Systems and methods for deidentifying entries in a data source

• US 7,269,578 B2
• Filed: 04/10/2002
• Issued: 09/11/2007
• Est. Priority Date: 04/10/2001
• Status: Expired due to Fees

• Current Assignee: Sweeney Design Labs LLC
• Original Assignee: Sweeney Design Labs LLC
• Inventors: Sweeney, Latanya
• Primary Examiner(s): ELISCA, PIERRE E
• Application Number:
  US10/119,553
• Publication Number:
  US 20020169793A1
• Time in Patent Office: 1,980 Days
• Field of Search: 705/74, 705/64
• US Class Current: 705/74
• CPC Class Codes: G06F 16/245 Query processing
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/383 Anonymous user system
• CPC Class Codes: G16H 10/60 for patient-specific data, e.g. for electronic patient records

Abstract

Systems and methods for deidentifying, or anonymizing, entries in an input data source are presented. According to one embodiment, the system includes a deidentification module for modifying entries in a version of the input data source to yield an output data source such that the entries of the output data source match a specified anonymity requirement. According to one embodiment, the resulting output data source may match the specified anonymity requirement with respect to a recipient profile that is input to the system. The deidentification module may further modify the entries in the version of the input data source such that the entries in the output data source are minimally distorted given the specified anonymity requirement.

Claims

1. A system for deidentifying entries in an input data source having field-structured data organized in fields and entries, comprising:

a processor; and

a deidentification module comprising software code which when executed by the processor causes the procecessor to anonymize entries in a version of the input data source by generalizing at least one entry value of the version of the input data source to yield an output data source having field-structured data organized in fields and entries, wherein the generalization is such that a value of each entry within at least one field of the output data source occurs at least k times, and wherein a value of k is such that entries of the output data source match a specified anonymity requirement, and wherein the processor, when executing the software code of the deidentification module, anonymizes entries in the version of the input data source by at least one of suppressing or replacing entry values in the version of the input data source such that the entries of the output data source match the specified anonymity requirement.

2. The system of claim 1, wherein the deidentification module is further for causing the processor to:

receive a recipient profile; and

anonymize entries in the version of the input data such that entries of the output data source match the specified anonymity requirement with respect to the recipient profile.

3. The system of claim 2, wherein the recipient profile identifies a likelihood that entries in the output data source will be useful for linking with another data source.

4. The system of claim 1, wherein the deidentification module is for causing the processor to anonymize entries in the version of the input data source such that the entries in the output data source are minimally distorted.

5. The system of claim 1, wherein the version of the input data source includes a copy of the input data source.

6. A system for deidentifying entries in an input data source having field-structured data organized in fields and entries, comprising:

a processor; and

a deidentification module comprising software code which when executed by the processor causes the the processor to anonymize entries in a version of the input data source by generalizing at least one entry value of the version of the input data source to yield an output data source having field-structured data organized in fields and entries, wherein the generalization is such that a value of each entry within at least one field of the output data source occurs at least k times, and wherein a value of k is such that entries of the output data source match a specified anonymity requirement, wherein the processor, when executing the software code of the deidentification module, anonymizes entries in the version of the input data source by;

determining whether each field in the version of the input data source requires one of an equivalent class substitution or a generalization; and

replacing an entry value in a field of each entry with a replacement value determined according to a generalization hierarchy when a determination is made that the field requires a generalization.

7. The system of claim 6, wherein the deidentification module is further for causing the processor to replace an entry value in a field in each entry with a replacement value determined according to a strong one-way hashing algorithm when a determination is made that the field requires an equivalent class substitution.

8. The system of claim 6, wherein the deidentification module is further for causing the processor to replace an entry value in a field in each entry with a replacement value determined according to a generalization hierarchy when a determination is made that the field requires a generalization by iteratively computing increasingly less specific values for each field until the specified anonymity requirement is obtained.

9. The system of claim 8, wherein the deidentification module is further for causing the processor to iteratively compute increasingly less specific values for each field until the specified anonymity requirement is obtained by iteratively computing less specific values for each field until there exists a number of entries corresponding to the specified anonymity requirement having the same values across a group of fields.

10. A computer readable medium, having stored thereon instructions, which when executed by a processor, cause the processor to:

read a specified anonymity requirement;

anonymize entries in a version of an input data source, the input data source having field-structured data organized in fields and entries, by generalizing at least one entry value of the version of the input data source to yield an output data source having field-structured data organized in fields and entries, wherein the generalization is such that a value of each entry within at least one field of the output data source occurs at Least k times, and wherein a value of k is such that entries of the output data source match the specified anonymity requirement;

determine whether each field in the version of the input data source requires one of an equivalent class substitution or a generalization; and

replace an entry value in a field of each entry with a replacement value determined according to a generalization hierarchy when a determination is made that the field requires a generalization.

11. The computer readable medium of claim 10, having further stored thereon instructions, which when executed by the processor, cause the processor to:

read a specified recipient profile; and

anonymize entries in the version of the input data source to match the specified anonymity requirement with respect to the recipient profile.

12. The computer readable medium of claim 11, wherein the recipient profile identifies a likelihood that entries in the output data source will be useful for linking with another data source.

13. The computer readable medium of claim 10, having further stored thereon instructions, which when executed by the processor, cause the processor to:

replace an entry value in a field in each entry with a replacement value determined according to a strong one-way hashing algorithm when a determination is made that the field requires an equivalent class substitution.

14. The computer readable medium of claim 10, having further stored thereon instructions, which when executed by the processor, cause the processor to:

replace an entry value in a field in each entry with a replacement value determined according to a generalization hierarchy when a determination is made that the field requires a generalization by iteratively computing increasingly less specific values for each field until the specified anonymity requirement is obtained.

15. The computer readable medium of claim 14, having further stored thereon instructions, which when executed by the processor, cause the processor to:

iteratively compute increasingly less specific values for each field until the specified anonymity requirement is obtained by iteratively computing less specific values for each field until there exists a number of entries corresponding to the specified anonymity requirement having the same values across a group of fields.

16. The computer readable medium of claim 10, having further stored thereon instructions, which when executed by the processor, cause the processor to anonymize the entries in the version of the input data source such that the entries in the output data source are minimally distorted.

17. A method for deidentifying entries in an input data source having field-structured data organized in fields arid entries, comprising:

receiving a specified anonymity requirement; and

anonymizing entries in a version of the input data source by generalizing at least one entry value of the version of the input data source to yield an output data source, the output data source having field-structured data organized in fields and entries, wherein the generalization is such that a value of each entry within at least one field of the output data source occurs at least k times, and wherein a value of k is such that entries of the output data source match the specified anonymity requirement,

wherein anonymizing entries in the input data source includes;

determining whether each field in the version of the input data source requires one of an equivalent class substitution or a generalization; and

replacing an entry value in a field of each entry with a replacement value determined according to a generalization hierarchy when a determination is made that the field requires a generalization.

18. The method of claim 17, further comprising receiving a specified recipient profile, and wherein anonymizing entries includes anonymizing entries in the version of the input data source such that the entries of the output data source match the specified anonymity requirement with respect to the recipient profile.

19. The method of claim 18, wherein the recipient profile identifies a likelihood that entries in the output data source will be useful for linking with another data source.

20. The method of claim 17, wherein anonymizing entries in the version of the input data source further includes replacing an entry value in a field of each entry with a replacement value determined according to a strong one-way hashing algorithm when a determination is made that the field requires an equivalent class substitution.

21. The method of claim 17, wherein replacing an entry value in a field of each entry with a replacement value determined according to a generalization hierarchy when a determination is made that the field requires a generalization includes iteratively computing increasingly less specific values for each field until the specified anonymity requirement is obtained.

22. The method of claim 21, wherein iteratively computing increasingly less specific values for each field until the specified anonymity requirement is obtained includes iteratively computing less specific values for each field until there exists a number of entries corresponding to the specified anonymity requirement having the same values across a group of fields.

23. The method of claim 17, wherein anonymizing entries in the version of the input data source such that the entries of the output data source match the specified anonymity requirement with respect to the recipient profile includes anonymizing entries in the version of the input data source such that the entries in the output data source are minimally distorted.

24. A system for deidentifying entries in an input data source, having field-structured data organized in fields and entries, comprising:

means for anonymizing entries in a version of the input data source by generalizing at least one entry value of the version of the input data source to yield an output data source having field-structured data organized in fields and entries, wherein the generalization is such that a value of each entry within at least one field of the output data source occurs at least k times, and wherein a value of k is such that entries of the output data source match a specified anonymity requirement,

wherein the means for anonymizing entries in the input data source is further for;

determining whether each field in the version of the input data source requires one of an equivalent class substitution or a generalization; and

replacing an entry value in a field of each entry with a replacement value determined according to a generalization hierarchy when a determination is made that the field requires a generalization.

25. The system of claim 24, wherein the means for anonymizing further include means for anonymizing entries in the version of the input data source such that the entries of the output data source match the specified anonymity requirement with respect to a recipient profile.

26. The system of claim 25, wherein the recipient profile identifies a likelihood that entries in the output data source will be useful for linking with another data source.

27. The system of claim 24, wherein the means for anonymizing entries is further for replacing an entry value in a field of each entry with a replacement value determined according to a strong one-way hashing algorithm when a determination is made that the field requires an equivalent class substitution.

28. The system of claim 24, wherein the means for anonymizing is further for replacing an entry value in a field of each entry with a replacement value determined according to a generalization hierarchy when a determination is made that the field requires a generalization by iteratively computing increasingly less specific values for each field until the specified anonymity requirement is obtained.

29. The system of claim 28, wherein the means for anonymizing is further for iteratively computing increasingly less specific values for each field until the specified anonymity requirement is obtained by iteratively computing less specific values for each field until there exists a number of entries corresponding to the specified anonymity requirement having the same values across a group of fields.

30. The system of claim 24, wherein the means for anonymizing is further for anonymizing entries in the version of the input data source such that the entries in the output data source are minimally distorted.