Privacy-protected data aggregation device and privacy-protected data aggregation system

A privacy-protected data aggregation device, comprising:

• an attribute information encryption unit that encrypts a plurality of pieces of attribute information included in user data;
• an aggregation processing unit that aggregates the user data with the attribute information encrypted by the attribute information encryption unit, for all combinations of possible values of the plurality of pieces of attribute information, to obtain aggregated data including an aggregation result and the encrypted attribute information;
• and
• an anonymization processing unit that performs anonymization processing on the aggregated data obtained by the aggregation processing unit.

A privacy-protected data aggregation system, comprising:

• a first device that stores first user data including a first user ID and first attribute information related to a user of a first service;
• and
• a second device that stores second user data including a second user ID and second attribute information related to a user of a second service,
• wherein the first device and the second device include an aggregation image generation unit that generates an aggregation image, in which all combinations of the first attribute information and the second attribute information are described, based on possible values of the first attribute information and possible values of the second attribute information and shares the generated aggregation image between the first device and the second device,
• wherein the first device includes a first encryption unit that encrypts the first user data including the first user ID and the first attribute information and transmits the encrypted first user data to the second device, and that additionally encrypts the encrypted second user ID received from the second device and transmits the additionally encrypted second user ID to the second device, and
• wherein the second device includes:
• a second encryption unit that encrypts the second user ID and transmits the encrypted second user ID to the first device, and that receives the additionally encrypted second user ID encrypted by the first device;
• a matching unit that matches the encrypted first user data encrypted by the first encryption unit with the second user data;
• and
• an aggregation processing unit that categorizes matched data based on unencrypted second attribute information in the second user data and aggregates the categorized matched data for all combinations described in the aggregation image to obtain aggregated data.