System, method, and apparatus for proximity-based authentication for managing personal data

• US 8,693,990 B2
• Filed: 03/12/2012
• Issued: 04/08/2014
• Est. Priority Date: 06/16/2009
• Status: Expired due to Fees

• Current Assignee: HCL Technologies Limited
• Original Assignee: International Business Machines Corporation
• Inventors: Facemire, Michael D, Jania, Frank L, Rankin, Tracy L, Wanderski, Michael
• Primary Examiner(s): Patel, Nimesh
• Application Number:
  US13/417,580
• Publication Number:
  US 20120178419A1
• Time in Patent Office: 757 Days
• Field of Search: 455/410, 455/411, 455/414.2, 455/414.3, 4554561-457, 455/556.1
• US Class Current: 455/411
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 4/023 using mutual or relative location information between multiple location based services [LBS] targets or of distance thresholds

Abstract

A computer program product that includes a computer useable storage medium to store a computer readable program for proximity-based authentication for managing personal data that, when executed on a computer, causes the computer to perform operations. The operations include receiving a request for personal data from a data access device, determining a first location corresponding to a location of the data access device, and determining a second location corresponding to a location of an authentication device. The operations also include transmitting the personal data to the data access device if the first location is within a threshold distance of the second location.

Claims

1. A computer implemented method for proximity-based authentication for managing personal data, the method comprising:

receiving, at an access controller, a request for personal data from a data access device of a requesting party, wherein the personal data belongs to a personal data owner, wherein the personal data does not belong to the requesting party, wherein the data access device comprises a request transmitter to transmit the request, wherein the data access device comprises a personal data receiver to receive the personal data;

maintaining a first access level and a second access level for the personal data, wherein the first access level permits access to a first subset of the personal data and the second access level permits access to a second subset of the personal data;

accessing a data access device database associating the data access device with a first location corresponding to a location of the data access device;

receiving second location data indicating a second location corresponding to a location of an authentication device;

transmitting the first subset of the personal data to the data access device in response to determining that the second location is within a first threshold distance of the first location;

transmitting the second subset of the personal data to the data access device in response to determining that the second location is within a second threshold distance of the first location;

assigning the second access level to the received request for personal data in response to determining that the data access device is entitled to access the second subset of the personal data; and

transmitting only the second subset of the personal data and not transmitting the first subset of the personal data to the data access device in response to determining that the second location is within the second threshold distance of the first location and not within the first threshold distance of the first location and in response to receiving a confirmation code indicating that the personal data owner authorizes release of the personal data, wherein the confirmation code is separate and distinct from the second location data, wherein the confirmation code is input by the personal data owner.

2. The computer implemented method of claim 1, wherein the request for personal data from the data access device comprises the second location data.

3. The computer implemented method of claim 1, wherein the second location data is received from the authentication device.

8. The computer implemented method of claim 1,

wherein transmitting the personal data to the data access device further comprises limiting the personal data transmitted to the data access device to the second subset of the personal data in response to assigning the second access level to the received request for personal data.

9. The computer implemented method of claim 8, further comprising maintaining a data access device database associating the data access device with an allowed access level indicating allowed access to one or more data items, and wherein determining that the data access device is entitled to access the second subset of the personal data comprises comparing the allowed data access level to the second access level.

10. The computer implemented method of claim 8, further comprising receiving input from a personal data owner indicating one or more data items to be included in the second subset of the personal data.

11. The computer implemented method of claim 8, further comprising establishing a default set of data items to be included in the second subset of the personal data.

4. A computer implemented method for proximity-based authentication for managing personal data, the method comprising:

receiving, at an access controller, a request for personal data from a data access device of a requesting party, wherein the personal data belongs to a personal data owner, wherein the personal data does not belong to the requesting party, wherein the data access device comprises a request transmitter to transmit the request, wherein the data access device comprises a personal data receiver to receive the personal data;

maintaining a first access level and a second access level for the personal data, wherein the first access level permits access to a first subset of the personal data and the second access level permits access to a second subset of the personal data;

determining a first location corresponding to a location of the data access device;

determining a second location corresponding to a location of an authentication device;

receiving a confirmation code indicating that the personal data owner authorizes release of the personal data, wherein the confirmation code is separate and distinct from the second location data, wherein the confirmation code is input by the personal data owner; and

transmitting the personal data to the data access device in response to determining that the second location is within a threshold distance of the first location and in response to receiving the confirmation code.

5. The computer implemented method of claim 4, further comprising receiving the confirmation code from the data access device.

6. The computer implemented method of claim 4, further comprising receiving the confirmation code from the authentication device.

7. The computer implemented method of claim 4, further comprising receiving a timeframe for continued access from the personal data owner.