SECURE ACCESS TO INDIVIDUAL INFORMATION

• US 20160099935A1
• Filed: 10/01/2015
• Published: 04/07/2016
• Est. Priority Date: 10/01/2014
• Status: Active Grant

• Current Assignee: Vyrty Corporation
• Original Assignee: Vyrty Corporation
• Inventors: Luskin, Eugene, Khassanov, Raif, Grinberg, Yakov P., Kolker, Eugene
• Granted Patent: US 9,613,226 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G16H 10/60 for patient-specific data, e.g. for electronic patient records
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A facility for accessing information relating to a person is described. In a reader device, the facility accesses first credentials stored in a first storage device, second credentials stored in a second storage device, and third credentials stored in the reader device. In the reader device, the facility uses a combination of the first credentials, second credentials, and third credentials to decrypt information relating to the person stored in the first storage device.

Claims

1. A method of one or more computing devices for targeting individual information to a storage device, comprising

at a time when the storage device is accessible by a first computing device, in the first computing device:

(a) causing to be stored in the storage device an identifier of individual information;

at a time when the storage device is not accessible by the first computing device, in the first computing device;

(b) obtaining the individual information;

(c) encrypting the individual information with a public key associated with the storage device;

(d) causing the encrypted individual information to be stored on an Internet-connected server in connection with the individual information identifier;

at a time when the storage device is accessible by a second computing device, in the second computing device;

(e) causing the individual information identifier to be retrieved from the storage device;

(f) using the retrieved individual information identifier to retrieve the encrypted individual information from the server; and

(g) causing to be stored on the storage device the retrieved encrypted individual information.

2. The method of claim 1 wherein the first and second computing devices are the same computing device.

3. The method of claim 1 wherein the first and second computing devices are different computing devices.

4. The method of claim 1 wherein (e) is performed in response to the storage device becoming accessible by the second computing device.

5. The method of claim 1, the method further comprising:

at a time when the storage device is accessible by a first computing device, in the first computing device;

causing to be stored in the storage device information identifying the server,

and wherein (f) uses the information identifying the server stored in the storage device.

6-19. -19. (canceled)

20. A portable storage device configured to store health information for a person and configured to be carried by the person, comprising:

a first storage region configured to store health information for the person encrypted with a public key established for the person; and

a second storage region configured to store a private key established for the person corresponding to the public key established for the person that can be used in a process to decrypt the encrypted health information for the person stored in the first storage region.

21. The portable storage device of claim 20, further comprising an interface configured to communicatively connect the portable storage device to a reader device configured to perform the process to decrypt the encrypted health information for the person stored in the first storage region using the private key stored in the second storage region.

22. The portable storage device of claim 21 wherein the interface comprises at least one electrical contact.

23. The portable storage device of claim 21 wherein the interface comprises a wireless transceiver.

24. The portable storage device of claim 21 wherein the interface comprises passive RFID transceiver.

25. The portable storage device of claim 21 wherein the private key established for the person stored in the second storage region is encrypted with a key established for the reader device.

26. The portable storage device of claim 20 wherein the portable storage device is a smart phone.

27. The portable storage device of claim 20 wherein the portable storage device conforms to the ISO/IEC 7810 ID1 size format.

28. The portable storage device of claim 20 wherein the portable storage device has straight edges coinciding with the edges of a rectangular prism having dimensions 86 mm, 54 mm, and 1 mm.

29. The portable storage device of claim 28 wherein the portable storage device has circular arc corners each having a radius of between 2 mm and 4 mm.

30. A data access device configured to access personal information on a portable storage device, the data access device comprising:

a first interface configured to communicatively connect the data access device to a portable storage device containing encrypted health information for a person; and

a controller configured to interact with the encrypted health information contained by the portable storage device.

31. The data access device of claim 30, further comprising:

a storage region configured to store a key established for the data access device, the key established for the storage device usable to decrypt a private key established for the person contained in the portable storage device that, when decrypted, is usable to decrypt the encrypted health information contained by the portable storage device.

32. The data access device of claim 31 wherein the controller is configured to:

use the key established for the data access device stored by the storage region to decrypt the private key established for the person; and

use the decrypted private key established for the person to decrypt the encrypted health information contained by the portable storage device.

33. The data access device of claim 32, further comprising:

a second interface configured to communicatively connect the data access device to a health services provider computing device in order to convey to the health services provider computing device at least a portion of the health information decrypted by the controller.

34. The data access device of claim 32, further comprising:

a second interface configured to communicatively connect the data access device to a data access device key server in order to receive a revolving sequence of keys established for the data access device,

and wherein the storage region is configured to store each key among the received revolving sequence of keys established for the data access device,

and wherein the controller is configured to use any key among the revolving sequence of keys stored in the storage region to decrypt the private key established for the person.

35. The data access device of claim 34 wherein the controller is configured to use the key among the revolving sequence of keys stored in the storage region receive most recently to re-encrypt the decrypted private key established for the person,

and wherein the first interface is configured to convey the re-encrypted private key established for the person to the portable storage device to substitute in the portable storage device the re-encrypted private key established for the person for the encrypted private key established for the person.

36. The data access device of claim 30 wherein the controller is configured to use a public key established for the person contained by the portable storage device accessed via the first interface to encrypt incremental health information for the person,

and wherein the first interface is configured to store in the portable storage device the incremental health information encrypted by the controller.

37. The data access device of claim 36, further comprising:

a second interface configured to communicatively connect the data access device to a health services provider computing device in order to convey the incremental health information to the data access device from the health services provider computing device.

38. The data access device of claim 32, wherein the second interface is a USB interface.

39. The data access device of claim 30, further comprising:

a second interface configured to communicatively connect the data access device to a health services provider credential repository to access credentials of a health services provider contained by the health services provider credential repository.

40. The data access device of claim 39 wherein the second interface represents itself to the health services provider credential repository as a disk drive.

41. The data access device of claim 39 wherein the second interface represents itself to the health services provider credential repository as a printer.

42. The data access device of claim 39 wherein the first interface comprises at least one electrical contact.

43. The data access device of claim 39 wherein the first interface comprises a wireless transceiver.

44. The data access device of claim 30 wherein the first interface comprises at least one electrical contact.

45. The data access device of claim 30 wherein the first interface comprises a wireless transceiver.

46. The data access device of claim 30, further comprising:

a second interface configured to communicatively connect the data access device to an analytics server in order to convey to the analytics server health information aggregated from health information retrieved from a plurality of portable access devices each containing health information for a different person.

47. The data access device of claim 46 wherein the controller is configured to limit conveyance of health information to the analytics server via the second interface to health information that is aggregated across at least a minimum number of people.

48-54. -54. (canceled)