Personal information control and processing

• US 20050105719A1
• Filed: 10/27/2004
• Published: 05/19/2005
• Est. Priority Date: 10/30/2003
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Hada, Satoshi
• Application Number:
  US10/974,923
• Publication Number:
  US 20050105719A1
• Time in Patent Office: Days
• US Class Current: 380/28
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/3073 involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing

Abstract

The present invention provides a personal information controlling system that limits use of personal information stored in a storage device. An example of a system comprises: controlling means for controlling a privacy policy for each piece of personal information in connection with a specified available period in which a user of the personal information is allowed to use the personal information, the privacy policy being information specifying the available period; key acquiring means for acquiring a cipher key for a cipher that can be deciphered by an administrator of the privacy policy and that cannot be deciphered by the user of the personal information; and ciphering means for using the cipher key acquired by the key acquiring means to cipher the personal information so that the user cannot use the personal information if the available period specified by the privacy policy has expired.

Claims

1. ) A personal information controlling system that limits use of personal information stored in a storage device, the system comprising:

controlling means for controlling a privacy policy for each piece of personal information in connection with a specified available period in which a user of said personal information is allowed to use said personal information, the privacy policy being information specifying the available period;

key acquiring means for acquiring a cipher key for a cipher that can be deciphered by an administrator of said privacy policy and that cannot be deciphered by the user of said personal information; and

ciphering means for using said cipher key acquired by said key acquiring means to cipher said personal information so that said user cannot use the personal information if the available period specified by said privacy policy has expired.

2. ) The personal information controlling system according to claim 1, wherein said controlling means controls said privacy policy by storing it in said storage device in association with said personal information, and

if the available period specified by said privacy policy has expired, said ciphering means uses said cipher key to further cipher said privacy policy and deletes a part of said personal information which corresponds to the privacy policy.

3. ) The personal information controlling system according to claim 1, wherein said cipher key acquired by said key acquiring means acquires, as said cipher key, a public key for a public key ciphering system for which said administrator controls a secret key and for which said user does not control said secret key, and

said ciphering means ciphers said personal information using said public key.

4. ) The personal information controlling system according to claim 3, wherein said key acquiring means acquires different public keys for respective pieces of personal information, and

said ciphering means carries out ciphering using said different public keys for the respective pieces of personal information.

5. ) The personal information controlling system according to claim 3, further comprising deciphering means for deciphering said personal information in response to an instruction form said administrator, and

wherein said key acquiring means acquires a public key different from the public key for the cipher deciphered by said deciphering means if said key acquiring means receives an instruction from said administrator on re-ciphering of the deciphered personal information, and

said ciphering means re-ciphers the personal information using said public key acquired by said key acquiring means.

6. ) The personal information controlling system according to claim 1, further comprising key generating means for generating a cipher key for a cipher for which said administrator controls a decipher key and for which said user does not control the decipher key, on the basis of personal identification information that identifies an individual specified by said personal information,

wherein said key acquiring means acquires said cipher key generated by said key generating means, and

said ciphering means uses said cipher key based on said personal identification information to cipher said personal information using an identity-based encryption.

7. ) The personal information controlling system according to claim 1, further comprising inquiry target input means for receiving an inquiry as to whether or not a piece of personal information is unfairly used, together with this piece of personal information;

and

deciphering means for deciphering the personal information stored in the storage device after being ciphered, in response to an instruction from said administrator and comparing the deciphered personal information with the personal information inputted by said inquiry target input means to output the result of the comparison.

8. ) The personal information controlling system according to claim 1, wherein after ciphering said personal information, said ciphering means further outputs a notice to a terminal of an individual identified by the ciphered individual information, the notice indicating that the ciphering means has ciphered said personal information.

16. ) A computer program product comprising a computer usable medium having computer readable program code means embodied therein for causing limitation of use of personal information stored in a storage device of a computer, the computer readable program code means in said computer program product comprising computer readable program code means for causing a computer to effect the functions of claim 1.

9. ) An information processing system comprising:

a personal information controlling system that limits use of personal information stored in a storage device, wherein the personal information controlling system having controlling means for controlling a privacy policy for each piece of personal information in connection with a specified available period in which a user of said personal information is allowed to use said personal information, the privacy policy being information specifying the available period;

key acquiring means for acquiring a cipher key for a cipher that can be deciphered by an administrator of said privacy policy and that cannot be deciphered by the user of said personal information; and

ciphering means for using said cipher key acquired by said key acquiring means to cipher said personal information so that said user cannot use the personal information if the available period specified by said privacy policy has expired; and

a user terminal of a user that uses said personal information stored in said storage device,

wherein said user terminal reads and uses said personal information during the available period specified by the privacy policy based on the instruction of said user.

10. ) The information processing system according to claim 9, wherein said storage device stores plural pieces of personal information, and

said user terminal uses the personal information by reading, from said storage device, plural pieces of personal information which are included in said plural pieces of personal information and which are not deciphered by said deciphering means, to generate statistical data on the plural pieces of personal information.

11. ) The information processing system according to claim 9, wherein said personal information contains an e-mail address, and

said user terminal uses the personal information by reading personal information that is not deciphered by said deciphering means, from said storage device, to transmit an advertising e-mail to said e-mail address contained in the personal information.

14. ) An article of manufacture comprising a computer usable medium having computer readable program code means embodied therein for causing limitation of use of personal information stored in a storage device of a computer, the computer readable program code means in said article of manufacture comprising computer readable program code means for causing a computer to effect the steps of claim 10.

15. ) A program storage device readable by machine, tangibly embodying a program of instructions executable by the machine to perform method steps for limiting use of personal information stored in a storage device of a computer, said method steps comprising the steps of claim 10.

17. ) A computer program product comprising a computer usable medium having computer readable program code means embodied therein for causing information processing, the computer readable program code means in said computer program product comprising computer readable program code means for causing a computer to effect the functions of claim 9.

12. ) A personal information controlling method that limits use of personal information stored in a storage device of a computer, the method comprising:

a controlling step executed by said computer to control a privacy policy for each piece of personal information in connection with a specified available period in which a user of said personal information is allowed to use said personal information, the privacy policy being information specifying the available period;

a key acquiring step executed by said computer to acquire a cipher key for a cipher that can be deciphered by an administrator of said privacy policy and that cannot be deciphered by the user of said personal information; and

a ciphering step executed by said computer to use said cipher key acquired by said key acquiring means to cipher said personal information so that said user cannot use the personal information if the available period specified by said privacy policy has expired.

13. ) A program product that is executed on a computer to work as a personal information controlling system that limits use of personal information stored in a storage device, the program products comprising a computer-readable storage medium having computer-readable program code means embodied in the medium, the computer-readable program code means comprising:

controlling means for controlling a privacy policy for each piece of personal information in connection with a specified available period in which a user of said personal information is allowed to use said personal information, the privacy policy being information specifying the available period;

key acquiring means for acquiring a cipher key for a cipher that can be deciphered by an administrator of said privacy policy and that cannot be deciphered by the user of said personal information; and

ciphering means for using said cipher key acquired by said key acquiring means to cipher said personal information so that said user cannot use the personal information if the available period specified by said privacy policy has expired.