SYSTEM AND METHOD FOR LIMITING DISCLOSURE IN HIPPOCRATIC DATABASES

• US 20060248592A1
• Filed: 04/28/2005
• Published: 11/02/2006
• Est. Priority Date: 04/28/2005
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: AGRAWAL, RAKESH, SRIKANT, RAMAKRISHNAN, KIERNAN, GERALD GEORGE, XU, YI RONG, LEFEVRE, KRISTEN RIEDT
• Application Number:
  US10/908,145
• Publication Number:
  US 20060248592A1
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 16/24553 of query operations
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes

Abstract

A tool for enforcing limited disclosure rules in a software application, typically an unmodified database. The invention enables individual queries to respect data subjects'"'"' preferences and choices by storing privacy semantics, classifying data items into categories, rewriting incoming queries to reflect stored privacy semantics, and masking prohibited values. Privacy semantics include individual data subject choices and privacy policies comprise rules describing authorized data recipients and authorized data access purposes. Privacy policies may require specific consent from data subjects. The invention assigns each (purpose, recipient) pair a view over each database table, so entire tuples and individual cells can have particular privacy semantics. Purposes and recipients are inferred based on the application issuing the query. Masking is performed at the individual cell level, and may employ NULL or other predetermined indicia for prohibited values. The invention is cost-efficient and scalable to large databases.

Claims

1. A computer-implemented method for limiting data disclosure in a software application, comprising:

storing privacy semantics;

classifying data items into categories;

rewriting incoming queries to reflect stored privacy semantics; and

masking prohibited values.

2. The method of claim 1 wherein the software application is an unmodified database.

3. The method of claim 1 wherein the privacy semantics include privacy policies and individual data subject choices.

4. The method of claim 3 wherein the privacy policies comprise rules describing authorized data recipients and authorized data access purposes.

5. The method of claim 4 wherein each (purpose, recipient) pair is assigned a view over each database table, so that entire tuples and individual cells can have particular privacy semantics.

6. The method of claim 4 wherein the privacy policies require at least one of:

opt-in consent from data subjects for authorized data access and opt-out consent from data subjects for data access to be denied.

7. The method of claim 1 wherein the masking is performed at the individual cell level.

8. The method of claim 1 wherein the masking employs NULL to indicate a prohibited value.

9. The method of claim 1 wherein the masking employs a predefined non-NULL value to indicate a prohibited value.

10. A system for limiting data disclosure in a software application comprising:

means for storing privacy semantics;

means for classifying data items into categories;

means for rewriting incoming queries to reflect stored privacy semantics; and

means for masking prohibited values.

11. The system of claim 10 wherein the masking is performed at the individual cell level.

12. A computer program product comprising a computer useable medium including a computer readable program that causes a computer system to limit data disclosure in a software application by:

storing privacy semantics;

classifying data items into categories;

rewriting incoming queries to reflect stored privacy semantics; and

masking prohibited values.

13. The product of claim 12 wherein the software application is an unmodified database.

14. The product of claim 12 wherein the privacy semantics include privacy policies and individual data subject choices.

15. The product of claim 12 wherein the privacy policies comprise rules describing authorized data recipients and authorized data access purposes.

16. The product of claim 15 wherein each (purpose, recipient) pair is assigned a view over each database table, so that entire tuples and individual cells can have particular privacy semantics.

17. The product of claim 15 wherein the privacy policies require at least one of:

opt-in consent from data subjects for authorized data access and opt-out consent from data subjects for data access to be denied.

18. The product of claim 12 wherein the masking is performed at the individual cell level.

19. The product of claim 12 wherein the masking employs NULL to indicate a prohibited value.

20. The product of claim 12 wherein the masking employs a predefined non-NULL value to indicate a prohibited value.