JP3270483B2 - System and method for protecting sensitive information in a database and enabling targeted advertising in a communication network - Google Patents

Description

Description: FIELD OF THE INVENTION The present invention relates to systems and methods for maintaining the confidentiality of certain information in databases. According to embodiments of the present invention, the database illustratively includes demographic information about the customers of the communication network. In accordance with the present systems and methods, advertisers are able to target specific customers whose advertiser surveys match advertiser-specified profiles and advertise over communication networks. Specifically, the present methods and systems ensure that advertisers cannot infer customer private (non-public) information beyond a controllable level of uncertainty, so that To process a background check database so that certain confidential information belonging to.

BACKGROUND OF THE INVENTION The present invention relates to the distribution of information in any kind of information infrastructure. The invention is described herein using a communication network type information infrastructure capable of delivering video programming.

In a typical network, such as a conventional cable television network, where advertisements and other video programming are distributed, advertisements are distributed indiscriminately to a large number of customers. This is inconvenient for the customer because some of the customers are targeted for advertisements that are not of interest to them. This is inconvenient for the advertiser because the advertiser must pay for delivering the ad to a large audience, including those who want to reach the ad and those who are not interested in the ad. It is.

In a preferred advertising strategy, the advertiser targets a selected group of customers who are likely to be interested in the advertisement and distributes the advertisement only to the selected group of customers.
Until recently, these targeted ads (targeted adv
ertisement) was not possible with broadcast communications because the communications network where the ads were delivered could not deliver the ads to only certain customers. However, recent advances in communication networks have enabled selective delivery of broadcasted advertisements. FIG. 1 shows an improved conventional communication network of this kind.
Here are 10 examples. In this example, communication network 10 includes various networks, for example, a telephone network, a computer network, and a local area network (LAN).
k), wide area network (WAN), and cable television network. As shown, network 10 interconnects sources 21 and 22, such as advertisers, to destinations 31, 32, 33, and 34, such as customers. The communication network 10 transmits video, audio, and other data to a source (eg, source 2).
From 1), the transport can be performed only to the identification destinations (for example, 31 and 33) among the destinations 31 to 34. For example, video, audio,
Data can be transmitted as a bitstream organized into packets. Each packet represents a destination 31, 32, 33 and / or 34,
At least one ID that is unique throughout the network 10
(Eg, the ID of the destinations 31 and 33). These IDs are called network IDs. The packet is sent to the communication network 10 as specified by the network address contained in its header.
Route to these destinations 31 and 33 only.

To implement a targeted advertising strategy, the advertiser must be able to determine the customers targeted by the advertisement. In one advantageous way, the background survey data about the customer is organized in a database. A database is defined as consisting of a collection of data items, organized according to a data model, and accessed by a query. Here, the present invention has been described using a relational database model. A relational database or relation can be organized as a two-dimensional table that contains rows and columns of information. Each column of the relation corresponds to a particular attribute and has a domain that contains the data value of that attribute. Each row of the relation contains one value from each attribute and is called a record or tuple.

FIG. 2 shows an example of a relational database (conventional) Y. The relation Y in FIG. 2 contains data on a certain population. Relation Y has six attributes or columns 2-1, 2-2, 2-3, 2-4, 2-5, 2-
6, each of which stores data values of the population, such as name, age, weight, height, social security number, and extension telephone number. This database contains 12 records or tuples 3-1, 3-2, 3-3,.
There are also twelve. Each tuple 3-1, 3-2, 3-3,.
12 has one data value from each attribute. For example, tuple 3-10 has a name attribute value “lee”, an age attribute value 40, a weight attribute value 171, a height attribute value 180, a social security number attribute value 999-98-7654, and an extension telephone attribute value 0123. Having.

To identify the target customers for your ads,
The profile containing the query is executed against the database. The query is used to identify tuples from the database that match the criteria of interest. Queries typically include predicates that specify criteria of interest. For example, the following query executed on relation Y: Select from A where Y.Age <15 OR Y.Age> 50 specifies the predicate of "where Y.Age <15 OR Y.Age>50". Contain, which specifies that only tuples with an age attribute value less than 15 or greater than 50 are identified. Thus, the advertiser can create a profile that is run against the relational database to identify the target customer audience.

A problem that arises when implementing such a targeted advertising scheme is that customers are hesitant to disclose the background survey data necessary to build a relational database. Specifically, the customer must: (1) directly emit raw information about the individual customer; (2) infer non-released information of the individual customer from information about the identity of the customer that matches a certain profile; (3) We are concerned about inferring the unreleased information of a particular personal customer from our knowledge of a set of profiles, along with the number of personal customers that will or will receive ads corresponding to the set of profiles.

The first two potential privacy concerns are Hardt
−Kornacki & Yacobi, Securing End−User Privacy Du
ring Information Filtering PROC.OF THE CONF.ON HIG
This can be overcome by improving the communications network in the same way as is done in H PERF.INFO.FILTERING, 1991, to protect the anonymity of customers searching for videos. Such an improved network is shown in FIG. As shown, this communication network 50 is similar to the network 10 of FIG.
62 and destinations (customers) 71, 72, 73, 74 are interconnected. However, it also has a filter station 80 and a name translator station 90, which are connected to the communication network 50. By way of illustration, the filter station 80 has a memory 82 which holds a database of customer survey data. further,
The filter station 80 has a processor 84 that can execute a query against a personal survey database stored in a memory 82. Each source is a source
Like 62, it has a server 64 and a memory 66. Source
62 server 64 sends one or more profiles (including queries identifying the identified target audience) to processor 64 of filter station 80. Processor 84
Performs each profile query against the relational database stored in memory 82 and assigns the alias (al) assigned to each customer identified in each query.
ias). Processor 84 then sends the corresponding alias for each profile back to server 64 at source 62, which may store it in memory 66 for future use.

When advertiser source 62 wants to send an advertisement to a target customer destination, for example, destinations 72 and 74, server 64 sends the advertisement and alias to network 50. The network 50 sends the advertisement and the alias to the processor 92 of the name translator station 90. Next, processor 92 converts the alias to a corresponding network address, using, for example, information stored in memory 94. Next, the processor of the name translator station 90
92 sends the advertisement to customer destinations 72, 74 using the network address.

In this improved communication system, the customer destination, e.g., destination 72, knows its own background survey information. The advertiser source, eg, source 62, knows the advertisement, its profile, and how many customers will receive the advertisement. Advertisers receive only aliases for individual customers 71-74. Thus, the advertiser does not own the background survey information and is not given information identifying the customer (such as a network address). Filter station 80
Contains information about the background survey database and receives the profile passed by the advertiser. The name translator station 90 receives only aliases and advertisements, including only translations of the aliases to network addresses. Network 50 receives only the destination advertisement and network address.

Despite such protection, advertisers still obtain some of the results of querying the profile against the background database, such as the number of customers matching each profile. This alone is enough to infer the customer's personal information. For example, suppose the advertiser is on ZIP code 07090 and knows the IDs of the 100 customers collecting stamps. In addition, the advertiser is on ZIP code 07090, collects stamps, and earns $ 5
Suppose you pass a profile that targets all customers, which is 0,000- $ 100,000. If 100 aliases were returned to the advertiser, the advertiser would successfully infer the salary range of all 100 stamp collectors.

The above threats are known as "tracker attacks" because the query results can lead to inference of private information.
attack) ". More generally,
A “tracker” is a special case of a linear system that solves the following equation:

HX = Q (1) where H is a matrix representing tuples satisfying the corresponding query, where each column j represents a different tuple, each row i represents a different query,
Each matrix element has h _j = 1 when the j-th tuple satisfies the predicate C of the i-th query,
Otherwise, it is 0. C is a vector representing a predicate used in each i-th query, X is a vector representing a tuple (unknown) that satisfies the predicate C (the solution of which is obtained by equation (1)), and Q Is a vector of counts or other results returned from each i-th query and containing element q _i , where q _i is the sum of the attributes of the tuples retrieved in the i-th query (or the i-th query Other results returned from).

In the prior art, several solutions have been proposed to protect statistical relational databases from tracker attacks. Dobkin Jones & Lipton, Secure Database Pro
tection Against User Inference, ACM TRANS, On DATABA
SE SYS., Vol. 4, no 1, Mar., 1979, p. 97-106, restricts the overlap of query sets, that is, prohibits the passing of multiple similar query sets. It is proposed to prevent. However, this type of control is difficult to implement because it must keep a record of all previously passed query sets and compare them against recently passed queries. A "cell-suppression" approach has also been proposed. This approach ensures that statistics or other query execution results that could reveal sensitive information are never released. However, the cell suppression method is 2
Queries that create dimensional and three-dimensional tables are best used, but not any queries that are of interest in implementing targeted advertising.

A random noise technique has been proposed, in which a random number is subtracted from the results returned from the query. This solution is insufficient to achieve targeted advertising because the results provided to advertisers are inherently inaccurate. Warner, Randomi
zed Response: A Survey Technique for Eliminating Ev
asive Answer Bias, 60 J.OF THE AM.STAT.ASSOC.p.63−
69 (1965)), the individual may enter an incorrect value into the relational database at some percentage of the time. The problem with this approach is that the advertiser targets the ad to an incorrect audience at some percentage of the time. Denn
ing, Secure Statistical Database Under Random Sampl
e Queries, ACM TRANS.ON DATABASE SYS.vol.5, no.3, Sep
t., 1980, pp. 291-315, disclose a noise approach, where the query is applied to only a random subset of the tuples, rather than all of the tuples in the relational database. In addition to the individual drawbacks described above, one or more of the above-described noise adding techniques may yield their status to various noise removal techniques.

Yu & Chin, A Study on the Protection of Statisti
cal Database, PROC.ACM SIGMOD INT'L CONF.ON THE MGM
T.OF DATA, p.169-181 (1977) and Chin & Ozsoyoglu,
Security in Partitioned Dynamic Statistical Databa
se, PROC. IEEE COMPSAC CONF., p. 594-601 (1979))
Discloses a technique for partitioning a relational database into disjoint partitions.

None of the above techniques were developed primarily for statistical relational databases and have no characteristics that enable the realization of targeted advertising. In particular,
With the above approach, neither the tuples that satisfy the query are accurately identified, nor the exact count of such tuples retrieved (or other returned query results). However, both of these characteristics are important in targeted advertising. First, it is important to accurately target all customers whose background survey data matches the passed profile. Second, importantly, for the purpose of billing advertisers,
To obtain an accurate count of the identified customers for the purpose of determining whether the profile has identified the desired number of customers receiving the advertisement.

Therefore, an object of the present invention is to eliminate the problems of the prior art. It is another object of the present invention to provide a targeted advertising method that maintains the privacy of customer confidential information. Specifically, it is an object of the present invention to reduce the advertiser's ability to infer confidential information about a customer from the results of one or more profile queries performed against a background survey relational database.

SUMMARY OF THE INVENTION The above and other objects are achieved by the present invention. According to an embodiment of the present invention, it is possible to keep information in a database confidential used in a communication system environment. As in conventional communication systems, in this embodiment, the advertiser, the customer, the filter station, and the name translator station are interconnected by a communication network. For explanation,
The filter station maintains a background survey database of information about customers. However, the invention works well with databases that store any type of information, and works well with both relational and non-relational databases. To obtain a targeted audience for advertising, an advertiser can pass one or more profiles containing queries to a filter station. The filter station provides a profile
Perform a query to identify tuples corresponding to customers that match the profile of the target audience. To keep the customer anonymous, the filter station sends the customer's alias to the advertiser instead of the customer's identity identified in the profile. When an advertiser wants to deliver an advertisement to a target customer audience, the advertiser sends the advertisement and the alias to the name translator station over the communication network. next,
The name translator station uses the translation table to translate the received alias into the customer's network
Translates the address and sends the advertisement to the customer over the communication network.

As with conventional communication networks, communication networks according to embodiments of the present invention limit advertisers from accessing the background survey relational database and provide the advertiser with the customer's actual network address, Has published an alias. This prevents (1) raw information in the database from being published to advertisers, and (2) inferring confidential information from customer IDs. However, unlike conventional communication systems, the present invention also reduces the advertiser's ability to infer confidential information from results returned from the filter station in response to a profile query passed by the advertiser. . That is, the present invention protects against tracker attacks and other types of security leaks. This means that an advertiser can use sensitive information about customers in the database,
Protects against attempts to infer only from the number of aliases returned in response to a profile query.

To achieve this protection in the present invention, attributes are of two classes: public (non-secure).
ic) Attributes and confidential private (privat)
e) It is divided into attributes. To prevent advertisers from inferring private attribute values, the database is then processed to reduce the high correlation between public and private attribute values. A vector of one or more identifying public attribute values is said to have a high correlation with a private attribute value if:

(1) The identification public attribute value vector identifies a group of database tuples having a public attribute value that matches the public attribute value vector.

(2) The uncertainty level regarding the value of the private attribute of the identified group is less than a predetermined threshold level.

Stated another way, a particular vector of tuple public attribute values may match a small number of private attribute values, reducing the uncertainty about private attribute values when the public attribute values are known. Become. In the worst case, a vector of public attribute values will match only one private attribute value.
Therefore, the certainty level when judging the actual private attribute value of the tuple group identified by the identification vector of the public attribute becomes higher. For the sake of explanation, if the number of discretely different private attribute values of the group identified by such a vector is less than the predetermined threshold value, the correlation of the public attribute becomes abnormally high. In the following, a public attribute value having an abnormally high correlation with one or more private attribute values is referred to as a “highly corelative public attribute value”.
e) ".

According to one embodiment of the present invention, a tuple including a public attribute value that is highly correlated with a private attribute value camouflages the public attribute of the tuple,
Alternatively, such a tuple is processed to be removed from the ID in the database. A tuple has a high correlation with one or more specific private attribute values of the tuple,
It is “camouflaged” by combining a particular public attribute value of the tuple with other public attribute values of the tuple to reduce their correlation.

Thus, in the method and system according to the present invention, attributes are classified as private or public, and the correlation between public and private attributes is reduced by camouflaging highly correlated public attribute values. According to the present invention, an adjustable level of uncertainty is introduced when inferring private information from the results of a query performed on a background research relational database.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a diagram showing a conventional example of a normal communication network.

FIG. 2 is a diagram showing a conventional example of a relational database for personal examination.

FIG. 3 is a diagram showing a conventional communication network having a privacy protection function of a customer network address.

FIG. 4 is a diagram showing a communication network according to an embodiment of the present invention, which has a function of anonymously protecting private customer information.

FIG. 5 is a flowchart illustrating a method according to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE INVENTION The present invention is directed to protecting the confidentiality of virtually any kind of data, as described above, whether in relational or non-relational databases or in various environments, including communication networks. Can be. Hereinafter, for the sake of simplicity, the present invention will be described using a communication network environment and a relational database including personal examination information. In the embodiments described below, the advertiser queries whether to run a relational background survey database for the purpose of identifying the target audience for advertising,
This is an illustrative example. The invention is applicable to other applications where queries are made to achieve other goals.

FIG. 4 shows an example of the communication network 100 of the present invention. As shown in FIG. 4, advertisers 121, 122 and customers 131, 132, 13
There are 3, 134 and a name translator station 140, each connected to the communication network 100. Furthermore, there is a filter station 150 adapted according to the invention. Filter station 150
, The processor 155 and the memory 160 are connected.

Like processor 84 and memory 82 (FIG. 3) of conventional filter station 80 (FIG. 3), processor 155 and memory 160 also perform various functions to prevent raw data from being disclosed to advertisers 121-122. . Processor 155 and memory 160 also provide functionality to prevent advertisers 121-122 from inferring private information from the customer's ID (from the customer's network address). Processor 155 can receive the background survey information from customers 131-134 and can build a background survey relational database. Processor 155 may store a background check relational database in memory 160. Processor 155 may also receive a profile from advertisers 121-122, eg, advertiser 122, that includes a query as to whether to execute against a relational database. Upon receiving that profile, processor 15
5 identifies the relational database tuple that matches the profile. And processor 15
5 sends the ID and alias to the advertiser 122.

Processor 155 and memory of filter station 150
160 also plays a role in processing the background research relational database to reduce the advertiser's ability to infer private information from the results returned by the filter station in response to the advertiser's profile query. The following description is a general description that can be applied to any result returned in response to a profile query, but advertisers use the number of aliases returned to infer private information Shall be.

The processing of the processor 155 and the memory 160, in essence, can partition the database into public attributes that do not need to be secured and private attributes that are given security. When providing security, some information in the background research relational database may already be deemed public or otherwise deemed to have no security value. Please be careful. For example, a frequent flyer database (freque flyer database) that contains attributes such as ZIP codes, phone numbers, occupations, dietary restrictions, and income levels.
nt flyer database). Individual customer phone numbers can be widely publicized in a telephone directory.
In addition, the profession of each customer is not widely publicized, but is not confidential or non-private (non-p
ersonal). On the other hand, information such as dietary restrictions and income levels are private and can be assumed to be confidential. After partitioning the database,
The correlation between public and private attributes is
Some public attribute values with high correlation are camouflaged, and camouflage is diluted by immediately removing tuples that are difficult and contain high correlation public attribute values.

Processor 155 may also partition ID attributes from the database that uniquely identify each tuple. like this
If ID, network address, social security number,
And so on. Such information can be used in profile queries only if the profile query is not performed on private attributes or if the profile query is only used to update the corresponding tuple in the database. Is the case.

For the purpose of explanation, public attributes are further divided into important public attributes and non-important public attributes. Advertisers are allowed to specify attribute values of important public attributes that are more certain than non-important public attributes.
By way of illustration, an advertiser can specify which attributes are treated as important. The present invention described below is an example of classifying into important public attributes and non-important public attributes.

In the following description, vector A represents the public attributes of a set or group of the specified tuple, each component <A ₁ ,...,A _n vector A> represents the individual public attribute vector. Vector A 'represents an important public attributes of a set or group of the specified tuple, A' each component <A ₁ ,...,A _m of> represents a separate important public attribute vector. The vector A "represents the non-significant public attributes of the specified set or group of tuples, where each component of A"<A" ₁ , ...,
A " _t > represents an individual non-significant public attribute vector. Vector P represents the private attribute of the specified set or group of tuples, and the component <
P ₁ , ..., P _q > represent individual private attribute vectors. The vector K represents a vector of the uncertainty threshold of the private attribute P. By way of illustration, each scalar component k _i of K is a threshold count of discrete different private attribute values of P _i . Each uncertainty threshold k _i can be fixed and the processor adjusts the level of security.
155 can also be adjusted dynamically. The vectors V, V ', V ", V, U are the scalar attribute values <that are unique to a single tuple's public attribute A, A' or A".
v ₁ , .., Vn>, <v ′ ₁ , .., v ′ _n , .. v ′ _m >, etc. Here, A ′ ₁ = v ₁ ,..., A ′ _n = v _n
The public attribute values, e.g., A _'1 is the corresponding discrete scalar attribute values, for example, a tuple taking v ₁ (i.e., a row in a relational database) refers to.

FIG. 5 is a flowchart illustrating a process performed by processor 155 and memory 160 to protect the confidentiality of the background information from inference by advertisers 121-122. In a first step 202, the processor 155 converts the attributes of the database to public attributes including non-confidential information.
A ₁ , .., A _n and private attributes P ₁ , .., P _q including confidential information
Classify into. For example, the attributes are age, height, religious beliefs, and salary. Perhaps the age and height attributes could be designated as public attributes, and the religious beliefs and salary attributes could be designated as private attributes.

Next, at steps 204-226, the processor 155 removes the high correlation between the public and private attributes of the tuple in the database. Stated another way, a specific vector of the unique attribute value V, for example, A ₁ =
Consider v ₁ , A ₂ = v ₂ , ..., A _n = v _n . This vector V
Is public attributes A ₁ that matches V, .., identifying the groups of tuples having a value for A _n. The group of tuples identified by vector V contains the i of this group
The database is processed to ensure that there is a threshold level of uncertainty level k _i near the value of the th private attribute P _i . Here, consider a database having only the public attribute of age and occupation and only the private attribute of the salary range. This database contains age and occupation vectors (eg, <age: 35, o
ccupation: doctor>), which has relatively few different values for salary (eg, salary: top 5%). In this database process, certain attribute values are combined to "camouflage" tuples having private attribute values that may be easily inferred. Other tuples that cannot be camouflaged are removed.

(More on that, the "removed" tuple is
Treated as one of many methods. For example, removed tuples can be excluded from performing the query so that they do not receive targeted ads. Alternatively, "removed" tuples are not excluded from either query execution or targeted advertising. However, processor 155 must take action to ensure that the confidentiality of the private attribute values of such removed tuples is not compromised by query execution. At steps 204-210, the processor 155 partitions the database into "safe" set F tuples and "unsafe" set R tuples. At step 204, the processor creates each possible vector of important public attribute values V '. Important public attribute value V 'each important public attributes _{A' 1, ..., A '} j, .., A' 1 single attribute value for _{m v 1, .. v j,} .., a v _m Including. For example, the vector <age =
53, occupation = doctor>;<age = 35, occupation = doc>
tor>;<age = 35, occupation = minister>;
It is a separate vector that can be created on a database using important public attributes (age, weight, and occupation) and private attributes (salary). A group of tuples respectively correspond to these vectors V '. That is, each tuple in a particular group contains the same important attribute values as the vector V 'to which the group corresponds. For example, the vector <age = 35, occupation = minister> is the following tuple: age = 35, occupation = minister, salary = 70% age = 35, occupation = minister, salary = 70% age = 35, occupation = minister, salary = 65% age = 35, occupation = minister, salary = 35% age = 35, occupation = minister, salary = 40% age = 35, occupation = minister, salary = 40% age = 35, occupation = minister, salary = 15% can be identified.

In step 206, with respect to each such group made in the processor 155 compares the number of distinct attribute values of each i-th private attribute P _i of the group, to the corresponding non-certainty threshold . Each ith private attribute
For P _i , if the group has at least k _i discrete private attribute values, processor 155
Adds the group of tuples to set F in step 208. Otherwise, the processor 155 adds the group of tuples to the set R at step 210.
For example, the age, occupation, the salary of example, and k _i is set to 4. In such a case, there are five discrete values for the salary that are private attributes: 70%, 65%, 40%, 35% and 15%. On the other hand, for the vector <age = 35 occupation = doctor>, another group of tuples is identified as follows:

age = 35, occupation = doctor, salary = 5% age = 35, occupation = doctor, salary = 5% age = 35, occupation = doctor, salary = 10% age = 35, occupation = doctor, salary = 10% age = 35, occupation = doctor, salary = 5% age = 35, occupation = doctor, salary = 10% age = 35, occupation = doctor, salary = 5% age = 35, occupation = doctor, salary = 15% age = 35, occupation = doctor, salary = 5% age = 35, occupation = doctor, salary = 5% age = 35, occupation = doctor, salary = 15% This group has three discrete salary attribute values, namely 5
With only 10%, 10%, and 15%. Accordingly, processor 155 will add these tuples to set R.

Next, in steps 212-222, the processor 155 combines the selected important public attribute values. Steps
At 212, processor 155 selects an important public attribute _A'j . For the sake of explanation, the processor 155 selects the discrete attribute values of the entire database in descending order for each j value.
Then, the processor 155 uses the key public attributes A _'j selected, executes Step 214-226. In step 214, the processor 155 identifies the _j 'each discrete value v of _j' important public attributes A selected in the set R. At step 216, the processor 155 sets the sets R and F
And the important public attribute A '
_j identify each tuple with each important public attribute value v ′ _j (identified in set R). For example,
Assume that age is selected as attribute _A'j . Then ag
e = 35 is a public attribute value in set R <age = 35 occ
publication attribute value included in the tuple having “upation = doctor>”. age = 35 is also a public attribute value included in the tuple having the public attribute value <age = 35 occupation = ministor> in the set F. Thus, the next tuple in sets R and F is identified.

age = 35, occupation = minister, salary = 70% age = 35, occupation = minister, salary = 70% age = 35, occupation = minister, salary = 65% age = 35, occupation = minister, salary = 35% age = 35, occupation = minister, salary = 40% age = 35, occupation = minister, salary = 40% age = 35, occupation = minister, salary = 15% age = 35, occupation = doctor, salary = 5% age = 35, occupation = doctor, salary = 5% age = 35, occupation = doctor, salary = 10% age = 35, occupation = doctor, salary = 10% age = 35, occupation = doctor, salary = 5% age = 35, occupation = doctor, salary = 10% age = 35, occupation = doctor, salary = 5% age = 35, occupation = doctor, salary = 15% age = 35, occupation = doctor, salary = 5% age = 35, occupation = doctor, salary = 5% age = 35, occupation = doctor, salary = 15% Next, at step 218, the processor identifies each discrete vector V "in the identified tuples of sets F and R. , The vector V ″ is A Important public attribute values v ″ ₁ , .. v ″ _{j + 1 ,.} Related to the important public attributes A ′ ₁ , .., A ′ _jt , A _{j + 1} , .., A ′ _m excluding ' _j . ., v " _m . The group of tuples identified in sets R and F is
Each tuple in a particular group has an attribute value of a particular attribute value vector V "corresponding to that group. Such tuples are identified by the processor 155 at step 218.

For example, assume that the public attribute is age, weight, and height, and the private attribute is salary. Value v ′ _j =
35 and v ′ _j = 53 identify the following tuple:

age = 35, weight = 150, height = 6 ′, salary = 5% age = 53, weight = 150, height = 6 ′, salary = 10% age = 35, weight = 160, height = 6 ′, salary = 10 % Age = 53, weight = 160, height = 5.5 ', salary = 15% age = 35, weight = 150, height = 5.5', salary = 5% age = 53, weight = 150, height = 5.5 ', salary = 10% age = 35, weight = 150, height = 5.5 ', salary = 15% age = 53, weight = 160, height = 6', salary = 20% Vector V "is <weight = 150, height = 6 '> , <We
ight = 160, height = 6 '>, <weight = 150, height = 5.
5 ′>, <weight = 160, height = 5.5 ′>. The identified groups are as follows:

weight = 150, height = 6 ′ age = 35, weight = 150, height = 6 ′, salary = 5% age = 53, weight = 150, height = 6 ′, salary = 10% weight = 160, height = 6 ′ age = 35, weight = 160, height = 6 ', salary = 10% age = 53, weight = 150, height = 6', salary = 20% weight = 160, heiaht = 5.5 'age = 53, weight = 160, height = 5.5 ', salary = 15% weight = 150, height = 5.5' age = 35, weight = 150, height = 5.5 ', salary = 5% age = 53, weight = 150, height = 5.5', salary = 10 % Age = 35, weight = 150, height = 5.5 ', salary = 15% Next, in step 220, for each i-th private attribute P _i , k _i discrete private attribute values are included in the group. in some cases, the processor 155 combines all values in the group of important public attributes a _'j. For the sake of explanation, it is assumed that each value v ′ _i can be combined only once. For example, assume that the salary is k = 3. Then
The group corresponding to the vector V ″ = <weight = 150, height = 5.5 ′> satisfies the uncertainty threshold, so the following tuple: age = {35,53}, weight = 150, height = 5.5 ', salary = 5% age = {35,53}, weight = 150, height = 5.5', salary = 10% age = {35,53}, weight = 150, height = 5.5 ', salary = 15 The age attribute values are combined to make%.

At step 222, processor 155 replaces each combination with a representative public attribute value. This example will be described continuously. If this representative value is the first selected public attribute value vv ′ _i , that is, if age = 35, the following tuple is obtained.

age = 35, weight = 150, height = 5.5 ', salary = 5% age = 35, weight = 150, height = 5.5', salary = 10% age = 35, weight = 150, height = 5.5 ', salary = 15 % At step 224, the processor 155 identifies each discrete vector V of the important public attribute A 'in the set F. At step 226, the processor 155 determines that each vector U of the non-significant public attribute values, ie, A ″ ₁ = u ₁ , A ″.
_{2 =} u _2, A "value u ₁ such as _{t =} u _t, .. identifies the u _t. Each vector U are those appearing with each discrete attribute value vector V important public attributes A '. Step At 226, processor 155 combines each vector U of non-important public attribute values A 'with a discrete attribute value vector V of important public attribute A' that appears with vector U.

For example, the set F includes gender and age of important attributes, height and weight of non-important attributes, and salary of private attributes. Further, before this step 226, set F includes the following tuple:

sex = M, age = 35, weight = 180, height = 6 ′, salary = 10% sex = M, age = 35, weight = 175, height = 5 ′, salary = 15% sex = M, age = 35, weight = 180, height = 6 ′, salary = 25% sex = M, age = 35, weight = 180, height = 6 ′, salary = 15% sex = M, age = 35, weight = 175, height = 6 ′ , salary = 15% sex = M, age = 35, weight = 180, height = 5 ′, salary = 10% sex = M, age = 35, weight = 175, height = 5 ′, salary = 10% sex = F , age = 35, weight = 120, height = 6 ′, salary = 10% sex = F, age = 35, weight = 120, height = 6 ′, salary = 15% sex = F, age = 35, weight = 120 , height = 5 ′, salary = 25% sex = F, age = 30, weight = 110, height = 5 ′, salary = 10% sex = F, age = 30, weight = 110, height = 5 ′, salary = 15% sex = F, age = 30, weight = 120, height = 6 ′, salary = 15% sex = F, age = 30, weight = 110, height = 5 ′, salary = 25% Important public attribute value A ′ Is a discrete vector V of
<Sex = F, age = 35>, <sex = F, age = 30> and <sex
= M, age = 35>. A vector U appearing with V = <sex = F, age = 35> is expressed as <weight = 120, height =
6 ′> and <weight = 120, height = 5 ′>. V =
The vector U that appears with <sex = F, age = 30> is <we
ight = 110, height = 5 '> and <weight = 120, height =
6 '>. The vector U appearing with V = <sex = M, age = 35> is represented by <weight = 180, height = 6 ′>, <we
ight = 175, height = 6 '>, <weight = 175, height =
5 ′> and <weight = 180, height = 5 ′>. The combined tuple is as follows:

sex = M, age = 35, <weight = 180,175>, <height = 6 ', 5'>, salary = 10% sex = M, age = 35, <weight = 180,175>, <height = 6 ', 5'>, Salary = 15% sex = M, age = 35, <weight = 180,175>, <height = 6 ′, 5 ′>, salary = 25% sex = M, age = 35, <weight = 180,175>, <height = 6 ', 5'>, salary = 15% sex = M, age = 35, <weight = 180,175>, <height = 6 ', 5'>, salary = 15% sex = M, age = 35, <weight = 180,175>, <height = 6 ', 5'>, salary = 10% sex = M, age = 35, <weight = 180,175>, <height = 6 ', 5'>, salary = 10% sex = F, age = 35, <weight = 120,110>, <height = 6 ', 5'>, salary = 10% sex = F, age = 35, <weight = 120,110>, <height = 6 ', S'>, salary = 15% sex = F, age = 35, <weight = 120,110>, <height = 6 ′, 5 ′>, salary = 25% sex = F, age = 30, <weight = 120,110>, <height = 6 ′, 5 '>, salary = 10% sex = F, age = 30, <weight = 120,110>, <height = 6', 5 '>, salary = 15% sex = F, age = 30, <weight = 120,110>, <height = 6 ′, 5 ′>, salary = 15% sex = F, age = 30, <weight = 120,110>, <height = 6 ′, 5 '>, salary = 25% In the above process, it should be noted that public attributes are classified into important public attributes and non-important public attributes. Note that only attributes are checked. Non-critical public attributes are:
It is only combined as described in step 224. As described above, for purposes of explanation, the advertiser identifies which of the public attributes A are important public attributes A 'and which are non-important public attributes A ". This identification is significant. This is because the classification of public attributes as important and non-important determines which public attributes are examined to require camouflage and determines which public attributes are only to be combined in step 224.

After performing steps 202-224, processor 155 stores the tuples in set F as a new background check relational database. For illustrative purposes, processor 155 discards the tuple of set R. That is, no query is performed on these tuples. Queries can be performed on this new background check relational database. However, the advertiser needs to know that there is a combined value and needs to refer to the combined public attribute value when making the profile query.

Alternatively, instead of building a new background checkup relational database, processor 155 maintains a record in memory 160 indicating the segmentation of the attribute value. Consider the database described above in connection with step 224.
An example of a partition obtained as a result of performing steps 202-224 is as follows.

(1) For sex = F, age = 35, the tuple is sex = F, age = 35, <weight = 120,110>, <height = 6 ′, 5 ′>, salary = 10% sex = F, age = 35, <weight = 120,110>, <height = 6 ', 5'>, salary = 15% sex = F, age = 35, <weight = 120,110>, <height = 6 ', 5'>, salary = 25% It is.

(2) For sex = F, age = 30, tuple is sex = F, age = 30, <weight = 120,110>, <height = 6 ′, 5 ′>, salary = 10% sex = F, age = 30, <weight = 120,110>, <height = 6 ', 5'>, salary = 15% sex = F, age = 30, <weight = 120,110>, <height = 6 ', 5'>, salary = 15% sex = F, age = 30, <weight = 120,110>, <height = 6 ′, 5 ′>, salary = 25%.

Processor 155 maintains a record that includes a partition indicator.

However, if the record is retained, the processor 155
Must perform some post-processing to ensure that no profile queries are violating the partition. That is, a query that identifies all tuples in a partition must not violate that partition. However, a query that attempts to identify only some of the tuples in a partition will violate the partition. More specifically, a query is said to have compromised a partition when: Database row vector T ₁ = <A ₁ =
v ₁ , .., A _k = v _k , .., A _m = v _m > and T ₂ = <A ₁ = u ₁ , .., A _k =
There are two tuples represented by u _k , .., A _m = u _m >
Both T ₁ and T ₂ is to be in the same partition. In other words, each important attribute A _1, .., has become _{A k, v 1 = u 1} , v 2 = u 2, v k = u k. Query has a reference that refers to both public attributes and private attributes, but query is satisfied by the tuple T _1, when not met by the tuple T _2, thus violating the partition. Profile
To determine whether the query has violated a partition, processor 155 can perform a profile query against the background survey relational database. Next, the processor 155 compares the tuple identified in the profile query with the unidentified tuple in the background survey relational database, and the non-specific tuple T ₂ whose corresponding attribute value is in the same partition as described above. it is possible to determine whether a particular tuple T ₁ exists with.

If the profile query violates a partition, the processor 155 may reject the profile query strictly. Alternatively,
Processor 155 by first identifying also tuples T ₂ not identified by the query, that is, by including them, to remove the partition violation by changing the set of identified tuple. However, if such changes are made, the processor 155 must inform the advertiser of the changes and content. By way of illustration, processor 155 accomplishes this by describing the contents of the partition for the attribute specified in the advertiser's query. For example, processor 155 may send a message regarding the change to the advertiser.

In summary, a system and method for protecting a database from inferring sensitive attribute values in the database is disclosed. The memory is for storing the database, and the processor is for processing the database. Using the processor, the database is electronically partitioned into public attributes containing non-sensitive attribute values and private attributes containing private attribute values. The processor is then used to electronically process the private attribute values to dilute the high correlation between public and private attribute values. Specifically, the processor partitions the database into non-secure tuples of secure tuples, such that each non-secure tuple is a member of the next group.

(1) A group identified by a vector of attribute values (that is, each tuple in the group has a public attribute value that matches the vector).

(2) A group having an uncertainty level less than an uncertainty threshold level for at least one value of a private attribute.

The processor then selectively combines the public attribute values of the tuple and infers a private attribute value that exceeds the uncertainty threshold level, thereby camouflaging the tuple or removing the tuple from the database. This is achieved by:

(1) Identify all tuples that include a particular attribute value for the selected public attribute, the particular value being included in at least one tuple having a highly correlated public attribute value.

(2) A public attribute value corresponding to a discrete vector of values for public attributes other than the selected public attribute, that is, a tuple and a group including a matching public attribute value are identified.

(3) For each private attribute value in the group, if there is at least one uncertainty threshold level, combine the values of the selected public attributes of each group.

(4) Remove non-secure tuples that cannot be combined to camouflage non-secure tuples.

Finally, the above description is merely illustrative for explaining the present invention. Accordingly, various modifications can be made by those skilled in the art without departing from the spirit and scope of the invention.

Continued on the front page (72) Inventor Griffith, Nancy, Davis United States 07090 Westfield West Dudley Avenue, New Jersey 264 (72) Inventor Katz, James, Everett United States 07960 Mauricetown, NJ, New Jersey 39 (56 References: JP-A-5-63696 (JP, A) MICHALEWICS, Z. , FUNCTIONAL DEPENDENC IES AND THEIR CONNECTION WITH SECURITY OF OF STATISTICAL DATABASES, INNOFORMA ITON SYSTEMSTEMS, UK, Pergamon Journal, June 24, 1987 12 N.1, pp. 17-27 DENNING DE, INFER ENCE CONTROLS FOR STATISTICAL DATABA SES, COMPUTER, IEEE, July 27, 1983, Vol. 16 No.7, pp. 69-82 MICHAREWICZ Z, CHENK-W, RANGES AND TRACKES STAISTICAL DATABASES, Lecture Notes in Computer Science, April 4, 1989, Vol. 339, pp. 193-206 ADAM NR, SECURITY-CONTROL METHODS FOR STATISTICAL DAT ABASES: A COMPARATION VE STUDY ACM COMPU TING SURVEYS, Vol. 21 No. 4, Vol. 21 No. 4, pp. 515-556, issued December 1989 GRIFFETH, N.M. D. & KATZ, J, AN ANONYMITY SERVICE FOR TARGE TED ADVERTING, IN FORMATION AND COMMUNICATION TECHNOLO GIES IN TOURISM, USA, Springer-Verlag, 1995, September-VerlagW. 180-191 (58) Field surveyed (Int. Cl. ⁷ , DB name) G06F 17/30 JICST file (JOIS)

Claims (10)

(57) [Claims] 1. A method for protecting a database from inferring confidential attribute values in the database, comprising: using a processor to divide the database into a public attribute including a public attribute value and a private attribute including a private attribute value. Electronically processing the confidential attribute value using a processor to reduce a high correlation between the public attribute value and the private attribute value. Features method. 2. The method of claim 1 wherein said processing step further comprises the step of electronically partitioning said database tuples into a secure set and a non-secure set using said processor. Features method. 3. The method of claim 2, wherein a tuple is present for the corresponding public attribute of the attribute value, wherein the vector of the attribute value identifies a group of tuples having the vector of the attribute value. If the level of uncertainty for at least one value of the private attribute of the group is less than an uncertainty threshold level, the unsafe set is partitioned and the uncertainty for at least one value of the private attribute of the group is The method of claim 1, wherein the certainty level is less than the uncertainty threshold level if the number of discrete values of the value of the one private attribute included in the group is less than a threshold number. 4. The method of claim 2, wherein the public attribute values are further divided into important public attribute values and non-significant public attribute values, and the tuples are: If the vector of attribute values identifying a group of tuples having the vector of attribute values is present and an uncertainty level for at least one value of the private attribute of the group is less than an uncertainty threshold level; , Said non-secure set being partitioned. 5. The method of claim 2, wherein the step of partitioning the tuple into a secure set and a non-secure set comprises, using the processor, different public attribute values for the public attribute. Electronically creating a vector, using the processor, for each group of tuples identified by the vector of public attribute values, if there is a threshold level of uncertainty for private attribute values in the group Electronically partitioning the tuples of the group into the secure set; otherwise, electronically partitioning the tuples of the group into the non-secure set. Method. 6. The method of claim 1, wherein the processing step prevents using the processor to infer the private attribute value of the tuple beyond an uncertainty threshold level. Further comprising the step of electronically combining the plurality of public attribute values of the tuple, the method further comprising: using the processor to determine a specific value of the selected public attribute, the highly correlated public attribute value. Electronically identifying all tuples containing a particular value contained in at least one of the tuples having the particular value for each public attribute other than the selected public attribute using the processor. Electronically identifying discrete vectors having the following formulas and electronically identifying a group of tuples for each of the discrete vectors: Wherein each tuple of the identified group is a discrete vector of values for a public attribute of the tuple other than the particular public attribute; and The at least one uncertainty threshold level for each private attribute value is present in the group corresponding to the discrete vector, the selected one of the groups of the group corresponding to one of the discrete vectors is selected. Combining the values of the public attributes electronically. 7. The method of claim 1 wherein, after the partitioning and processing steps, electronically receiving a profile query from an advertiser using the processor; and using the processor. Executing the profile query against the database; and using the processor to electronically communicate to the advertiser an ID corresponding to the profile query and an alias of the tuple identified in the profile query. Transmitting the information in a dynamic manner. 8. A system for protecting a database from inference of confidential attribute values located in the database, comprising: a memory for storing the database; a public attribute including the public attribute value for the database; A processor that electronically divides the private attribute into a public attribute value and electronically processes the value to reduce a high correlation between the public attribute value and the private attribute value. 9. A memory for storing a database, and the database is electronically divided into a public attribute containing a public attribute value and a private attribute containing a private attribute value. A filter station comprising a processor for electronically processing said values to reduce the high correlation of said filter station; and an advertiser for sending a profile query to said processor of said filter station. Communication system. 10. The communication system of claim 9, wherein said processor electronically partitions and processes said database, wherein said processor executes said profile query electronically against said database. A processor electronically transmitting an ID from the profile query and an alias of the tuple identified by the profile query to the advertiser; the communication system further comprises a name translator station; Electronically constructing a table for translating tuple aliases to the tuple's network address, electronically transmitting the ID and the table of the profile query to the name translator station, In addition, each ad distribution And a plurality of customers who have a network address for, and the advertisers, and the processor of the filter station, and the name of the translator station,
A communication network interconnecting the plurality of customers, wherein the advertiser sends an advertisement, the tuple alias, and the profile query ID to the communication network, the name translator station includes the advertisement,
The tuple alias and the profile query
Receiving an ID from the communication network, using the table to convert the tuple alias to the network address, and converting the advertisement using the network address of the tuple to identify the plurality of customers through the communication network. A communication system characterized by transmitting to a customer.