(19)
(11)EP 3 459 001 B1

(12)EUROPEAN PATENT SPECIFICATION

(45)Mention of the grant of the patent:
03.08.2022 Bulletin 2022/31

(21)Application number: 17798873.0

(22)Date of filing:  11.05.2017
(51)International Patent Classification (IPC): 
G06F 21/62(2013.01)
G06F 21/60(2013.01)
(52)Cooperative Patent Classification (CPC):
G06F 21/606; H04L 63/0428; H04L 63/20
(86)International application number:
PCT/IL2017/050522
(87)International publication number:
WO 2017/199235 (23.11.2017 Gazette  2017/47)

(54)

SYSTEM AND METHOD FOR PRIVACY POLICY ENFORCEMENT

SYSTEM UND VERFAHREN ZUR UMSETZUNG VON DATENSCHUTZRICHTLINIEN

SYSTÈME ET PROCÉDÉ D'APPLICATION DE POLITIQUE DE CONFIDENTIALITÉ


(84)Designated Contracting States:
AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

(30)Priority: 16.05.2016 US 201662336764 P

(43)Date of publication of application:
27.03.2019 Bulletin 2019/13

(73)Proprietor: Privacy Rating Ltd.
Ganey-Tikva 5591491 (IL)

(72)Inventors:
  • WASSERMAN, Yehonatan
    5529339 Kiryat-Ono (IL)
  • KOREN, Yoseph
    5529339 Kiryat-Ono (IL)

(74)Representative: Pearl Cohen Zedek Latzer Baratz UK LLP 
The Gridiron Building One Pancras Square
London N1C 4AG
London N1C 4AG (GB)


(56)References cited: : 
WO-A1-2015/016828
US-A1- 2007 250 904
US-A1- 2012 110 680
US-A1- 2013 290 716
US-A1- 2007 250 904
US-A1- 2009 300 716
US-A1- 2013 159 021
US-A1- 2015 312 263
  
  • THILAKANATHAN12, D. ET AL.: 'SafeProtect : Controlled Data Sharing with User-Defined Policies in Cloud-based Collaborative Environment' IEEE TRANSACTIONS ON EMERGING TOPICS IN COMPUTING, [Online] vol. 4, no. 2, 31 December 2012, pages 301 - 315, XP011613149 Retrieved from the Internet: <URL:https://www.researchgate.net/profile/R afael_ Calvo/ publication/284709537_SafeProtect_Controlle d_Data_Sharing_with_User- Defined_Policies_in_Cloud-Based_Collaborati ve_Environment/ links/57f9516008ae91deaa616a5b.pdf> [retrieved on 2017-08-08]
  
Note: Within nine months from the publication of the mention of the grant of the European patent, any person may give notice to the European Patent Office of opposition to the European patent granted. Notice of opposition shall be filed in a written reasoned statement. It shall not be deemed to have been filed until the opposition fee has been paid. (Art. 99(1) European Patent Convention).


Description

FIELD OF INVENTION



[0001] The present invention relates to communication systems. More particularly, the present invention relates to architecture of communication systems and methods for enforcement of privacy policies that enable controlled reconciliation of data exchange and metadata gathering.

BACKGROUND OF THE INVENTION



[0002] In recent years more and more communication sessions are being biased (in terms of shared data and application usage) toward one party which has specific advantages that can be raised from either technology superiority or formal regulation power, and/or any other item. Such biasing may occur due to rapid development of communication related software, as well as due to development of computer technology. Furthermore, currently there are no means to enforce and assure any privacy agreements or settlements between users and service providers so there is no sufficient tracking of privacy protocols.

[0003] Securing the privacy elements of a user's device engaging with other users (among others, with application providers) and/or conduct various transactions via a communication network by way of computer applications, has been a challenge for many years with the rapid development of computer technology. For example, social network providers use cookies and/or social plug-ins in computer's browsers and/or applications, such cookies may collect user's data. Plug-ins main role is to assist and improve user experience by: linking to websites, executing objects, "like" mark of content, "share" data and the like. Such plug-ins may be configured with additional hidden operators (e.g. special Java scripts) that stimulate collection of private data from user's devise to the social network provider's server.

[0004] Typically, communication sessions are carried out via open systems interconnection (OSI) architecture, which is a conceptual architecture characterizing and standardizing the communication functions of a telecommunication or computing system without regard to their underlying internal structure and technology. Its goal is the interoperability of diverse communication systems with standard protocols. This architecture partitions a communication system into numerous abstraction layers, wherein each layer serves the layer above it and is served by the layer below it. The original version of the model defines seven layers. At each level N, two entities at the communicating systems (layer N peers) exchange Protocol Data Units (PDUs) by means of a layer N protocol. Each PDU contains a payload, called the Service Data Unit (SDU), along with protocol-related headers and/or footers.

[0005] An example of commercial use of OSI architecture is the Internet protocol suite, in which computers, servers, routers and other devices" layout and set of communications protocols are used to form computer networks and/or communication systems. For example, TCP/IP provides end-to-end data communication functions. This functionality is organized into four abstraction layers which are used to sort all related protocols according to the scope of networking involved.

[0006] Another example may be for application providers wishing either to present pre-paid ads and/or sell statistical user's information to certain third parties, and are therefore, for instance, willing to enable in return user experience with their social application, whereby such application may verify that user information is available (as agreed between the parties) and not manipulated.

[0007] Another example may be for application providers that need to prove to formal regulatory entities (e.g. EU GDPR - general data protection regulations) that they meet the mutually agreed privacy settlement that represent the agreed privacy trade-off between the specific user and/or other specific application provider in full, in order to be relieved from regulatory limitations and fines. US 2012/0110680 describes application of privacy policies to structured data.

SUMMARY OF THE INVENTION



[0008] There is thus provided, in accordance with some embodiments of the invention, a method and a corresponding system for privacy policy enforcement to ensure reconciliation between a user and a service provider communicating via an open system interconnection "OSI" communication architecture, the method comprising: receiving, by a privacy settlement bureau, a privacy policy for a device of the user; receiving, by the privacy settlement bureau, a usage policy for the service provider, wherein the privacy settlement bureau remotely manages policies for the user and the service provider; receiving, by a first server, via a network having a privacy layer monitored by the privacy settlement bureau, at least one dataset from the user's device to be sent to the service provider, wherein the at least one dataset comprises at least one data segment; receiving, at the first server, from the privacy settlement bureau, a privacy policy enforcement vector comprising encryption codes; encrypting, by the first server, the received at least one data segment based on the received encryption codes; receiving, at a second server, from the first server, at least one encrypted data segment; receiving, at the second server, from the privacy settlement bureau, a selective corresponding keys vector having selective decryption keys corresponding to the encryption codes and configured to allow decryption of at least one encrypted data segment when a match between the privacy policy and the usage policy occurs to decrypt the at least one encrypted data segment; and performing selective decryption, by the second server, for each received at least one encrypted data segment based on the selective corresponding keys vector, wherein at least one encrypted data segment is decrypted when a match between the privacy policy and the usage policy occurs, wherein at least one of the first server and the second server is external to the user's device and the service provider, and wherein the decrypted at least one data segment passes through the privacy layer added to OSI architecture, the privacy layer being in communication with the user's device.

[0009] Further embodiments are defined in the appended dependent claims.

BRIEF DESCRIPTION OF THE DRAWINGS



[0010] The subject matter regarded as the invention is particularly pointed out and distinctly claimed in the concluding portion of the specification. The invention, however, both as to organization and method of operation, together with objects, features, and advantages thereof, may best be understood by reference to the following detailed description when read with the accompanying drawings in which:

Fig. 1A schematically illustrates a known communication system with a privacy management platform;

Fig. 1B schematically illustrates a known communication system with privacy management platform and local control units;

Fig. 2 schematically illustrates a communication system with an extended OSI architecture including a privacy layer, according to some embodiments of the invention;

Fig. 3 shows a flow diagram for privacy policy enforcement between a user and a service provider, according to some embodiments of the invention;

Fig. 4 schematically illustrates data flow in a communication session from a user to a service provider within the open communication system, according to some embodiments of the invention; and

Fig. 5 schematically illustrates data flow in a communication session from a service provider to a user within the open communication system, according to some embodiments of the invention.



[0011] It will be appreciated that for simplicity and clarity of illustration, elements shown in the figures have not necessarily been drawn to scale. For example, the dimensions of some of the elements may be exaggerated relative to other elements for clarity. Further, where considered appropriate, reference numerals may be repeated among the figures to indicate corresponding or analogous elements.

DETAILED DESCRIPTION OF THE PRESENT INVENTION



[0012] In the following detailed description, numerous specific details are set forth in order to provide a thorough understanding of the invention. However, it will be understood by those skilled in the art that the present invention may be practiced without these specific details. In other instances, well-known methods, procedures, and components have not been described in detail so as not to obscure the present invention.

[0013] It should be noted that as used herein, the term data may refer to private data and/or data that has been identified as such that is structured as any type of data including datasets (e.g. cluster, grouping and/or integrated data), data segments and/or data fragments (e.g. private information unit and/or user experience unit and/or any other data unit selected as private data by users). As used herein the term data may also refer to any type of information, signals, metadata, artificial intelligence algorithm output, bots output, automatic robots operation, and the like. In some embodiments, data as used hereinafter may also include applicable or relevant data, for example information which might be generated separately and/or as a response to a request by the user and/or by the service provider.

[0014] Reference is now made to Figs. 1A-1B, which schematically illustrate a known communication system 100 with a privacy management platform 108. Communication system 100 connects a user 102, for instance using a computerized device, with a service provider 106 that provides some service to the user via at least one communication network 104, 114. It should be appreciated that as used herein, the term network may refer to a wired, wireless and/or cellular network

[0015] Network 104, 114 comprises an open systems interconnection (OSI) architecture that operates as a third party in communication with a privacy management platform 108 providing a policy for engagement (e.g. in communication sessions) between the user 102 and the service provider 106 such that neither the user nor the service provider influence and/or control OSI architecture of network 104, 114 (e.g. controlling communication of private data via parallel system(s) and/or privacy management platform).

[0016] It should be noted that data passing from user 102 to service provider 106, initially passes upstream 103 towards a first network 104 with OSI architecture, wherein the term upstream refers to the direction in which data can be transferred from the client to the server (e.g. uploading). Then, data passes downstream 113 to privacy management platform 108 for privacy management, wherein the term downstream refers to the "opposite" direction in which data can be transferred from the server to the client (e.g. downloading). From privacy management platform 108 to service provider 106, data passes upstream 115 to second network 114 (also having OSI architecture), and then downstream 105 to service provider 106. It should be appreciated that in such a communication system all information must pass through OSI architecture via protocol of network 104, 114 and then in addition, all information must pass through privacy management platform 108 therefore creates additional high network traffic passing through the privacy management platform 108, thereby creating lower efficiency, which may require additional (e.g. doubled) hardware means (additional routers, servers, and the like, in order to process all network protocol and privacy enforcement) together with additional processing time.

[0017] It should be noted that for data passing from service provider 106 to user 102, the direction of data may be reversed. Specifically, data may be uploaded upstream 105 to second network 114, then downstream 115 to privacy management platform 108, then upstream 113 to first network 104, and finally downstream 103 to user device 102.

[0018] At least some of privacy policy enforcement may be executed at local units (e.g. such architecture may include partial privacy enforcement by local unit(s), partial controlling communication of private data via parallel system(s) and/or quasi privacy management platform). As illustrated in Fig. 1B, the communication system 100 may further comprise a user's privacy control unit 107, and a service provider's privacy control unit 109. Thus, objectivity of the system and the network protocol may be compromised and manipulated in case that additional elements have access to end units, wherein such privacy control units 107, 109 may at least partially enforce privacy policy of transferred data instead of all privacy policy enforced by privacy management platform 108. It should be appreciated that in such a communication system, objectivity may be lost since privacy is managed at the end units (i.e. the users) instead of a third party.

[0019] It should be noted that as used herein, the term network may refer to any wired, wireless, global and/or local, cellular, cloud based, or any other communication network.

[0020] Reference is now made to Fig. 2, which schematically illustrates a communication system 200 with a privacy layer 211, according to some embodiments of the invention. It should be appreciated that with this communication system 200, different types of data may be transferred to different elements. Similarly to the system shown in Figs. 1A-1B, specific privacy policy configuration may be set up for a user 202 via communication network 204 (e.g. a wired, a wireless network or a cloud based network), wherein user 202 may define all privacy preferences regarding data fragments and services (e.g., private data and user experience) to be obtained from service provider 206. It should be noted that in some cases a service provider may also be considered as a "user" communicating with a different service provider.

[0021] In some embodiments, service provider 206 may also provide general default options to user 202 regarding privacy settings with a corresponding usage policy. It should be noted that such general options are not specific to a particular user, whereby the user is not identified. An example for a privacy policy may be sharing location and output of social plug-ins (e.g. application plug-ins, SDK's, API's and browser plug-ins, such plug-ins are usually created as operators and/or communication utilities for improved and efficient user experience that link between activities, share content and support services), and an example for a usage policy may be allowing access to application data and content, for instance a usage policy to provide service subject to receiving advertisements or not from service provider 206. In some embodiments, service provider 206 may also specifically define user experience parameters and communicate with network 204, as further described hereinafter.

[0022] In some embodiments, network 204 may comprise an open systems interconnection (OSI) architecture 210 that may act as a third party providing a policy and/or protocol for engagement (i.e. communication session) between the user 202 and the service provider 206 such that neither the user nor the service provider may influence, or manipulate the policy by controlling OSI architecture 210 of network 204.

[0023] According to some embodiments, OSI architecture 210 may have an abstraction layer based structure, for instance in a non-limiting embodiment having seven data layers, wherein each data layer communicates with neighboring layers and differently enlarge and/or reduce the data string (e.g. by adding layer related payload and/or change in template and/or protocol related header and/or footer). In some embodiments, an additional privacy layer or protocol 211 may be added to the layer structure of OSI architecture 210 while maintaining its layer structure (i.e. changing the data string and serving the layer above, and being served by the layer below), such that the main architecture of the system may be maintained, as an extended OSI architecture. It should be noted that privacy layer or protocol 211 may be utilized for sharing of data and metadata based on preferences of users, as further described hereinafter. It should be appreciated that in contrast to some commercially available solutions, only a single already existing network 204 may be required since there is no longer a need for adding separate duplicate infrastructure (e.g. servers, routers and the like) and all communication may pass through the same network 204.

[0024] It should be noted that communication between user 202 and network 204, for instance including the extended OSI architecture 210 and 211 may be set up and defined with specific configurations for each user 202 (e.g. selected level of user experience made of content, activities and/or services to be shared by the service provider with the user). Thereby defining the initial privacy input level that arrives to user 202. With such connection, user 202 may for instance view and/or modify and/or reset the privacy settings. In some embodiments, data arriving from user 202 (e.g. as a dataset) may be fragmented to multiple data fragment units that may be shared with other users and/or service providers, for example user's device information, and/or result of and/or response to a social plug-in script.

[0025] Similarly, communication between service provider 206 and network 204 may be set up and defined with general configurations for each service and content (e.g., user experience unit) using at least one privacy input object and one output level of the service. In some embodiments, the default configuration for all services may be defined as "closed" such that communication may be established only when both parties (i.e. user and service provider) agree to share particular content item. In some embodiments, data arriving from service provider 206 (e.g. as a user experience cluster) may be fragmented or split into multiple user experience units that may be later enabled for other users and/or service providers, for example content information or advertising.

[0026] According to some embodiments, user 202 and service provider 206 may further communicate with a Privacy Settlement Bureau (PSB) 208 (e.g. server implemented as a separate, remote server and/or cloud based server and/or other independent set of servers, managing policies remotely form the user and the service provider in order to maintain objectivity and be able to certify the settlement as required by official authorities), for instance via network 204 or some other network Privacy settlement bureau 208 may communicate with OSI architecture 210 with added privacy layer 211 via network 204, so as to control privacy configurations of data transfer between user 202 and service provider 206. In some embodiments, privacy preferences for user 202 may be initially set up with a first connection 203 to privacy settlement bureau 208, and similarly general usage preferences for service provider 206 may be initially set up with a second connection 205 to privacy settlement bureau 208. Thus, privacy settlement bureau 208 may receive only the privacy policy and usage policy from user 202 and service provider 206 (respectively) such that additional information may be transferred to other elements, as further described hereinafter. In some embodiments, privacy policy and usage policy may be received as a privacy matrix, having various privacy vectors for different users.

[0027] According to some embodiments, all data transferred may be in "normally closed" state (i.e. closed by default), meaning that all data may be initially (upstream) encrypted. In case that the privacy policy of user 202 matches the usage policy of service provider 206, for specific segments of data, then this data may be (downstream) exposed 209 (or decrypted). In some embodiments, a data segment not matching (or contradicting) the privacy policy may be shown as non-decrypted unreadable marked junk data segments, and/or nullified, for instance replaced with a random string of characters, or replaced with a predefined string of marked junk characters and/or null.

[0028] It should be appreciated that privacy layer 211 may be added utilizing the same communication network 204 (such that additional servers and routers and other network hardware elements are not required), while maintaining the full objectively control of data transfer between user 202 and service provider 206 (e.g. for certification purpose).

[0029] It should be noted that service provider 206 may have an initial encryption on all data (that is unchanged by system 200), and the encryption of system 200, passing through privacy layer 211, may be added as a second (upstream) encryption layer of data to that initial encryption, for example initial encryption "A" as shown in Fig. 4. In some embodiments, such second encryption layer (for example encryption "B" as shown in Fig. 4) may provide in real-time encryption based on predefined parameters that user 202 and service provider 206 are willing to expose (e.g. matching privacy policy), and also parameters that user 202 and service provider 206 are not willing to expose (e.g. not matching and/or contradicting privacy policy and thereby marked and non-decrypted).

[0030] In some embodiments, data transferred from user 202 may pass to privacy layer 211 on a separate channel 213, and similarly data transferred from service provider 206 may pass to privacy layer 211 on a separate channel 215. In some embodiments, all data passing through privacy layer 211 may be monitored by privacy settlement bureau 208, for instance with predefined session control 201.

[0031] According to some embodiments, data transfer between user 202 and service provider 206 may be encrypted and/or decrypted based on privacy policy and usage policy that are initially provided to privacy settlement bureau 208 with first connection 203 and second connection 205, as described above. Thus, data from user 202 may pass upstream to network 204 so as to undergo encryption by privacy layer 211 within the extended OSI architecture. Then, a session 201 with privacy settlement bureau 208 applying privacy policy vector may check or compare privacy policy with usage policy so as to provide privacy layer 211 with elements to enforce privacy policy preferences (from user 202) that match usage policy and should therefore be decrypted, as further described in Fig. 4. The decrypted data may then pass downstream from network 204 to service provider 206, while elements that do not match and/or contradict the usage policy may pass non-decrypted as marked junk data.

[0032] Similarly, data from service provider 206 may pass upstream to network 204 so as to undergo encryption by privacy layer 211 of extended OSI model. Then, a session 201 with privacy settlement bureau 208 applying usage policy vector may check or compare privacy policy with usage policy so as to provide privacy layer 211 with elements of usage policy level (from service provider 206) that match privacy policy and should therefore be decrypted, as further described in Fig. 5. The decrypted data may then pass downstream from network 204 to user 202, while elements that do not match and/or contradict the usage policy may pass non-decrypted as marked junk data and/or nullified. It should be appreciated that with such a system objectivity may be maintained, since privacy settlement bureau 208 only stores privacy policy and usage policy while encryption and decryption are carried out with privacy layer 211 within the external network 204.

[0033] In some embodiments, such a system may also prevent access to automatic/computerized artificial intelligent robot's behavior trying to bypass privacy layer and/or protocols since an additional layer of data is created and such a robot cannot penetrate the user or service provider as the privacy layer is "normally closed". For example, an alert may be created if the system identifies a manipulation attempt on the privacy layer.

[0034] According to some embodiments, such a communication system 200 having an addition privacy layer 211 (as an extended OSI model) may allow controlled, structured and consistent reconciliation of data exchange and metadata gathering between users.

[0035] It should be appreciated that adding the privacy layer and/or protocol to the OSI architecture as the extended OSI may be carried out as part of the OSI layer structure and may include several steps (for instance implemented as a script or algorithm) that may include initially identifying relevant or applicable data (e.g. private data items such as user's location, user's browser history and the like and user experience items by the service provider such as retrieve data from external source, activate external service and the like), such that only data types that may be treated by such a communication system are processed, i.e. data from user and/or service provider to be encrypted and decrypted according to privacy and usage policy. After such identification, all data may be (upstream) encrypted and then data segments corresponding to a match between the privacy policy and the usage policy are (downstream) selectively decrypted while the remaining data segments (with no-match and/or contradicting policy) are not-decrypted (e.g. marked and then nullified or become junk data). It should also be noted that such a privacy layer may also maintain data transfer structure between layers of the OSI architecture so an additional step of integrating of access to and/or from other layers (i.e. changing the data string and serves the layer above and being served by the layer below) may also be implemented. Thus, the operation of adding an additional privacy layer to the OSI model may be regarded as equivalent to carrying out these steps.

[0036] Reference is now made to Fig. 3, which shows a flow diagram for privacy policy enforcement between a user and a service provider, according to some embodiments. Initially, privacy policy for at least one user device and usage policy for at least one service provider may be received 301, for instance by the privacy settlement bureau via the OSI architecture. For example, privacy policy and usage policy may be received by privacy settlement bureau during initial setup of the system, e.g. as described in Fig. 2. In some embodiments, a service provider may be also considered as a user with a privacy policy and/or usage policy so as to allow communication between at least two users. It should be noted that the usage policy may define at least two usage levels, a first usage level and a second usage level, wherein the first usage level may correspond to a first privacy policy and the second usage level may correspond to a second privacy policy. For example, a service provider offering different usages to which the user has different privacy policies.

[0037] Next, a fragmented dataset that is applicable (e.g. private data items such as user's audio sensor output, user's web search history and the like and user experience items by the service provider such as updated data at external source, activate link for closed list of members and the like) to be processed by the system may be identified 302, for instance as part of adding a privacy layer to an OSI architecture (thereby creating the extended OSI architecture) so as to allow data segments transmitted between the user's device and the service provider, wherein the privacy layer may comprise some reference information, such as communication session identification, regarding the privacy policy and the usage policy. Encryption codes may then be received 303 from the privacy settlement bureau, with selective corresponding decryption keys to be provided at a later stage. All data segments may then be encrypted 304 and then transferred 305 between the user and the service provider. For example, encrypt (upstream) all data passing from user to network via extended OSI architecture.

[0038] Next, privacy policy enforcement vector may be received 306 by privacy layer of extended OSI architecture, for example received from privacy settlement bureau. Based on the privacy policy enforcement vector, encrypted elements of data may be selectively decrypted or exposed 307 to be read by the other party (e.g. read by service provider).

[0039] In case that data segments do not correspond to a match (or contradict) at least one of the privacy policy and the usage policy, then these data segments may be marked and thereby remain as non-decrypted, as marked junk data and/or nullify that cannot be read by the other party. Finally, the fragmented dataset (e.g., data segments) may be sent 308 to the other party, with elements that are exposed (i.e. decrypted) and possibly with elements not matching privacy policies that appear as non-decrypted, marked junk data and/or nullify, such that enforcement of privacy policy may be finally achieved.

[0040] According to some embodiments, such privacy policy enforcement vector may allow controlled, structured and consistent reconciliation of data exchange and metadata gathering between users (e.g. to enable official certification issuance).

[0041] Reference is now made to Fig. 4, which schematically illustrates data flow from a user 402 to a service provider 406 within the communication system, according to some embodiments. It should be appreciated that Fig. 4 illustrates an exemplary data flow within communication system 200, for instance as shown in Fig. 2.

[0042] User 402 may provide a dataset of data segments 409, for instance a dataset (or list) with an array of different data types, having information regarding at least one of internet protocol (IP) address, geographic location, and data from at least one sensor 1-i, for instance data from camera sensor. It should be noted that while some data types are general data structure (e.g. IP address), other information and/or signal may be specific data structure such as mouse movement over the screen, so at least some of the information in dataset 409 may be chosen by the user as initially locked 403 in the user privacy policy. In some embodiments, dataset 409 may include data fragment units.

[0043] In some embodiments, some elements in dataset 409 are initially encrypted 403 (e.g. by an external application) prior to usage of privacy policy. This initial encryption may be later decrypted (externally of the communication system described herein) after data transfer between user 402 and service provider 406 is completed such that this basic encryption 403 may not affect the encryption 413 of the privacy protocol 410 as these two encryption methods are separated by different layers and cannot combined. For example, a data fragment initially encrypted 403 by an external party (e.g. by a social application) is further encrypted 413 by privacy protocol 410 so that only after encryption by privacy protocol 410 is removed (i.e. decrypted if match to privacy policy), the initial encryption 403 may also be removed by the external application provider.

[0044] Dataset 409 may then be transferred to network 404 (e.g. wired or cloud based network) having privacy protocol 410, and passed to a first server (or processor) 407 to be encrypted (upstream) 405 such that each and every element in the dataset receives a corresponding upstream encrypted element B1-Bi 413 to create encrypted dataset 412. It should be noted that encryption 413 by first server 407 corresponds to the direction of data, and since data transferred from user 402 to network 404, the transfer is upstream and all data is therefore encrypted 405 with privacy protocol 410. In the opposite case, as for example illustrated in Fig. 5, data passes downstream from network 404 to user 402.

[0045] It should be appreciated that first server 407 may receive a privacy enforcement vector 416 with codes for encryption 405 of dataset 409. The selective corresponding keys vector 418, for codes vector 416, may then be sent to second server 417 for decryption 415, as further described hereinafter. It should be noted that as used herein, first and second servers refer to logic references for the servers and not necessarily to sequential servers as additional servers may be implemented between the first and second servers.

[0046] It should be appreciated that privacy settlement bureau (PSB) 408 may control encryption of codes or locks B1-Bi 416 and corresponding keys B1-Bi 418 as part of the privacy policy vector. Thus, considering open communication between PSB 408 and either first server 407 or second server 417 both encryption and decryption may be controlled by PSB 408, for instance based on the received privacy policy vector. It should be noted that keys set 418 loaded to the servers may correspond to privacy policy, such that only upon a match to the privacy policy the key may unlock a corresponding lock (e.g., decrypt an encrypted data segment).

[0047] Next, encrypted dataset 412 may transfer data to a second server (or processor) 417 for downstream exposure or decryption 415 with privacy policy vector from PSB 408 to settle and assure user 402 privacy policy and usage policy of service provider 406.

[0048] It should be appreciated that second server 417 may ask PSB 408 for keys to decrypt all elements of dataset 412, and PSB 408 may then determine which elements to decrypt and which elements to keep non-decrypted (e.g. marked and then become junk data and/or nullify) by selectively not providing the corresponding key(s).

[0049] During downstream decryption 415, privacy protocol 410 may determine if all elements in encrypted dataset 412 have corresponding policy elements such that there is no mismatch between the privacy policy and the usage policy. Thus, after downstream decryption 415 a remaining decrypted dataset 420 may be finally received by service provider 406. It should be noted that in case that some element in encrypted dataset 412 does not correspond to a match between and/or contradicting privacy policy and usage policy, then this element may not be decrypted, marked and then become marked junk data and/or nullify while all other elements (corresponding to a match) may be decrypted.

[0050] In some embodiments, if there is no communication between user 402 and service provider 406 all data may be received as non-decrypted and marked junk data (i.e. initially closed) and/or nullified.

[0051] Reference is now made to Fig. 5, which schematically illustrates data flow from a service provider 506 to a user 502 within the open communication system, according to some embodiments. It should be appreciated that Fig. 5 illustrates an exemplary data flow within communication system 200, for instance as shown in Fig. 2.

[0052] Service provider 506 may provide a dataset 509, for instance a dataset (or list) with an array of different data types, having information regarding at least one of internet protocol (IP) address, advertisements to be presented on the user's screen, social information and/or signal, and data from at least one content 1-j. In some embodiments, dataset 509 may include fragmented user experience units.

[0053] In some embodiments, some elements in dataset 509 may be initially encrypted or locked 503 (by an external application) prior to implementing the usage policy by the policy protocol 510.

[0054] It should be appreciated that privacy settlement bureau (PSB) 508 may control encryption of locks B1-Bj 516 and corresponding keys B1-Bj 518. Thus, with open communication between PSB 508 and either first server 507 or second server 517 both encryption and decryption may be controlled by PSB 508, for instance based on the received privacy policy vector. It should be noted that set of keys 518 loaded to the servers may correspond to usage policy, such that only upon a match to the usage policy the key may unlock a corresponding lock (e.g., decrypt an encrypted data segment).. It should be noted that as used herein, first and second servers refer to logic references for the servers and not necessarily to sequential servers as additional servers may be implemented between the first and second servers.

[0055] Dataset 509 may then be transferred to network 504 (e.g. wired or cloud based network) having privacy protocol 510, and passed to a first server (or processor) 507 to be encrypted 505 such that each element in the dataset receives a corresponding encrypted element B1-Bj 513 to create encrypted dataset 512. Next, encrypted dataset 512 may transfer data to a second server (or processor) 517 for selective decryption 515 with privacy policy vector from PSB 508 to settle and assure of user 502 and usage policy of service provider 506.

[0056] During decryption 515, privacy protocol 510 may determine if all elements in encrypted dataset 512 have corresponding policy elements such that there is no mismatch and/or contradiction between the privacy policy and the usage policy. Thus, after decryption 515 a decrypted dataset 520 may be finally received by user 502. It should be noted that in case that any element in encrypted dataset 512 does not correspond to a match in privacy policy and usage policy, then this element may be non-decrypted marked and then become junk data or nullify while all other elements (corresponding to a match) may be decrypted.

[0057] In some embodiments, if there is no communication between user 502 and service provider 506 all data may be received as decrypted and unreadable and/or nullify (i.e. initially closed).

[0058] While certain features of the invention have been illustrated and described herein, many modifications, substitutions, changes, and equivalents will now occur to those of ordinary skill in the art.


Claims

1. A method for privacy policy enforcement to ensure reconciliation between a user and a service provider communicating via an open system interconnection "OSI" communication architecture, the method comprising:

receiving (301), by a privacy settlement bureau (208, 408, 508), a privacy policy for a device of the user;

receiving (301), by the privacy settlement bureau (208, 408, 508), a usage policy for the service provider, wherein the privacy settlement bureau (208, 408, 508) remotely manages policies for the user and the service provider;

receiving, by a first server (407, 507), via a network (404) having a privacy layer (211) monitored by the privacy settlement bureau (208, 408, 508), at least one dataset (409, 509) from the user's device to be sent to the service provider, wherein the at least one dataset (409, 509) comprises at least one data segment;

receiving (303), at the first server (407, 507), from the privacy settlement bureau (208, 408, 508), a privacy policy enforcement vector (416) comprising encryption codes;

encrypting (304), by the first server (407, 507), the received at least one data segment based on the received encryption codes;

receiving (305), at a second server (417, 517), from the first server (407, 507), at least one encrypted data segment;

receiving (306), at the second server (417, 517), from the privacy settlement bureau (208, 408, 508), a selective corresponding keys vector (418) having selective decryption keys corresponding to the encryption codes and configured to allow decryption (415, 515) of at least one encrypted data segment when a match (302) between the privacy policy and the usage policy occurs to decrypt the at least one encrypted data segment; and

performing selective decryption (307), by the second server (417,517), for each received at least one encrypted data segment based on the selective corresponding keys vector (418), wherein at least one encrypted data segment is decrypted when a match (302) between the privacy policy and the usage policy occurs,

wherein at least one of the first server (407,507) and the second server (417,517) is external to the user's device and the service provider, and wherein the decrypted at least one data segment passes through the privacy layer (211) added to the OSI architecture, the privacy layer (211) being in communication with the user's device.


 
2. The method of claim 1, further comprising creating a privacy policy matrix from the received privacy policy and usage policy, wherein the privacy policy matrix is stored in the privacy settlement bureau (208, 408, 508).
 
3. The method according to any preceding claim, further comprising identifying, by the privacy settlement bureau (208, 408, 508), at least one data segment of the at least one dataset (409, 509) that is applicable to be processed for privacy policy enforcement.
 
4. The method according to any preceding claim, further comprising marking, by the privacy settlement bureau (208, 408, 508), at least one data segment of the at least one dataset (409, 509) that is not decrypted.
 
5. The method according to any preceding claim, further comprising nullifying, by the privacy settlement bureau (208, 408, 508), at least one data segment of the at least one dataset (409, 509) that is not decrypted.
 
6. The method according to any preceding claim, wherein the encryption (405, 505) is carried out upstream or wherein the decryption (415, 515) is carried out downstream.
 
7. The method of claim 1, further comprising sending, by the second server (417,517), at least the decrypted data to the service provider.
 
8. The method of claim 7, further comprising sending, by the second server (417,517), non-decrypted data to the service provider.
 
9. The method of claim 1, wherein at least one of the first server (407,507) and the second server (417,517) is part of the network infrastructure of the OSI communication architecture.
 
10. A system for privacy policy enforcement to ensure reconciliation between a user and a service provider communicating via a network having an open system interconnection "OSI" communication architecture, the system comprising:

at least one database, configured to store a privacy policy of the user and a usage policy of the service provider;

a privacy layer (211) added to the OSI architecture, in communication with a device of the user, wherein the privacy layer is configured to facilitate privacy configurations of the user and the service provider;

a privacy settlement bureau (208, 408, 508), in communication with the OSI architecture and configured to allow control of encryption (405, 505) and of decryption (415, 515) of data, wherein the privacy settlement bureau (208, 408, 508) remotely manages policies for the user and the service provider;

a first server (407,507), in communication with the privacy settlement bureau (208, 408, 508) and configured to encrypt data passing through the privacy layer; and

a second server (417,517) configured to perform selective decryption of encrypted data passing through the privacy layer received from the first server (407, 507), wherein data segments are decrypted by the second server (417,517) when a match between the privacy policy and the usage policy occurs, wherein at least one of the first server (407,507) and the second server (417,517) is external to the user's device and the service provider, and wherein the at least one of the first server (407,507) and the second server (417,517) is configured to implement the steps of a method according to any preceding claim.


 
11. The system of claim 10, wherein the encryption (405, 505) is carried out upstream, or wherein the decryption (415, 515) is carried out downstream.
 
12. The system of according to either claim 10 or 11, wherein at least one of the first server (407,507) and the second server (417,517) is part of the network infrastructure of the OSI communication architecture.
 


Ansprüche

1. Verfahren zur Durchsetzung von Datenschutzerklärungen, um einen Abgleich zwischen einem Nutzer und einem Dienstanbieter, die über eine Kommunikationsarchitektur einer offenen Systemvernetzung (Open System Interconnection, OSI) miteinander kommunizieren, sicherzustellen, wobei das Verfahren wie folgt umfasst:

Empfangen (301) einer Datenschutzerklärung für ein Gerät des Nutzers durch eine private Datenschutz-Abwicklungsstelle (208, 408, 508);

Empfangen (301) einer Nutzungsrichtlinie für den Dienstanbieter durch eine private Datenschutz-Abwicklungsstelle (208, 408, 508), wobei die private Datenschutz-Abwicklungsstelle (208, 408, 508) Richtlinien für den Nutzer und den Dienstanbieter fernverwaltet;

Empfangen mindestens eines Datensatzes (409, 509), der von dem Gerät des Nutzers an den Dienstanbieter zu senden ist, durch einen ersten Server (407, 507) und über ein Netzwerk (404) mit einer Datenschutzschicht (211), die von der Datenschutz-Abwicklungsstelle (208, 408, 508) überwacht wird, wobei der mindestens eine Datensatz mindestens ein Datensegment umfasst;

Empfangen (303) eines Durchsetzungsvektors für eine Datenschutzerklärung (416) von der Datenschutz-Abwicklungsstelle (208, 408, 508) durch den ersten Server (407, 507), welcher Verschlüsselungscodes umfasst;

Verschlüsseln (304) des empfangenen mindestens einen Datensegments, basierend auf den empfangenen Verschlüsselungscodes, durch den ersten Server (407, 507);

Empfangen (305) mindestens eines verschlüsselten Datensegments von dem ersten Server (407, 507) durch einen zweiten Server (417, 517);

Empfangen (306) eines entsprechenden selektiven Schlüsselvektors (418) von der Datenschutz-Abwicklungsstelle (208, 408, 508) durch den zweiten Server (417, 517), wobei jener selektive Entschlüsselungsschlüssel hat, die den Verschlüsselungscodes entsprechen und dazu konfiguriert sind, eine Entschlüsselung (415, 515) mindestens eines verschlüsselten Datensegments zuzulassen, wenn eine Übereinstimmung (302) zwischen der Datenschutzerklärung und der Nutzungsrichtlinie stattfindet, um das mindestens eine verschlüsselte Datensegment zu entschlüsseln; und

Durchführen einer selektiven Entschlüsselung (307) für jedes empfangene mindestens eine verschlüsselte Datensegment durch den zweiten Server (417, 517), jeweils basierend auf dem selektiven entsprechenden Schlüsselvektor (418),

wobei mindestens ein verschlüsseltes Datensegment entschlüsselt wird, wenn eine Übereinstimmung (302) zwischen der Datenschutzerklärung und der Nutzungsrichtlinie stattfindet,

wobei mindestens einer von dem ersten Server (407,507) und dem zweiten Server (417,517) extern von dem Gerät des Nutzers und von dem Dienstanbieter ist, und wobei das entschlüsselte, mindestens eine Datensegment die Datenschutzschicht (211), die der OSI-Architektur hinzugefügt wird, passiert, wobei die Datenschutzschicht (211) in Kommunikation mit dem Gerät des Nutzers ist.


 
2. Verfahren nach Anspruch 1, ferner umfassend Erstellen einer Datenschutzerklärungsmatrix aufgrund der empfangenen Datenschutzerklärung und Nutzungsrichtlinie, wobei die Datenschutzerklärungsmatrix in der Datenschutz-Abwicklungsstelle (208, 408, 508) gespeichert wird.
 
3. Verfahren nach einem der vorhergehenden Ansprüche, ferner umfassend Identifizieren mindestens eines Datensegments des mindestens einen Datensatzes (409, 509) durch die Datenschutz-Abwicklungsstelle (208, 408, 508), welches anwendbar ist, um zur Durchsetzung von Datenschutzerklärung verarbeitet zu werden.
 
4. Verfahren nach einem der vorhergehenden Ansprüche, ferner umfassend Markieren mindestens eines Datensegments des mindestens einen Datensatzes (409, 509) durch die Datenschutz-Abwicklungsstelle (208, 408, 508), welches nicht entschlüsselt ist.
 
5. Verfahren nach einem der vorhergehenden Ansprüche, ferner umfassend Annullieren mindestens eines Datensegments des mindestens einen Datensatzes (409, 509) durch die Datenschutz-Abwicklungsstelle (208, 408, 508), welches nicht entschlüsselt ist.
 
6. Verfahren nach einem der vorhergehenden Ansprüche, wobei die Verschlüsselung (405, 505) vorgeschaltet durchgeführt wird oder wobei die Entschlüsselung (415, 515) nachgeschaltet durchgeführt wird.
 
7. Verfahren nach Anspruch 1, ferner umfassend Senden mindestens der entschlüsselten Daten durch den zweiten Server (417, 517) an den Dienstanbieter.
 
8. Verfahren nach Anspruch 7, ferner umfassend Senden von nicht entschlüsselten Daten durch den zweiten Server (417, 517) an den Dienstanbieter.
 
9. Verfahren nach Anspruch 1, wobei mindestens einer von dem ersten Server (407, 507) und dem zweiten Server (417, 517) Teil der Netzwerkinfrastruktur der OSI-Kommunikationsarchitektur ist.
 
10. System zur Durchsetzung von Datenschutzerklärungen, um einen Abgleich zwischen einem Nutzer und einem Dienstanbieter, die über eine Kommunikationsarchitektur einer offenen Systemvernetzung (Open System Interconnection, OSI) miteinander kommunizieren, sicherzustellen, wobei das System wie folgt umfasst:

mindestens eine Datenbank, die dazu konfiguriert ist, eine Datenschutzerklärung des Nutzers und eine Nutzungsrichtlinie des Dienstanbieters zu speichern;

eine Datenschutzschicht (211), die der OSI-Architektur hinzugefügt wird, die mit einem Gerät des Nutzers in Kommunikation ist, wobei die Datenschutzschicht dazu konfiguriert ist, Datenschutzkonfigurationen des Nutzers und des Dienstanbieters zu ermöglichen;

Datenschutz-Abgleichstelle (208, 408, 508), die mit der OSI-Architektur in Kommunikation ist und dazu konfiguriert ist, eine Steuerung der Verschlüsselung (405, 505) und der Entschlüsselung (415, 515) der Daten zuzulassen, wobei die Datenschutz-Abgleichstelle (208, 408, 508) Richtlinien für den Nutzer und den Dienstanbieter fernverwaltet;

ein erster Server (407, 507), der mit der Datenschutz-Abgleichstelle (208, 408, 508) in Kommunikation ist und dazu konfiguriert ist, Daten, die die Datenschutzschicht passieren, zu verschlüsseln; und

ein zweiter Server (417, 517), der dazu konfiguriert ist, eine selektive Entschlüsselung von verschlüsselten Daten, die die Datenschutzschicht passieren, durchzuführen, und die von dem ersten Server (407, 507) empfangen wurden, wobei Datensegmente von dem zweiten Server (417, 517) entschlüsselt werden, wenn eine Übereinstimmung zwischen der Datenschutzerklärung und der Nutzungsrichtline stattfindet, wobei mindestens einer von dem ersten Server (407, 507) und dem zweiten Server (417,517) extern von dem Gerät des Nutzers und dem Dienstanbieter ist, und wobei der mindestens eine von dem ersten Server (407, 507) und dem zweiten Server (417, 517) dazu konfiguriert ist, die Schritte des Verfahrens nach dem vorhergehenden Anspruch zu implementieren.


 
11. System nach Anspruch 10, wobei die Verschlüsselung (405, 505) vorgeschaltet durchgeführt wird oder wobei die Entschlüsselung (415, 515) nachgeschaltet durchgeführt wird.
 
12. System nach einem der Ansprüche 10 oder 11, wobei mindestens einer von dem ersten Server (407, 507) und dem zweiten Server (417, 517) Teil der Netzwerkinfrastruktur der OSI-Kommunikationsarchitektur ist.
 


Revendications

1. Procédé d'application d'une politique de confidentialité permettant d'assurer la réconciliation entre un utilisateur et un fournisseur de services communiquant via une architecture de communication « OSI » d'interconnexion de systèmes ouverts, le procédé comprenant :

la réception (301), par un bureau de règlement de confidentialité (208, 408, 508 ), d'une politique de confidentialité pour un dispositif de l'utilisateur ;

la réception (301), par le bureau de règlement de confidentialité (208, 408, 508), d'une politique d'utilisation pour le fournisseur de services, dans lequel le bureau de règlement de confidentialité (208, 408, 508) gère à distance les politiques destinées à l'utilisateur et au fournisseur de services ;

la réception, par un premier serveur (407, 507), via un réseau (404) ayant une couche de confidentialité (211) contrôlée par le bureau de règlement de confidentialité (208, 408, 508), d'au moins un ensemble de données (409, 509) du dispositif de l'utilisateur à envoyer au fournisseur de services, dans lequel l'au moins un ensemble de données (409, 509) comprend au moins un segment de données ;

la réception (303), au niveau du premier serveur (407, 507), depuis le bureau de règlement de confidentialité (208, 408, 508), d'un vecteur d'application de politique de confidentialité (416) comprenant des codes de cryptage ;

le cryptage (304), par le premier serveur (407, 507), de l'au moins un segment de données reçu en fonction des codes de cryptage reçus ;

la réception (305), au niveau d'un deuxième serveur (417, 517), depuis le premier serveur (407, 507), d'au moins un segment de données cryptées ;

la réception (306), au niveau du deuxième serveur (417, 517), depuis le bureau de règlement de confidentialité (208, 408, 508), d'un vecteur ayant des clés de décryptage sélectives (418) dont une clé de décryptage sélective correspondant aux codes de cryptage et configurée pour permettre le décryptage (415, 515) d'au moins un segment de données cryptées lorsqu'une correspondance (302) entre la politique de confidentialité et la politique d'utilisation se produit pour décrypter l'au moins un segment de données cryptées ; et

l'exécution d'un décryptage sélectif (307) par le second serveur (417, 517) pour au moins chacun des segments de données cryptées reçus en fonction du vecteur de clés sélectives (418) correspondant,

dans lequel au moins un segment de données cryptées est décrypté lorsqu'une correspondance (302 ) entre la politique de confidentialité et la politique d'utilisation se produit,

dans lequel au moins l'un du premier serveur (407, 507) et du deuxième serveur (417, 517) est externe au dispositif de l'utilisateur et au fournisseur de services, et dans lequel l'au moins un segment de données décryptées transite par la couche de confidentialité (211) ajoutée à l'architecture OSI, la couche de confidentialité (211) étant en communication avec le dispositif de l'utilisateur.


 
2. Procédé selon la revendication 1, comprenant en outre la création d'une matrice de politique de confidentialité à partir de la politique de confidentialité et de la politique d'utilisation reçues, la matrice de politique de confidentialité étant stockée dans le bureau de règlement de confidentialité (208, 408, 508).
 
3. Procédé selon l'une quelconque des revendications précédentes, comprenant en outre l'identification, par le bureau de règlement de confidentialité (208, 408, 508), d'au moins un segment de données de l'au moins un ensemble de données (409, 509) qui est susceptible d'être traité pour l'application de la politique de confidentialité.
 
4. Procédé selon l'une quelconque des revendications précédentes, comprenant en outre le marquage, par le bureau de règlement de confidentialité (208, 408, 508), d'au moins un segment de données de l'au moins un ensemble de données (409, 509) qui n'est pas décrypté.
 
5. Procédé selon l'une quelconque des revendications précédentes, comprenant en outre l'annulation, par le bureau de règlement de confidentialité (208, 408, 508), d'au moins un segment de données du au moins un ensemble de données (409, 509) qui n'est pas décrypté.
 
6. Procédé selon l'une quelconque des revendications précédentes, dans lequel le cryptage (405, 505) est réalisé en amont ou dans lequel le décryptage (415, 515) est réalisé en aval.
 
7. Procédé selon la revendication 1, comprenant en outre l'envoi, par le deuxième serveur (417, 517), d'au moins les données décryptées au fournisseur de services.
 
8. Procédé selon la revendication 7, comprenant en outre l'envoi, par le deuxième serveur (417, 517), de données non décryptées au fournisseur de services.
 
9. Procédé selon la revendication 1, dans lequel au moins l'un du premier serveur (407,507) et du second serveur (417,517) fait partie de l'infrastructure réseau de l'architecture de communication OSI.
 
10. Système d'application de la politique de confidentialité permettant d'assurer la réconciliation entre un utilisateur et un fournisseur de services communiquant via un réseau ayant une architecture de communication d'interconnexion de systèmes ouverts "OSI", le système comprenant :

au moins une base de données, configurée pour stocker une politique de confidentialité d'utilisateur et une politique d'utilisation du fournisseur de services ;

une couche de confidentialité (211) ajoutée à l'architecture OSI, en communication avec un dispositif de l'utilisateur, la couche de confidentialité étant configurée pour faciliter les configurations de confidentialité de l'utilisateur et du fournisseur de services ;

un bureau de règlement de confidentialité (208, 408, 508), en communication avec l'architecture OSI et configuré pour permettre le contrôle du cryptage (405, 505) et du décryptage (415, 515) des données, dans lequel le bureau de règlement de confidentialité (208, 408, 508) gère à distance les politiques de l'utilisateur et du fournisseur de services ;

un premier serveur (407, 507), en communication avec architecture de communication « OSI » d'interconnexion de systèmes ouverts le bureau de règlement de confidentialité (208, 408, 508) et configuré pour crypter les données transitant par la couche de confidentialité ; et

un deuxième serveur (417, 517) configuré pour effectuer un décryptage sélectif des données cryptées transitant par la couche de confidentialité, reçues du premier serveur (407, 507),

dans lequel des segments de données sont décryptés par le deuxième serveur (417, 517) lorsqu'une correspondance entre la politique de confidentialité et la politique d'utilisation se produit, dans lequel au moins l'un parmi le premier serveur (407, 507) et le deuxième serveur (417, 517) est externe au dispositif de l'utilisateur et au fournisseur de services, et dans lequel l'au moins un parmi le premier serveur (407, 507) et le deuxième serveur (417, 517) est configuré pour mettre en Ĺ“uvre les étapes d'un procédé selon l'une quelconque des revendications précédentes.
 
11. Système selon la revendication 10, dans lequel le cryptage (405, 505) est réalisé en amont, ou dans lequel le décryptage (415, 515) est réalisé en aval.
 
12. Système selon l'une quelconque des revendications 10 ou 11, dans lequel au moins l'un du premier serveur (407, 507) et du deuxième serveur (417, 517) fait partie de l'infrastructure réseau de l'architecture de communication OSI.
 




Drawing























Cited references

REFERENCES CITED IN THE DESCRIPTION



This list of references cited by the applicant is for the reader's convenience only. It does not form part of the European patent document. Even though great care has been taken in compiling the references, errors or omissions cannot be excluded and the EPO disclaims all liability in this regard.

Patent documents cited in the description