IBM unveils privacy software

Claiming a technology breakthrough in privacy and security, IBM on Tuesday introduced software that allows corporate users to share information with each other and government agencies without having to reveal private personal details.

The technology, called DB2 Anonymous Resolution, could serve to address the range of security problems involved in handling personal information in markets such as health care, financial services, and even national security.

The technology is an extension of IBM's analytics software that makes use of irreversible "digital signatures" and other techniques for correlating the data while it remains in an "anonymized" form. This results in enhancing privacy but it also prevents data from being observed in its original form, thereby reducing the risk of misuse or accidental exposure, company officials explained.

"Everyone wants and needs to share data but the more it is shared the higher the chances it will get out of your control. There are lots of people with information who would like to know when they have two records in common, for instance, but they don't want to share all their information just to discover that," said Jeff Jonas, chief scientist of Entity Analytics and Distinguished IBM Engineer, who invented the technology.

Offering one example of how the technology works and what its benefit could be, Jonas said banks who want to market services to their own customers typically turn to a company with large databases such as Nexus-Lexis to obtain more specific information about those customers, such as what magazines they might subscribe to or how many children they have. But many times banks are reluctant to disclose their customers' names.

"With this technique, a bank doesn't have to tell them who their customers are. The bank can just send the anonymized data and if there is a match then someone like Nexus-Lexis can just send the demographics. But if there is not a match the database marketer [Nexus-Lexis] can't discover who the bank's customers are," Jonas said.

Historically, Jonas said, cryptography has been used as the technical solution to such problems where both parties encrypt their own data and then send it to each other. But Jonas claims his approach is the first where each party encrypts their own data using advanced correlation and only cryptographic data.

"Specifically, what is different with this approach is, instead of correlating the data and then anonymizing the results, you anonymize the data and then you correlate it while it is being anonymized. That is very different," Jonas said.

DB2 Anonymous Resolution also supports a number of strategic and regulatory initiatives, including privacy compliance, information sharing in support of homeland security, regulatory compliance, due diligence in mergers and acquisitions, and clinical research, IBM officials said.

"With the recent rise in identity theft and unintentional information disclosure, users across all industries are telling us that the ability to safely and securely share data is a top priority for them," said John Slitz, an IBM vice president responsible for Entity Analytics.

Slitz said the new software is designed to aid users in meeting the security and privacy demands associated with opening up their data repositories and allowing them to take better advantage of emerging business opportunities. In the healthcare market, for example, "anonymization" may be used by public health organizations to share and correlate data that has been stripped of personal information for medical research.