Privacy-preserving matching service

Abstract

Described herein are technologies pertaining to protecting user privacy in connection with attribute-based matching services. A user registers with a platform that includes a plurality of non-collaborating partitions, where registration includes transmitting a message to the platform that indicates that the user has one or more attributes corresponding thereto. Through selective encryption and a communications protocol amongst the partitions, none of the partitions are able to ascertain that the user has the attributes. Acting in conjunction, however, the plurality of partitions perform rich attribute-based matching.

What is claimed is: 
     
         1 . A system comprising:
 a processor; and   memory that comprises an attribute-based matching system that is executable by the processor, the attribute-based matching system configured to:
 receive first data from a first computing device, the first data indicative of a value for an attribute; 
 identify a match for the value for the attribute based upon second data that has been received from a second computing device, the match indicating that a user of the second computing device has the value for the attribute, the attribute-based matching system configured to identify the match without learning a linkage between an identity of the user and the value for the attribute; and 
 transmit a message to the first computing device responsive to identifying the match, the message indicating that the match has been identified. 
   
     
     
         2 . The system of  claim 1 , the attribute being geographic location, the value of the attribute indicating the geographic location of the user. 
     
     
         3 . The system of  claim 2 , the attribute-based matching system further configured to transmit a second message to the second computing device responsive to identifying the match, the second message indicating that the match has been identified. 
     
     
         4 . The system of  claim 3 , the message transmitted by the attribute-based matching system fails to identify the user of the second computing device. 
     
     
         5 . The system of  claim 4 , the match indicating that the user of the second computing device and a user of the first computing device are within a threshold geographic distance from one another. 
     
     
         6 . The system of  claim 1 , the attribute-based matching system comprises:
 a first computing partition, comprising:
 a matcher component; and 
 a first data set, the first data set comprises:
 the identity of the user; 
 an identity of a second user of the first computing device; 
 the value for the attribute; 
 first linkage data that anonymously links the identity of the user with the value for the attribute; 
 second linkage data that anonymously links the identity of the second user with the value for the attribute, wherein the first linkage data and the second linkage data are indexed by the value for the attribute in the first data set; and 
 
   a second computing partition, comprising:
 a combiner component; and 
 a second data set, the second data set comprises:
 an anonymized representation of the identity of the user; 
 an anonymized representation of the identity of the second user; 
 the first linkage data; and 
 the second linkage data, the anonymized representation of the identity of the user indexed by the first linkage data in the second data set, the anonymized representation of the identity of the second user indexed by the second linkage data in the second data set, wherein the first computing partition is configured such that the matcher component is provided with access to the first data set but inhibited from accessing the second data set, the second computing partition is configured such that the combiner component is provided with access to the second data set but inhibited from accessing the first data set, the matcher component and the combiner component are configured to transmit messages between one another, and the attribute-based matching system is configured to identify the match based upon the messages transmitted between the matcher component and the combiner component. 
 
   
     
     
         7 . The system of  claim 6 , wherein the matcher component is configured to receive data that identifies the user of the second computing device, the messages transmitted between the matcher component and the combiner component comprise a first message from the matcher component to the combiner component, the first message comprises the anonymized representation of the identifier for the user. 
     
     
         8 . The system of  claim 7 , wherein the combiner component, responsive to receiving the first message, is configured to identify the first linkage data in the second data set based upon the anonymized representation of the identifier for the user, and is further configured to transmit a second message to the matcher component, the second message comprises the first linkage data. 
     
     
         9 . The system of  claim 8 , wherein the matcher component, responsive to receiving the second message, is configured to identify the value for the attribute that indexes the first linkage data in the first data set, and is further configured to identify the second linkage data in the first dataset that is indexed by the value for the attribute, the matcher component still further configured to transmit a third message to the combiner component, the third message comprises the second linkage data. 
     
     
         10 . The system of  claim 9 , wherein the combiner component, responsive to receiving the third message, is configured to identify the anonymized representation of the identity of the second user based upon the second linkage data, the message transmitted to the first computing device responsive to the combiner component identifying the anonymized representation of the identity of the second user. 
     
     
         11 . A method executed at a computing device for performing an attribute-based match, the method comprising:
 executing a messaging protocol between a first computing partition and a second computing partition, the first computing partition inhibited from accessing data retained in the second computing partition, the second computing partition inhibited from accessing data retained in the first computing partition; and   based upon the executing of the messaging protocol, transmitting a message to a first computing device, the message indicating that a user of the first computing device has been identified as having a value for an attribute, wherein the message is transmitted without either the first computing partition or the second computing partition learning that the user has the value for the attribute.   
     
     
         12 . The method of  claim 11 , wherein the value for the attribute of the user is a value that is indicative of a geographic location of the user. 
     
     
         13 . The method of  claim 12 , further comprising:
 based upon the executing of the messaging protocol, transmitting a second message to a second computing device, the second message indicating that a second user of the second computing device shares the value for the attribute with the first user of the first computing device, wherein the second message is transmitted without either the first computing partition or the second computing partition learning that the second user has the value for the attribute.   
     
     
         14 . The method of  claim 13 , further comprising:
 based upon the executing of the messaging protocol, transmitting messages to the first computing device and the second computing device, the messages cause the first computing device and the second computing device to set up a direct communications link between one another.   
     
     
         15 . The method of  claim 11 , wherein the value for the attribute is a value that indicates that the user is interested in a specified topic. 
     
     
         16 . The method of  claim 11 , wherein executing the messaging protocol comprises a first plurality of acts undertaken at the first computing partition, the first plurality of acts comprising:
 responsive to receiving an anonymized identifier for a second user of a second computing device, identifying linkage data in a first dataset in the first computing partition based upon the anonymized identifier for the second user, the linkage data anonymously indicating that the second user has set forth the attribute value; and   transmitting the linkage data to the second computing partition.   
     
     
         17 . The method of  claim 16 , wherein executing the messaging protocol further comprises a second plurality of acts undertaken at the second computing partition, the second plurality of acts comprising:
 responsive to receiving the linkage data from the first computing partition, identifying the value of the attribute in a second dataset in the second computing partition based upon the linkage data;   responsive to identifying the value of the attribute in the second dataset, identifying second linkage data in the second dataset based upon the value of the attribute, the second linkage data anonymously indicating that the first user has set forth the attribute value; and   transmitting the second linkage data to the first computing partition.   
     
     
         18 . The method of  claim 17 , wherein executing the messaging protocol further comprises a third plurality of acts undertaken at the first computing partition, the third plurality of acts comprising:
 responsive to receiving the second linkage data from the second computing partition, identifying, in the first dataset, an anonymous identifier for the first user of the first computing device based upon the second linkage data; and   transmitting the anonymous identifier for the user of the first computing device to the second computing partition.   
     
     
         19 . The method of  claim 18 , wherein executing the messaging protocol further comprises a fourth plurality of acts undertaken at the second computing partition, the fourth plurality of acts comprising:
 responsive to receiving the anonymous identifier for the user of the first computing device, identifying, in the first dataset, the user based upon the anonymous identifier for the user; and   transmitting the message to the first computing device responsive to identifying the user.   
     
     
         20 . A computer-readable medium comprising instructions that, when executed by a processor, cause the processor to perform acts comprising:
 receiving, from a first computing device, a request to identify any computing devices that are within a particular geographic range from a current location of the first computing device;   responsive to receiving the request, executing a messaging protocol between a first computing partition and a second computing partition, wherein executing the messaging protocol comprises transmitting a message to the first computing device that indicates that a second computing device is within the particular geographic range from the current location of the first computing device, wherein the messaging protocol prevents the first partition and the second partition from learning a geographic location of the second computing device when transmitting the message to the first computing device.