SYSTEM, METHOD, AND APPARATUS FOR PROXIMITY-BASED AUTHENTICATION FOR MANAGING PERSONAL DATA

• US 20100317323A1
• Filed: 06/16/2009
• Published: 12/16/2010
• Est. Priority Date: 06/16/2009
• Status: Active Grant

• Current Assignee: HCL Technologies Limited
• Original Assignee: International Business Machines Corporation
• Inventors: Rankin, Tracy L., Jania, Frank L., Wanderski, Michael, Facemire, Michael D.
• Granted Patent: US 8,693,988 B2
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 4/023 using mutual or relative location information between multiple location based services [LBS] targets or of distance thresholds

Abstract

A computer program product that includes a computer useable storage medium to store a computer readable program for proximity-based authentication for managing personal data that, when executed on a computer, causes the computer to perform operations. The operations include receiving a request for personal data from a data access device, determining a first location corresponding to a location of the data access device, and determining a second location corresponding to a location of an authentication device. The operations also include transmitting the personal data to the data access device if the first location is within a threshold distance of the second location.

Claims

1. A computer program product comprising a computer useable storage medium to store a computer readable program for proximity-based authentication for managing personal data wherein the computer readable program, when executed on a computer, causes the computer to perform operations comprising:

receiving a request for personal data from a data access device;

determining a first location corresponding to a location of the data access device;

determining a second location corresponding to a location of an authentication device; and

transmitting the personal data to the data access device in response to determining that the first location is within a threshold distance of the second location.

2. The computer program product of claim 1, further comprising receiving navigation satellite system data for the authentication device to determine the second location.

3. The computer program product of claim 1, further comprising receiving cell phone tower data for the authentication device to determine the second location.

4. The computer program product of claim 1, further comprising:

maintaining a first access level and a second access level for the personal data; and

wherein the first access level permits access to a first subset of the personal data and the second access level permits access to a second subset of the personal data.

5. The computer program product of claim 4, further comprising:

assigning the first access level to the received request for personal data in response to determining that the data access device is entitled to access the first subset of the personal data; and

wherein transmitting the personal data to the data access device further comprises limiting the personal data transmitted to the data access device to the first subset of the personal data in response to assigning the first access level to the received request for personal data.

6. The computer program product of claim 5, further comprising receiving input from a personal data owner indicating one or more data items to be included in the first subset of the personal data.

7. The computer program product of claim 5, further comprising maintaining a data access device database associating the data access device with an allowed access level indicating allowed access to one or more data items, and wherein determining that the data access device is entitled to access the first subset of the personal data comprises comparing the allowed data access level to the first access level.

8. The computer program product of claim 5, further comprising establishing a default set of data items to be included in the first subset of the personal data.

9. The computer program product of claim 1, wherein transmitting the personal data is further in response to receiving a confirmation code indicating that a personal data owner authorizes release of the personal data.

10. The computer program product of claim 1, further comprising allowing continued access to the personal data by the data access device for a limited time.

11. A system for proximity-based authentication for managing personal data, the system comprising:

an access controller to manage access to personal data, the access controller comprising;

a request receiver to receive a request for the personal data from a data access device;

a first location determiner to determine a first location corresponding to a location of the data access device;

a second location determiner to determine a second location corresponding to a location of an authentication device to authenticate the request for personal data; and

a personal data transmitter to transmit the personal data to the data access device in response to determining that the first location is within a threshold distance of the second location;

the data access device coupled to the access controller to access the personal data, the data access device comprising;

a request transmitter to transmit the request for personal data to the access controller; and

a personal data receiver to receive the personal data from the access controller; and

a personal data store coupled to the access controller to store the personal data.

12. The system of claim 11, wherein the authentication device is coupled to the access controller and comprises:

a second location sensor to sense location data corresponding to the location of the authentication device;

a second location transmitter to transmit the location data to the access controller; and

a secure identifier to establish the identity of the authentication device.

13. The system of claim 12, wherein the authentication device further comprises a confirmation code receiver to receive a confirmation code from a personal data owner, the confirmation code to authorize transmission of the personal data to the data access device.

14. The system of claim 12, wherein:

the authentication device further comprises a data access device interface to communicate with the data access device;

the authentication device transmits the secure identifier to the data access device; and

the request for personal data from the data access device comprises the secure identifier.

15. The system of claim 12, wherein the authentication device further comprises a navigation satellite receiver to receive navigation satellite system data, and wherein the navigation satellite system data is transmitted to the access controller to determine the second location.

16. The system of claim 12, wherein the authentication device further comprises a cell phone receiver to receive cell phone tower data, and wherein the cell phone tower data is transmitted to the access controller to determine the second location.

17. A computer implemented method for proximity-based authentication for managing personal data, the method comprising:

receiving a request for personal data from a data access device;

accessing a data access device database associating the data access device with a first location corresponding to a location of the data access device;

receiving second location data indicating a second location corresponding to a location of an authentication device; and

transmitting the personal data to the data access device in response to determining that the first location is within a threshold distance of the second location.

18. The computer implemented method of claim 17, further comprising transmitting a subset of the personal data in response to determining that the first location is within a second threshold distance of the second location.

19. The computer implemented method of claim 17, wherein the request for personal data from the data access device comprises the second location data.

20. The computer implemented method of claim 17, wherein the second location data is received from the authentication device.