US 8,799,981 B2Granted

Privacy protection system

AssigneeThales Holdings UK PLC

InventorAdrian Waller

Life of this patent

Estimating the term…

Loading patent…

Abstract

A method and system is disclosed for enforcing at least one privacy policy in relation to user data, the system comprising: a user system, a broker system, and a service provider system, the user system being operable to: encrypt the user data using a symmetric encryption algorithm and an encryption key generated in dependence on said at least one privacy policy and a master key associated with the user system; and transmit the encrypted user data to the service provider in the form of a digital container that includes the encrypted user data and said at least one privacy policy; and the broker system being operable to: receive a request from the service provider to access the user data, the request including said at least one privacy policy; verify that the request complies with said at least one privacy policy; and if so, regenerate the encryption key in dependence on the master key and at least one privacy policy supplied by the service provider, whereby the service provider system is able to decrypt the user data using a symmetric decryption algorithm and the regenerated encryption key.

Claims22

Dependent claims

A system for enforcing at least one privacy policy in relation to user data, the system comprising:

a user system;
a broker system;
and
a service provider system,
wherein the user system comprises:
one or more processors and one or more associated memory devices;
an encryption key generation means for generating an encryption key in dependence on a master key and in dependence on privacy policy data representing the at least one privacy policy, the encryption key generation means being software implemented by the one or more processors and the one or more associated memory, dedicated circuitry, or a combination thereof;
an encryption means for carrying out symmetric encryption of the user data with the encryption key to form encrypted user data, the encryption means being software implemented by the one or more processors and the one or more associated memory, dedicated circuitry, or a combination thereof;
a combiner means for combining the encrypted user data and the privacy policy data to form a digital container for secure transmission of the user data, the combiner means being software implemented by the one or more processors and the one or more associated memory, dedicated circuitry, or a combination thereof;
and
a network interface for transmitting the digital container to the service provider system over a computer network;
and
wherein the broker system is operable to:
receive a request from the service provider system over the computer network to access the user data, the request including said privacy policy data;
verify that the request complies with said at least one privacy policy;
and
if so, regenerate the encryption key in dependence on the master key and at least one privacy policy supplied by the service provider system to the broker system over the computer network, and transmit the regenerated encryption key to the service provider system;
whereby the service provider system is able to decrypt the user data using a symmetric decryption algorithm and the regenerated encryption key.

15 more elements

A method of enforcing at least one privacy policy in relation to user data, the method comprising:

at a user computer system:
generating an encryption key in dependence on a master key and in dependence on privacy policy data representing the at least one privacy policy;
carrying out symmetric encryption of the user data with the encryption key to form encrypted user data;
combining the encrypted user data and the privacy policy data to form a digital container for secure transmission of the user data;
communicating with a broker computer system over a computer network and transmitting the digital container to a service provider system over the computer network;
and
transmitting the digital container to the service provider system;
and
at the broker computer system:
receiving a request from the service provider system over the computer network to access the user data, the request including said privacy policy data;
verifying that the request complies with said at least one privacy policy;
and
if so, regenerating the encryption key in dependence on the master key and at least one privacy policy supplied by the service provider system, and transmitting the regenerated encryption key to the service provider system;
whereby the service provider system is able to decrypt the user data using a symmetric decryption algorithm and the regenerated encryption key.

11 more elements

Dependencies are inferred from the claim text.

Facts

Application: 11/737,407Filed 19 Apr 2007
Priority: GB 0607714.319 Apr 2006
Published: US 2007/0250904 A125 Oct 2007
Granted: 5 Aug 2014
Term ends: Not estimatedThe source records don’t support an estimate.

Classification5 codes

G06F 21/6245
To a system of files or objects, e.g. local or distributed file system or database: protecting personal data, e.g. for financial or medical purposes
H04L 9/3073
Involving algebraic varieties, e.g. elliptic or hyper-elliptic curves: involving pairings, e.g. identity based encryption [IBE], bilinear mappings…
H04L 63/0435
Wherein the data content is protected, e.g. by encrypting or encapsulating the payload: wherein the sending and receiving network entities apply…
G06F
Computing and data processing