PRESERVING INDIVIDUAL INFORMATION PRIVACY BY PROVIDING ANONYMIZED CUSTOMER DATA

• US 20090327296A1
• Filed: 06/27/2008
• Published: 12/31/2009
• Est. Priority Date: 06/27/2008
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Francis, Jonathan, Stokes, Michael
• Granted Patent: US 8,140,502 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/00 Information retrieval; Database structures therefor; File system structures therefor

Abstract

A method of preserving individual information privacy for each of a plurality of customers while providing aggregated information about the plurality of customers includes storing static customer data and dynamic customer data of the plurality of customers in a protected database. The method includes restricting shared access to the static customer data and the dynamic customer data to a set of approved privacy-preserving queries. The privacy preserving queries include a privacy-preserving aggregation query that uses one or more parameters to indicate a characteristic of interest for which aggregation of the static customer data and the dynamic customer data is requested. The privacy-preserving aggregation query may be configured to retrieve aggregated customer data related to the characteristic of interest. The aggregated customer data may be returned in response to the privacy-preserving aggregation query not including any personally identifiable information of any particular one of the plurality of customers.

Claims

1. A method of preserving individual information privacy for each of a plurality of customers while providing aggregated information about the plurality of customers, the method comprising:

storing static customer data and dynamic customer data of the plurality of customers in one or more protected databases; and

restricting shared access to the static customer data and the dynamic customer data to a set of approved privacy-preserving queries, including a privacy-preserving aggregation query that uses one or more parameters to indicate a characteristic of interest for which aggregation of the static customer data and the dynamic customer data is requested, the privacy-preserving aggregation query configured to retrieve aggregated customer data related to the characteristic of interest, the aggregated customer data not including any personally identifiable information of any particular one of the plurality of customers.

2. The method of claim 1, further comprising:

automatically logging all access to the one or more protected databases, such logging identifying, for each instance of access to the one or more protected databases, at least an indication of content retrieved from the one or more protected databases and a recipient of content retrieved from the one or more protected databases.

3. The method of claim 2, further comprising:

auditing logged access of the one or more protected databases to ensure an unapproved party has not retrieved personally identifiable information for any particular one of the plurality of customers.

4. The method of claim 1, further comprising:

receiving a privacy regulation from a regulatory source; and

modifying access to the static or dynamic customer data of the one or more protected databases to comply with the privacy regulation.

5. The method of claim 4, where the privacy regulation includes a duration in which the static or dynamic customer data is accessible, and modifying access to the static or dynamic customer data includes restricting access to at least some of the static or dynamic customer data upon exceeding the duration.

6. The method of claim 4, further comprising:

generating a script for enforcing the privacy regulation; and

running the script on the one or more protected databases to modify access to the static or dynamic customer data to comply with the privacy regulation.

7. The method of claim 4, where the dynamic customer data includes an internet protocol address for each of the plurality of customers and both the static customer data and the dynamic customer data include a persistent, privacy-preserving pseudo-random identification corresponding to that internet protocol address.

8. The method of claim 7, where the privacy regulation includes a duration in which the internet protocol address of each customer is stored in the one or more protected databases, the method further comprising:

replacing the internet protocol address with the privacy-preserving pseudo-random identification for each of the plurality of customers in response to exceeding the duration.

9. The method of claim 1, where the dynamic customer data includes a navigational log of customer network activity.

10. The method of claim 1, where aggregated customer data related to the specified characteristic of interest is retrieved via one-way hashing of the one or more protected databases.

11. A method of preserving individual information privacy for each of a plurality of customers while providing an anonymous customer persona corresponding to the plurality of customers, the method comprising:

storing static customer data and dynamic customer data of the plurality of customers in one or more protected databases;

restricting shared access to the static customer data and the dynamic customer data to a set of approved privacy-preserving queries, including a privacy-preserving, anonymous-persona query that uses a parameter to indicate a primary characteristic of interest, the privacy-preserving, anonymous-persona query configured to inject noise into returned customer data;

performing statistical analysis on results returned from the privacy-preserving, anonymous-persona query to determine statistically significant correlations between the primary characteristic of interest and one or more secondary characteristics; and

generating an anonymous customer persona including the primary characteristic of interest and one or more statistically significant secondary characteristics.

12. The method of claim 11, where the anonymous customer persona is only generated if a number of customers used to generate the persona is large enough to preserve individual information privacy of each of the plurality of customers.

13. The method of claim 11, further comprising:

merging external data with customer data to expand the anonymous customer persona.

14. The method of claim 13, where the external data includes one or more of geographical data, anonymous purchase data at an external partner, and navigational activity data at an external partner.

15. The method of claim 11, where only protected databases are queried.

16. The method of claim 11, further comprising:

automatically logging all access to the customer data, such logging identifying, for each instance of access, at least an indication of retrieved content and a recipient of retrieved content.

17. The method of claim 16, further comprising:

auditing logged access to the customer data to ensure an unapproved party has not retrieved personally identifiable information for any particular one of the plurality of customers.

18. The method of claim 11, where the static customer data includes one or more customer-identifying attributes for each of the plurality of customers.

19. The method of claim 11, where the dynamic customer data includes a navigational log of customer network activity for each of the plurality of customers.

20. A method of preserving individual information privacy for each of a plurality of customers while providing an anonymous customer persona corresponding to the plurality of customers, the method comprising:

storing static customer data and dynamic customer data of the plurality of customers in one or more protected databases;

restricting shared access to the static customer data and the dynamic customer data to a set of approved privacy-preserving queries, including a privacy-preserving, anonymous-persona query configured to inject noise into returned customer data;

generating an anonymous customer persona having one or more characteristics of interest based on analyzed results returned from the privacy-preserving, anonymous-persona query, the anonymous customer persona not including any personally identifiable information of any particular one of the plurality of customers.