System and method for transforming data to preserve privacy

• US 20030208457A1
• Filed: 04/16/2002
• Published: 11/06/2003
• Est. Priority Date: 04/16/2002
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Iyengar, Vijay S.
• Granted Patent: US 7,024,409 B2
• Time in Patent Office: Days
• US Class Current: 707/1
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

A data transform system comprises a processor, a memory connected to the processor, storing a collection of data, and a data transform module, accepting two data constraints and the collection of data from memory, wherein a first constraint is a usage constraint and a second constraint is a privacy constraint, the data transform module transforming the collection of data according to the usage constraint and the privacy constraint.

Claims

1. A data transform system comprising:

a processor;

a memory connected to the processor, storing a collection of data; and

a data transform module, accepting two data constraints and the collection of data from memory, wherein a first constraint is a usage constraint and a second constraint is a privacy constraint, the data transform module transforming the collection of data according to the usage constraint and the privacy constraint.

2. The data transform system of claim 1, wherein the collection of data is a data base.

3. The data transform system of claim 1, wherein the collection of data comprises:

a meta data portion comprising information about the collection of data; and

a tabular data portion comprising a plurality of attributes corresponding to the collection of data.

4. The data transform system of claim 3, wherein the tabular data portion is organized by rows or columns.

5. The data transform system of claim 1, wherein the usage constraint determines a subset of data from the collection of data.

6. The data transform system of claim 1, wherein the privacy constraint abstracts the data collection.

7. The data transform system of claim 1, wherein the privacy constraint suppresses the data collection.

8. The data transform system of claim 1, wherein the privacy constraint defines a minimum population that can be identified by an output of the data transform module.

9. A method for constraining data comprising the steps of:

determining, for a collection of data, a level of granularity;

determining an application specific constraint;

determining a metric according to the level of granularity, the application specific constraint; and

constraining the collection of data according to the metric.

10. The method of claim 9, wherein the step of constraining the collection of data further comprises the step of abstracting and suppressing values for an identifying attribute in the collection of data, wherein the collection of data comprises a meta data portion specifying the identifying attribute.

11. The method of claim 10, wherein a categorical identifying attribute is abstracted according to values in a corresponding taxonomy tree.

12. The method of claim 10, wherein a numeric identifying attribute is abstracted to a set of disjoint intervals that cover values in the collection of data.

13. The method of claim 10, further comprising the step of determining a data loss, according to the metric, in the collection of data according to the application constraint.

14. The method of claim 13, wherein the step of constraining comprises minimizing the data loss.

15. The method of claim 13, wherein the step of constraining comprises minimizing the data loss according to a genetic algorithm.

16. The method of claim 9, wherein the application constraint specifies at least one target attribute for which a predictive model is generated.

17. The method of claim 16, wherein a plurality of identifying attributes are grouped according to values, wherein the metric aggregates a variability in the values for each target attribute within a group.

18. The method of claim 17, wherein the variability for a numeric target attribute is determined as the sum of absolute deviations between a representative value for the group and values for the numeric target attribute within the group.

19. The method of claim 17, wherein the variability for a categorical target attribute is determined as a number of categories in a group with a value for the categorical target attribute different from a majority value in the group.

20. The method of claim 9, wherein the application constraint specifies a weight for an identifying attribute of the data.

21. The method of claim 20, further comprising the step of determining a weighted sum of data loss over the collection of data.

22. The method of claim 21, wherein the data loss for an identifying attribute depends on a type of attribute and is determined as an average loss for each entry for that attribute.

23. The method of claim 22, wherein the data loss for a numeric type attribute entry is a width of an abstracted interval.

24. The method of claim 22, wherein the data loss for a categorical attribute type entry is based on an ambiguity in an abstracted value from a taxonomy tree.

25. A program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform method steps for constraining data, the method steps comprising:

determining, for a collection of data, a level of granularity;

determining an application specific constraint;

determining a metric according to the level of granularity, the application specific constraint; and

constraining the collection of data according to the metric.