PREFERENCE EDITOR TO FACILITATE PRIVACY CONTROLS OVER USER IDENTITIES

• US 20090300512A1
• Filed: 05/27/2009
• Published: 12/03/2009
• Est. Priority Date: 05/27/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: Open Invention Network LLC
• Inventors: Ahn, Gail-Joon
• Granted Patent: US 9,130,915 B2
• Time in Patent Office: Days
• US Class Current: 715/747
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 21/6263 during internet communication, e.g. revealing personal data from cookies
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 Protocols

Abstract

A privacy preference editor enables a user to institute privacy preferences relative to user identity information on a card-based and category-based basis. An identity selector furnishes information cards representative of user identities. The editor allows the user to set a privacy preference for each information card. Any proposed disclosure of an information card invokes its corresponding privacy preference. In turn, an agent engine evaluates the invoked privacy preference against the privacy policy of a relying party seeking the card information. The editor also permits the user to create information categories, populate the categories with a group of relevant user identity attributes, and set a privacy preference to the category. In this way, a category-specific privacy preference can be invoked by using the attribute required by the security policy as an index to the appropriate categorized group where the required attribute resides.

Claims

1. A system, comprising:

a means for providing at least one indication of at least one user identity each having a respective plurality of user identity attributes; and

a privacy preference editor;

the privacy preference editor configured to receive at least one input indicative of a user selection specifying a privacy preference feature relative to one of the user identity indications, and to generate at least one privacy preference relative to a user identity indication using the at least one input.

2. The system of claim 1, wherein the privacy preference editor includes:

a means for selectively associating the at least one privacy preference to at least one of;

(1) at least one information card each defining a collection of attributes, (2) at least one categorized group of user identity attributes, and (3) a respective user identity attribute in a one-to-one correspondence.

3. The system of claim 1, wherein the privacy preference editor further includes:

a process having a first operating mode and a second operating mode;

the first mode being configured to provide a respective privacy preference for each user identity; and

the second operating mode being configured to associate at least one user identity attribute with a respective privacy preference.

4. The system of claim 3, wherein the second operating mode configured further to:

(1) provide at least one category, (2) populate each category with at least one user identity attribute to form a respective category-specific group, and (3) associate each category with a respective privacy preference.

5. The system of claim 3, further comprises:

an interface means for enabling a user to interact with the privacy preference editor to direct the first operating mode and the second operating mode.

6. The system of claim 5, wherein the interface means further includes:

a means for enabling the user, in respect of the first operating mode, to selectively assign a privacy preference to each user identity; and

a means for enabling the user, in respect of the second operating mode, to selectively conduct operations to determine at least one category, assign at least one attribute to each category, and establish a privacy preference for each category.

7. The system of claim 1, further includes:

the means for providing a plurality of user identities includes a means for providing a plurality of information cards;

the privacy preference editor includes a means for selectively associating at least one information card with a respective privacy preference; and

the privacy preference editor includes a means for selectively determining at least one categorized group of attributes, and for selectively determining a privacy preference for each category.

8. The system of claim 1, wherein the privacy preference editor further includes:

a means for generating at least one ruleset based on the at least one generated privacy preference.

9. A method, comprising:

providing at least one indication of at least one user identity each having a respective plurality of user identity attributes;

determining at least one privacy preference feature relative to one of the user identity indications; and

generating at least one privacy preference relative to a user identity indication, using the determination.

10. The method of claim 9, wherein the generating further includes:

defining at least one category;

populating each category with at least one user identity attribute to form a respective group; and

associating each category with a respective privacy preference.

11. The method of claim 9, wherein the generating further includes:

providing at least one category;

a user selectively mapping at least one user identity attribute to a relevant category; and

the user selectively assigning a privacy preference to each category.

12. The method of claim 9, further comprises:

the providing further includes providing a plurality of information cards; and

associating each information card with a privacy preference.

13. The method of claim 9, wherein the generating further includes:

selectively associating the at least one privacy preference to at least one of;

(1) at least one information card each defining a collection of attributes, (2) at least one categorized group of user identity attributes, and (3) a respective user identity attribute in a one-to-one correspondence.

14. The method of claim 9, further comprises:

providing at least one ruleset based on the at least one generated privacy preference.

15. A computer-readable medium having computer-executable instructions for execution by a processor, that, when executed, cause the processor to:

receive at least one input indicative of a privacy preference specification relative to an indication of at least one user identity each having a respective plurality of user identity attributes; and

generate at least one privacy preference relative to a user identity indication, using the at least one input.

16. The computer-readable medium of claim 15, wherein the instructions further cause the processor to:

define at least one category;

populate each category with at least one user identity attribute to form a respective group; and

associate each category with a respective privacy preference.

17. The computer-readable medium of claim 15, wherein the instructions further cause the processor to:

provide at least one category;

enable a user to selectively map at least one user identity attribute to a relevant category; and

enable the user to selectively assign a privacy preference to each category.

18. The computer-readable medium of claim 15, wherein the instructions further cause the processor to:

receive an indication of at least one information card; and

associate each information card indication with a privacy preference.

19. The computer-readable medium of claim 15, wherein the instructions further cause the processor to:

provide at least one ruleset based on the at least one generated privacy preference

20. The computer-readable medium of claim 15, wherein the instructions further cause the processor to:

selectively associate the at least one privacy preference to at least one of;

(1) an indication of at least one information card each defining a collection of attributes, (2) at least one categorized group of user identity attributes, and (3) a respective user identity attribute in a one-to-one correspondence.