Method of and system for privacy awareness

• US 10,362,067 B2
• Filed: 09/02/2016
• Issued: 07/23/2019
• Est. Priority Date: 09/04/2015
• Status: Active Grant

• Current Assignee: Swim.it Inc.
• Original Assignee: Swim.it Inc.
• Inventors: Sachs, Christopher David
• Primary Examiner(s): King, John B
• Application Number:
  US15/256,055
• Publication Number:
  US 20170070539A1
• Time in Patent Office: 1,054 Days
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 21/121 Restricting unauthorised execution of programs
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06Q 30/0277 Online advertisement
• CPC Class Codes: H04L 43/0894 Packet rate
• CPC Class Codes: H04L 45/70 Routing based on monitoring results
• CPC Class Codes: H04L 47/125 by balancing the load, e.g. traffic engineering
• CPC Class Codes: H04L 51/04 Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 51/214 using selective forwarding
• CPC Class Codes: H04L 51/234 for tracking messages
• CPC Class Codes: H04L 61/4541 Directories for service discovery
• CPC Class Codes: H04L 61/5069 for group communication, multicast communication or broadcast communication
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/101 : based on network conditions
• CPC Class Codes: H04L 67/104 : Peer-to-peer [P2P] networks
• CPC Class Codes: H04W 12/02 : Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]

Abstract

A privacy awareness method and system observes data collection by third parties on websites and applications and determines what privacy metadata is retrieved and/or sent and where the privacy metadata is sent. The privacy awareness method and system informs users about the privacy information collection, so that users are able to better understand what information is being retrieved and navigate the Internet accordingly.

Claims

1. A method comprising:

observing, using a web browser extension module programmed in a non-transitory memory of a device, data collection of third-party traffic on websites;

processing in realtime, data collection instructions to determine associated metadata based on the data collection, wherein the processing in realtime is performed without code injection into the web browser extension module and further wherein the web browser extension module comprises a document object model;

storing and analyzing the associated metadata for reporting privacy metadata to a user; and

analyzing the third-party traffic to determine relationships among third-parties for data sharing, and informing a user of the relationships including what data is shared with which third-party.

2. The method of claim 1 wherein the third-party traffic includes at least one of cookies, scripts, server interactions, local document object model HTTP/S calls.

3. The method of claim 1 wherein processing the data collection instructions, analysis and metadata generation are performed using a suite of software components programmed in a server.

4. The method of claim 1 wherein the associated metadata is stored in a privacy metadata dataset.

5. The method of claim 4 further comprising seeding the privacy metadata dataset from a subset of companies.

6. The method of claim 4 further comprising updating the privacy metadata dataset via crowdsourcing.

7. The method of claim 1 further comprising displaying the associated metadata using consumer friendly notifications to the user.

8. The method of claim 1 wherein the associated metadata comprises a type of privacy data collected from a website or application.

9. The method of claim 1 further comprising comparing privacy-related declarations with the associated metadata to determine gaps between the privacy-related declarations and the associated metadata.

10. The method of claim 1 further comprising analyzing servers across the world that are exchanging information, wherein the information includes scripts and user data.

11. The method of claim 1 further comprising comparing advertiser data to provide additional information to the user regarding advertising by an advertiser, wherein the advertiser data is related to the third-party traffic, further wherein the advertiser data includes at least one of images, scripts, and latency information.

12. An apparatus comprising:

a non-transitory memory for storing an application, the application configured for;

processing in realtime, data collection instructions to determine associated metadata based on the data collection, wherein the processing in realtime is performed without code injection into a web browser extension module and further wherein the web browser extension module comprises a document object model;

storing and analyzing the associated metadata for reporting privacy metadata to a user;

analyzing third-party traffic to determine relationships among third-parties for data sharing, and informing a user of the relationships including what data is shared with which third-party; and

a processor for processing the application.

13. The apparatus of claim 12 wherein the application is further for observing, using the web browser extension module, data collection of the third-party traffic on websites.

14. The apparatus of claim 13 wherein the third-party traffic includes at least one of cookies, scripts, server interactions, local document object model HTTP/S calls.

15. The apparatus of claim 12 wherein processing the data collection instructions, analysis and metadata generation are performed using a suite of software components programmed in a server.

16. The apparatus of claim 12 wherein the associated metadata is stored in a privacy metadata dataset.

17. The apparatus of claim 16 wherein the application is further for seeding the privacy metadata dataset from a subset of companies.

18. The apparatus of claim 16 wherein the application is further for updating the privacy metadata dataset via crowdsourcing.

19. The apparatus of claim 12 wherein the application is further for displaying the associated metadata using consumer friendly notifications to the user.

20. The apparatus of claim 12 wherein the associated metadata comprises a type of privacy data collected from a website or application.

21. The apparatus of claim 12 wherein the application is further for comparing privacy-related declarations with the associated metadata to determine gaps between the privacy-related declarations and the associated metadata.

22. The apparatus of claim 12 wherein the application is further for analyzing servers across the world that are exchanging information, wherein the information includes scripts and user data.

23. The apparatus of claim 12 wherein the application is further for comparing advertiser data to provide additional information to a user regarding advertising by an advertiser, wherein the advertiser data is related to the third-party traffic, further wherein the advertiser data includes at least one of images, scripts, and latency information.

24. A system comprising:

a client device configured for storing a web browser extension module to observe data collection of third-party traffic on websites; and

a server device configured for storing;

a first suite of software components to process in realtime data collection instructions, analyze and generate privacy metadata associated with the data collection, wherein the processing in realtime is performed without code injection into the web browser extension module and further wherein the web browser extension module comprises a document object model;

a second suite of software components to store and analyze the privacy metadata for reporting data to a user; and

analyzing the third-party traffic to determine relationships among third-parties for data sharing, and informing a user of the relationships including what data is shared with which third-party.

25. The system of claim 24 wherein the third-party traffic includes at least one of cookies, scripts, server interactions, local document object model HTTP/S calls.

26. The system of claim 24 wherein the associated metadata is stored in a privacy metadata dataset.

27. The system of claim 26 wherein the privacy metadata dataset is seeded with privacy metadata information from a subset of companies.

28. The system of claim 26 wherein the client device is further for updating the privacy metadata dataset via crowdsourcing.

29. The system of claim 24 wherein the client device is further for displaying the associated metadata using consumer friendly notifications to the user.

30. The system of claim 24 wherein the associated metadata comprises a type of privacy data collected from a website or application.

31. The system of claim 24 wherein the server device is further for comparing privacy-related declarations with the associated metadata to determine gaps between the privacy-related declarations and the associated metadata.

32. The system of claim 24 wherein the server device is further for analyzing servers across the world that are exchanging information, wherein the information includes scripts and user data.

33. The system of claim 24 wherein the server device is further for comparing advertiser data to provide additional information to a user regarding advertising by an advertiser, wherein the advertiser data is related to the third-party traffic, further wherein the advertiser data includes at least one of images, scripts, and latency information.