# US 2025/0094632 A1 · Privacy-protected data aggregation device and privacy-protected data aggregation system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2025/0094632 A1 - Document ID: US20250094632A1 - Status: Published application - Kind: A1 - Application number: 18/727,143 - Filed: 2022-11-29 - Published: 2025-03-20 - Earliest claimed: 2022-01-21 - Assignees: Ntt Docomo, Inc. - Applicants: Ntt Docomo, Inc. - Inventors: Kazuma NOZAWA; Keita HASEGAWA; Tomohiro NAKAGAWA; Hiroshi AONO; Masayuki TERADA - Web page: https://patentgrep.com/patent/US20250094632A1 ## CPC - G06F 21/6254: {by anonymising data, e.g. decorrelating personal data from the owner's identification} - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - H04L 9/008: {involving homomorphic encryption} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A privacy-protected data aggregation device (10) includes: an attribute information encryption unit (13) that encrypts attribute information in user data to be aggregated, which includes a plurality of pieces of attribute information, using a homomorphic encryption method enabling aggregation processing; an aggregation processing unit (14) that aggregates user data with encrypted attribute information, for all combinations of possible values of the plurality of pieces of attribute information in domain data that defines possible values of each of the pieces of attribute information included in the user data, to obtain aggregated data including an aggregation result and encrypted attribute information; an anonymization processing unit (15) that performs anonymization processing on the aggregated data; and a decryption unit (16) that decrypts aggregated data subjected to the anonymization processing to obtain aggregated data including an aggregation result after the anonymization processing and decrypted attribute information. ## Claims ### Claim at position 1 1-8. (canceled) ### Claim 9 A privacy-protected data aggregation device, comprising: an attribute information encryption unit that encrypts a plurality of pieces of attribute information included in user data; an aggregation processing unit that aggregates the user data with the attribute information encrypted by the attribute information encryption unit, for all combinations of possible values of the plurality of pieces of attribute information, to obtain aggregated data including an aggregation result and the encrypted attribute information; and an anonymization processing unit that performs anonymization processing on the aggregated data obtained by the aggregation processing unit. ### Claim 10 (depends on 9) The privacy-protected data aggregation device according to claim 9, wherein the anonymization processing unit fixes the aggregation result of a non-existent combination among all combinations of possible values of the plurality of pieces of attribute information to zero and performs anonymization processing on a combination other than the non-existent combination. ### Claim 11 (depends on 9) The privacy-protected data aggregation device according to claim 9. wherein the aggregation processing unit aggregates the user data for a combination other than the non-existent combination among all combinations of possible values of the plurality of pieces of attribute information. ### Claim 12 (depends on 9) The privacy-protected data aggregation device according to claim 9, wherein the aggregation processing unit aggregates the user data for a combination excluding non-existent combinations from all combinations of possible values of the plurality of pieces of attribute information. ### Claim 13 A privacy-protected data aggregation system, comprising: a first device that stores first user data including a first user ID and first attribute information related to a user of a first service; and a second device that stores second user data including a second user ID and second attribute information related to a user of a second service, wherein the first device and the second device include an aggregation image generation unit that generates an aggregation image, in which all combinations of the first attribute information and the second attribute information are described, based on possible values of the first attribute information and possible values of the second attribute information and shares the generated aggregation image between the first device and the second device, wherein the first device includes a first encryption unit that encrypts the first user data including the first user ID and the first attribute information and transmits the encrypted first user data to the second device, and that additionally encrypts the encrypted second user ID received from the second device and transmits the additionally encrypted second user ID to the second device, and wherein the second device includes: a second encryption unit that encrypts the second user ID and transmits the encrypted second user ID to the first device, and that receives the additionally encrypted second user ID encrypted by the first device; a matching unit that matches the encrypted first user data encrypted by the first encryption unit with the second user data; and an aggregation processing unit that categorizes matched data based on unencrypted second attribute information in the second user data and aggregates the categorized matched data for all combinations described in the aggregation image to obtain aggregated data. ### Claim 14 (depends on 13) The privacy-protected data aggregation system according to claim 13, wherein the second device further includes: an anonymization processing unit that fixes the aggregated data of a non-existent combination among the combinations described in the aggregation image to zero and performs anonymization processing on a combination other than the non-existent combination in the aggregated data. ### Claim 15 (depends on 13) The privacy-protected data aggregation system according to claim 13, wherein the aggregation processing unit aggregates the matched data for a combination other than the non-existent combination among the combinations described in the aggregation image. ### Claim 16 (depends on 13) The privacy-protected data aggregation system according to claim 13, wherein the aggregation processing unit aggregates the matched data for a combination excluding non-existent combinations from the combinations described in the aggregation image. ### Claim 17 (depends on 13) The privacy-protected data aggregation system according to claim 13, wherein the first encryption unit encrypts the first user ID with a private key for user ID of the first device and encrypts the first attribute information with a private key for attribute information of the first device and transmits the first user data including the encrypted first user ID and the encrypted first attribute information to the second device and that receives an encrypted second user ID, which is obtained by encrypting the second user ID with a private key for user ID of the second device, from the second device, additionally encrypts the encrypted second user ID with the private key for user ID of the first device, and transmits the additionally encrypted second user ID to the second device. ### Claim 18 (depends on 13) The privacy-protected data aggregation system according to claim 13, wherein the matching unit matches the first user data encrypted by the first encryption unit with the second user data by comparing the first user ID and the second user ID, both of which are encrypted with both the private key for user ID of the first device and the private key for user ID of the second device.