Apparatus and methods ensuring data privacy in a content distribution network

• US 10,148,623 B2
• Filed: 11/12/2010
• Issued: 12/04/2018
• Est. Priority Date: 11/12/2010
• Status: Active Grant

• Current Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Original Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Inventors: Tidwell, Justin, Samame, Eduardo, Engel, Craig, Goldberg, Craig
• Primary Examiner(s): Recek, Jason D
• Application Number:
  US12/944,985
• Publication Number:
  US 20120124161A1
• Time in Patent Office: 2,944 Days
• Field of Search: 709217, 725 9
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: H04H 60/31 Arrangements for monitoring the use made of the broadcast services
• CPC Class Codes: H04L 63/0421 Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer

Abstract

Methods and apparatus for ensuring the privacy of users and/or devices in a content delivery network from which data regarding the users'"'"' interaction with content is collected and distributed. In one embodiment, “tuning” records which describe the interaction of users with content or other activities of interest are collected. It is determined whether an opportunity for compromise of the user'"'"'s privacy (e.g., by derivative association) is present. If it is determined that such an opportunity exists, at least portions of the data are modified (e.g., collapsed). The modification may comprise replacing a first explicit data value with a second descriptive data value, increasing a range for the value, generalizing the value, removing the value, or encoding the value. Further processing of the collected tuning records may include, validating the data, accounting for latency, and generating reports based thereon.

Claims

1. A computer readable apparatus configured to implement a method for ensuring privacy of a plurality of transmitted data, said plurality of transmitted data relating to the interaction of individual ones of a plurality of subscribers in a content distribution network with digitally rendered content provided over said network, said computer readable apparatus comprising a non-transitory storage medium, the non-transitory storage medium comprising a plurality of instructions which are configured to, when executed on a computerized apparatus of the content distribution network:

receive a plurality of data at the computerized apparatus of said content distribution network, said plurality of data relating to interaction of said plurality of subscribers with said content;

examine a first cardinality of a subset of said plurality of subscribers having a first aspect reflected in respective ones of individual ones of said plurality of data;

when said first cardinality of said subset meets or exceeds a predetermined threshold, transmit, via said computerized apparatus, said plurality of data to a remote computerized entity for algorithmic analysis thereat, said algorithmic analysis further comprising execution of an algorithm to examine a second cardinality associated with both said plurality of data and said first cardinality of said subset; and

when said first cardinality does not meet said predetermined threshold, perform an automated data collapse process via said computerized apparatus, said automated data collapse process comprising;

automatically cause adjustment of said first aspect of said plurality of data so as to increase said privacy thereof; and

cause transmission of said adjusted data to a remote entity for algorithmic analysis thereat.

2. The computer readable apparatus of claim 1, wherein said received plurality of data comprises anonymized tuning records received from individual ones of a plurality of user devices associated with respective ones of said plurality of sub scribers.

3. The computer readable apparatus of claim 1, wherein said act of examination of a cardinality of said first aspect of said individual ones of said plurality of data is utilized to determine whether an identity of said individual ones of said plurality of subscribers is discoverable from said plurality data when combined with at least one other piece of additional information.

4. The computer readable apparatus of claim 1, wherein said second cardinality comprises a cardinality of a difference between said subset of said plurality of subscribers having said first aspect reflected in respective ones of said plurality of data and said plurality of subscribers;

and

the plurality of instructions are further configured to, when executed;

when said second cardinality is less than a predetermined threshold, transmitting cause transmission of said plurality of data; and

when said second cardinality is not less than said predetermined threshold,

automatically cause adjustment of said first aspect of said plurality of data; and

cause transmission of said adjusted data.

5. The computer readable apparatus of claim 1, wherein said automatic adjustment of said first aspect comprises at least one of:

replacing a value of said first aspect; and

increasing a range of a value of said first aspect.

6. The computer readable apparatus of claim 1, wherein said automatic adjustment of said first aspect comprises at least one of:

removing a value of said first aspect; and

generalizing a value of said first aspect.

7. The computer readable apparatus of claim 1, wherein the plurality of instructions are further configured to, when executed, provide a description of said individual ones of said plurality of data which is inaccurate.

8. A computerized apparatus for use in a content distribution network, said computerized apparatus comprising:

at least one interface configured to receive data representative of a plurality of tuning event data records associated with a respective plurality of user devices in said content distribution network;

a storage apparatus comprising at least one computer program stored thereon; and

at least one digital processor configured to execute said at least one computer program, said computer program comprising a plurality of instructions which are configured to, when executed;

algorithmically determine whether a number of said received data representative of said plurality of tuning event data records having a first aspect is within an acceptable range, said acceptable range comprising a range selected to ensure that privacy of identity of said user devices is maintained;

when said number is greater or less than said acceptable range, automatically increase a magnitude of a size of said acceptable range for said first aspect of said data representative of said plurality of tuning event records so as to maintain said privacy of identity of said user devices; and

transmit said data representative of said plurality of tuning event records to a remote entity.

9. The apparatus of claim 8, wherein said data representative of said plurality of tuning event records comprise information indicative of various interactions of said plurality of user devices with content.

10. The apparatus of claim 8, wherein said plurality of instructions are further configured to, when said number is greater or less than said acceptable range:

replace a value of said first aspect.

11. The apparatus of claim 8, wherein said plurality of instructions are further configured to, when said number is greater or less than said acceptable range:

remove a value of said first aspect;

or

generalize said value of said first aspect.

12. The apparatus of claim 8, wherein said determination of whether said number of said received data representative of said plurality of tuning event records having said first aspect is within an acceptable range further comprises:

subtraction of said number of said received data representative of said plurality of tuning event records having said first aspect from a total number of said received data representative of said plurality of tuning event records; and

determination of whether a result of said subtraction is within said acceptable range.

13. The apparatus of claim 8, wherein said acceptable range is calculated to reduce vulnerability to derivative association.

14. A computerized method for ensuring privacy of data in a content distribution network comprising a plurality of client devices, said method comprising:

receiving at a first computerized apparatus, a plurality of data representative of anonymized data records, each of said plurality of data representative of anonymized data records describing an interaction of an individual one of a plurality of users with said plurality of client devices configured to provide digitally rendered content, said plurality of data representative of anonymized data records each having a plurality of fields;

examining a first cardinality of a subset of said plurality of data representative of anonymized data records with respect to a first one of said plurality of fields via said first computerized apparatus;

examining a second cardinality of a difference between (i) said subset of said plurality of data representative of anonymized data records with respect to said first one of said plurality of fields and (ii) said plurality of data representative of anonymized data records; and

when either said first or said second cardinality is not within a respective predetermined range computed to avoid vulnerability to derivative association of at least said first one of said plurality of data representative of anonymized data records, automatically initiating an algorithm to adjust, via said first computerized apparatus, said first one of said plurality of fields by performing at least one of broadening, replacing or eliminating said first one of said plurality of fields.

15. The method of claim 14, wherein said act of adjusting said first one of said plurality of fields comprises adjusting said plurality of data representative of anonymized data records for a subset of a plurality of subscribers.

16. The method of claim 14, further comprising iteratively re-examining said first and second cardinalities with respect to each of said plurality of fields.

17. The method of claim 14, further comprising, when said first and said second cardinalities are within said respective predetermined ranges, transmitting said plurality of data representative of anonymized data records to a remote entity for analysis thereof.

18. The method of claim 14, wherein the replacing of said first one of said plurality of fields comprises inserting a different value in place of said first one of said plurality of fields, the different value comprising a categorical value applicable to at least (i) a first one of said first one of said plurality of fields and (ii) a second one of said first one of said plurality of fields.

19. A system for providing a plurality of data records relating to subscribers'"'"' interaction with digitally rendered content via a plurality of computerized client devices, said digitally rendered content provided via a content distribution network, said system comprising:

said plurality of computerized client devices, each of said plurality of computerized client devices being configured to receive said digitally rendered content via said content distribution network and configured to generate a plurality of information describing interaction therewith; and

a headend server in communication with said plurality of computerized client devices and configured to receive said plurality of information therefrom, said headend server further configured to run a computer program thereon, said computer program comprising a plurality of instructions which are configured to, when executed;

examine said plurality of information to determine whether an identity of an individual one of said plurality of computerized client devices is derivable when said plurality of information is provided to an outside party;

when said identity is derivable, automatically replace a value of a first aspect of respective ones of said plurality of information with a broadened value therefor;

when said value is replaced with said broadened value, examine said plurality of information comprising the broadened value to algorithmically determine whether the identity of the individual one of said computerized client devices is derivable; and

when it is determined that said identity is not derivable after said replacement, provide said plurality of information to said outside party.

20. The system of claim 19, wherein said computer program is further configured to process said plurality of information to ensure said plurality of information is reliable.

21. The system of claim 20, wherein said computer program is further configured to determine and account for a latency associated with a transmission of said plurality of information from said plurality of computerized client devices to said headend server.

22. The system of claim 20, wherein said computer program is further configured to validate said plurality of information.

23. The system of claim 20, wherein said computer program is further configured to parse said plurality of data records into manageable portions according to one or more criteria.

24. The system of claim 23, wherein said manageable portions are provided to at least one entity remote to said content distribution network.

25. A non-transitory computer-readable apparatus comprising a storage medium having a plurality of instructions thereon, the plurality of instructions being configured to cause a computerized apparatus to, when executed by a processor apparatus:

receive a plurality of data records via the computerized apparatus;

examine a cardinality of a first subset of the plurality of data records, the plurality of data records each having a first aspect;

responsive to the cardinality of the first subset meeting or exceeding a predetermined threshold;

determine whether a second cardinality meets or exceeds a second predetermined threshold, the second cardinality comprising a difference between a cardinality of the plurality of data records and the cardinality of the first subset;

responsive to the second cardinality not meeting or exceeding the second predetermined threshold, automatically adjust the first aspect of a second subset of the plurality of data records, and transmit the plurality of data records comprising adjusted second subset; and

responsive to the second cardinality meeting or exceeding the second predetermined threshold, transmit the plurality of data records; and

responsive to the cardinality of the first subset not meeting or exceeding the predetermined threshold;

automatically adjust the first aspect of the first subset;

determine whether the second cardinality meets or exceeds the second predetermined threshold;

responsive to the second cardinality not meeting or exceeding the second predetermined threshold, automatically adjust the first aspect of the second subset of the plurality of records, and transmit the plurality of records comprising the adjusted first subset and second subset; and

responsive to the second cardinality meeting or exceeding the second predetermined threshold, transmit the adjusted plurality of records.