Controlling disclosure of trace data related to moving object

Abstract

A system for controlling disclosure of trace data related to moving object, including a first receiving module for receiving, for at least one moving object in a first region, a first record aggregate; a second receiving module for receiving, for at least one moving object in a second region, a second record aggregate; a calculating module for calculating trace data from at least one attribute value of a first identifier that is in received first and second record aggregates in response to data search request; an anonymizing module for calculating to satisfy a condition of the moving object passing through at least one region; and a transmitting module for returning calculated trace data as a search result if the moving object moves in calculated ranges and if the moving object has the first identifier that is in both the received first and second record aggregates.

1 . A system that controls disclosure of data provided from at least one data provider system, the system comprising:
 a first receiving module for receiving, for at least one moving object in a first spatio-temporal region, a first record aggregate from at least one data provider system, said first record aggregate comprising, as a unit record, a first identifier for identifying a first recorded moving object and at least one attribute value associated with said first identifier;   a second receiving module for receiving, for at least one moving object in a second spatio-temporal region, a second record aggregate from said at least one data provider system, said second record aggregate comprising, as a unit record, a second identifier for identifying a second recorded moving object and at least one attribute value associated with said second identifier, said second identifier comprising at least one of said first identifier;   a calculating module for calculating trace data from said at least one attribute value associated with said first identifier that is present in both received first record aggregates and received second record aggregates in response to a reception of a data search request to search for data related to a moving object, wherein said trace data is related to said moving object that corresponds to said data search request;   an anonymizing module for calculating to satisfy a condition of said moving object passing through at least one region having certain spatio-temporal ranges within certain time ranges and to satisfy another condition of at least two of said moving objects being present in each of said at least one region, said spatio-temporal range of said at least one region, and/or a passing time range of said spatial temporal range of each of said at least one region; and   a transmitting module for returning calculated trace data or part of said trace data as a search result if said moving object moves in calculated spatio-temporal ranges within calculated passing time ranges and if said moving object has said first identifier that is present in both said received first record aggregates and said received second record aggregates.   
     
     
         2 . The system according to  claim 1 , wherein said anonymizing module:
 replaces a first value that is calculated from at least one first attribute value associated with an identifier of a first moving object in said received first record aggregates and said received second record aggregates with a second value that is calculated from at least one second attribute value associated with an identifier of a second moving object in said received first record aggregates and said received second record aggregates when said first moving object is within said calculated spatio-temproal range within said calculated passing time range and said second moving object is within said calculated spatio-temporal range within said calculated passing time range;   controls selection of said first attribute value so that an aggregate value calculated after said step of replacing with said second value completely matches an aggregate value calculated from said first value, said second value calculated using a method that is same as a method with which said first value is determined; and   returns said calculated trace data related to said moving object that corresponds to said data search request, said part of said trace data, or controlled attribute value as said search result if said aggregate value calculated after said step of replacing with said second value completely matches said aggregate value calculated from the first value as a result of the control.   
     
     
         3 . The system according to  claim 1 , wherein said anonymizing module restricts disclosure of said calculated trace data or said part of said trace data in accordance with a policy associated with said first identifier that is present in both said received first record aggregates and said received second record aggregates. 
     
     
         4 . The system according to  claim 2 , wherein said anonymizing module restricts disclosure of said calculated trace data or said part of said trace data in accordance with a policy associated with said first identifier that is present in both said received first record aggregates and said received second record aggregates. 
     
     
         5 . The system according to  claim 3 , wherein:
 said policy associated with said first identifier comprises constraint data selected from the group consisting of: (i) number of times said trace data related to said first recorded moving object is being disclosed; (ii) a destination of disclosure of said trace data; and combinations thereof; and   said anonymizing module restricts disclosure of said calculated trace data related to said moving object that corresponds to said data search request or said part of said trace data in accordance with said constraint data.   
     
     
         6 . The system according to  claim 4 , wherein:
 said policy associated with said first identifier comprises constraint data selected from the group consisting of: (i) number of times said trace data related to said first recorded moving object is being disclosed; (ii) a destination of disclosure of said trace data; and combinations thereof; and   said anonymizing module restricts disclosure of said calculated trace data related to said moving object that corresponds to said data search request or said part of said trace data in accordance with said constraint data.