System and Method for Selecting Records from a List with Privacy Protections

• US 20080086452A1
• Filed: 10/06/2006
• Published: 04/10/2008
• Est. Priority Date: 10/06/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Jonas, Jeffrey James, Martin, David Charles
• Granted Patent: US 7,644,068 B2
• Time in Patent Office: Days
• US Class Current: 707/3
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A system and method for selecting records from a list with privacy protections is provided. A user wishes to view a record, such as one that includes a person'"'"'s medical history, located in a record storage area. In order to prevent the user from viewing records other than the specific record in which the user is interested, a record selection manager iteratively requests attribute information from the user to disambiguate which record to provide until the record selection manager identifies a reduction completion result, which the record selection manager then provides to the user. Using the invention described herein, the record selection manager conceals records included in the records storage area until it identifies a reduction completion result and, at that point, the record selection manager provides only the reduction completion result to the user to view.

Claims

1. A computer-implemented method comprising:

receiving a request from a user that includes an initial user provided attribute;

identifying a subset of records from a plurality of records using the initial user provided attribute, the subset of records including more than one of the plurality of records and each of the subset of records including a first record attribute value that matches the initial user provided attribute;

in response to the identifying of the subset of records, sending a subset discriminating request to the user;

receiving a subsequent user provided attribute from the user in response to the sending of the subset discriminating request;

reducing, in response to receiving the subsequent user provided attribute, the subset of records to a reduction completion result, the reduction completion result including one or more records that each include a second record attribute value that matches the subsequent user provided attribute; and

providing the reduction completion result to the user.

2. The method of claim 1 wherein the reduction completion result is only one record from the subset of records, the one record being an explicit matched record.

3. The method of claim 1 wherein the reduction completion result is an irreducible record set that comprises a reduced subset of records, each of the reduced subset of records including record attribute values such that the reduced subset of records is not further reducible using additional subsequent user provided attributes.

4. The method of claim 1 further comprising:

concealing, from the user, each of the subset of records during the identifying, the sending, the receiving, and the reducing; and

concealing, from the user, each of the subset of records other than those in the reduction completion result during the providing.

5. The method of claim 1 further comprising:

computing conjoint probabilities among record attributes using their corresponding record attribute values; and

determining, based upon the computing of the conjoint probabilities, discrimination factors that have the highest calculated conjoint probabilities of appearing together in the subset of records.

6. The method of claim 1 wherein the subsequent user provided attributes are selected from the group consisting of a demographic attribute, a non-demographic attribute, a biographical attribute, a descriptive attribute, a condition attribute, a state attribute, a transactional attribute, a geo-spatial attribute, and a temporal attribute.

7. The method of claim 1 wherein the subset discriminating requests are based upon at least one discrimination factor that is selected from the group consisting of a probability factor, an expert rules factor, and a policy factor.

8. The method of claim 1 wherein the reduction completion result is selected from the group consisting of an explicit matched record, an irreducible record set, an under threshold set, and an over limit response.

9. The method of claim 1 further comprising:

determining that the subset of records is the reduction completion result by only using the initial user provided attribute; and

performing the providing in response to determining that the subset of records is the reduction completion result by only using the initial user provided attribute.

10. The method of claim 1 further comprising:

determining that the reducing results in a non-compliant amount of records based upon a maximum record set limit, resulting in the reduction completion result being an over limit response; and

providing zero records to the user in response to the determining of the over limit response.

11. The method of claim 1 further comprising:

determining that the reducing results in an amount of records that are less than an allowable threshold value, resulting in the reduction completion result being an under threshold set; and

providing the records included in the under threshold set to the user in response to the determining of the under threshold set.

12. An information handling system comprising:

one or more processors;

a memory accessible by the processors;

a storage device accessible by the processors; and

a record selection tool for selecting records, the record selection tool being effective to;

receive a request from a user that includes an initial user provided attribute;

identify a subset of records from a plurality of records using the initial user provided attribute, the subset of records including more than one of the plurality of records and each of the subset of records including a first record attribute value that matches the initial user provided attribute;

in response to the identifying of the subset of records, send a subset discriminating request to the user;

receive a subsequent user provided attribute from the user in response to the sending of the subset discriminating request;

reduce, in response to receiving the subsequent user provided attribute, the subset of records to a reduction completion result, the reduction

completion result including one or more records that each include a second record attribute value that matches the subsequent user provided attribute; and

provide the reduction completion result to the user.

13. The information handling system of claim 12 wherein the reduction completion result is only one record from the subset of records, the one record being an explicit matched record.

14. The information handling system of claim 12 wherein the reduction completion result is an irreducible record set that comprises a reduced subset of records, each of the reduced subset of records including record attribute values such that the reduced subset of records is not further reducible using additional subsequent user provided attributes.

15. The information handling system of claim 12 wherein the record selection tool is further effective to:

conceal, from the user, each of the subset of records during the identifying, the sending, the receiving, and the reducing; and

conceal, from the user, each of the subset of records other than those in the reduction completion result during the providing.

16. The information handling system of claim 12 wherein the record selection tool is further effective to:

compute conjoint probabilities among record attributes using their corresponding record attribute values; and

determine, based upon the computing of the conjoint probabilities, discrimination factors that have the highest calculated conjoint probabilities of appearing together in the subset of records.

17. The information handling system of claim 12 wherein the subsequent user provided attributes are selected from the group consisting of a demographic attribute, a non-demographic attribute, a biographical attribute, a descriptive attribute, a condition attribute, a state attribute, a transactional attribute, a geo-spatial attribute, and a temporal attribute.

18. The information handling system of claim 12 wherein the subset discriminating requests are based upon at least one discrimination factor that is selected from the group consisting of a probability factor, an expert rules factor, and a policy factor.

19. The information handling system of claim 12 wherein the reduction completion result is selected from the group consisting of an explicit matched record, an irreducible record set, an under threshold set, and an over limit response.

20. The information handling system of claim 12 wherein the record selection tool is further effective to:

determine that the subset of records is the reduction completion result by only using the initial user provided attribute; and

perform the providing in response to determining that the subset of records is the reduction completion result by only using the initial user provided attribute.

21. The information handling system of claim 12 wherein the record selection tool is further effective to:

determine that the reducing results in a non-compliant amount of records based upon a maximum record set limit, resulting in the reduction completion result being an over limit response; and

provide zero records to the user in response to the determining of the over limit response.

22. The information handling system of claim 12 wherein the record selection tool is further effective to:

determine that the reducing results in an amount of records that are less than an allowable threshold value, resulting in the reduction completion result being an under threshold set; and

provide the records included in the under threshold set to the user in response to the determining of the under threshold set.

23. A computer program product stored on a computer operable media, the computer operable media containing instructions for execution by a computer, which, when executed by the computer, cause the computer to implement a method for selecting records from a plurality of records, the method comprising:

receiving a request from a user that includes an initial user provided attribute;

identifying a subset of records from the plurality of records using the initial user provided attribute, the subset of records including more than one of the plurality of records and each of the subset of records including a first record attribute value that matches the initial user provided attribute;

in response to the identifying of the subset of records, sending a subset discriminating request to the user;

receiving a subsequent user provided attribute from the user in response to the sending of the subset discriminating request;

reducing, in response to receiving the subsequent user provided attribute, the subset of records to a reduction completion result, the reduction completion result including one or more records that each include a second record attribute value that matches the subsequent user provided attribute; and

providing the reduction completion result to the user.

24. The computer program product of claim 23 wherein the reduction completion result is only one record from the subset of records, the one record being an explicit matched record.

25. The computer program product of claim 23 wherein the reduction completion result is an irreducible record set that comprises a reduced subset of records, each of the reduced subset of records including record attribute values such that the reduced subset of records is not further reducible using additional subsequent user provided attributes.

26. The computer program product of claim 23 wherein the method further comprises:

concealing, from the user, each of the subset of records during the identifying, the sending, the receiving, and the reducing; and

concealing, from the user, each of the subset of records other than those in the reduction completion result during the providing.

27. The computer program product of claim 23 wherein the method further comprises:

computing conjoint probabilities among record attributes using their corresponding record attribute values; and

determining, based upon the computing of the conjoint probabilities, discrimination factors that have the highest calculated conjoint probabilities of appearing together in the subset of records.

28. The computer program product of claim 23 wherein the subsequent user provided attributes are selected from the group consisting of a demographic attribute, a non-demographic attribute, a biographical attribute, a descriptive attribute, a condition attribute, a state attribute, a transactional attribute, a geo-spatial attribute, and a temporal attribute.

29. The computer program product of claim 23 wherein the subset discriminating requests are based upon at least one discrimination factor that is selected from the group consisting of a probability factor, an expert rules factor, and a policy factor.

30. The computer program product of claim 23 wherein the reduction completion result is selected from the group consisting of an explicit matched record, an irreducible record set, an under threshold set, and an over limit response.

31. The computer program product of claim 23 wherein the method further comprises:

determining that the subset of records is the reduction completion result by only using the initial user provided attribute; and

performing the providing in response to determining that the subset of records is the reduction completion result by only using the initial user provided attribute.

32. The computer program product of claim 23 wherein the method further comprises:

determining that the reducing results in a non-compliant amount of records based upon a maximum record set limit, resulting in the reduction completion result being an over limit response; and

providing zero records to the user in response to the determining of the over limit response.

33. The computer program product of claim 23 wherein the method further comprises:

determining that the reducing results in an amount of records that are less than an allowable threshold value, resulting in the reduction completion result being an under threshold set; and

providing the records included in the under threshold set to the user in response to the determining of the under threshold set.