Sensitive data aliasing

• US 8,984,656 B1
• Filed: 09/23/2013
• Issued: 03/17/2015
• Est. Priority Date: 01/27/2006
• Status: Active Grant

• Current Assignee: Appriss Retail Information LLC
• Original Assignee: Verisk Crime Analytics, Inc.
• Inventors: Duhaime, David A., Duhaime, Brad J.
• Primary Examiner(s): Truong, Thanhnga B
• Assistant Examiner(s): Jeudy, Josnel
• Application Number:
  US14/033,657
• Time in Patent Office: 540 Days
• Field of Search: 713189-194, 726 4- 6, 726 17- 19, 726 26- 30, 380 42- 44, 709/203, 709247-249, 707/607, 707/609, 707/661, 707/667, 707/705
• US Class Current: 726/28
• CPC Class Codes: G06F 16/122 using management policies backup systems G06F11/1446; file migration policies for HSM systems G06F16/185
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06Q 20/356 Aspects of software for card payments
• CPC Class Codes: G06Q 20/383 Anonymous user system
• CPC Class Codes: H04L 9/0625 with splitting of the data block into left and right halves, e.g. Feistel based algorithms, DES, FEAL, IDEA or KASUMI
• CPC Class Codes: H04L 9/0631 Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC

Abstract

Database management and security is implemented in a variety of embodiments. In one such embodiment, data sets containing sensitive data elements are analyzed using aliases representing sensitive data elements. In another embodiment, the sensitive data elements are stored in an encrypted form for use from a secure access, while the alias is available for standard access.

Claims

1. A computerized method of processing sensitive medical data, comprising the steps of:

providing access to personal medical data sets in a storage device, wherein the personal medical data sets include encrypted data elements using a first encryption method; and

by operating at least one computer,

using aliases independent from the data elements to generate an association between the aliases and the data elements;

restricting access to the encrypted data elements to a set of authorized users; and

by providing a circuit interface communicatively coupled to the at least one computer, permitting qualified access to the aliases and the data elements;

using the aliases in place of the data elements for a set of standard users, where at least some of the standard users are not included in the set of authorized users; and

maintaining data, accessible by a data-processing circuit, including data elements corresponding to one or more aliases as indicated by an electronic request from the data-processing circuit for at least some of the personal medical data.

2. The computerized method of claim 1, further including the step of allowing access, via the data-processing circuit, to aliases based on whether the electronic request indicates an access request by an authorized user, and providing selected portions of the sensitive medical data in response to the electronic request.

3. The computerized method of claim 1, further including the steps of:

identifying an alias corresponding to data elements selected by an authorized user; and

providing the identified alias to said authorized user through the circuit interface.

4. The computerized method of claim 1, further including the steps of:

identifying a data element corresponding to an alias selected by an authorized user; and

providing the identified data element to said authorized user through the circuit interface.

5. The computerized method of claim 1, further including the step of:

decrypting the data elements and subsequently encrypting the data elements using a second encryption method; and

maintaining the association between the aliases and the data elements.

6. The computerized method of claim 1, further including formatting the data elements to represent displayable characters.

7. The computerized method of claim 1, further including the step of appending a portion of a data element to an alias associated with said data element.

8. The computerized method of claim 4, further including the step of creating a log of activities by the authorized users and the standard users.

9. The computerized method of claim 1, wherein the data elements are stored in a first database and the aliases are stored in a second database.

10. A computerized method of managing a database, including sensitive medical data, the database including encrypted data sets containing data elements and aliases to represent the data elements, the method including the steps of:

providing aliases to represent the data elements, the aliases being characterized independent of the data elements;

by operating at least one computer,

determining if the data elements are encrypted;

decrypting the data elements in response to a determination that the data is encrypted;

encrypting the data elements using a first encryption method resulting in encrypted data;

generating an association between the aliases and the data elements;

restricting access to the data elements to a set of authorized users; and

using the aliases in place of the data elements for a set of standard users, where at least some of the standard users are not included in the set of authorized users; and

by providing a circuit interface communicatively coupled to the at least one computer, permitting qualified access to the aliases and the data elements.