Dynamic de-identification and anonymity

• US 9,087,215 B2
• Filed: 10/31/2014
• Issued: 07/21/2015
• Est. Priority Date: 11/01/2013
• Status: Active Grant

• Current Assignee: Anonos IP LLC
• Original Assignee: Anonos, Inc.
• Inventors: LaFever, Malcolm Gary, Myerson, Ted N., Hampton, Samantha L., Kaushansky, Howard, Mason, Steven
• Primary Examiner(s): Pham, Luu
• Assistant Examiner(s): Baum, Ronald
• Application Number:
  US14/529,960
• Publication Number:
  US 20150128287A1
• Time in Patent Office: 263 Days
• Field of Search: 713/162
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088

Abstract

Various systems, computer-readable media, and computer-implemented methods of providing improved data privacy, anonymity and security by enabling subjects to which data pertains to remain “dynamically anonymous,” i.e., anonymous for as long as is desired—and to the extent that is desired—are disclosed herein. Embodiments include systems that create, access, use, store and/or erase data with increased privacy, anonymity and security, thereby facilitating the availability of more qualified and accurate information. When data is authorized by subjects to be shared with third parties, embodiments may facilitate sharing information in a dynamically controlled manner that enables delivery of temporally-, geographically-, and/or purpose-limited information to the receiving party. In one example, anonymity measurement scores may be calculated for the shared data elements so that a level of consent/involvement required by the Data Subject before sharing the relevant data elements to third parties may be specified.

Claims

1. A system, comprising:

a communication interface for sending data;

one or more memory elements having, stored therein, computer program code; and

one or more processing units operatively coupled to the one or more memory elements and configured to execute instructions in the computer program code that cause the one or more processing units to;

generate or receive two or more dynamically-changing, temporally unique identifiers;

receive a first request from a first client for two or more dynamically-changing, temporally unique identifiers related to a first data subject;

associate, in response to the first request, two or more dynamically-changing, temporally unique identifiers with the first data subject;

generate first time period data, wherein the first time period data comprises information defining a first time period during which a first one of the two or more dynamically-changing, temporally unique identifiers associated with the first data subject is used to identify the first data subject;

generate second time period data, wherein the second time period data comprises information defining a second time period during which a second one of the two or more dynamically-changing, temporally unique identifiers associated with the first data subject is used to identify the first data subject,

wherein the first time period is different from the second time period,

wherein the first dynamically-changing, temporally unique identifier is different from the second dynamically-changing, temporally unique identifier,

wherein the first dynamically-changing, temporally unique identifier is not used to identify the first data subject during the second time period, and

wherein the second dynamically-changing, temporally unique identifier is not used to identify the first data subject during the first time period, thereby providing anonymity to the first data subject;

store, in at least one of the one or more memory elements, the two or more dynamically-changing, temporally unique identifiers and the first and second time period data; and

send the two or more dynamically-changing, temporally unique identifiers to the first client.

2. The system of claim 1, wherein the instructions in the computer program code further cause the one or more processing units to:

associate one or more data attributes with the first dynamically-changing,

temporally unique identifier of the two or more dynamically-changing,

temporally unique identifiers.

3. The system of claim 2, wherein at least one of the one or more data attributes associated with the first dynamically-changing, temporally unique identifier relates to an action, activity, process, purpose, identity, or trait of the first data subject.

4. The system of claim 3, wherein the instructions in the computer program code further cause the one or more processing units to:

receive a second request from a second client for at least one of the one or more data attributes associated with the first dynamically-changing, temporally unique identifier during the first time period;

determine that the second request is authorized; and

grant the ability of the second client to determine the requested one or more data attributes associated with the first dynamically-changing, temporally unique identifier during the first time period.

5. The system of claim 3, wherein the instructions in the computer program code further cause the one or more processing units to:

associate the first dynamically-changing temporally unique identifier with a second data subject during a third time period,

wherein at least one of the one or more data attributes associated with the first dynamically-changing temporally unique identifier during the first time period is the same as one of the one or more data attributes associated with the first dynamically-changing temporally unique identifier during the third time period.

6. The system of claim 4, wherein the instructions in the computer program code further cause the one or more processing units to:

revoke the ability of the second client to determine the requested one or more data attributes associated with the first dynamically-changing temporally unique identifier during the second time period.

7. The system of claim 1, wherein the instructions in the computer program code further cause the one or more processing units to:

associate the first dynamically-changing, temporally unique identifier of the two or more dynamically-changing, temporally unique identifiers with a second data subject during the first time period or during the second time period.

8. The system of claim 1, wherein the instructions in the computer program code further cause the one or more processing units to:

associate, in response to the first request, a third dynamically-changing, temporally unique identifier of the two or more dynamically-changing, temporally unique identifiers with the first data subject;

generate third time period data, wherein the third time period data comprises information defining a third time period during which the third dynamically-changing, temporally unique identifier is used to identify the first data subject,

wherein the third time period is different from the first and second time periods,

wherein the third dynamically-changing, temporally unique identifier is different from the second dynamically-changing, temporally unique identifier, but the same as the first dynamically-changing, temporally unique identifier,

wherein the third dynamically-changing, temporally unique identifier is not used to identify the first data subject during the second time period;

store, in at least one of the one or more memory elements, the third dynamically-changing, temporally unique identifier and the third time period data; and

send the third dynamically-changing, temporally unique identifier to the first client.

9. The system of claim 1, wherein the instructions in the computer program code further cause the one or more processing units to:

associate one or more data attributes with the second dynamically-changing temporally unique identifier,

wherein at least one of the one or more data attributes associated with the second dynamically-changing temporally unique identifier relates to an action, activity, process, purpose, identity, or trait of the first data subject.

10. The system of claim 9, wherein at least one of the one or more data attributes associated with the first dynamically-changing temporally unique identifier is different from at least one of the one or more data attributes associated with the second dynamically-changing temporally unique identifier.

11. The system of claim 1, wherein the instructions in the computer program code further cause the one or more processing units to:

receive from a second client, a third dynamically-changing temporally unique identifier related to a second data subject;

associate the third dynamically-changing temporally unique identifier with the second data subject;

generate third time period data, wherein the third time period data comprises information defining a third time period during which the third dynamically-changing temporally unique identifier used to identify the second data subject; and

store, in at least one of the one or more memory elements, the third dynamically-changing temporally unique identifier and the third time period data.

12. A non-transitory computer readable medium comprising computer executable instructions stored thereon to cause one or more processing units to:

generate or receive two or more dynamically-changing, temporally unique identifiers;

receive a first request from a first client for two or more dynamically-changing temporally unique identifiers related to a first data subject;

associate, in response to the first request, two or more dynamically-changing temporally unique identifiers with the first data subject;

generate first time period data, wherein the first time period data comprises information defining a first time period during which a first one of the two or more dynamically-changing temporally unique identifiers associated with the first data subject is used to identify the first data subject;

generate second time period data, wherein the second time period data comprises information defining a second time period during which a second one of the two or more dynamically-changing, temporally unique identifiers associated with the first data subject is used to identify the first data subject,

wherein the first time period is different from the second time period,

wherein the first dynamically-changing, temporally unique identifier is different from the second dynamically-changing, temporally unique identifier,

wherein the first dynamically-changing, temporally unique identifier is not used to identify the first data subject during the second time period, and

wherein the second dynamically-changing, temporally unique identifier is not used to identify the first data subject during the first time period, thereby providing anonymity to the first data subject;

store, in one or more memory elements, the two or more dynamically-changing temporally unique identifiers and the first and second time period data; and

send the first and second dynamically-changing temporally unique identifiers to the first client.

13. The non-transitory computer readable medium of claim 12, wherein the instructions further cause the one or more processing units to:

associate one or more data attributes with the first dynamically-changing temporally unique identifier of the two or more dynamically-changing temporally unique identifiers.

14. The non-transitory computer readable medium of claim 13, wherein at least one of the one or more data attributes associated with the first dynamically-changing temporally unique identifier relates to an action, activity, process, purpose, identity, or trait of the first data subject.

15. The non-transitory computer readable medium of claim 13, wherein the first dynamically-changing temporally unique identifier is not derived from any of the one or more data attributes associated with the first dynamically-changing temporally unique identifier.

16. The non-transitory computer readable medium of claim 14, wherein the instructions further cause the one or more processing units to:

receive a second request from a second client for at least one of the one or more data attributes associated with the first dynamically-changing temporally unique identifier during the first time period;

determine that the second request is authorized; and

grant the ability of the second client to determine the requested one or more data attributes associated with the first dynamically-changing temporally unique identifier during the first time period.

17. The non-transitory computer readable medium of claim 14, wherein the instructions further cause the one or more processing units to:

associate the first dynamically-changing temporally unique identifier with a second data subject during a third time period,

wherein at least one of the one or more data attributes associated with the first dynamically-changing temporally unique identifier during the first time period is the same as one of the one or more data attributes associated with the first dynamically-changing temporally unique identifier during the third time period.

18. The non-transitory computer readable medium of claim 16, wherein the instructions further cause the one or more processing units to:

revoke the ability of the second client to determine the requested one or more data attributes associated with the first dynamically-changing temporally unique identifier during the second time period.

19. The non-transitory computer readable medium of claim 12, wherein the instructions further cause the one or more processing units to:

associate the first dynamically-changing temporally unique identifier of the two or more dynamically-changing temporally unique identifiers with a second data subject during a second time period.

20. The non-transitory computer readable medium of claim 12, wherein the instructions further cause the one or more processing units to:

associate the first dynamically-changing temporally unique identifier of the two or more dynamically-changing temporally unique identifiers with a second data subject during the first time period.

21. The non-transitory computer readable medium of claim 12, wherein the instructions further cause the one or more processing units to:

associate, in response to the first request, a third dynamically-changing temporally unique identifier of the two or more dynamically-changing, temporally unique identifiers with the first data subject;

generate third time period data, wherein the third time period data comprises information defining a third time period during which the third dynamically-changing temporally unique identifier is used to identify the first data subject,

wherein the third time period is different from the first and second time periods,

wherein the third dynamically-changing, temporally unique identifier is different from the second dynamically-changing, temporally unique identifier, but the same as the first dynamically-changing, temporally unique identifier,

wherein the third dynamically-changing, temporally unique identifier is not used to identify the first data subject during the second time period;

store, in at least one of the one or more memory elements, the third dynamically-changing temporally unique identifier and the third time period data; and

send the third dynamically-changing temporally unique identifier to the first client.

22. The non-transitory computer readable medium of claim 21, wherein the first time period and the second time period do not overlap.

23. The non-transitory computer readable medium of claim 21, wherein the first time period and the second time period at least partially overlap.

24. The non-transitory computer readable medium of claim 12, wherein the instructions further cause the one or more processing units to:

associate one or more data attributes with the second dynamically-changing temporally unique identifier,

wherein at least one of the one or more data attributes associated with the second dynamically-changing temporally unique identifier relates to an action, activity, process, purpose, identity, or trait of the first data subject.

25. The non-transitory computer readable medium of claim 24, wherein at least one of the one or more data attributes associated with the first dynamically-changing temporally unique identifier is different from at least one of the one or more data attributes associated with the second dynamically-changing temporally unique identifier.

26. The non-transitory computer readable medium of claim 12, wherein the instructions further cause the one or more processing units to:

receive from a second client, a third dynamically-changing temporally unique identifier related to a second data subject;

associate the third dynamically-changing temporally unique identifier with the second data subject;

generate third time period data, wherein the third time period data comprises information defining a third time period during which the third dynamically-changing temporally unique identifier used to identify the second data subject; and

store, in at least one of the one or more memory elements, the third dynamically-changing temporally unique identifier and the third time period data.

27. The non-transitory computer readable medium of claim 26, wherein the third dynamically-changing temporally unique identifier comprises a Hypertext Transfer Protocol (HTTP) cookie.

28. The non-transitory computer readable medium of claim 12, wherein the instructions further cause the one or more processing units to:

receive a second request from a second client for an identity of the first data subject associated with a first dynamically-changing temporally unique identifier of the one or more dynamically-changing temporally unique identifiers during the first time period;

determine that the second request is authorized; and

grant the ability of the second client to determine the identity of the first data subject during the first time period.

29. The non-transitory computer readable medium of claim 28, wherein the instructions further cause the one or more processing units to:

revoke the ability of the second client to determine the identity of the first data subject during the first time period.

30. The non-transitory computer readable medium of claim 12, wherein the first dynamically-changing temporally unique identifier of the two or more dynamically-changing temporally unique identifiers comprises a primary identifier for the first data subject.