Dynamic de-identification and anonymity

• US 9,129,133 B2
• Filed: 10/31/2014
• Issued: 09/08/2015
• Est. Priority Date: 11/01/2013
• Status: Active Grant

• Current Assignee: Anonos IP LLC
• Original Assignee: Anonos, Inc.
• Inventors: LaFever, Malcolm Gary, Myerson, Ted N., Hampton, Samantha L., Kaushansky, Howard, Mason, Steven
• Primary Examiner(s): Jeudy, Josnel
• Application Number:
  US14/530,304
• Publication Number:
  US 20150128284A1
• Time in Patent Office: 312 Days
• Field of Search: 726 2- 4, 726 27- 30
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0414 during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

Various systems, computer-readable media, and computer-implemented methods of providing improved data privacy, anonymity and security by enabling subjects to which data pertains to remain “dynamically anonymous,” i.e., anonymous for as long as is desired—and to the extent that is desired—are disclosed herein. Embodiments include systems that create, access, use, store and/or erase data with increased privacy, anonymity and security, thereby facilitating the availability of more qualified and accurate information. When data is authorized by subjects to be shared with third parties, embodiments may facilitate sharing information in a dynamically controlled manner that enables delivery of temporally-, geographically-, and/or purpose-limited information to the receiving party. In one example, anonymity measurement scores may be calculated for the shared data elements so that a level of consent/involvement required by the Data Subject before sharing the relevant data elements to third parties may be specified.

Claims

1. A system, comprising:

a communication interface for sending and receiving data;

one or more memory elements having, stored therein, computer program code; and

one or more processing units operatively coupled to the one or more memory elements and configured to execute instructions in the computer program code that cause the one or more processing units to;

generate or receive two or more dynamically-changing, temporally unique identifiers;

associate the two or more dynamically-changing, temporally unique identifiers with a first data subject;

associate one or more data attributes with a first of the two or more dynamically-changing, temporally unique identifiers;

generate first time period data, wherein the first time period data comprises information defining a first time period during which the first of the two or more dynamically-changing, temporally unique identifiers associated with the first data subject is used to identify the first data subject and retrieve the associated one or more data attributes;

generate second time period data, wherein the second time period data comprises information defining a second time period during which a second one of the two or more dynamically-changing, temporally unique identifiers associated with the first data subject is used to identify the first data subject,

wherein the first time period is different from the second time period,

wherein the first dynamically-changing, temporally unique identifier is different from the second dynamically-changing, temporally unique identifier,

wherein the first dynamically-changing, temporally unique identifier is not used to identify the first data subject during the second time period, and

wherein the second dynamically-changing, temporally unique identifier is not used to identify the first data subject during the first time period, thereby providing anonymity to the first data subject;

store, in at least one of the one or more memory elements, the two or more dynamically-changing, temporally unique identifier, the one or more data attributes, and the first and second time period data; and

send the one or more data attributes to a first client.

2. The system of claim 1, wherein the instructions to generate the first of the two or more dynamically-changing, temporally unique identifier are executed based on at least one of the following:

time, purpose, and location.

3. The system of claim 1, wherein the instructions in the computer program code further cause the one or more processing units to:

terminate the first dynamically-changing, temporally unique identifier'"'"'s ability to retrieve the associated one or more data attributes.

4. The system of claim 3, wherein the instructions to terminate the first dynamically-changing, temporally unique identifier'"'"'s ability to retrieve the associated one or more data attributes are executed based on at least one of the following:

time, purpose, and location.

5. The system of claim 1, wherein at least one of the one or more data attributes associated with the first dynamically-changing, temporally unique identifier relates to an action, activity, process, purpose, identity, or trait of the first data subject.

6. The system of claim 1, wherein the instructions in the computer program code further cause the one or more processing units to:

associate the first dynamically-changing, temporally unique identifier with a second data subject during the second time period.

7. The system of claim 1, wherein the instructions in the computer program code further cause the one or more processing units to:

associate the first dynamically-changing, temporally unique identifier with a second data subject during the first time period.

8. The system of claim 1, wherein the instructions in the computer program code further cause the one or more processing units to:

receive a first request from a second client for identifying information of the first data subject associated with the first dynamically-changing, temporally unique identifier during the first time period;

determine that the first request is authorized; and

grant the ability of the second client to determine identifying information of the first data subject during the first time period.

9. The system of claim 8, wherein the instructions in the computer program code further cause the one or more processing units to:

revoke the ability of the second client to determine the identifying information of the first data subject during the first time period.

10. The system of claim 1, wherein the instructions in the computer program code further cause the one or more processing units to:

receive a first request from a second client for one or more of the data attributes associated with the first dynamically-changing, temporally unique identifier during the first time period;

determine that the first request is authorized; and

grant the ability of the second client to determine the requested one or more of the data attributes associated with the first dynamically-changing, temporally unique identifier during the first time period.

11. The system of claim 10, wherein the instructions in the computer program code further cause the one or more processing units to:

revoke the ability of the second client to determine the requested one or more of the data attributes associated with the first dynamically-changing, temporally unique identifier during the first time period.

12. The system of claim 1, wherein the first dynamically-changing, temporally unique identifier is not derived from any of the one or more data attributes associated with the first dynamically-changing, temporally unique identifier.

13. The system of claim 1, wherein the first dynamically-changing, temporally unique identifier comprises a primary identifier for the first data subject.

14. A non-transitory computer readable medium comprising computer executable instructions stored thereon to cause one or more processing units to:

generate or receive two or more dynamically-changing, temporally unique identifiers;

associate the two or more dynamically-changing, temporally unique identifiers with a first data subject;

associate one or more data attributes with a first one of the two or more dynamically-changing, temporally unique identifier;

generate first time period data, wherein the first time period data comprises information defining a first time period during which the first of the two or more dynamically-changing, temporally unique identifiers associated with the first data subject is used to identify the first data subject and to retrieve the associated one or more data attributes;

generate second time period data, wherein the second time period data comprises information defining a second time period during which a second one of the two or more dynamically-changing, temporally unique identifiers associated with the first data subject is used to identify the first data subject,

wherein the first time period is different from the second time period,

wherein the first dynamically-changing, temporally unique identifier is different from the second dynamically-changing, temporally unique identifier,

wherein the first dynamically-changing, temporally unique identifier is not used to identify the first data subject during the second time period, and

wherein the second dynamically-changing, temporally unique identifier is not used to identify the first data subject during the first time period, thereby providing anonymity to the first data subject;

store, in at least one of one or more memory elements, the first two or more dynamically-changing, temporally unique identifiers, the one or more data attributes, and the first and second time period data; and

send the one or more data attributes to a first client.

15. The non-transitory computer readable medium of claim 14, wherein the instructions to generate the first of the two or more dynamically-changing, temporally unique identifier are executed based on at least one of the following:

time, purpose, and location.

16. The non-transitory computer readable medium of claim 14, wherein the instructions further cause the one or more processing units to:

terminate the first dynamically-changing, temporally unique identifier'"'"'s ability to retrieve the associated one or more data attributes.

17. The non-transitory computer readable medium of claim 16, wherein the instructions to terminate the first dynamically-changing, temporally unique identifier'"'"'s ability to retrieve the associated one or more data attributes are executed based on at least one of the following:

time, purpose, and location.

18. The non-transitory computer readable medium of claim 14, wherein at least one of the one or more data attributes associated with the first dynamically-changing, temporally unique identifier relates to an action, activity, process, purpose, identity, or trait of the first data subject.

19. The non-transitory computer readable medium of claim 14, wherein the instructions further cause the one or more processing units to:

associate the first dynamically-changing, temporally unique identifier with a second data subject during the second time period.

20. The non-transitory computer readable medium of claim 14, wherein the instructions further cause the one or more processing units to:

associate the first dynamically-changing, temporally unique identifier with a second data subject during the first time period.

21. The non-transitory computer readable medium of claim 14, wherein the instructions further cause the one or more processing units to:

receive a first request from a second client for identifying information of the first data subject associated with the first dynamically-changing, temporally unique identifier during the first time period;

determine that the first request is authorized; and

grant the ability of the second client to determine the identifying information of the first data subject during the first time period.

22. The non-transitory computer readable medium of claim 21, wherein the instructions further cause the one or more processing units to:

revoke the ability of the second client to determine the identifying information of the first data subject during the first time period.

23. The non-transitory computer readable medium of claim 14, wherein the instructions further cause the one or more processing units to:

receive a first request from a second client for one or more of the data attributes associated with the first dynamically-changing, temporally unique identifier during the first time period;

determine that the first request is authorized; and

grant the ability of the second client to determine the requested one or more of the data attributes associated with the first dynamically-changing, temporally unique identifier during the first time period.

24. The non-transitory computer readable medium of claim 23, wherein the instructions further cause the one or more processing units to:

revoke the ability of the second client to determine the requested one or more of the data attributes associated with the first dynamically-changing, temporally unique identifier during the first time period.

25. The non-transitory computer readable medium of claim 14, wherein the first dynamically-changing, temporally unique identifier is not derived from any of the one or more data attributes associated with the first temporally unique identifier.

26. The non-transitory computer readable medium of claim 14, wherein the first dynamically-changing, temporally unique identifier comprises a primary identifier for the first data subject.