# US 2014/0195818 A1 · Method and device for privacy respecting data processing > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0195818 A1 - Document ID: US20140195818A1 - Status: Published application - Kind: A1 - Application number: 14/147,942 - Filed: 2014-01-06 - Published: 2014-07-10 - Earliest claimed: 2013-01-09 - Applicants: Thomson Licensing - Inventors: Christoph NEUMANN; Olivier HEEN; Stephane ONNO; Augustin SOULE; Jaideep CHANDRASHEKAR - Web page: https://patentgrep.com/patent/US20140195818A1 ## CPC - G06F 21/6209: {to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself} - G06F 21/60: Protecting data - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A user device encrypts data and privacy attributes associated with the data. A processing device receives the encrypted data and privacy attributes, receives a signed script from a requester and verifies the signature. If successfully verified, the private key is unsealed and used to decrypt the privacy attributes and script attributes, which are compared to determine if the script respects the privacy attributes. If so, the encrypted data are decrypted and the script processes the private data to generate a result that is encrypted using a key of the requester and the encrypted result is then output. The device is preferably configured to inhibit the output of any information while the data is unencrypted. This way, the user can be ensured that the processing of the private data respects the privacy attributes set by the user. ## Claims ### Claim 1 A method of data processing, the method comprising the steps, in a device comprising a processor, of: obtaining encrypted data to process; obtaining privacy attributes associated with the encrypted data, the privacy attributes defining processing requirements a data processing task should respect to be allowed to process the encrypted data or to output a result of data processing of the encrypted data; obtaining a script and a signature for the script; verifying the signature; and if the signature is successfully verified: decrypting the encrypted data to obtain decrypted data; executing the script to process the decrypted data to obtain a result; and outputting the result; the method further comprising the step of comparing the privacy attributes and processing attributes of the script, the processing attributes defining processing requirements respected by the script to determine if the script respects the privacy attributes. ### Claim 2 (depends on 1) The method of claim 1, wherein the comparing step is performed before the decrypting step if the signature is successfully verified and the decrypting step is performed upon determination that the script respects the privacy attributes. ### Claim 3 (depends on 1) The method of claim 1, wherein the comparing step is performed after the processing step and the outputting step is performed upon determination that the script respects the privacy attributes. ### Claim 4 (depends on 1) The method of claim 1, wherein the private key is sealed within the device and the method further comprises the step, upon determination that the script respects the privacy attributes, of unsealing the private key. ### Claim 5 (depends on 1) The method of claim 1, further comprising the step, after the comparison step, of deleting at least one of the privacy attributes and the processing attributes. ### Claim 6 (depends on 1) The method of claim 1, wherein the script is obtained from a requester and the method further comprises the step of encrypting the result using a key of the requester so that the result is output in encrypted form. ### Claim 7 A device for data processing comprising: at least one interface configured to: obtain encrypted data to process; obtain privacy attributes associated to the encrypted data, the privacy attributes defining processing requirements a data processing task should respect to be allowed to process the encrypted data or to output a result of data processing of the encrypted data; obtain a script and a signature for the script; and output a result; and a processor configured to: verify the signature; and if the signature is successfully verified, compare the privacy attributes and processing attributes of the script, the processing attributes defining processing requirements respected by the script to determine if the script respects the privacy attributes; and decrypt the encrypted data to obtain decrypted data; execute the script to process the decrypted data to obtain the result. ### Claim 8 (depends on 7) The device of claim 7, wherein the private key is sealed within the device and the processor is further configured, upon determination that the script respects the privacy attributes, to unseal the private key. ### Claim 9 (depends on 7) The device of claim 7, wherein the processor is further configured to, after comparison of the processing requirements and the processing attributes, delete at least one of the privacy attributes and the processing attributes. ### Claim 10 (depends on 7) The device of claim 7, wherein said at least one interface is configured to obtain the script from a requester and further to obtain a key of the requester and wherein the processor is further configured to encrypt the result using the key of the requester so that the result is output in encrypted form. ### Claim 11 (depends on 7) The device of claim 7, wherein the device is configured to inhibit output of any information while the data is decrypted. ### Claim 12 (depends on 7) The device of claim 7, wherein the device is implemented using a Trusted Platform Module. ### Claim 13 (depends on 12) The device of claim 12, wherein the Trusted Platform Module relies on a Trusted Computing Base launched using late-launch Trusted Platform Module capabilities. ### Claim 14 (depends on 7) The device of claim 7, wherein the processor is further configured to decrypt the encrypted data and to process the decrypted data only upon successful determination that the script respects the privacy attributes. ### Claim 15 (depends on 7) The device of claim 7, wherein the processor is further configured to output the result only upon successful determination that the script respects the privacy attributes. ### Claim 16 (depends on 7) The device of claim 7, wherein the device is a gateway.