of the first verification processing. 
           [0030]      FIG. 19  illustrates an example of a group of verification success records in the second round of the first verification processing. 
           [0031]      FIG. 20  illustrates an example of a group of verification failure records in the second round of the first verification processing. 
           [0032]      FIG. 21  illustrates an example of data stored in a verification success data storage unit after the second round of the second verification processing. 
           [0033]      FIG. 22  illustrates the outline of processing according to a second embodiment. 
           [0034]      FIG. 23  illustrates an example of a processing flow of an information processing apparatus according to the second embodiment. 
           [0035]      FIG. 24  illustrates an example of definition data according to the second embodiment. 
           [0036]      FIG. 25  illustrates an example of a processing flow of third verification processing. 
           [0037]      FIG. 26  illustrates an example of records judged to be verification success records in the third verification processing. 
           [0038]      FIG. 27  illustrates an example of records judged to be verification failure records in the third verification processing. 
           [0039]      FIG. 28  illustrates an example of a processing flow of fourth verification processing. 
           [0040]      FIG. 29  illustrates an example of a processing flow of the fourth verification processing. 
           [0041]      FIG. 30  is an example of a table illustrating the concealment of a verification failure record. 
           [0042]      FIG. 31  illustrates an example of a processing flow of data distribution processing. 
           [0043]      FIG. 32  illustrates an example of distribution data. 
           [0044]      FIG. 33  illustrates an example of a record specified as restoration data by a second round of the third verification processing. 
           [0045]      FIG. 34  illustrates an example of records specified as verification success records in the second round of the third verification processing. 
           [0046]      FIG. 35  illustrates an example of a record specified as a verification failure record in the second round of the third verification processing. 
           [0047]      FIG. 36  illustrates an example of second distribution data. 
           [0048]      FIG. 37  illustrates an example of data accumulated in target systems. 
           [0049]      FIG. 38  illustrates an example of a hardware configuration of a computer. 
           [0050]      FIG. 39  illustrates an example of functional blocks of an information processing apparatus according to an embodiment. 
       
    
    
     DESCRIPTION OF EMBODIMENTS 
       [0051]    With reference to  FIG. 3 , the outline of processing in a first embodiment will be described. An information processing apparatus that performs processing in this embodiment collects data from one or a plurality of business systems (also referred to as “source systems”), anonymizes the collected data, and performs a process as described below, and then distributes the processed data to other systems (also referred to as “target systems”) that utilize anonymized information. For example, when three records are collected as illustrated on the upper left side of  FIG. 3 , duplication of records is judged among the three records (step ( 1 )). Note that the three records are data obtained after data conversion processing for anonymization (for example, converting data into data of a corresponding range of values, converting data into Japanese syllabary, or discarding an attribute that forms part of the records). 
         [0052]    If it is judged in step ( 1 ) that N or more records (where N is an integer that is set to be greater than or equal to 2), for example, are duplicate records, there is no personal identifiability, and therefore these records are judged to be [OK] and added to verified, anonymized information. In the example of  FIG. 3 , N is 2. In the example of  FIG. 3 , the upper two records are added to the verified, anonymized information. In contrast, the lowermost record that includes attribute values of A, B, C, and D is not a duplicate of any other record, and as a result, there is personal identifiability. This record is therefore judged to be [Failed]. However, the record that includes ABCD is compared to the verified, anonymized information to check whether a record that matches this record is included in the verified, anonymized information (step ( 2 )). In this example, because there is no record that is a duplicate of the record that includes ABCD, the record that includes ABCD is also judged to be [Failed] in step ( 2 ). In this embodiment, the record that includes ABCD is not discarded, and is held so as to be used when judging a subsequently collected record regarding whether there is a duplicate record of the subsequently collected record. The verified, anonymized information is distributed to target systems. 
         [0053]    Next, when two records are collected from a source system, the two records are combined with the held record (step ( 3 )), and all three records are judged in terms of duplication of records (step ( 4 )). For example, when a record that includes ABCD and a record that includes EFGH are newly collected from a source system, these records are judged together with the record that includes ABCD, which has been held, in terms of duplication of records. In this case, since there is no personal identifiability in the records that include ABCD, the records that include ABCD are added to the verified, anonymized information. Regarding the record that includes EFGH, in contrast, there is no duplication among the three records, and therefore there is personal identifiability. The record that includes EFGH is judged to be [Failed]. The record that includes EFGH is compared to the verified, anonymized information to check whether a record that matches this record is included in the verified, anonymized information (step ( 5 )). In the example of  FIG. 3 , since the record that includes EFGH is already included in the verified, anonymized information, the record that is currently collected and includes EFGH is judged to be [OK] and is added to the verified, anonymized information. Thus, the three records verified this time are distributed to target systems. 
         [0054]    By performing a process such as that described above, more records are enabled to be effectively utilized in target systems. Moreover, each time records are collected, a process such as that described above is performed on the collected records. This allows target systems to perform processing, such as statistical processing, on the latest data without impairing immediacy. 
         [0055]    The outline of a system according to this embodiment will next be described with reference to  FIG. 4  and  FIG. 5 . As illustrated in  FIG. 4 , an information processing apparatus  1000  that performs primary processing according to this embodiment is coupled via a network  300  to source systems  1001  and  1002 , and is coupled via a network  400  to target systems  1003  and  1004 . A single source system and a single target system may be provided. The source systems  1001  and  1002  transmit, for example, data to be stored in their own databases via the network  300  to the information processing apparatus  1000 . 
         [0056]    The target systems  1003  and  1004  also accumulate data received via the network  400  from the information processing apparatus  1000 , for example, in their own databases, and, asynchronously with data reception, perform processing in response to requests from other device and the like. 
         [0057]      FIG. 5  is a functional block diagram of the information processing apparatus  1000 . The information processing apparatus  1000  includes a data collection unit  100 , a collected data storage unit  110 , a data converter  120 , a converted data storage unit  130 , a first verification processing unit  140 , a verification failure data storage unit  150 , a second verification processing unit  160 , and a verification success data storage unit  170 , a distribution processing unit  180  that distributes anonymized data via the network  400  to the target systems, a distribution data storage unit  190 , a definition management unit  200 , and a definition data storage unit  210 . 
         [0058]    The data collection unit  100  receives data via the network  300  from the source systems  1001  and  1002 , and stores the data in the collected data storage unit  110 . The data converter  120  performs data conversion processing in accordance with data stored in the definition data storage unit  210 , and stores a processing result in the converted data storage unit  130 . The first verification processing unit  140  performs verification processing on data stored in the converted data storage unit  130  and the verification failure data storage unit  150  in accordance with the data stored in the definition data storage unit  210 . Then, the first verification processing unit  140  outputs a record that results in verification success to the distribution processing unit  180 , and stores, in the verification failure data storage unit  150 , a record that results in verification failure. 
         [0059]    The second verification processing unit  160  performs verification processing on data stored in the verification failure data storage unit  150  in accordance with data that is stored in the definition data storage unit  210  for data stored in the verification success data storage unit  170 . Then, the second verification processing unit  160  outputs a record that resulted in verification success to the distribution processing unit  180 , and stores, in the verification failure data storage unit  150 , a record that resulted in verification failure. The distribution processing unit  180  stores, in the distribution data storage unit  190 , the data received from the first verification processing unit  140  and the second verification processing unit  160 , and updates the verification success data storage unit  170  using the received data. Then, the distribution processing unit  180  transmits data stored in the distribution data storage unit  190  via the network  400  to the target systems  1003  and  1004 . 
         [0060]    The definition management unit  200  stores, in the definition data storage unit  210 , definition data for data conversion processing and verification processing, in accordance with an instruction from an administrator terminal  2000 . The definition management unit  200  sets data that is stored in the definition data storage unit  210  in the data converter  120 , the first verification processing unit  140 , the second verification processing unit  160 , and the like. 
         [0061]    With reference to  FIG. 6  to  FIG. 21 , processing of the information processing apparatus  1000  will be described next. First, the data collection unit  100  collects data from the source system  1001  or  1002 , and stores the collected data in the collected data storage unit  110  ( FIG. 6 : S 1 ). For example, the data collection unit  100  collects data as illustrated in  FIG. 7  and stores the data in the collected data storage unit  110 . In the example given in  FIG. 7 , each record contains a personal identifier (ID), name, sex, age, height, and weight. Note that a number (No.) is contained in each record for the sake of convenience of identification of the record in a description of the subsequent processing; however, in reality, the number is not contained. 
         [0062]    Then, the data converter  120  performs a specified data conversion in accordance with definition data stored in the definition data storage unit  210 , and stores a processing result in the converted data storage unit  130  (S 3 ). In this embodiment, the data converter  120  is set the definition data by the definition management unit  200 . An example of the definition data stored in the definition data storage unit  210  is illustrated in  FIG. 8 . The example of  FIG. 8  includes the number of duplications, which is a judging criterion for anonymization, and data indicating whether listed items are to be verified. In the example of  FIG. 8 , “sex”, “age”, “height”, and “weight” are listed as items, and data of other items is discarded for anonymization purposes. Specifically, the data converter  120  discards “personal ID” and “name”. In this embodiment, as an example of making data of items ambiguous, it is judged which of a range of values that has been determined in advance the data of an item indicated to be verified belongs to, and then the data of the item is replaced by data that specifies the range of values. For example, in the case of “A” whose height is “179”, the data of the height belongs to a range of values of 170-179, and is replaced by identification data for the range of values concerned. The data of the items “age” and “weight” is similarly replaced. As a result, the data of  FIG. 7  is converted into the data illustrated in  FIG. 9 . In the example of  FIG. 9 , the items “personal ID” and “name” are discarded, and the item “sex” remains intact. The data of items “age”, “height”, and “weight” are replaced by data that specifies ranges of values to which the data of the items belongs as described above. 
         [0063]    Then, the first verification processing unit  140  performs first verification processing of data stored in the converted data storage unit  130  in accordance with definition data stored in the definition data storage unit  210  (S 5 ). With reference to  FIG. 10  to  FIG. 13 , the first verification processing will be described. 
         [0064]    In the first verification processing, the first verification processing unit  140  first checks whether previous verification failure data is stored in the verification failure data storage unit  150  ( FIG. 10 : S 21 ). If there is no previous verification failure data, then the first verification processing unit  140  reads converted data for the current processing from the converted data storage unit  130  (S 24 ). Then, the process proceeds to S 25 . On the other hand, if there is previous verification failure data, then the first verification processing unit  140  combines the previous verification failure data with the converted data for the current processing stored in the converted data storage unit  130  (S 23 ). 
         [0065]    Then, the first verification processing unit  140  obtains definition data from the definition data storage unit  210  (S 25 ). Specifically, items to be verified are specified. In the example of  FIG. 8 , “sex”, “age”, “height”, and “weight” are to be verified. Hereinafter, assume that “records that match” or “records that are identical” means records that are the same in terms of the values of items to be verified. 
         [0066]    Then, the first verification processing unit  140  specifies one record that has not yet been processed among data to be processed (the data read in S 24  or the data combined in S 23 ) (S 27 ). Thereafter, the first verification processing unit  140  searches for a record that matches the specified record out of the data to be processed (S 29 ). In accordance with the definition data illustrated in  FIG. 8 , the verification is successful if there are two or more records that are identical. When there is no previous verification failure data and processing in S 29  is performed on the data illustrated in  FIG. 9 , a result as illustrated in  FIG. 11  is obtained.  FIG. 11  illustrates that records number  1  and number  6  match, records number  7  and number  9  match, and records number  2  and number  5  match. There is no record that matches records number  3 , number  10 , number  4 , or number  8 . 
         [0067]    Then, the first verification processing unit  140  judges whether the number of records that are duplicates of the specified record is N or more (where N is “2” in the example of the definition data of  FIG. 8 , and is, in general, an integer that is set to be greater than or equal to 2) (S 31 ). If the number of duplicate records is N or more, the first verification processing unit  140  classifies the specified record as a verification success record (S 35 ). For example, the first verification processing unit  140  registers the specified record and the detected records equal to the specified record in a verification success list in a storage device, such as a main memory. Then, the process proceeds to S 37 . 
         [0068]    On the other hand, if the number of duplicate records is less than N, then the first verification processing unit  140  classifies the specified record as a verification failure record (S 33 ). In this embodiment, the specified record is stored in the verification failure data storage unit  150 . 
         [0069]    Then, the first verification processing unit  140  judges whether there is a record that has not yet been processed among data to be processed (S 37 ). If there is a record that has not yet been processed, then the process returns to S 27 . On the other hand, if there is no record that has not yet been processed, then the first verification processing part  140  outputs the verification success record to the distribution processing unit  180 , and the distribution processing unit  180  stores the received verification success record in the distribution data storage unit  190  (S 39 ). Thereafter, the process returns to processing of the call source. 
         [0070]    In this way, data to be processed is classified into two groups. For each record of one group, it is judged that the number of records that are duplicates of the record is N or more and therefore the record is a verification success record (hereinafter, this group is referred to as a “group of verification success records”). For each record of the other group, it is judged that the number of records that are duplicates of the record is less than N and therefore the record is a verification failure record (hereinafter, this group is referred to as a “group of verification failure records”). For example, as described with reference to  FIG. 11 , the group of verification success records, which is a record group as illustrated in  FIG. 12 , is stored in the distribution data storage unit  190 . In contrast, the group of verification failure records, which is a record group as illustrated in  FIG. 13 , is temporarily stored in the verification failure data storage unit  150 . 
         [0071]    Returning to the description of processing for  FIG. 6 , the first verification processing unit  140  judges whether all the records in the data to be processed have been judged to be verification success records (S 7 ). If all the records are verification success records, then the process moves to S 11 . On the other hand, if there is a verification failure record, then the second verification processing unit  160  is instructed to perform processing, and the second verification processing unit  160  performs second verification processing (S 9 ). The second verification processing will be described with reference to  FIG. 14 . 
         [0072]    In the second verification processing, the second verification processing unit  160  obtains the definition data from the definition data storage unit  210  ( FIG. 14 : S 40 ). Specifically, items to be verified are specified. In the example of  FIG. 8 , “sex”, “age”, “height”, and “weight” are to be verified. Thereafter, the second verification processing unit  160  specifies one record that has not yet been processed and is included in verification failure data stored in the verification failure data storage unit  150  (S 41 ). Then, the second verification processing unit  160  obtains a record that matches the specified record from the verification success data storage unit  170 (S 43 ). In the above example, nothing is currently stored in the verification success data storage unit  170 . As such, the number of duplicate records is zero for a record group as illustrated in  FIG. 13 . 
         [0073]    Then, the second verification processing unit  160  judges whether the number of records that are duplicates of the specified record is N or more (S 45 ). When the data stored in the verification success data storage unit  170  is searched and the number of records that are duplicates of the specified record is N or more, a specific individual is not identified. Thus, the specified record may be judged to be a verification success record. As a result, the number of records judged to be verification success records may increase and thus the number of records distributed to target systems may increase. This may enable personal information to be anonymized with reliability, while reducing the influence on statistical processing. 
         [0074]    Accordingly, the second verification processing unit  160  classifies the specified record as a verification success record (S 47 ). For example, the second verification processing unit  160  registers the specified record in a verification success list in a storage device, such as a main memory. Then, the process proceeds to S 51 . 
         [0075]    On the other hand, when the number of duplicate records is less than N, then the second verification processing unit  160  classifies the specified record as a verification failure record (S 49 ). For example, the second verification processing unit  160  registers the specified record in a verification failure list in a storage device, such as a main memory. Thereafter, the second verification processing unit  160  judges whether there is a record that has not yet been processed in the verification failure data (S 51 ). If there is a record that has not yet been processed, then the process returns to S 41 . On the other hand, if there is no record that has not yet been processed, then the second verification processing unit  160  updates data stored in the verification failure data storage unit  150  with a verification failure record (S 53 ). Then, the second verification processing unit  160  outputs a verification success record to the distribution processing unit  180 , and the distribution processing unit  180  stores the received verification success record in the distribution data storage unit  190  (S 55 ). Thereafter, the process returns to processing of the call source. 
         [0076]    In the example described above, since nothing is stored in the verification success data storage unit  170 , data stored in the verification failure data storage unit  150  is the same as that illustrated in  FIG. 13 . Data stored in the distribution data storage unit  190  is also the same as that illustrated in  FIG. 12 . 
         [0077]    Returning to the description of processing of  FIG. 6 , the distribution processing unit  180  updates the verification success data storage unit  170  using the data that has been received from the first verification processing unit  140  and the second verification processing unit  160  and is stored in the distribution data storage unit  190  (S 11 ). In this embodiment, data as illustrated in  FIG. 15 , for example, is stored in the verification success data storage unit  170 . That is, only one record is left among identical records, and the number of duplicate records is registered. If an identical record is included in the verification success data storage unit  170 , the number of duplicate records is incremented. 
         [0078]    Then, the distribution processing unit  180  distributes verification success data stored in the distribution data storage unit  190  to the target systems  1003  and  1004  (S 13 ). Specifically, verification success data is transmitted via the network  400 . 
         [0079]    When the above processing is performed, it may be verified that anonymity of more records is secured. Accordingly, more records may be distributed to target systems, allowing appropriate processing to be performed in the target systems. 
         [0080]    Note that, in the target systems  1003  and  1004 , statistical processing may be performed on the basis of various viewpoints, for example. Furthermore, statistical processing may be performed after data is processed by addition of data on health conditions and data on findings as illustrated in  FIG. 16 . 
         [0081]    A description will be given of a case where data conversion processing is performed on data collected at the next timing and, as a result, data as illustrated in  FIG. 17  is obtained. As mentioned above, the numbers in  FIG. 17  are added only for the sake of explanation. 
         [0082]    In such a case, in the first verification processing, the previous verification failure record illustrated in  FIG. 13  and the current record are combined together, and the combined records are searched for identical records. As a result, as illustrated in  FIG. 18 , records number  3  and number  12  match, records number  10  and number  15  match, records number  4  and number  13  match, and records number  8  and number  14  match. Accordingly, data as illustrated in  FIG. 19  is specified as verification success records, and is stored in the distribution data storage unit  190 . Moreover, as illustrated in  FIG. 20 , only record number  11  is specified as a verification failure record, and is temporarily stored in the verification failure data storage unit  150 . 
         [0083]    Thereafter, in the second verification processing, the verification failure record illustrated in  FIG. 20  is compared to data that is illustrated in  FIG. 15  and is stored in the verification success data storage unit  170 . As a result, it is found that the verification failure record illustrated in  FIG. 20  matches the record at the top of  FIG. 15 , and therefore is stored in the distribution data storage unit  190 . Furthermore, data stored in the verification success data storage unit  170  illustrated in  FIG. 15  is updated, so that the data is as illustrated in  FIG. 21 . That is, new records are added, and the number of duplicate records is incremented if identical records are detected. Such processing is repeatedly performed. 
         [0084]    With reference to  FIG. 22 , the outline of processing according to a second embodiment will be described. 
         [0085]    An information processing apparatus that performs processing in this embodiment collects data from one or a plurality of source systems, anonymizes the collected data, and performs a process described below, and then distributes the processed data to target systems that utilize anonymized information. For example, when three records are collected as illustrated on the upper left side of  FIG. 22 , duplication of records is judged for the three records (step ( 11 )). The three records are data obtained after data conversion processing for anonymization (for example, converting data into data of corresponding range of values, converting data into Japanese syllabary, or discarding an attribute that forms part of the records). 
         [0086]    If it is judged in step ( 11 ) that two or more records match, for example, there is no personal identifiability, and therefore the two or more records are judged to be [OK] and added to verified, anonymized information. In the example of  FIG. 22 , the upper two records that include JKFG match, and therefore are added to the verified, anonymized information. The lowermost record that includes attribute values of A, B, C, and D does not match any other record, and, as a result, there is personal identifiability. This record is therefore judged to be [Failed]. The record that includes ABCD, however, is compared to the verified, anonymized information to check whether a record that matches this record is already included in the verified, anonymized information. In this example, there is no record that is a duplicate of the record that includes ABCD, the record that includes ABCD is also judged to be [Failed] in this comparison. In this embodiment, however, part of the record that includes ABCD is concealed, and is distributed together with records of [OK] to target systems (step ( 12 )). Thus, although part of a record is concealed, all the records are distributed to target systems. The record that includes ABCD itself is separately held. 
         [0087]    Next, when three records are collected from the source system, the three records are combined with the held record (step ( 13 )), and the total four records are judged in terms of duplication of records (step ( 14 )). For example, when a record that includes ABCD, a record that includes JKFG, and a record that includes EFGH are collected from the source system, these records are judged, in terms of duplication, together with a record that has been judged previously as [Failed] and includes ABCD. There is no personal identifiability in the records that include ABCD, and therefore one of the records is added to the verified, anonymized information. Since the other record has been partially concealed in step ( 12 ), the partially concealed record is restored to a record that includes ABCD in the verified, anonymized information (step ( 15 )). 
         [0088]    When the record that includes JKFG is judged in terms of duplication among the total four records, the record that includes JKFG does not match any other record, and as a result, there is personal identifiability. The record that includes JKFG is therefore judged to be [Failed]. The record that includes JKFG, however, is compared to the verified, anonymized information to check whether a record that matches this record is already included in the verified, anonymized information. In the example of  FIG. 22 , since a record that includes JKFG is already included in the verified, anonymized information, the record that is collected this time and includes JKFG is judged to be [OK] and is added to the verified, anonymized information (step ( 16 )). 
         [0089]    In contrast, regarding the record that includes EFGH, since there are no records that match this record among the total four records, there is personal identifiability. The record that includes EFGH is therefore judged to be [Failed]. The record that includes EFGH is compared to the verified, anonymized information to check whether a record that matches this record is already included in the verified, anonymized information. In the example of  FIG. 22 , since there is no record that matches the record that includes EFGH, the record that includes EFGH is judged to be [Failed]. Then, part of the record that includes EFGH is concealed and the record that includes EFGH is distributed together with records of [OK] (step ( 17 )). 
         [0090]    In this way, a record without personal identifiability may be restored. Although records collected this time may be partially concealed, all of them are distributed to target systems. 
         [0091]    By performing such a process, more records may be enabled to be effectively utilized in target systems. Moreover, each time records are collected, a process as described above is performed on the collected records. This may allow target systems to perform processing such as statistical processing on the latest data without impairing immediacy. 
         [0092]    In this embodiment, the entire system configuration is the same as in the first embodiment ( FIG. 4 ), and the configuration of the information processing apparatus  1000  is also the same as in the first embodiment ( FIG. 5 ). However, operations of some components are different from those in the first embodiment. Accordingly, with reference to  FIG. 23  to  FIG. 37 , processing according to this embodiment will be described. 
         [0093]    First, the data collection unit  100  collects data from the source system A or B, and stores the collected data in the collected data storage unit  110  ( FIG. 23 : S 61 ). For example, the data collection unit  100  collects data as illustrated in  FIG. 7  and stores the data in the collected data storage unit  110 . 
         [0094]    Then, the data converter  120  performs a specified data conversion in accordance with definition data stored in the definition data storage unit  210 , and stores the processing result in the converted data storage unit  130  (S 63 ). In this embodiment, the data converter  120  is set the definition data by the definition management unit  200 . An example of the definition data stored in the definition data storage unit  210  is illustrated in  FIG. 24 . The example of  FIG. 24  includes the number of duplications, which is a judging criterion for anonymization, data indicating whether listed items are to be verified, and data indicating whether the listed items are to be concealed. In the example of  FIG. 24 , “sex”, “age”, “height”, and “weight” are listed as items, and data of other items is discarded for anonymity purposes. Specifically, the data converter  120  discards “personal ID” and “name”. In this embodiment, as an example of making data of items ambiguous, it is judged which range of values that has been determined in advance the data of an item that is indicated to be verified belongs to, and then the data of the item is replaced by data that specifies the range of values. As a result, the data of  FIG. 7  is converted into the data illustrated in  FIG. 9 . This is the same as the first embodiment. 
         [0095]    Then, the first verification processing unit  140  performs third verification processing of data stored in the converted data storage unit  130  in accordance with definition data stored in the definition data storage unit  210  (S 65 ). With reference to  FIG. 25  to  FIG. 27 , the third verification processing will be described. 
         [0096]    In the third verification processing, first, the first verification processing unit  140  checks whether previous verification failure data is stored in the verification failure data storage unit  150  (S 81 ). If there is no previous verification failure data, then the first verification processing unit  140  reads converted data for the current processing from the converted data storage unit  130  (S 83 ). Then, the process proceeds to S 87 . On the other hand, if there is previous verification failure data, then the first verification processing unit  140  combines the previous verification failure data with the converted data for the current processing stored in the converted data storage unit  130  (S 85 ). 
         [0097]    Then, the first verification processing unit  140  sets definition data stored in the definition data storage unit  210  (S 87 ). Specifically, items to be verified are specified. In the example of  FIG. 24 , “sex”, “age”, “height”, and “weight” are to be verified. 
         [0098]    Then, the first verification processing unit  140  specifies one record that has not yet been processed among data to be processed (the data read in S 83  or the data combined in S 85 ) (S 89 ). Thereafter, the first verification processing unit  140  searches for a record that matches the specified record among the data to be processed (S 91 ). In accordance with the definition data illustrated in  FIG. 24 , the verification is successful if there are two or more records that are identical. When there is no previous verification failure data and processing in S 91  is performed on the data illustrated in  FIG. 9 , a result as illustrated in  FIG. 11  is obtained. So far, the processing is the same as in the first embodiment. 
         [0099]    Then, the first verification processing unit  140  judges whether the number of records that are duplicates of the specified record is N or more (where N is “2” in the example of the definition data of  FIG. 8 , and is, in general, an integer that is set to be greater than or equal to 2) (S 93 ). If the number of duplicate records is N or more, then the first verification processing unit  140  judges whether the specified record is included in the previous verification failure data (S 97 ). If the specified record is included in the previous verification failure data, then the first verification processing unit  140  classifies the specified record as restoration data (S 99 ). Specifically, the first verification processing unit  140  registers the specified record in a restoration data list in a storage device, such as a main memory. If the specified record is not included in the previous verification failure data, then the first verification processing unit  140  classifies the specified record as a verification success record (S 101 ). For example, the first verification processing unit  140  registers the specified record and the detected identical records in a verification success list in a storage device, such as a main memory. Then, the process proceeds to S 103 . 
         [0100]    On the other hand, if the number of duplicate records is less than N, then the first verification processing unit  140  classifies the specified record as a verification failure record (S 95 ). In this embodiment, the specified record is stored in the verification failure data storage unit  150 . 
         [0101]    Then, the first verification processing unit  140  judges whether there is a record that has not yet been processed among data to be processed (S 103 ). If there is a record that has not yet been processed, then the process returns to S 89 . On the other hand, if there is no record that has not yet been processed, then the first verification processing part  140  outputs the verification success record and the restoration data to the distribution processing unit  180 , and the distribution processing unit  180  stores the received verification success record and the restoration data in the distribution data storage unit  190  (S 105 ). Thereafter, the process returns to processing of the call source. 
         [0102]    In this way, records are classified into three categories. Records in a first category are included in the previous verification failure data among a group of records for each of which it is judged that the number of records that are duplicates of the record is N or more and therefore the record is a verification success record. Records in a second category are included in data converted this time among the group of verification success records. A third category is a group of records for each of which it is judged that the number of records that are duplicates of the record is less than N and therefore the record is a verification failure record. 
         [0103]    With the data as illustrated in  FIG. 11 , since there is no previous verification failure data, a verification success record group among the data converted this time is a record group as illustrated in  FIG. 12 . In this embodiment, record management identifiers (IDs) are added to the records of this group, and data as illustrated in  FIG. 26  is stored in distribution data storage unit  190 . In contrast, the group of verification failure records is a record group as illustrated in  FIG. 13 . In this embodiment, record management IDs are added to the records of this group, and data as illustrated in  FIG. 27  is temporarily stored in the verification failure data storage unit  150 . 
         [0104]    Returning to the description of processing of  FIG. 23 , the first verification processing unit  140  judges whether all the records in the data to be processed have been judged to be verification success records (S 67 ). If all the records are verification success records, then the process moves to S 71 . On the other hand, if there is a verification failure record, then the second verification processing unit  160  is instructed to perform processing, and the second verification processing unit  160  performs fourth verification processing (S 69 ). With reference to  FIG. 28  to  FIG. 30 , the fourth verification processing will be described. 
         [0105]    In the fourth verification processing, the second verification processing unit  160  sets the definition data stored in the definition data storage unit  210  ( FIG. 28 : S 111 ). Specifically, items to be verified are specified. In the example of  FIG. 24 , “sex”, “age”, “height”, and “weight” are to be verified. Thereafter, the second verification processing unit  160  specifies one record that has not yet been processed and is included in verification failure data stored in the verification failure data storage unit  150  (S 113 ). Then, the second verification processing unit  160  searches for a record that matches the specified record in the data stored in the verification success data storage unit  170  (S 115 ). In the above example, nothing is stored in the verification success data storage unit  170 . As a result, the number of duplicate records is zero in a record group as illustrated in  FIG. 27 . 
         [0106]    Then, the second verification processing unit  160  judges whether the number of records that are duplicates of the specified record is N or more (S 117 ). If the data stored in the verification success data storage unit  170  is searched and the number of records that are duplicates of the specified record is N or more, a specific individual may not be specified. Thus, the specified record may be judged to be a verification success record. As a result the number of records judged to be verification success records may increase and thus the number of records distributed to target systems may increase. This may enable personal information to be anonymized with reliability, while reducing the influence on statistical processing. 
         [0107]    Accordingly, the second verification processing unit  160  classifies the specified record as a verification success record (S 121 ). For example, the second verification processing unit  160  registers the specified record in a verification success list in a storage device, such as a main memory. Then, the process proceeds to S 123 . 
         [0108]    On the other hand, if the number of duplicate records is less than N, then the second verification processing unit  160  classifies the specified record as a verification failure record (S 119 ). For example, the second verification processing unit  160  registers the specified record in a verification failure list in a storage device, such as a main memory. Thereafter, the second verification processing unit  160  judges whether there is a record that has not yet been processed in the verification failure data (S 123 ). If there is a record that has not yet been processed, then the process returns to S 113 . On the other hand, if there is no record that has not yet been processed, then the second verification processing unit  160  proceeds via a terminal A to processing of  FIG. 29 . 
         [0109]    Moving to the description of processing of  FIG. 29 , the second verification processing unit  160  stores the verification failure record in data stored in the verification failure data storage unit  150  (S 125 ). Assuming that the number of duplicate records is zero, data as illustrated in  FIG. 27  is stored as is in the verification failure data storage unit  150 . 
         [0110]    The second verification processing unit  160  then performs concealing processing for a verification failure record that is not included in previous verification failure data (for example, the last verification failure data is identified by the record management ID or the like, or the last verification failure data is stored in the verification failure data storage unit  150  and is identified) in accordance with the definition data, and outputs the data after concealing processing to the distribution processing unit  180 . The distribution processing unit  180  stores the received data that has been subjected to concealing processing in the distribution data storage unit  190  (S 127 ). If data as illustrated in  FIG. 27  is a verification failure record that is not included in the previous verification failure data, the values of items “age”, “height”, and “weight”, for which an instruction for concealing is provided in the definition data, are set to be null so that data as illustrated in  FIG. 30  is generated. 
         [0111]    The second verification processing unit  160  outputs a verification success record to the distribution processing unit  180 , and the distribution processing unit  180  stores the received verification success record in the distribution data storage unit  190  (S 129 ). Thereafter, the process returns to processing of the call source. 
         [0112]    Returning to the description of processing of  FIG. 23 , the distribution processing unit  180  performs data distribution processing (S 71 ). With reference to  FIG. 31  and  FIG. 32 , the data distribution processing will be described. 
         [0113]    The distribution processing unit  180  updates the verification success data storage unit  170  with the verification success records and the restoration data that have been received from the first verification processing unit  140  and the second verification processing unit  160  and are stored in the distribution data storage unit  190  ( FIG. 31 : S 131 ). In this embodiment, data as illustrated in  FIG. 15 , for example, is stored in the verification success data storage unit  170 . That is, only one record is left among identical records, and the number of duplicate records is registered. If an identical record is already included in the verification success data storage unit  170 , the number of duplicate records is incremented. Because records are aggregated in the above manner, record management IDs are not stored in the verification success data storage unit  170 . 
         [0114]    Furthermore, the distribution processing unit  180  combines the verification success record, the restoration data, and the partially-concealed verification failure record together to generate distribution data (S 133 ). Then, the distribution processing unit  180  distributes the generated distribution data to the target systems  1003  and  1004  (S 135 ). For example, distribution data as illustrated in  FIG. 32  is distributed to the target systems  1003  and  1004 . As described above, records of number  3 , number  4 , number  8 , and number  10  are partially concealed, and the values of items “age”, “height”, and “weight” of the records are set to null. Then, the processing of the call source is performed again. 
         [0115]    When such processing is performed, for records for which it is verified that anonymization is secured, data that has been subjected to data conversion is distributed as is to the target systems, and for the records for which it is not verified that anonymization is secured, data on which concealment has been performed is distributed to the target systems. Thus, appropriate processing may be performed in the target systems. 
         [0116]    A description will be given of a case where when data conversion processing is performed on data collected at the subsequent timing, data as illustrated in  FIG. 17  is obtained. 
         [0117]    In such a case, in the third verification processing, the previous verification failure record illustrated in  FIG. 13  and the current record are combined together, and identical records are searched for in the combined records. As a result, as illustrated in  FIG. 18 , records number  3  and number  12  match, records number  10  and number  15  match, records number  4  and number  13  match, and records number  8  and number  14  match. 
         [0118]    Accordingly, as illustrated in  FIG. 33 , records number  3 , number  4 , number  8 , and number  10  are specified as restoration data. As illustrated in  FIG. 34 , records number  12  to number  15  are specified as verification success records. As illustrated in  FIG. 35 , the record number  11  is specified as a verification failure record and is temporarily stored in the verification failure data storage unit  150 . The verification success records and the verification failure record may be provided with record management IDs by the first verification processing unit  140 , and may be provided by the distribution processing unit  180 . 
         [0119]    Thereafter, in the fourth verification processing, the verification failure record illustrated in  FIG. 35  is compared to data illustrated in  FIG. 15  that is stored in the verification success data storage unit  170 . It is found that the verification failure record in  FIG. 35  matches the top record in  FIG. 15 , and therefore the verification failure record in  FIG. 35  is also stored in the distribution data storage unit  190 . Then, data stored in the verification success data storage unit  170  illustrated in  FIG. 15  is updated, so that the data as illustrated in  FIG. 21  is obtained. That is, new records are added, and the number of duplicate records is incremented if identical records are detected. The above processing is repeatedly performed. 
         [0120]    Although the distribution processing unit  180  combines the verification success record, the restoration data, and the partially-concealed verification failure record together to generate distribution data, in the example described above there is no verification failure record, and therefore distribution data as described in  FIG. 36  is generated using the restoration data and the verification success records. In this embodiment, record management IDs are also included in the distribution data. On the target system side, upon receiving records that include management IDs identical to those of records that have already been received, the target systems updates using the records included in the currently received data. That is, the data from the original records is restored. In the example of  FIG. 36 , the upper four rows are transmitted in order to update records that have already been distributed. In contrast, for records specified as new verification success records, there are no records identical to these records on the target system side, and therefore the new verification success records are added to the databases on the target system side. Then, in the target systems  1003  and  1004 , data as illustrated in  FIG. 32  is updated to data as illustrated in  FIG. 37 . 
         [0121]    As described above, while the embodiments of this technology have been described, this technology is not limited to this. The functional block diagram referred to in the above description may not be exactly the same as actual program modules. The data structure and manners of holding data are examples, and the examples described above are only one kind of example. Moreover, although an example of performing processing of one type of data is demonstrated, a plurality of types of data is sometimes handled. In that case, a verification success record, a verification failure record, and restoration data are distinguished by attaching an identifier. 
         [0122]    With regard to the processing flow, the order of execution of steps is sometimes changed as long as the processing results do not change, and the steps are sometimes executed in parallel. 
         [0123]    The information processing apparatus  1000 , the source systems  1001  and  1002 , and the target systems  1003  and  1004  are implemented as one or a plurality of computer devices, in which, as illustrated in  FIG. 38 , a memory  2501 , a central processing unit (CPU)  2503 , a hard disk drive (HDD)  2505 , a display control interface  2507  coupled to a display device  2509 , a drive device  2513  for a removable disk  2511 , an input device  2515 , and a communication control interface  2517  for connection to a network are coupled via a bus  2519 . An operating system (OS) and an application program for performing processing in this embodiment are stored in the HDD  2505  or the removable disc  2511 , and are read from the HDD  2505  into the memory  2501  when they are executed by the CPU  2503 . By executing the application program, the CPU  2503  implements functions of the data collection unit  100 , the data converter  120 , the definition management unit  200 , the first verification processing unit  140 , the second verification processing unit  160 , and the distribution processing unit  180 . The CPU  2503  controls the display control interface  2507 , the communication control interface  2517 , and the drive device  2513  in accordance with the contents of processing of the application program. Although data being processed is primarily stored in the memory  2501 , the data may be stored in the HDD  2505 . 
         [0124]    The CPU  2503  is an example of a processor that reads out and executes the application program. The processor is hardware, such as the CPU  2503 , a graphics processing unit (GPU), floating point unit (FPU) or digital signal processor (DSP), that carries out operations based on at least one program (such as the application program) and controls other hardware. 
         [0125]    In the embodiments of this technology, the application program for performing the processing described above may be stored in and distributed from the computer-readable removable disk  2511 , and is installed from the drive device  2513  into the HDD  2505 . The application program may also be installed via a network such as the Internet and the communication control interface  2517  into the HDD  2505 . In such a computer device, hardware, such as the CPU  2503  and the memory  2501  mentioned above, and programs, such as the OS and the application program, cooperate systematically, so that various functions as described above are achieved. 
         [0126]    An information processing method according to this embodiment includes (A) a first process of extracting, from a plurality of records acquired from a first system, a first record that is a record for which the number of records meeting a identity condition that has been determined in advance is greater than or equal to a certain number, (B) a second process of extracting, from a second record that is a record other than the first record among the plurality of records, a third record that is a record for which the number of records of a combination of a record group already extracted and stored in a data storage unit and the second record that meets the identity condition is greater than or equal to the certain number, as the record for which the number of records that meet the identity condition is greater than or equal to the certain number, and (C) a third process of outputting the first record and third record to a second system. 
         [0127]    By performing the above processing, more records may be enabled to be output to the second system. That is, more records whose anonymity is secured may be enabled to be utilized in the second system. In the data storage unit, data that is an aggregate of records having a sameness that has been determined in advance may be held, or all the records may be accumulated. According to one aspect, out of the data included in the data group, the quantity of data that is judged to be not meeting a condition for data may be suppressed. 
         [0128]    The plurality of records described above may include a record newly acquired from the first system and a record that has been previously acquired from the first system and has not been extracted in the first processing and the second processing. In this way, even when verification results in failure once, there is a possibility that anonymity may be secured with the aid of a record group obtained later. 
         [0129]    Moreover, the above information processing method may further include (D) a fourth process of concealing an attribute value of at least part of a fourth record that is a record other than the first record and the third record among the plurality of records and thus generating a fifth record, (E) a fifth process of outputting the fifth record to the second system, (F) a sixth process of extracting, from the record newly acquired from the first system and the fourth record, a record for which the number of records that meet the identity condition that has been determined in advance is greater than or equal to the certain number, and (G) a seventh process of outputting data for restoring the fifth record back to the fourth record when the record extracted in the sixth processing is the fourth record. In this way, records whose anonymity is not secured may be output to the second system after concealment is performed on the records. Moreover, when anonymity is secured by using the record collected later, it becomes possible to provide an instruction for restoring a record on which concealment has been performed to its original data. 
         [0130]    Moreover, an information processing apparatus ( FIG. 39 :  4000 ) according to this embodiment includes a first processing unit ( FIG. 39 :  4100 ) that extracts, from a plurality of records acquired from the first system  4500 , a first record that is a record for which the number of records that meet a identity condition that has been determined in advance is greater than or equal to a certain number, a second processing unit ( FIG. 39 :  4200 ) that extracts, from a second record that is a record other than the first record among the plurality of records, a third record that is a record for which the number of records, of a combination of a record group already extracted and stored in a data storage unit ( FIG. 39 :  4300 ) and the second record, that meet the identity condition is greater than or equal to the certain number, as the record for which the number of records meeting the identity condition is greater than or equal to the certain number, and a third processing unit ( FIG. 39 :  4400 ) that outputs the first record and the third record to the second system  4600 . 
         [0131]    A program for causing a computer to perform the processing as described above may be created, and the program is stored in a computer-readable storage medium or a storage device, examples of which include a floppy disk, an optical disk such as a compact disk read-only memory (CD-ROM), a magneto-optical disk, a semiconductor memory (for example, read only memory (ROM)), and a hard disk. Data being processed is temporarily kept in a storage device, such as a random access memory (RAM). 
         [0132]    All examples and conditional language recited herein are intended for pedagogical purposes to aid the reader in understanding the invention and the concepts contributed by the inventor to furthering the art, and are to be construed as being without limitation to such specifically recited examples and conditions, nor does the organization of such examples in the specification relate to a showing of the superiority and inferiority of the invention. Although the embodiments of the present invention have been described in detail, it should be understood that the various changes, substitutions, and alterations could be made hereto without departing from the spirit and scope of the invention.