EXCHANGE AND AGGREGATION

RELATED APPLICATION

[0001] The present application claims the benefit of the filing date of U.S. Pat. App. Ser. No. 15/078,804, filed March 23, 2016 and entitled "SYSTEMS AND METHODS TO PROTECT SENSITIVE INFORMATION IN DATA EXCHANGE AND AGGREGATION", the entire disclosure of which application is hereby incorporated herein by reference.

FIELD OF THE TECHNOLOGY

[0002] At least some embodiments disclosed herein relate to data storage and retrieval in general and more particularly but not limited to protection of identity information in data storage and retrieval.

BACKGROUND

[0003] Personally identifiable information (Pll) is data that could potentially identify a specific individual. Information that can be used to distinguish one person from another and can be used for de-anonymizing anonymous data may be considered Pll. Pll can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context. From Pll the identity of a corresponding person can be reasonably ascertainable.

[0004] Examples of Pll include full name, home address, email address, national identification number, passport number, driver's license number, telephone number, credit card numbers, digital identity, IP address, login name, screen name, nickname, date of birth, birthplace, genetic information, facial image, fingerprints, or handwriting.

[0005] There is a need to protect Pll for privacy, anonymity, and/or compliance with rules, laws and regulations.

[0006] U.S. Pat. No. 7,933,841 discloses a system to track member consumer credit card transactions without receiving personal information for non-members by using a one way hash function. In such a system, a one-way hash function is applied to personal information (e.g., a credit card number) to obtain fingerprints that represent the persona! information. The persona! information in transaction data of credit card users is replaced by the fingerprints, where some of the users are members and some of the users are non-members. A computer having the personal information of the members can used the personal information to generate the corresponding fingerprints to identify the transactions of the members without access to the persona! information of the non-members. The one way hash function makes it neariy impossible to reverse the fingerprints to the corresponding personal information that the computer does not already have.

BRIEF DESCRIPTION OF THE DRAWINGS

[0007] The embodiments are il!ustrated by way of example and not limitation in the figures of the accompanying drawings in which like references indicate similar elements.

[0008] Figure 1 shows a system to protect identification information in data exchange and aggregation according to one embodiment.

[0009] Figure 2 shows a method to generate de-personalized data according to one embodiment.

[0010] Figure 3 shows a method to tokenize identification information according to one embodiment.

[0011] Figure 4 shows a method to aggregate data according to identity according to one embodiment.

[0012] Figure 5 shows a data processing system that can be used to implement some of the components of the system according to one embodiment.

DETAILED DESCRIPTION

[0013] The following description and drawings are illustrative and are not to be construed as limiting. Numerous specific details are described to provide a thorough understanding. However, in certain instances, well known or conventional details are not described in order to avoid obscuring the description. References to one or an embodiment in the present disclosure are not necessarily references to the same embodiment; and, such references mean at feast one.

[0014] Figure 1 shows a system to protect identification information in data exchange and aggregation according to one embodiment. [0015] The system in Figure 1 includes a data bank (101), a data exchange (103), and a plurality of data sources (107, 109).

[0016] In Figure 1, the data sources (107, 109) are configured to store de-personalized data that uses a token (e.g., 111 or 113) to represent the identification information (e.g., 121 , or 123).

[0017] Examples of identification information (e.g., 121 , or 123) include personally identifiable information (Pll) and other sensitive information.

[0018] In Figure 1, the data sources (107, 109) do not store the identification information (e.g., 121 , or 123) that can be used to determine the identity of an entity (e.g., a person, an organization, a company). The data sources (107, 109) delegate the task of storing the identification information (e.g., 121 , or 123) to the centralized data bank (101), which assigns tokens (111, 113, 115) to represent pieces of identification information (121 , 123, 125) received from the data sources (107, 109).

[0019] For example, after obtaining the identification information A (121 ) that identifies a person/entity, the data source X (107) submits the identification information A (121) to the data bank (101). In response the data bank (101 ) assigns a token A (111) to represent the identification information A (121), stores data associating the token A (111 ) and the identification information A (121 ), and provides the token A (111 ) to the data source X (107) as a response to receiving the identification information A (121 ). Thus, the data source X (107) stores data items (e.g., 131) in association with the token A (111 ) to indicate the association between the data items (e.g., 131) and the identification information A (121).

[0020] In one embodiment, each piece of identification information (e.g., 121 , or 123) received from a separate request from a data source (e.g., 107, or 109) is assigned a separate token (111 , or 1 13). The same identification information submitted by different data sources (e.g., 107, 109) can be assigned different tokens. Further, the same identification information submitted by the data sources (e.g., 107, or 109) in different requests for tokens can be assigned different tokens. Thus, the same identification information can be represented in the same data source (107, or 109) and/or different data sources (107, 109) by different tokens (e.g., 111 , 113, 115).

[0021] In Figure 1, the data bank (101) stores the identification information (121 , 123, 125) but not the data items (e.g., 131 , 133) associated with the identification information (121 , 123, 125); and the data sources (107, 109) store the data items (e.g., 131 , 133) without the identification information (121 ,

123, 125). Thus, the risk of revealing information that can be linked to individual persons/entities is reduced, even when the security of one of the data storage component is compromised. Further, using different tokens to represent the same person/entity in different data sources and/or for different data items within a data source reduces the risk of data items being linked to identify the person/entity in unauthorized use of the data.

[0022] In one embodiment, the data bank (101 ) is a highly secured facility that prevents unauthorized access. Thus, the data security of the entire system in protecting the identification information (121 , 123, 125) is improved.

[0023] In Figure 1, the data exchange (103) is configured to provide data aggregation service to authorized data users (e.g., 105). The data exchange (103) is configured to link the date items (e.g., 131 , 133) associated with different tokens (e.g., 111 , 113) representing the same person/entity for the data user (105).

[0024] For example, the data exchange (141) transmits a token matching request (141) to the data bank (101). In response, the data bank (101 ) identifies, based on the identification information (121 , 123, 125) stored in the data bank (101 ), a set of tokens (e.g., 111 , 113) are assigned to represent the same person/entity and assigns a token (119) to represent the set of identified tokens (e.g., 111 , 113) of the same person/entity. The data exchange (103) than replaces, in the data records retrieved from the data sources (107, 109), the identified tokens (e.g., 111 , ..., 113) of the same person/entity with the token (119) provided in the matching response (143). In such a way the data exchange (103) generates, for the data user (105), a data bundle (145) that links the data items (131, 133) with the same token (119) representing the different tokens (1 11 , 113) used in the data sources (107, ..., 109) to represent the person/entity. Thus, the data items of the person/entity across the data sources (107, 109) are aggregated according to the identities of the persons/entities, without revealing the identification information (121 ,

123, 125) outside the data bank (101 ).

[0025] Different tokens (e.g., 1 19) can be used represent the same set of tokens (111, 123) of a person/entity in data bundles (e.g., 145) provided to different data users (e.g., 105) and/or to the same data user (105) for different data using projections for enhanced identity protection.

[0026] Figure 2 shows a method to generate de-personalized data according to one embodiment. For example, the method of Figure 2 can be implemented in a data source (107, or 109) illustrated in Figure 1.

[0027] In Figure 2, a computing device (e.g., 107, or 109) is configured to: collect (201) identification information (e.g., 121 or 123) of an entity (e.g., a person, an organization); submit (203) to a data bank (101) a request for a token (e.g., 1 11 or 113) representing the identification information (e.g., 121 , or 123) of the entity; store (205) data items (e.g., 131 or 133) related to the entity in association with the token (e.g., 111 or 1 13) without the identification information of the entity; receive (207) a data request; and provide (209) the data items (e.g., 131 or 133) in association with the token (e.g., 11 1 or 113) without the identification information (e.g., 121 or 123) of the entity.

[0028] For example, the same entity can be represented by different tokens (e.g., 111 , 113) in different data sources (e.g., 107, 119). Further, the same entity associated with different data items in a same data source can be represented by different tokens. Thus, privacy of the entities involved in the data items stored in the data sources (e.g., 107, 119) is improved.

[0029] In one embodiment, a data source (e.g., 107 or 109) does not store the identification information (e.g., 121 or 123) that is represented by the respective tokens (e.g., 111 or 113). Thus, the damage of a data breach in the data source (e.g., 107 or 109) is limited.

[0030] Figure 3 shows a method to tokenize identification information according to one embodiment. For example, the method of Figure 3 can be implemented in a data bank (101) illustrated in Figure 1.

[0031] In Figure 3, a computing device (e.g., 101) is configured to: receive (221 ) a request identifying identification information (e.g., 121 or 123) of an entity;

generate (223) a token (e.g., 111 or 113) uniquely representing the identification information (e.g., 121 or 123) received in the request; store (225) data associating the token (e.g., 111 or 113) and the identification information (e.g., 121 or 123); provide (227) the token (e.g., 111 or 113) as a response to the request such that association between data items (e.g., 131 or 133) and the entity identified by the identification information (e.g., 121 or 123) can be represented by association between the data items (e.g., 131 or 133) and the tokens (e.g., 111 or 113) without the need to store the identification information (e.g., 121 or 123) in data sources (e.g., 107 or 109); receive (229) a token matching request (141 ) from a data exchange (103); identify (231 ) a plurality of tokens (e.g., 1 11 1 13) associated with the entity based on the identification information (e.g., 121 , 123) stored in the computing device (e.g., 101 ); generate (233) a master token (e.g., 1 19) representing the plurality of tokens (e.g., 111 , 113); and provide (235) the master token (e.g., 119) as a response to the token matching request (141 ) to allow the recipient to link data items (e.g., 131 , 133) that are associated with the different tokens (e.g., 1 11 , 113) in the data sources (e.g., 107, 109) with the same master token (119) that represents the entity without revealing any of the

identification information (e.g., 121 , 123) of the entity.

[0032] The tokens (e.g., 121 , 123, 125) are generated in a way that cannot be reversed to reveal the identification information (e.g., 121 , 123, 125) represented by the respective tokens (e.g., 121 , 123, 125). For example, the tokens (e.g., 121 , 123, 125) can be selected from random numbers generated by the data bank (101 ). Alternatively or in combination, the tokens (e.g., 121 , 123, 125) can be selected further based on the identification information (e.g., 121 , 123, 125) and/or the requests for tokens. For example, the token (1 11 ) can be computed from a one-way hash of a combination of the identification information (121), a random number, an identification of the data source (107) that submits the identification information (121 ) to obtain the token (111 ), the date and/or time of the request for the token (11 1), and/or the date and/or time of the generation of the token (1 1), etc.

[0033] Figure 4 shows a method to aggregate data according to identity according to one embodiment. For example, the method of Figure 4 can be implemented in the data exchange (103) illustrated in Figure 1.

[0034] In Figure 4, a computing device (e.g., 103) is configured to: receive (241 ) a data request (e.g., from a data user (105) over a data communication network), receive (243) data records of entities from one or more data sources (e.g., 107, 109) without identification information of entities, where each data record has a token (e.g., 111 or 113) representing one of the entities; submit (245) a token matching request (141 ) to a data bank (101) that stores data associating tokens (e.g., 111 , 113, 115) and identification information (e.g., 121 , 123, 125); receive (247) a master token (119) representing a plurality of tokens (e.g., 111 , 113) associated with an entity; replace (249) in the data records the plurality of tokens (e.g., 1 11 , 113) with the master token (119) to generate modified data records (e.g., data bundle (145)); and provide (251 ) the modified data records in a response to the data request.

[0035] Figure 5 shows a data processing system that can be used to implement some of the components of the system according to one embodiment. While

Figure 5 illustrates various components of a computer system, it is not intended to limit the implementations to any particular architecture or manner of interconnecting the components. One embodiment may use other systems that have fewer or more components than those shown in Figure 5.

[0036] For example, the data exchange (103) illustrated in Figure 1 can be implemented using one or more data processing systems illustrated in Figure 5, with fewer or more components than those shown in Figure 5.

[0037] For example, a data source (e.g., 107 or 109) illustrated in Figure 1 can be implemented using one or more data processing systems illustrated in Figure 5, with fewer or more components than those shown in Figure 5.

[0038] For example, the data bank (101 ) illustrated in Figure 1 can be implemented using one or more data processing systems illustrated in Figure 5, with fewer or more components than those shown in Figure 5.

[0039] In Figure 5, the data processing system (170) includes an inter-connect

(171) (e.g., bus and system core logic), which interconnects a microprocessor(s)

(173) and memory (176). The microprocessor (173) is coupled to cache memory

(179) in the example of Figure 5.

[0040] In one embodiment, the inter-connect (171) interconnects the

microprocessor(s) (173) and the memory (176) together and also interconnects them to input/output (I/O) device(s) (175) via I/O controller(s) (177). I/O devices (175) may include a display device and/or peripheral devices, such as mice, keyboards, modems, network interfaces, printers, scanners, video cameras and other devices known in the art. In one embodiment, when the data processing system is a server system, some of the I/O devices (175), such as printers, scanners, mice, and/or keyboards, are optional.

[0041] In one embodiment, the inter-connect (171) includes one or more buses connected to one another through various bridges, controllers and/or adapters. In one embodiment the I/O controllers (177) include a USB (Universal Serial Bus) adapter for controlling USB peripherals, and/or an IEEE-1394 bus adapter for controlling IEEE-1394 peripherals.

[0042] In one embodiment, the memory (176) includes one or more of: ROM (Read Only Memory), volatile RAM (Random Access Memory), and non-volatile memory, such as hard drive, flash memory, etc.

[0043] Volatile RAM is typically implemented as dynamic RAM (DRAM) which requires power continually in order to refresh or maintain the data in the memory. Non-volatile memory is typically a magnetic hard drive, a magnetic optical drive, an optical drive (e.g., a DVD RAM), or other type of memory system which maintains data even after power is removed from the system. The non-volatile memory may also be a random access memory.

[0044] The non-volatile memory can be a local device coupled directly to the rest of the components in the data processing system. A non-volatile memory that is remote from the system, such as a network storage device coupled to the data processing system through a network interface such as a modem or Ethernet interface, can also be used.

[0045] In this description, some functions and operations are described as being performed by or caused by software code to simplify description. However, such expressions are also used to specify that the functions result from execution of the code/instructions by a processor, such as a microprocessor.

[0046] Alternatively, or in combination, the functions and operations as described here can be implemented using special purpose circuitry, with or without software instructions, such as using Application-Specific Integrated Circuit (ASIC) or

Field-Programmable Gate Array (FPGA). Embodiments can be implemented using hardwired circuitry without software instructions, or in combination with software instructions. Thus, the techniques are limited neither to any specific combination of hardware circuitry and software, nor to any particular source for the instructions executed by the data processing system.

[0047] While one embodiment can be implemented in fully functioning computers and computer systems, various embodiments are capable of being distributed as a computing product in a variety of forms and are capable of being applied regardless of the particular type of machine or computer-readable media used to actually effect the distribution.

[0048] At least some aspects disclosed can be embodied, at least in part, in software. That is, the techniques may be carried out in a computer system or other data processing system in response to its processor, such as a microprocessor, executing sequences of instructions contained in a memory, such as ROM, volatile RAM, non-volatile memory, cache or a remote storage device.

[0049] Routines executed to implement the embodiments may be implemented as part of an operating system or a specific application, component, program, object, module or sequence of instructions referred to as "computer programs." The computer programs typically include one or more instructions set at various times in various memory and storage devices in a computer, and that, when read and executed by one or more processors in a computer, cause the computer to perform operations necessary to execute elements involving the various aspects.

[0050] A machine readable medium can be used to store software and data which when executed by a data processing system causes the system to perform various methods. The executable software and data may be stored in various places including for example ROM, volatile RAM, non-volatile memory and/or cache. Portions of this software and/or data may be stored in any one of these storage devices. Further, the data and instructions can be obtained from centralized servers or peer to peer networks. Different portions of the data and instructions can be obtained from different centralized servers and/or peer to peer networks at different times and in different communication sessions or in a same communication session. The data and instructions can be obtained in entirety prior to the execution of the applications. Alternatively, portions of the data and instructions can be obtained dynamically, just in time, when needed for execution. Thus, it is not required that the data and instructions be on a machine readable medium in entirety at a particular instance of time.

[0051] Examples of computer-readable media include but are not limited to recordable and non-recordable type media such as volatile and non-volatile memory devices, read only memory (ROM), random access memory (RAM), flash memory devices, floppy and other removable disks, magnetic disk storage media, optical storage media (e.g., Compact Disk Read-Only Memory (CD ROMS), Digital Versatile Disks (DVDs), etc.), among others. The computer-readable media may store the instructions.

[0052] The instructions may also be embodied in digital and analog

communication links for electrical, optical, acoustical or other forms of propagated signals, such as carrier waves, infrared signals, digital signals, etc. However, propagated signals, such as carrier waves, infrared signals, digital signals, etc. are not tangible machine readable medium and are not configured to store instructions.

[0053] In general, a machine readable medium includes any mechanism that provides (i.e., stores and/or transmits) information in a form accessible by a machine (e.g., a computer, network device, personal digital assistant, manufacturing tool, any device with a set of one or more processors, etc.).

[0054] In various embodiments, hardwired circuitry may be used in combination with software instructions to implement the techniques. Thus, the techniques are neither limited to any specific combination of hardware circuitry and software nor to any particular source for the instructions executed by the data processing system.

[0055] The description and drawings are illustrative and are not to be construed as limiting. The present disclosure is illustrative of inventive features to enable a person skilled in the art to make and use the techniques. Various features, as described herein, should be used in compliance with all current and future rules, laws and regulations related to privacy, security, permission, consent, authorization, and others. Numerous specific details are described to provide a thorough understanding. However, in certain instances, well known or conventional details are not described in order to avoid obscuring the description. References to one or an embodiment in the present disclosure are not necessarily references to the same embodiment; and, such references mean at least one.

[0056] The use of headings herein is merely provided for ease of reference, and shall not be interpreted in any way to limit this disclosure or the following claims.

[0057] Reference to "one embodiment" or "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the disclosure. The appearances of the phrase "in one embodiment" in various places in the specification are not necessarily all referring to the same embodiment, and are not necessarily all referring to separate or alternative embodiments mutually exclusive of other embodiments. Moreover, various features are described which may be exhibited by one embodiment and not by others. Similarly, various requirements are described which may be requirements for one embodiment but not other embodiments.

Unless excluded by explicit description and/or apparent incompatibility, any combination of various features described in this description is also included here. For example, the features described above in connection with "in one embodiment" or "in some embodiments" can be ail optionally included in one implementation, except where the dependency of certain features on other features, as apparent from the description, may Iimit the options of excluding selected features from the implementation, and incompatibility of certain features with other features, as apparent from the description, may Iimit the options of including selected features together in the implementation.

[0058] The disclosures of the above discussed patent documents are hereby incorporated herein by reference.

[0059] In the foregoing specification, the disclosure has been described with reference to specific exemplary embodiments thereof. It will be evident that various modifications may be made thereto without departing from the broader spirit and scope as set forth in the following claims. The specification and drawings are, accordingly, to be regarded in an illustrative sense rather than a restrictive sense.