Patent Application Titled “Dynamic Anonymization Of Event Data” Published Online (USPTO 20220358249): Patent Application

2022 NOV 24 (NewsRx) -- By a News Reporter-Staff News Editor at Insurance Daily News -- According to news reporting originating from Washington, D.C., by NewsRx journalists, a patent application by the inventor Fleck, Matthew (Pleasant Hill, CA, US), filed on April 19, 2022, was made available online on November 10, 2022.

No assignee for this patent application has been made.

Reporters obtained the following quote from the background information supplied by the inventors: “A major problem with structured data storage is the ability to maintain confidentiality even if access to the data store is somehow compromised. This is most readily apparent for the storage of medical information, where the Health Insurance Portability and Accountability Act (HIPAA) provides for a very high degree of privacy even within a single institution.

“Unfortunately, this high degree of privacy prohibits the easy collation, sharing and transfer of information between people and organizations that could benefit from easy access to the information. For example, and without limitation, a physician treating a person suffering a traumatic injury would not have any way to easily access medical, dental and psychological data from various databases. Even if that data was technically accessible, the HIPAA requirement would bar any personal identifiable information (PII) from being disclosed.

“Similarly, large record sets of medical research data needs to be scrubbed of PII before it can be share thus severely limiting the ability to cross index datasets to look for correlations and cross correlations in the data and with person’s medical history and treatment.

“Different jurisdictions may define very strict rules for data to be considered “Anonymized.” If organizations are not able to fully adhere to these rules there is leeway to provide lesser capability which still delivers on the intent of the regulations. One such set of regulations from the French Data Protection Authority (“CNIL”) have three strict requirements for data to be considered anonymous. These rules prohibit:

“

“Singling out an individual in a dataset

“Linking two records within a dataset

“Inferring any information in such a dataset

“

“Strict interpretation of these rules makes certain reporting either impossible or useless. For example, and without limitation, in the computer gaming industry events such as mouse-clicks, and web pages interactions may not be properly tracked.

“One major concern of using anonymized data is the potential for that data to be re-identified using data in the anonymized data set and potentially data which is available external to the anonymized data. In these cases the risk of re-identification increases with the frequency of a consistent anonymous identifier.

“Presented herein are systems and methods for addressing these well-known deficiencies in data management of personal identifiable information.

“The construction and method of operation of the invention, however, together with additional objectives and advantages thereof will be best understood from the following description of specific embodiments when read in connection with the accompanying drawings.”

In addition to obtaining background information on this patent application, NewsRx editors also obtained the inventor’s summary information for this patent application: “A method for anonymizing an event data series including receiving, at a server, an event information, and identifying personal identifiable information (PII) in the event information. Determining if the event information is associated with a multi-event session and either creating a new session identifier with a new anonymous identifier or assigning an existing session identifier and existing anonymous identifier in response to said determining, said anonymous identifier associated with the PII and the session, and replacing at least a portion of the PII in the event information with the anonymous identifier, and transmitting the event information over a network. Some embodiments may include event which are mouse-clicks or web page visits. Rules for correlating events into sessions may include an allowable amount of time which may occur between the first event in a session and all other events within a session, an allowable amount of time after the start of one event and the start of the next event, or an allowable amount of time for a specific type of event.”

The claims supplied by the inventors are:

“1. A method for anonymizing an event data series including: receiving, at a server, event information; identifying a personal identifiable information (PII) in the event information, said PII including at least one of a name, address, email, or telephone number; determining if the event information is associated with a session by querying a rules data source, and either creating a new session identifier with a new anonymous identifier or assigning an existing session identifier and existing anonymous identifier in response to said determining, said anonymous identifier associated with the PII and the session; replacing at least a portion of the PII in the event information with the anonymous identifier, and transmitting the event information over a network.

“2. The methods of claim 1 wherein a session includes a series events associated with a single entity and a session identifier associates multiple events.

“3. The method of claim 1 wherein an event includes at least one of a mouse-click, or a web page interaction.

“4. The method of claim 1 wherein the rules includes at least on of an allowable amount of time which may occur between the first event in a session and all other events within a session, an allowable amount of time after the start of one event and the start of the next event, or an allowable amount of time for a specific type of event.

“5. The methods of claim 1 wherein a session a collection of records, collected at different times and potentially different places, all processed at the same time in a batch process.

“5. A method for anonymizing an event data series including: receiving, at a server, an event information; identifying a personal identifiable information (PII) in the event information; determining if the event information is associated with a session and either creating a new session identifier with a new anonymous identifier or assigning an existing session identifier and existing anonymous identifier in response to said determining, said anonymous identifier associated with the PII and the session replacing at least a portion of the PII in the event information with the anonymous identifier, and transmitting the event information over a network.

“6. The method of claim 5 wherein the PII includes at least one of a name, address, social security number, email address, IP address, device identifier, or phone number.

“7. The methods of claim 5 wherein a session includes a series events associated with a single entity and a session identifier associates multiple events.

“8. The method of claim 5 wherein an event includes at least one of a mouse-click, or a web page interaction.

“9. The method of claim 5 wherein said determining if the event information is associated with a session includes querying a rules data source.

“10. The method of claim 9 wherein the rules includes at least on of an allowable amount of time which may occur between the first event in a session and all other events within a session, an allowable amount of time after the start of one event and the start of the next event, or an allowable amount of time for a specific type of event.

“11. The method of claim 5 further including: receiving a session identifier from a remote user; querying a structured data store for records associated with the session identifier, and returning to the remote user the results of said querying, wherein the results of said querying includes multiple records of event associated with a session.

“12. One or more processor-readable memory devices encoded with non-transitory processor instruction directing a processor to perform a method including: receiving, at a server, an event information; identifying a personal identifiable information (PII) in the event information; determining if the event information is associated with a session and either creating a new session identifier with a new anonymous identifier or assigning an existing session identifier and existing anonymous identifier in response to said determining, said anonymous identifier associated with the PII and the session replacing at least a portion of the PII in the event information with the anonymous identifier, and transmitting the event information over a network.

“13. The devices of claim 12 wherein the PII includes at least one of a name, address, social security number, email address, IP address, device identifier, or phone number.

“14. The devices of claim 12 wherein 5 wherein a session includes a series events associated with a single entity and a session identifier associates multiple events.

“15. The devices of claim 12 wherein an event includes at least one of a mouse-click, or a web page interaction.

“16. The devices of claim 12 wherein said determining if the event information is associated with a session includes querying a rules data source.

“17. The devices of claim 12 wherein the rules includes at least on of an allowable amount of time which may occur between the first event in a session and all other events within a session, an allowable amount of time after the start of one event and the start of the next event, or an allowable amount of time for a specific type of event.”

For more information, see this patent application: Fleck, Matthew. Dynamic Anonymization Of Event Data. Filed April 19, 2022 and posted November 10, 2022.

(Our reports deliver fact-based news of research and discoveries from around the world.)