Selecting records from a list with privacy protections

• US 7,644,068 B2
• Filed: 10/06/2006
• Issued: 01/05/2010
• Est. Priority Date: 10/06/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Martin, David Charles, Jonas, Jeffrey James
• Primary Examiner(s): Vo; Tim T.
• Assistant Examiner(s): Koo; Gary J
• Application Number:
  US11/539,260
• Publication Number:
  US 20080086452A1
• Time in Patent Office: 1,187 Days
• Field of Search: 707/3, 707/4, 707/5, 707/9
• US Class Current: 726/31
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A user wishes to view a record, such as one that includes a person'"'"'s medical history, located in a record storage area. In order to prevent the user from viewing records other than the specific record in which the user is interested, a record selection manager iteratively requests attribute information from the user to disambiguate which record to provide until the record selection manager identifies a reduction completion result, which the record selection manager then provides to the user. Using the invention described herein, the record selection manager conceals records included in the records storage area until it identifies a reduction completion result and, at that point, the record selection manager provides only the reduction completion result to the user to view.

Claims

1. A computer-implemented method comprising:

receiving a request from a user that includes an initial user provided attribute;

identifying a subset of records from a plurality of records using the initial user provided attribute, the subset of records including more than one of the plurality of records and each of the subset of records including a first record attribute value that matches the initial user provided attribute;

preventing the user from viewing any portion of the subset of records during steps of;

analyzing the subset of records in order to detect record attribute differences between records included in the subset of records;

identifying one or more discrimination factors in response to the analysis that discriminates one or more of the records over another one or more of the records;

in response to the identifying of the one or more discrimination factors, sending a subset discriminating request, without a subsequent user provided attribute, to the user that requests the user to provide the subsequent user provided attribute that corresponds to the one or more discrimination factors;

receiving the subsequent user provided attribute from the user in response to the sending of the subset discriminating request;

reducing, in response to receiving the subsequent user provided attribute, the subset of records to a reduction completion result utilizing the subsequent user provided attribute, the reduction completion result including one or more records that each include a second record attribute value that matches the subsequent user provided attribute; and

providing the reduction completion result to the user, wherein the providing includes preventing the user from viewing each of the subset of records other than those in the reduction completion result.

2. The method of claim 1 wherein the reduction completion result is only one record from the subset of records, the one record being an explicit matched record.

3. The method of claim 1 wherein the reduction completion result is an irreducible record set that comprises a reduced subset of records, each of the reduced subset of records including record attribute values such that the reduced subset of records is not further reducible using additional subsequent user provided attributes.

4. The method of claim 1 further comprising:

computing conjoint probabilities among record attributes using their corresponding record attribute values; and

determining, based upon the computing of the conjoint probabilities, the one or more discrimination factors that have the highest calculated conjoint probabilities of appearing together in the subset of records.

5. The method of claim 1 wherein the subsequent user provided attributes are selected from the group consisting of a demographic attribute, a non-demographic attribute, a biographical attribute, a descriptive attribute, a condition attribute, a state attribute, a transactional attribute, a geo-spatial attribute, and a temporal attribute.

6. The method of claim 1 wherein the one or more discrimination factors are selected from the group consisting of a probability factor and an expert rules factor, wherein the probability factor is based upon statistical analysis of the subset of records and wherein the expert rules factor is based upon always requesting one type of attribute over a different type of attribute.

7. The method of claim 1 wherein the reduction completion result is selected from the group consisting of an explicit matched record, an irreducible record set, an under threshold set, and an over limit response.

8. The method of claim 1 further comprising:

determining that the subset of records is the reduction completion result by only using the initial user provided attribute; and

performing the providing in response to determining that the subset of records is the reduction completion result by only using the initial user provided attribute.

9. The method of claim 1 further comprising:

determining that the reducing results in a non-compliant amount of records based upon a maximum record set limit, resulting in the reduction completion result being an over limit response; and

providing zero records to the user in response to the determining of the over limit response.

10. The method of claim 1 further comprising:

determining that the reducing results in an amount of records that are less than an allowable threshold value, resulting in the reduction completion result being an under threshold set; and

providing the records included in the under threshold set to the user in response to the determining of the under threshold set.

14. The computer program product of claim 1 wherein the information handling system further performs actions that include:

computing conjoint probabilities among record attributes using their corresponding record attribute values; and

determining, based upon the computing of the conjoint probabilities, the one or more discrimination factors that have the highest calculated conjoint probabilities of appearing together in the subset of records.

11. A computer program product stored in a tangible computer storage medium, comprising functional descriptive material that, when executed by an information handling system, causes the information handling system to perform actions that include:

receiving a request from a user that includes an initial user provided attribute;

identifying a subset of records from a plurality of records using the initial user provided attribute, the subset of records including more than one of the plurality of records and each of the subset of records including a first record attribute value that matches the initial user provided attribute;

preventing the user from viewing any portion of the subset of records during steps of;

analyzing the subset of records in order to detect record attribute differences between records included in the subset of records;

identifying one or more discrimination factors in response to the analysis that discriminates one or more of the records over another one or more of the records;

in response to the identifying of the one or more discrimination factors, sending a subset discriminating request, without a subseguent user provided attribute, to the user that requests the user to provide the subsequent user provided attribute that corresponds to the one or more discrimination factors;

receiving the subsequent user provided attribute from the user in response to the sending of the subset discriminating request;

reducing, in response to receiving the subsequent user provided attribute, the subset of records to a reduction completion result utilizing the subsequent user provided attribute, the reduction completion result including one or more records that each include a second record attribute value that matches the subsequent user provided attribute; and

providing the reduction completion result to the user, wherein the providing includes preventing the user from viewing each of the subset of records other than those in the reduction completion result.

12. The computer program product of claim 11 wherein the reduction completion result is only one record from the subset of records, the one record being an explicit matched record.

13. The computer program product of claim 11 wherein the reduction completion result is an irreducible record set that comprises a reduced subset of records, each of the reduced subset of records including record attribute values such that the reduced subset of records is not further reducible using additional subsequent user provided attributes.

15. The computer program product of claim 11 wherein the subsequent user provided attributes are selected from the group consisting of a demographic attribute, a non-demographic attribute, a biographical attribute, a descriptive attribute, a condition attribute, a state attribute, a transactional attribute, a geo-spatial attribute, and a temporal attribute.

16. The computer program product of claim 11 wherein the one or more discrimination factors are selected from the group consisting of a probability factor and an expert rules factor, wherein the probability factor is based upon statistical analysis of the subset of records and wherein the expert rules factor is based upon always requesting one type of attribute over a different type of attribute.

17. The computer program product of claim 11 wherein the reduction completion result is selected from the group consisting of an explicit matched record, an irreducible record set, an under threshold set, and an over limit response.

18. The computer program product of claim 11 wherein the information handling system further performs actions that include:

determining that the subset of records is the reduction completion result by only using the initial user provided attribute; and

performing the providing in response to determining that the subset of records is the reduction completion result by only using the initial user provided attribute.

19. The computer program product of claim 11 wherein the information handling system further performs actions that include:

determining that the reducing results in a non-compliant amount of records based upon a maximum record set limit, resulting in the reduction completion result being an over limit response; and

providing zero records to the user in response to the determining of the over limit response.

20. The computer program product of claim 11 wherein the information handling system further performs actions that include:

determining that the reducing results in an amount of records that are less than an allowable threshold value, resulting in the reduction completion result being an under threshold set; and

providing the records included in the under threshold set to the user in response to the determining of the under threshold set.

21. An information handling system comprising:

one or more processors;

a memory accessible by at least one of the processors;

a nonvolatile storage area accessible by at least one of the processors;

a set of instructions stored in the memory and executed by at least one of the processors in order to perform actions of;

receiving a request from a user that includes an initial user provided attribute;

identifying a subset of records from a plurality of records using the initial user provided attribute, the subset of records including more than one of the plurality of records and each of the subset of records including a first record attribute value that matches the initial user provided attribute;

preventing the user from viewing any portion of the subset of records during steps of;

analyzing the subset of records in order to detect record attribute differences between records included in the subset of records;

identifying one or more discrimination factors in response to the analysis that discriminates one or more of the records over another one or more of the records;

in response to the identifying of the one or more discrimination factors, sending a subset discriminating request, without a subsequent user provided attribute, to the user that requests the user to provide the subsequent user provided attribute that corresponds to the one or more discrimination factors;

receiving the subsequent user provided attribute from the user in response to the sending of the subset discriminating request;

reducing, in response to receiving the subsequent user provided attribute, the subset of records to a reduction completion result utilizing the subsequent user provided attribute, the reduction completion result including one or more records that each include a second record attribute value that matches the subsequent user provided attribute; and

providing the reduction completion result to the user, wherein the providing includes preventing the user from viewing each of the subset of records other than those in the reduction completion result.

22. The information handling system of claim 21 wherein the reduction completion result is only one record from the subset of records, the one record being an explicit matched record.

23. The information handling system of claim 21 wherein the reduction completion result is an irreducible record set that comprises a reduced subset of records, each of the reduced subset of records including record attribute values such that the reduced subset of records is not further reducible using additional subsequent user provided attributes.

24. The information handling system of claim 21 wherein the information handling system further performs actions that include:

computing conjoint probabilities among record attributes using their corresponding record attribute values; and

determining, based upon the computing of the conjoint probabilities, the one or more discrimination factors that have the highest calculated conjoint probabilities of appearing together in the subset of records.

25. The information handling system of claim 21 wherein the subsequent user provided attributes are selected from the group consisting of a demographic attribute, a non-demographic attribute, a biographical attribute, a descriptive attribute, a condition attribute, a state attribute, a transactional attribute, a geo-spatial attribute, and a temporal attribute.

26. The information handling system of claim 21 wherein the one or more discrimination factors are selected from the group consisting of a probability factor and an expert rules factor, wherein the probability factor is based upon statistical analysis of the subset of records and wherein the expert rules factor is based upon always requesting one type of attribute over a different type of attribute.

27. The information handling system of claim 21 wherein the reduction completion result is selected from the group consisting of an explicit matched record, an irreducible record set, an under threshold set, and an over limit response.

28. The information handling system of claim 21 wherein the information handling system further performs actions that include:

determining that the subset of records is the reduction completion result by only using the initial user provided attribute; and

performing the providing in response to determining that the subset of records is the reduction completion result by only using the initial user provided attribute.

29. The information handling system of claim 21 wherein the information handling system further performs actions that include:

determining that the reducing results in a non-compliant amount of records based upon a maximum record set limit, resulting in the reduction completion result being an over limit response; and

providing zero records to the user in response to the determining of the over limit response.

30. The information handling system of claim 21 wherein the information handling system further performs actions that include:

determining that the reducing results in an amount of records that are less than an allowable threshold value, resulting in the reduction completion result being an under threshold set; and

providing the records included in the under threshold set to the user in response to the determining of the under threshold set.