DE102016207468A1 - A system, method and program for storing anonymous behavior data and controlling access to such data - Google Patents

Abstract

A system for storing personalized data and controlling access to personalized data, the system comprising a data engine including a data store and an access control unit configured to receive anonymized personalized behavior data and to receive the received anonymized personalized behavior data in the data store wherein access to the stored anonymized personalized behavior data is controlled by the access control unit, the anonymized personalized behavior data being behavioral data representing a user's behavior, the behavioral data being anonymously personalized with an anonymous user ID; wherein the access control unit is configured to make configurable anonymized personalized behavior data configurably accessible to service providers when a request is received from one of the service providers for data specifying the anonymous user ID with which the requested data was personalized anonymously, wherein the service providers are entities separate from the data engine; a control provider, as an entity separate from the data engine, configured to receive from an identified user an access control unit configuration request specifying one of the service providers and an access configuration setting, and the access control unit configuration request to the data engine having the anonymous user ID to send the identified user; wherein the access control unit is configured to receive the access control unit configuration request and to configure the access by the specified one of the service providers to the personalized behavior data that has been personalized with the anonymous user ID according to the access configuration setting.

Description

The present invention relates to the field of systems for storing personalized data and controlling access to such data. More particularly, the invention relates to controlling access to anonymized personalized behavioral data and providing services utilizing that data to a user.

There are protocols and regimes for generating, personalizing, storing, and accessing data representing a person's actions in daily life. A user is able to log in to a service provider for a service. The service provider then processes data generated by the user or on behalf of the user as a service. The results may be transmitted to the user or to a third party.

Such regimes are designed to allow anyone to safely benefit from the benefits of increasing computing capabilities, for example, by allowing mobile devices to access a service provided by cloud networks when handling behavioral data.

Because storing this type of highly detailed personal information is highly sensitive, it is desirable to allow the user to remain anonymous. Therefore, the work frames include multiple parties so that personalized data can be stored by a party that is unknown to the identity of the person whose behavior (or activity) the data represents, while other parties can query the data and use the data as a service for can handle the person.

In such work frames, data is stored in a data engine, and a service user who stores personalized data in the data engine can not be identified by the data engine. This is advantageous because the data thus stored can not be assigned to the service user, which is why the data are anonymous in their stored state. However, the service user has no other means of exercising control over how to access behavioral data relating to the user's personal, except that he logs on and logs off for services offered by the service providing entities become. The data engine is operated by a party separate from the serving entities.

In existing work frames, the serving entities act as an intermediary between the user and the service provider (s). The data engine is not allowed to know who the user is (i.e., the data engine is prohibited from knowing the user about whom behavior data is being stored). Therefore, the only way the user can interact with the data engine and the data stored in it is through the service provider, which is itself allowed to query the data stored by the data engine.

Embodiments include a system for storing personalized data and controlling access to personalized data, the system including a data engine including a data store and an access control unit configured to receive anonymized personalized behavior data and receive the anonymized personalized behavior data received in the computer Storing data storage, the access to the stored anonymized personalized behavior data being controlled by the access control unit, the anonymized personalized behavior data being behavioral data representing a user's behavior, the behavioral data being anonymously personalized with an anonymous user ID; wherein the access control unit is configured to make configurable anonymized personalized behavior data accessible to the service providers when a request is received from one of the service providers for data specifying the anonymous user ID that anonymously personalizes the requested data, wherein the service providers are separate entities from the data engine. The system further comprises a control provider, as an entity separate from the data engine, configured to receive an access control unit configuration request from an identified user specifying one of the service providers and an access configuration setting, and the access control unit configuration request to the data engine transmit the anonymous user ID of the identified user; wherein the access control unit is configured to receive the access control unit configuration request and to configure the access by the specified one of the service providers to the personalized behavior data that has been personalized with the anonymous user ID according to the access configuration setting.

Advantageously, the control provider forwards the functionality of a work framework for the provision of services on the basis of stored anonymous personalized behavioral data to users. The control provider is a device that provides a technical functionality to give users (service users) control of their users to provide personalized behavioral data stored in the data engine.

The control provider is an entity separate from the service providers and the data engine, which provides a means for the user to configure the accessibility of the user's anonymized personalized behavior data stored in the data engine. By incorporating another party (the control provider) in addition to the user, the data engine, and the service providers, the anonymity of the personalized behavior data in the data engine can be preserved while providing a mechanism, interface, tool, means, or device the user can interact with the data engine and direct changes to the accessibility of stored data.

The system of embodiments includes a number of separate entities or parties in data communication with each other. The data engine may be provided by a first party, the service provider by a second party, and the control may be provided by a third party. Where entities are specified as separate parties or entities, the entities may also be considered separate legal entities, independent entities, and / or independent legal entities. The devices (control providers, service providers, data machines) are located in mutually independent computer environments, albeit in data communication with each other via the Internet or other data connection, which data connections may be encrypted connections. Each separate entity can have its own security infrastructure so that a security breach in one entity does not affect the other entities.

The anonymous user ID may be provided by an ID generation device, such as an identity issuing agency, which is an entity separate from the control provider, the data engine, the person, and the service provider.

From the user's perspective, behavioral data representing the user's own behavior may be personalized with a non-identifying (i.e., anonymous) user ID that prevents the physical or legal identity that the user is from being identified. Therefore, the user may upload that behavior data to a data engine that is accessible to multiple service providers without risking that the behavioral data may be associated with the user (i.e., by name naming). Thus, the user can enjoy the services of one or more service providers who use the behavioral data pertaining to the user personally, without the user being identifiable.

Behavioral data may represent a measured physical characteristic of the user, or may represent a user interaction with infrastructure that serves as a source of behavioral data. For example, behavioral data may represent an interaction of the user with a device configured to pass data representing the interaction to the data engine, for example, in a data structure representing the data representing the interaction with the anonymous user ID of the user linked. The behavioral data is personalized by being linked or linked to a person, the person being the user represented by the anonymous user ID. Therefore, the behavioral data stored by the data store is personalized insofar as it is linked to or linked to or assignable to a person, albeit a person who is represented only by an anonymous user ID, and thus a person with a single user can only be linked by an entity that knows the mapping of an anonymous user ID to the user ID.

The access control unit is configured to make the stored personalized behavior data configurably accessible to the service provider when a request is received from one of the service providers for data specifying the anonymous user ID with which the requested data has been personalized anonymously. "Configurable Accessible" means accessible according to configurable restrictions. In embodiments, the restrictions are configurable by the control provider upon receipt of access control unit configuration requests from the user. The restrictions are configurable by the control provider and enforced or implemented by the access control unit.

It may be that the data engine does not accept data write requests from service providers. For example, the data engine may be configured to receive only data read requests as data access requests. For example, the data engine may provide service providers with an interface for receiving data access requests that is limited to data read requests. Thus, in embodiments, data access requests may simply be referred to as data read requests.

Optionally, the access configuration setting serves to enable or disable access by the specified one of the service providers the personalized behavioral data that has been personalized with the received anonymous user ID.

Advantageously, the control provider provides the user with a mechanism by which he can individually disable and activate access to the user's anonymized personalized behavior data stored in the data machine for each service provider without requiring the service provider's permission, consent or intervention ,

Optionally, the access configuration control request specifies a setting application condition, wherein the access control unit is configured to selectively apply the specified access configuration setting depending on whether the requested data satisfies the setting application condition.

In embodiments in which the access control unit is configured to apply access configuration settings in a selective manner via settings application conditions received from the user via the control provider, the user advantageously gains control over which data specific configuration settings should apply. In other words, the access configuration setting instructs the access control unit to restrict the access in a certain way, and the application condition instructs the access control unit to which data the restriction is to be applied.

Optionally, the behavioral data is categorized according to a hierarchical taxonomy; and the setting application condition specifies a range of the hierarchical taxonomy.

A hierarchical taxonomy is a structure of categories into which the behavioral data is categorized. The same behavioral data can be categorized into more than one category within the hierarchical taxonomy. The hierarchical taxonomy may be divided into classes, each class comprising one or more subclasses. Such a taxonomy can have multiple levels, such as sub-subclasses.

Optionally, the access configuration setting is used to disable access until behavior data that meets the setting application condition has been removed.

Advantageously, such embodiments allow a user to be selectively forgotten. That is, because the access configuration setting applies to a specified subset of data (those that satisfy the settings application condition), a user may submit an access configuration setting via the control provider indicating that a subset of anonymized personalized behavior data associated with a particular anonymous user ID are to be removed from the data engine.

Optionally, the behavioral data is stored by the data engine in association with metadata that specifies a value of one or more of data reception time, data generation time, data generation location, data type, activity, and data generation device model information; and the adjustment application condition is a specified range of values of one of the one or more properties.

Advantageously, such embodiments give the user even greater control over which access configuration settings to apply to which anonymized personalized behavior data stored in the data engine.

Optionally, the control provider is configured to receive identification information identifying a user's identity, transmitting an identity request corresponding to the received identification information to an ID generation device, in return receiving an anonymous user ID, and the anonymous user ID. ID to the user.

Further, the system may include an ID generation device configured to generate the anonymous user ID by executing an irreversible process in response to receiving the request and output the anonymous user ID to the user via the control provider.

The entities that have the ability to associate the user with personal identification information that reveals the identity of the user (where "user's identity" means the particular physical entity or entity that the user is) are, in principle, the control providers, possibly the ID generation device and the user himself. Depending on the implementation, the control provider may optionally store a list of links between personal identification information and anonymous user IDs. The request corresponding to the received identification information transmitted by the control provider to the ID generation device may include some or all of the received identification information, possibly in a processed form. Alternatively, the request that received the Identification information, simply be a non-identifying request that does not contain any of the received identification information, but is triggered by the receipt of the identification information. In the latter case, the correspondence between the identification information and the request is that the request was triggered by the receipt of the identification information. The ID generation device can be realized as a stateless entity and, in this case, does not retain any received identification information revealing the identity of a user. It may even be that under no circumstances will identification information be received by the ID generation device. The control provider may, as appropriate, retain (depending on the implementation) identifying information that reveals the identity of a user, but in no case can access the data engine storing the anonymized personalized behavior data so that it is unable to anonymize in practice to associate personalized behavioral data with a specific user. The user can associate his own personalized behavioral data with his own identity. Personal identification information, personalized identification information, and identification information are used interchangeably in this document.

The control provider receiving the anonymous user ID in return means receiving the anonymous user ID in return for the submitted request. Thus, the response of the ID generation device to receiving the request is generating an anonymous user ID and issuing the generated anonymous user ID to the control provider. ID and identity mean the same in this document.

The anonymous user ID is unique, so no two users are assigned the same anonymous user ID. The ID generation device may be configured to perform an irreversible hash function to map the communicated identification information to a much larger anonymous user ID space (i.e., no two different versions of identification information result in the same anonymous user ID). The identifying information is information sufficient to identify the user from a population of potential system users. A random element can be included in the generation of the anonymous user ID from the transmitted identification information.

In embodiments in which the request from the control provider to the ID generation device is non-identifying, which may be referred to as an anonymized request, the ID generation device may receive time and / or date information from a system clock at the time of Extraction of the anonymous user ID in response to the received request and that an irreversible hash function is used, which prevents two different instances of extracted time and / or date information are mapped to the same anonymous user ID.

Optionally, each of the multiple service providers may be enrolled with the ID generation device. The data engine may be configured to certify service providers that provide data access requests to the ID generation device. Optionally, no such certification may be required.

Optionally, the specified access configuration setting is one or more access policies. The access control unit configures the access by the specified one of the service providers to the personalized behavior data personalized with the anonymous user ID according to the access configuration setting by allowing access by the specified one of the service providers on the condition of the approval of the specified one of the service providers or the multiple access provisions. Furthermore, one of the one or more access policies may be a cash payment from the specified service provider to the user.

Advantageously, such embodiments allow the user to derive a benefit (other than the service provided by the service provider) from making available to the specified service provider the user data (or a particular subset thereof by a corresponding or associated setting application condition) , The benefit may be, for example, that when accessing requested data, a fee is payable by the service provider to the user. The one or more determinations may relate to particular data (specified by a corresponding or associated settings application condition) and / or to a particular period of time during which they are to be applied to data access requests by the service provider. The one or more determinations may be a limitation on the use of data by the service provider. The one or more destinations may be an approval by the service provider to provide a service to the user provide. The one or more determinations may be an approval by the service provider to provide a specified service level to the user. The one or more provisions may apply for a specified period of time.

Optionally, the data engine is configured to maintain, for each anonymous user ID, a record of data access requests permitted by the anonymized personalized behavior data access control unit anonymized by the anonymous user ID of each of the service providers and the record periodically and / or to the control provider in response to a triggering event.

Data access requests permitted by the access control unit are those data access requests received by the access control unit at the request of which the service provider (from which the data access request was received) is made available by the access control unit some or all of the requested data. The control provider may use the record to determine fees to be charged to the service provider on behalf of the user corresponding to the anonymous user ID. The record may be provided to the user corresponding to the anonymous user ID by the control provider. For example, the user will be informed in this way how his personalized behavioral data will be used.

Optionally, the access control unit is configured to receive from a service provider a request for data specifying one or more anonymous user IDs that anonymously personalize the requested data and a data area, and to respond to the request that retrieving each of the one or more anonymous user IDs from the data store anonymized personalized behavior data stored in association with the anonymous user ID from the specified data area according to access control settings received for the service provider in access control unit configuration requests associated with of the anonymous user ID, and the retrieved data is output to the requesting service provider as a unified output.

In such embodiments, data relating to a single user but anonymously personalized with more than one anonymous user ID may be merged when the more than one anonymous user ID is registered with the service provider. Independent access control settings can be specified for each anonymous user ID.

Optionally, the access control unit configuration request specifies more than one service provider among the service providers, and the access configuration setting applies to each of the specified more than one service provider.

Embodiments also include a method of storing personalized data and controlling access to personalized data, the method comprising: at a data engine, receiving anonymized personalized behavior data, storing the received anonymized personalized behavior data in a data store, wherein the anonymized personalized behavior data includes behavioral data are that represent the behavior of a user, the behavioral data being anonymously personalized with an anonymous user ID; Controlling access to the stored anonymized personalized behavioral data by the stored anonymized personalized behavior data is made configurable to the service provider when one of the service providers receives a request for data specifying the anonymous user ID that anonymously personalizes the requested data, the service providers being separate entities from the data engine; in a control provider, an entity separate from the data machine, receiving, from an identified user, an access control unit configuration request specifying one of the service providers and an access configuration setting, and transmitting the access control unit configuration request to the data engine with the anonymous user ID of the identified user ; and in the data engine, receiving the access control unit configuration request and configuring the access by the specified one of the service providers to the personalized behavior data that has been personalized with the anonymous user ID according to the access configuration setting.

Embodiments also include a computer program that, when executed by interconnected computing devices, causes the interconnected computer devices to perform a method of storing personalized data and controlling access to personalized data, the method comprising: in a data engine , Receiving anonymized personalized behavioral data, storing the received anonymized personalized behavioral data in a data store, the anonymized personalized behavioral data being behavioral data representing a user's behavior, the behavioral data being anonymously personalized with an anonymous user ID; Controlling access to the stored anonymized personalized behavior data by making the stored anonymized personalized behavior data configurable to the service provider when one of the service providers obtains a request for data specifying the anonymous user ID with which the requested data is requested anonymized, the service providers being separate entities from the data engine; in a control provider, an entity separate from the data machine, receiving, from an identified user, an access control unit configuration request specifying one of the service providers and an access configuration setting, and transmitting the access control unit configuration request to the data engine with the anonymous user ID of the identified user ; and in the data engine, receiving the access control unit configuration request and configuring the access by the specified one of the service providers to the personalized behavior data that has been personalized with the anonymous user ID according to the access configuration setting.

There now follows a detailed description of specific embodiments with reference to the accompanying drawings, in which:

1 Fig. 10 illustrates a system embodying the present invention;

2 FIG. 12 illustrates a system embodying the present invention and an exemplary data flow in the system; FIG.

3 illustrates example hardware.

1 illustrates a system of one embodiment. The system includes a control provider 14 and a data engine 20 , Optionally, the system may also include an ID generation device 12 ("ID" in this document is short for "identity") (in 1 Not shown). Furthermore, there are several service providers 30 and a user 40 illustrated to demonstrate the use of the system. Depending on the implementation, the service providers may be considered part of the system.

The data engine 20 includes a data store 22 and an access control unit 24 ,

The data engine 20 can be realized by a single server or by a network of servers. More specifically, the access control unit 24 be a single server, with the data store 22 is formed by a plurality of interconnected memory units. Alternatively, the access control unit 24 a service that is provided by multiple data storage servers that work in concert so that the multiple data storage servers are the data engine 20 that are the function of both the data store 22 as well as the access control unit 24 To run.

The exchange of data over the Internet or other network between entities of the system and / or entities outside the system may be encrypted.

The control provider 14 is a server or other networked computing device that people at different geographic locations can access, for example, over the Internet. The server has network I / O functionality, a memory, a processor configured to execute a program for implementing the ID retrieval device functionality, and a storage unit configured at least to associate the program (in coded form) to save. The control provider 14 is one of the data engine 20 separate entity. The control provider 14 and the data engine 20 are part of stand-alone computing environments, so each one has an independent security infrastructure.

The service providers 30 are devices that provide services to users of the system. The service providers are opposite the data engine 20 and the control provider 14 independent entities. The service providers 30 are devices that provide data-based services to users. The service providers each have mechanisms for logging in users (via an anonymous user ID and optionally also some personal identification information) to access the data store 22 stored data, for processing the retrieved data and outputting the result of the processing either to another service provider, the user or to another destination.

The service provider 30 is a party to a service providing device, such as a server, which processes anonymized personalized behavioral data of a particular person and uses the results of that processing to provide a service to the user to which the person belongs (the person being referred to) an anonymous user ID is represented). The service provider 30 can be a server running the data machine 20 via a network, such as the Internet, can be connected via a connection that can be encrypted. A Public Key Infrastructure (PKI) system or an alternative may be on behalf of the data engine 20 operated to the identity of the service provider 30 to authenticate.

The user 40 is a person identifiable by personal identifying information as a particular person or entity. The user 40 is a system user, and in the context of this document, the term "user" is interchangeable with the term "individual" or the term "system user".

In 1 concrete interconnections are illustrated. The interconnections are a non-exclusive illustration of exemplary data exchange processes within and involving the system.

An interconnect is between the user 40 and the data store 22 illustrated. The data engine 20 is configured to receive anonymized personalized behavior data from a user (via one or more devices) and that anonymized personalized behavior data in the data store 22 save. Although as a direct interconnection between the user 40 and the data store 22 1, the anonymized personalized behavior data may also be generated by a source device, that is, a device that interacts with the user to generate behavioral data. The interconnection can be realized, for example, over the Internet.

The source device may generate data representing interaction with the user. The data may be passed through the source device to the data engine 20 be transmitted. For example, the source device may have the functionality to associate the anonymous user ID with the data representing that interaction and the data that interacts with the associated anonymous user ID in the data engine 20 represent as anonymized to transfer personalized behavioral data.

Alternatively, the data generated by the source device that represents the interaction with the user may be downloaded to a user intermediate device (such as a mobile phone, a personal computer, a tablet, or other data communication device). In the user intermediate device, the data representing the interaction with the user may be linked to the anonymous user ID, and the data representing the interaction with the associated anonymous user ID may be sent to the data engine 20 be transmitted.

The data engine 20 may have a special mechanism for processing received anonymized personalized behavioral data. For example, the data engine may attach metadata tags, such as the data receipt time, to the anonymized personalized behavior data. Other metadata tags may already be present in the anonymized personalized behavioral data when they are in the data engine 20 receive, for example, data generation time, data generation location, data type, activity, and data generation device model information.

An interconnect is between the user 40 and the control provider 14 illustrated. The control provider 14 is configured to receive from an identified user an access control unit configuration request specifying one of the service providers and an access configuration setting, and to transmit the access control unit configuration request to the data engine with the anonymous user ID of the identified user. The control provider 14 is a device, for example a server, on which software such as a web application works for a user 40 accessible via the Internet. The control provider 14 may provide an interface (such as a GUI or API) for receiving user access configuration control requests. Such an interface may provide a structure for access configuration control requests.

The identified user may be identified to the control provider by including the anonymous user ID in the access control unit configuration request. The identified user may be identified to the control provider by personal identification information, and the control provider is configured to associate it with an anonymous user ID (for example, by accessing a stored list of links stored by the control provider). The identified user may be identified to the control provider by personal identification information, and the control provider is configured to send it to an ID generation device (an entity separate from the control provider, the data engine, and the service provider) in exchange for an anonymous user ID uniquely identifies the user. The anonymous user ID thus obtained by the control provider may be sent to the user for use in registering for services with the service providers, transmitting personalized behavior data to the data engine (via one or more devices), and / or incorporating access control units communicated to the control provider. Configuration requirements are transmitted.

The control provider 14 may include an interface to receive access control unit configuration requests, and may include a register to store received requests until they are sent to the data engine 20 (more precisely, to the access control unit 24 ) can be issued. The control provider 14 may also include a transmitter configured to receive received access control unit configuration requests to the data engine 20 transferred to. The control provider 14 may be configured to perform a portion of the processing of received access control unit configuration requests prior to transmission to the data engine 20 perform. For example, any identification information must be extracted from the access control unit configuration requests before it is sent to the data engine 20 be transmitted. Certain details can be extracted and stored in the control provider 14 get saved. For example, if the access control unit configuration request specifies that data can be accessed as soon as a toll is charged by the service provider 30 bank details or details about an account with a payment mechanism, such as a user's Paypal ID 40 , by the control provider 14 and associated with the anonymous user ID for which the access control device configuration request was issued.

An interconnect is between the control provider 14 and the access control unit 24 illustrated. The interconnect represents the transmission of access control unit configuration requests to the access control unit 24 through the control provider 14 , A special relationship is made between the access control unit 24 and the control provider 14 defined as the access control unit 24 is configured for the access control unit configuration requests from the control provider 14 and to configure access by the service provider specified in the request to the personalized behavior data personalized with the anonymous user ID according to an access configuration setting included in the request. In other words: the access control unit 24 is configured to receive settings from the control provider 14 although they are separate entities. That is why the access control unit 24 include a mechanism to the control provider 14 at an authorization entity, to authenticate as the source of the received access control unit configuration requests.

The one or more storage devices that store the data 22 form an environment with controlled access. That is, parties wishing to access the data stored therein must authenticate using, for example, passwords, authentication codes, or other techniques. In the same way, the control provider 14 be forced to face the access control unit 24 to authenticate to impose access configuration settings.

The access control unit 24 provides a mechanism for the data engine 20 ready to control which parties can access the personalized behavior data stored in the data store 22 In particular, it may restrict access to authorized service providers only. Furthermore, the access control unit 24 configured to restrict access so that even authorized service providers that have passed the authentication may access only certain anonymized personalized behavior data if the anonymous user ID with which that particular personalized behavioral data has been personalized is known to the service provider, and was submitted in a data access request. Furthermore, the access by the access control unit is configurable according to access configuration settings made through the access control unit configuration requests from the control provider 14 were received. Each of the several service providers 30 can only access the personalized behavioral data of people who have signed up with the service provider (signing up is a process where the user has to submit an anonymous user ID to the service provider).

The interconnection between the access control unit 24 and the data store 22 represents the retrieval of data from the data store 22 through the access control unit 24 in response to a data access request from a service provider 30 , It may even be that the access control unit only determines a range of data from the range specified in the received data access request that matches the access configuration settings and instructs another component to retrieve the particular range of data from the data memory 22 and retrieve the retrieved data to the service provider 30 transferred to.

The access control unit 24 For example, it stores access configuration settings received in a database, such as a register or a datagraph (until it is replaced with a new relevant access configuration setting or becomes invalid for some other reason). Upon receiving a request for data (a data access request) from one of the service providers 30 specifying a range of data and anonymous user ID is the access control unit 24 configured to determine whether access control unit configuration requests have been received (stored) that specify the service provider from which the request was received and the anonymous user ID included in the request, and if so, the access control unit 24 configured to apply the access configuration setting of the access control unit configuration request in determining which data from the area from the data store 22 and call the service provider 30 to be transferred. In other words: the access control unit 24 is configured to determine if there are stored, active or current access configuration settings that are relevant to the received request and to respond to the request to follow these access configuration settings.

Common reference numerals designate common components, so the description above with respect to 1 also applies to the corresponding numbered components in the other figures.

2 illustrates a system of one embodiment. In addition, an exemplary data flow including steps S1 through S12 is shown in FIG 2 illustrated.

The system of 2 is an exemplary implementation of the system of 1 , In addition to the components used in the system of 1 are included in the system of 2 an ID generation device 12 , a source device 42 and a user intermediate device 44 ,

The ID generation device 12 is configured to receive a request from a control provider 14 to recieve. The request may include a user's personal identification information, or the request may be an anonymized request for an ID from the control provider 14 be. The ID generation device 12 is configured to respond to the received request with the creation of an anonymous user ID corresponding to the received request by performing an irreversible process on the received request and the anonymous user ID via the control provider 14 to the user.

The ID generation device 12 is a server or other networked computing device that is only the control provider 14 (or other control providers), for example over the Internet or over a secure network. The control provider 14 can by the ID generation device 12 be certified. The ID generation device 12 Can for more than one control provider 14 be accessible, so that more than one different entity can take on the role of the control provider. The server that is the role of the ID generation device 12 has a network I / O functionality, a memory, a processor configured to execute a program for realizing the functionality of the ID generation device, and a storage unit configured at least to configure the program (in FIG coded form). The program may be an algorithm that maps a short message (the received request) to a much larger message slot (representing the anonymous user IDs) using a cryptographic hash function. Alternatively, the request needs from the control provider 14 contain no identification information, but the text message may consist of information such as time or date information read from a system clock or an external timer. Thus, no two requests received will result in the same anonymous user ID, thus avoiding collisions. In some embodiments, a randomized element may be included such that the mapping of the request to a particular anonymous user ID is at least partially randomized and therefore not reliably reproducible. The ID generation device 12 does not store personal identification information (in some embodiments, it does not even receive any) and does not record issued anonymous user IDs. The ID generation device 12 may be configured to perform its functionality as a stateless procedure.

The control provider 14 may be configured to store certain identification information and optionally corresponding anonymous user IDs. If those data by the control provider 14 are stored, then they are stored in a secure manner, for example password protected, such that when a person transmits personal identification information, a password is provided and that password must then be entered to gain access to stored personal identification information or corresponding anonymous user IDs.

The source device 42 is a device that the user interacts with, and data representing the interaction is provided by the source device 42 generated. That data is behavioral data that is an element of the user's behavior, either by measuring the physical characteristics of the user or by representing a user Interaction between the person and the source device 42 represent. The source device 42 may be a device that either belongs to the user or is accessible to the user. The source device 42 may also be referred to as a behavioral data source device or user device, and in certain implementations, the behavioral data is derived from a behavioral data source device configured to interact with the user to generate behavioral data representing the person's behavior.

The source device 42 can with the data machine 20 via a network, such as the Internet, or may be connected to a user intermediary device 44 be connected to the self-data machine 20 can be connected via a network. The source device 42 may identify self-generated behavioral data with the anonymous user ID of a person, or behavioral data may be non-personalized until it reaches the user intermediary device 44 in which they are personalized by linking to the anonymous user ID of a user.

The user intermediate device 44 is a device, such as a personal computer, a tablet or a mobile phone, to which the user 40 and that is configured to share data with a source device 42 and with a data engine 20 exchange. The user intermediate device 44 may be configured from a source device 42 reformat received data, for example, into a format in which it is sent to the data engine 20 can be transmitted. The user intermediate device 44 may be configured to associate the data with an anonymous user ID provided by the user 40 in the user intermediate device 44 has been entered and stored therein. The anonymous user ID can be associated with behavioral data by adding it to the behavioral data as metadata. A single device may function both as a source device 42 as well as a user intermediate device 44 act.

Examples of source devices 42 include so-called intelligent devices that are self-networked and configured to transmit and / or receive data over a network. source devices 42 may record information representing interactions with a user, which information is associated with a person via an anonymous user ID (which may be linked to behavioral data when created, or by the user or by an intermediary device 44 on behalf of the user in their transmission to the data engine 20 can be added). Those interactions may be a measurement of a physical property of the user, such that the source device 42 may be referred to as a sensor device. For example, the source device 42 a sensor device configured to record a series of measurements of a physical characteristic of the user as behavioral data and the recorded series of measurements to the data engine 20 as anonymized personalized behavioral data, either by anonymously personalizing the behavioral data with the anonymous user ID of the person in the sensor device or via a user intermediary device 44 in which the behavioral data, anonymously personalized with the anonymous user ID of the person, are received and sent to the data engine 20 be transmitted as anonymized personalized behavioral data. A source device may be referred to as a behavioral data source device.

A source device may generate behavioral data representing one or a series of interactions with the user. In another example, a single measurement or a series of measurements may be recorded and transmitted as behavioral data. For example, a physical property of the user may be measured as a physical location, or may be a motion-based physical property, such as a number of steps taken. Other examples include weight, heart rate, temperature or respiratory rate. A user intermediate device 44 and / or a source device 42 may be provided by a party, or may execute software that has been downloaded by a party who is also a service provider 30 is.

In steps S1 to S3, a consumer ID (as an example of anonymous user ID) by the ID generation device 12 in response to a request from the control provider 14 generated. The request from the control provider 14 is initiated by a user 40 personal identification information in the control provider 14 enter and in turn request a consumer ID. The consumer ID is an anonymous user ID. An anonymous user ID is unique, verifiable via a signature and can not be traced back to the user (consumer). The anonymous user ID will be used for all interactions with the data engine 20 used. The anonymous user ID acts as a key that anonymously personalizes behavioral data and identifies data in a data access request (data read request) from a service provider.

The consumer ID is output to the user at step S6. The output can be made by ads in a user area of a website.

Although optional in a data exchange other than that by which the personal identification information is sent to the control provider 14 transmitted, transmits the user 40 In step S1, controls and a service provider ID are also sent to the control provider 14 , The controls and the service provider ID are examples of an access control unit configuration request specifying one of the service providers and an access configuration setting. The controls are an access configuration setting that dictates how behavior data that has been personalized with the user's anonymous user ID (which anonymous user ID may also be included in the access control unit configuration request) for the identified service provider 30 be made accessible.

At step S4, the control provider reports 14 the consumer ID at the data engine 20 and configured as the access control unit 24 the data engine 20 controls access by the identified service provider to behavioral data that has been personalized with the consumer ID. Optionally verifies the data engine 20 in that the identified service provider is supported by the entity responsible for generating the anonymous user ID. The user 40 can always have updated controls (a new access control unit configuration request) through the control provider 14 to the data engine 20 output.

At step S5, the data engine validates 20 the anonymous user ID with a validation service provided by the ID generation device. This step does not need to be repeated if controls or service providers are changed at a later date.

In step S6, the user receives 40 the generated anonymous user ID for use when logging in to a service provider 30 in step S7. Optionally, the control provider 14 the user at a service provider (identified by the user in step S1) 30 log in, so that steps S6 and S7 for the user 40 are transparent.

The service provider 30 that for the user 40 provide anonymous services, provides a mechanism for logging in the person 40 as an anonymous user by providing an anonymous user ID (consumer ID) instead of personal identification information. An interface is provided by the service provider 30 wherein the application only requires providing the anonymous user ID as information identifying the user. That is, the user may be identified as a user of the service because the anonymous user ID is personalized to the user but the user's identity is not revealed by the login. Thus, the service provider knows 30 in that a user has signed up for the service and that the user has an identity issued by the ID generation device, but he is unable to identify the user as a physical person or legal entity.

Optionally, at step S8, the user makes software a user intermediate device 44 downloaded. The software is personalized with the anonymous user ID, so that when the software through the user intermediary device 44 is executed, all of the behavior data received or generated at step S9 is personalized with the anonymous user ID and sent to the data engine 20 can be transmitted. At step S10, the anonymized personalized behavior data is acquired by the user intermediate device 44 to the data engine 20 transfer.

At step S11, the service provider takes 30 a privacy-limited query for behavioral data regarding the user 40 by adding a range of requested data and the user's anonymous user ID 40 be specified. The anonymous user ID is included in the query and is considered a key by the data engine 20 used to identify both the requested data and the access by the service provider 30 to authorize. Part of the service provider's authentication 30 can through the data machine 20 be executed. Furthermore, the data engine 20 configured to implement the controls received in step S4 in determining whether access by the service provider 30 should be allowed and which data may be read in response to the query. The controls are settings that dictate what data associated with the anonymous user ID is the service provider 30 may access. For example, the controls may specify that the service provider may access only behavioral data that is within a particular date range or by a particular source device 42 were generated. At step S12, the data engine issues 20 to the service provider 30 the data from the requested area according to the controls.

At step S13, the service (for example, a calorie count) is provided anonymously to the user based solely on the anonymous user ID.

A single step or a combination of steps from S2, S3, S1, S11, S12 and S10 may be secured via a PKI. Alternatively or additionally, a single step or a combination of steps from S1, S6, S11, S9 and S10 can be secured via a password.

Optionally, the embodiment may be implemented as an enhanced version of the coelition provider. In such an embodiment, the ID generation device is 12 a Coeltion IDA, the anonymized personalized behavioral data are atoms, the anonymous user ID is a ConsumerID, the service provider 30 are registered by the Coelition agency as Coelition-compatible service providers, and the data engine is a Coelition-compatible data engine.

As a concrete use scenario of the system of 1 and 2 Imagine a user who wants to get value in return for allowing a service provider to access his data. The data engine 20 has control over the anonymized personalized behavioral data of the user, but no way the user 40 to identify. The control provider 14 is by a party other than the data engine 20 operated. That's why the control provider 14 associate the anonymous user ID with the user's personal identification information (such as a Paypal ID or bank details) without the anonymity of the user in the data engine 20 to sacrifice. The control provider 14 Provides a means by which the user 40 may specify a destination (ie, an access fee) that a service provider 30 to access data that has been anonymously personalized with the user's anonymous user ID. For example, the control provider 14 Receive reports from the data engine about read accesses granted on data that has been anonymized by the data access control unit with a particular anonymous user ID. On the basis of this data, the control provider 14 then the service provider 30 make an invoice and the compensation on the basis of an agreed contract to the user 40 transfer.

3 FIG. 12 is a block diagram of a computing device, such as a data storage server, embodying the present invention that may be used to implement a method of one embodiment of the system. The computing device includes a processor 993 and a memory 994 , Optionally, the computing device also includes a network interface 997 for communication with other computing devices, for example, with other computing devices of embodiments of the invention.

The data engine 20 , the service provider 30 , the ID generation device 12 and / or the control provider 14 can be used as computer devices such as the ones in 3 be embodied, be embodied.

For example, one embodiment may consist of a network of such computing devices. Optionally, the computing device also includes one or more input mechanisms, such as keyboard and mouse 996 and a display unit, such as one or more monitors 995 , The components can be over a bus 992 be connected to each other.

The memory 994 may contain a computer-readable medium. This term may refer to a single medium or multiple media (eg, a centralized or decentralized database and / or associated caches and servers) configured to carry computer-executable instructions or to be provided with stored data structures. Computer-executable instructions may include, for example, instructions and data that may be accessed by a general purpose computer, a special purpose computer or special processing device (eg, one or more processors), and that will cause a general purpose computer, special purpose computer, or special processing device (eg, one or more processors) can perform one or more functions or operations. Thus, the term "computer-readable storage medium" may also include a medium capable of storing, encoding, or transporting a set of instructions for execution by the machine and causing the machine to perform one or more of the methods of the present disclosure , Accordingly, the term "computer readable medium" may be understood to include solid state memory, optical media, and magnetic media. Such computer readable media may include, for example: non-transitory computer readable storage media, including random access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), compact disc read only memory (CD-ROM), or other optical disk storage; Magnetic disk storage or other magnetic storage devices, flash memory devices (for example, solid state storage devices).

The processor 993 is configured to control the computing device and perform processing operations, for example, to execute code stored in the memory to implement the various functions of functional components described herein and in the claims. The memory 994 stores Data by the processor 993 be read and written. As discussed herein, a processor may include one or more general purpose processing devices such as a microprocessor, a central processing unit, or the like. The processor may include a Complex Instruction Set Computing (CISC) microprocessor, a Reduced Instruction Set Computing (RISC) microprocessor, a Very Long Instruction Word (VLIW) microprocessor, or a processor that implements other instruction sets, or a combination of processors Implement instruction sets. The processor may also include one or more special processing devices such as an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a digital signal processor (DSP), a network processor, or the like. In one or more embodiments, a processor is configured to execute instructions for performing the operations and steps discussed herein.

The display unit 997 may display a representation of data stored by the computing device and may also display a cursor and dialog boxes and screens that facilitate the interaction between a user and the programs and data stored in the computing device. The input mechanisms 996 may allow a user to enter data and commands into the computing device.

The network interface (network SS) 997 may be connected to a network, such as the Internet, and may be connected to other such computing devices via the network. The network SS 997 can control data input and output to or from other devices over the network. There may be other peripheral devices such as microphone, speakers, printer, power supply, fan, housing, scanner, trackball, etc. included in the computing device.

A control provider 14 of the 1 to 2 can be a processor 993 be (or can be a processor 993 operate) that executes processing instructions (a program, script, or compiled program) stored in the memory 994 are stored and sends data over a network SS. For example, the processor 993 Execute processing commands to pass through the network SS 997 Data of a user at step S1 of FIG 2 to receive a request to the ID generation device 12 at step S2 and a response from the ID generation device 12 via the network SS at step S3, and data over the network SS 997 to the data engine 20 at step S4 of FIG 2 to send. Furthermore, the processor 993 Processing instructions to execute the anonymous user ID via the network SS at step S6 997 to send to the user.

A data machine 20 of the 1 to 2 can be a processor 993 (or more of them) executing processing instructions (a program) stored in a memory 994 are stored, and data over a network SS 997 with a data store 22 exchanges that through the store 994 is formed. More precisely, the processor performs 993 Processing commands to retrieve data about the network SS from the control provider at step S4 of FIG 2 to recieve. Furthermore, the processor 993 Execute processing commands to pass through the network SS 997 the anonymous user ID to the ID generation device 12 for validation in step S5 of 2 to send. The processor 993 may also execute processing instructions to complete the query at step S11 of FIG 2 to receive an answer to the query by accessing the memory of the memory 994 optionally generate the retrieved data in the processor 993 and process the result as a response to the query over the network SS at step S12 of FIG 2 send.

A service provider 30 of the 1 to 2 can be a processor 993 (or more of them) executing processing instructions (a program) stored in a memory 994 are stored, and data over a network SS 997 exchanges. More precisely, the processor performs 993 Processing commands to the data exchange processes of steps S7 and S8 over the network SS 997 perform. The processor may also execute processing instructions to poll over the network SS 997 to the data engine 20 at step S11 of FIG 2 and to receive the answer at step S12. The service provider may also execute processing instructions to perform behavioral data processing as a service to the user 40 to provide and output the results in step S13.

A behavioral data source device 42 from 2 can be a processor 993 which executes processing instructions (a program, script, or compiled program) stored in memory 994 stored and exchanges data over a network SS. In particular, the processor can 993 Execute processing instructions to complete step S9 of FIG 2 to send data to the user intermediate device via the network SS that represents an interaction with the system user.

A user intermediate device 44 from 2 can be a processor 993 which executes processing instructions (a program, script, or compiled program) stored in memory 994 are stored, and data over a network SS 997 exchanges, and a system user information about an ad 995 and inputs from the system user via an input 996 answers. More precisely, the processor can 993 Processing instructions to execute step S10 of FIG 2 the anonymous personalization of the behavioral data and the transmission of the behavioral data over a network SS 997 to the data engine 20 perform.

Methods embodying the present invention may be applied to a computing device, such as those disclosed in U.S. Patent Nos. 4,766,701; 3 is illustrated. Such a computing device need not have every component included in 3 is illustrated, and may consist of a subset of these components. A method embodying the present invention may be performed by a single computing device communicating with one or more data storage servers over a network.

A method embodying the present invention may be performed by a plurality of computing devices that operate in concert with each other. One or more of the multiple computing devices may be a data storage server that stores at least a portion of the anonymized personalized behavior data.

Claims (16)

A system for storing personalized data and controlling access to personalized data, the system comprising: a data engine comprising a data store and an access control unit and configured to receive anonymized personalized behavior data and to store the received anonymized personalized behavior data in the data store, the access to the stored anonymized personalized behavior data being controlled by the access control unit, the anonymized personalized behavioral data is behavioral data that represents a user's behavior, the behavioral data being anonymously personalized with an anonymous user ID; wherein the access control unit is configured to make configurable anonymized personalized behavior data configurably accessible to service providers when a request is received from one of the service providers for data specifying the anonymous user ID with which the requested data was personalized anonymously, wherein the service providers are entities separate from the data engine; a control provider, as an entity separate from the data engine, configured to receive from an identified user an access control unit configuration request specifying one of the service providers and an access configuration setting, and the access control unit configuration request to the data engine having the anonymous user ID to send the identified user; wherein the access control unit is configured to receive the access control unit configuration request and to configure the access by the specified one of the service providers to the personalized behavior data that has been personalized with the anonymous user ID according to the access configuration setting. The system of claim 1, wherein the access configuration setting is to enable or disable access by the specified one of the service providers to the personalized behavior data personalized with the received anonymous user ID. A system according to claim 1 or 2, wherein the access configuration control request specifies a setting application condition; and the access control unit is configured to selectively apply the specified access configuration setting depending on whether the requested data satisfies the setting application condition. The system of claim 3, wherein the behavioral data is categorized according to a hierarchical taxonomy; and the setting application condition specifies a range of the hierarchical taxonomy. The system of claim 4, wherein the access configuration setting is to disable the access until the behavior data that satisfies the setting application condition has been removed. A system according to claims 1 to 5, wherein the behavioral data is stored by the data engine in association with metadata specifying a value of one or more of data reception time, data generation time, data generation location, data type, activity, and data generation device model information; and the setting application condition is a specified range of values of one of the one or more properties. The system of claims 1 to 6, wherein the control provider is configured to: Receive identification information that identifies a user's identity, transmits an identity request corresponding to the received identification information to an ID generation device, in return receives an anonymous user ID, and outputs the anonymous user ID to the user. The system of claim 7, further comprising an ID generation device configured to generate the anonymous user ID by performing an irreversible process in response to receiving the request and the anonymous user ID to the user via the control provider issue. The system of claim 7 or 8, wherein each of the plurality of service providers is registered with the ID generation device. A system according to any one of the preceding claims, wherein: the specified access configuration setting is one or more access policies; and the access control unit accesses, by the specified one of the service providers, to the personalized behavioral data personalized with the anonymous user ID according to the access configuration setting by allowing access by the specified one of the service providers to one or more of the conditions specified by the specified one of the service providers configured according to multiple access rules. The system of claim 10, wherein: one of the one or more access provisions is a cash payment from the specified service provider to the user. The system of any one of the preceding claims, wherein the data engine is configured to: for each anonymous user ID, maintaining a record of data access requests permitted by the anonymized personalized behavior data access control unit anonymized by the anonymous user ID of each of the service providers; and to transmit the record to the control provider periodically and / or in response to a triggering event. System according to one of the preceding claims, wherein the access control unit is configured to receive from a service provider a request for data specifying one or more anonymous user IDs that anonymously personalize the requested data and a data area, and to respond to the request that for each of the one or more anonymous user IDs retrieves from the data store anonymized personalized behavior data stored in association with the anonymous user ID from the specified data area according to access control settings received for the service provider in access control unit configuration requests associated with be transmitted to the anonymous user ID; and output the retrieved data to the requesting service provider as a unified output. The system of any one of the preceding claims, wherein the access control unit configuration request specifies more than one service provider among the service providers, and the access configuration setting is for each of the specified more than one service provider. A method of storing personalized data and controlling access to personalized data, the method comprising: storing in a data engine, anonymized personalized behavior data, storing the received anonymized personalized behavior data in a data store, the anonymized personalized behavior data being behavioral data representing a user's behavior, the behavior data being anonymously personalized with an anonymous user ID; Controlling access to the stored anonymized personalized behavior data by making the stored anonymized personalized behavior data configurable to the service provider when one of the service providers obtains a request for data specifying the anonymous user ID with which the requested data is requested anonymized, the service providers being separate entities from the data engine; in a control provider, an entity separate from the data machine, receiving, from an identified user, an access control unit configuration request specifying one of the service providers and an access configuration setting, and transmitting the access control unit configuration request to the data engine with the anonymous user ID of the identified user ; and in the data engine, receiving the access control unit configuration request and configuring the access by the specified one of the service providers to the personalized behavior data that has been personalized with the anonymous user ID according to the access configuration setting. Computer program that, when connected by interconnected computer devices is executed causes the interconnected computer devices to carry out a method according to claim 15.

Images