Profile and consent accrual

• US 8,719,366 B2
• Filed: 08/13/2009
• Issued: 05/06/2014
• Est. Priority Date: 02/23/2004
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Mathew, Ashvin Joseph, Vetrivel, Puhazholi, Mutha, Nayana Ramdas, Coco, Joseph Nicholas, Dunn, Melissa W.
• Primary Examiner(s): BLAIR, DOUGLAS B
• Application Number:
  US12/540,853
• Publication Number:
  US 20090300509A1
• Time in Patent Office: 1,727 Days
• Field of Search: 709/217, 709/219, 709/227, 709/229, 726/3, 726/4, 726/5, 726/6, 726/7
• US Class Current: 709/217
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/306 User profiles

Abstract

Consent management between a client and a network server. In response to a request for consent, a central server determines if requested user information is included in a user profile associated with a user and if the user has granted consent to share the requested user information. A user interface is provided to the user via a browser of the client to collect the requested user information that is not included in the user profile and the consent to share the requested user information from the user. After receiving the user information provided by the user via the user interface, the service provided by the network server is allowed access to the received user information, and the central server updates the user profile. Other aspects of the invention are directed to computer-readable media for use with profile and consent accrual.

Claims

1. A method of managing consent between a client and a network server, said client and said network server being coupled to a data communication network, said network server providing a service to a user via the client, said client operating a browser configured to permit the user to communicate on the data communication network, said method comprising:

maintaining a user profile associated with the user;

receiving a request from the service provided by the network server for user information associated with the user and for consent to use the requested user information;

determining, in response to the request for consent, when the requested user information is not included in the user profile;

in response to the determining that the requested user information is not included in the user profile, providing to the user via the browser a consent user interface to collect the requested user information from the user that is not included in the user profile from the user, wherein the consent user interface displays a user-selectable option for viewing intention information associated with the requested user information, said intention information describing how the requested user information will be used by the service provided by the network server;

providing an intention user interface via the browser for displaying the intention information, said intention user interface being provided in response to the user-selectable option being selected by the user;

receiving via the consent user interface the consent user information that is not included in the user profile, said user information provided by the user in response to the providing of the consent user interface to the user;

updating the user profile with the received user information;

allowing access by the service to the received user information in the updated user profile by granting consent for the service to use said user information, whereby the user profile is updated with user information which is not included in the user profile when the request is received from the service so that the requested user information is accessible to the service; and

providing a revocation user interface via the browser for allowing the user to revoke consent for the service provided by the network server to use the user information included in the user profile.

2. The method of claim 1, further comprising allowing, in response to the request for consent, access by the service to the requested user information if the user information is included in the user profile.

3. The method of claim 1, wherein the user profile is being maintained by a central server, said central server being coupled to the data communication network, and wherein the user interface is being provided by the central server and displays user information previously included in the user profile.

4. The method of claim 1, wherein said intention user interface further displays retention information associated with the requested user information, said retention information specifying how long the requested user information will be retained by the service provided by the network server.

5. The method of claim 1, wherein the service provided by the network server is a member of a policy group, and wherein said intention user interface further displays a list of members of said policy group.

6. The method of claim 5, wherein said intention user interface further displays a second user-selectable option for viewing a privacy policy associated with said policy group, said privacy policy relating to how user information that the policy group is granted consent to use is to be protected, and further comprising providing a policy user interface via the browser for displaying the privacy policy, said policy user interface being provided in response to the second user-selectable option being selected by the user.

7. The method of claim 1, further comprising providing an administrator user interface to a responsible person of the user in response to said receiving the user information provided by the user, said another user interface allowing the responsible person of the user to grant consent for the service provided by the network server to use the received user information and wherein said responsible person is a parent of the user.

8. The method of claim 7, wherein said allowing access by the service to the received user information comprises allowing access by the service to the received user information if consent for the service to use the received user information is granted by said responsible person.

9. A method of managing consent between a client and a network server, said client and said network server being coupled to a data communication network, said network server providing a service to a user via the client, said client operating a browser configured to permit the user to communicate on the data communication network, said method comprising:

maintaining a user profile associated with the user;

receiving a request from the service provided by the network server for user information associated with the user and for consent to use the requested user information;

determining, in response to the request for consent, when the requested user information is not included in the user profile;

in response to the determining that the requested user information is not included in the user profile, providing to the user via the browser a consent user interface to collect the requested user information from the user that is not included in the user profile from the user;

receiving via the consent user interface the consent user information that is not included in the user profile, said user information provided by the user in response to the providing of the consent user interface to the user;

updating the user profile with the received user information;

allowing access by the service to the received user information in the updated user profile by granting consent for the service to use said user information, whereby the user profile is updated with user information which is not included in the user profile when the request is received from the service so that the requested user information is accessible to the service; and

providing a revocation user interface via the browser for allowing the user to revoke consent for the service provided by the network server to use the user information included in the user profile, said revocation user interface displaying a list of services for which the user has granted consent to use the user information included in the user profile.

10. The method of claim 9, wherein said revocation user interface further displays a user-selectable option for revoking consent for the service provided by the network server to use the user information included in the user profile.

11. The method of claim 10, further comprising revoking consent for the service provided by the network server to use the user information included in the user profile in response to the user-selectable option being selected by the user.

12. The method of claim 10, further comprising providing a revocation confirmation user interface via the browser in response to the user-selectable option being selected by the user, wherein said revocation confirmation user interface further displays the consequences of selecting the user-selectable option for revoking consent for the service provided by the network server to use the user information included in the user profile.

13. The method of claim 9, said revocation user interface further displaying a list of policy groups for which the user has granted consent to use the user information included in the user profile.

14. The method of claim 13, wherein said revocation user interface further displays a user-selectable option for revoking consent for a policy group to use the user information included in the user profile.

15. The method of claim 14, further comprising revoking consent for the policy group to use the user information included in the user profile in response to the user-selectable option being selected by the user.

16. One or more tangible computer-readable storage media having computer-executable instructions for managing consent between a client and a network server, said client and said network server being coupled to a data communication network, said network server providing a service to a user via the client, said client operating a browser configured to permit the user to communicate on the data communication network, said computer-readable storage media comprising computer executable instructions for:

maintaining a user profile associated with the user;

receiving a request from the service provided by the network server for user information associated with the user and for consent to use the requested user information;

determining, in response to the request for consent, when the requested user information is not included in the user profile;

providing, in response to the determining that the requested user information is not included in the user profile, to the user via the browser a consent user interface to collect the requested user information that is not included in the user profile from the user;

reviewing instructions for displaying intention information associated with the requested user information, said intention information describing how the requested user information will be used by the first service provided by the network server;

receiving, from the user via the consent user interface, the user information that is not included in the user profile, said user information provided by the user in response to the providing of the consent user interface to the user;

updating the user profile with the received user information;

allowing access by the service to the received user information in the updated user profile by granting consent for the service to use said user information, whereby the user profile is updated with user information which is not included in the user profile when the request is received from the service so that the requested user information is accessible to the service, and

providing a revocation user interface via the browser for allowing the user to revoke consent for the service provided by the network server to use the user information included in the user profile, said revoking instructions displaying a list of member services that the user has granted consent to use the user-specific information stored in the profiling component.

17. The computer-readable storage media of claim 16, wherein the consent user interface is configured to display the user-specific information previously stored in a profiling component.

18. The computer-readable storage media of claim 16, wherein the reviewing instructions are configured to display retention information associated with the user information, said retention information specifying how long the user information will be retained by the first service provided by the network server.

19. The computer-readable storage media of claim 16, wherein the reviewing instructions are configured to display a list of member services of said policy group.

20. The computer-readable storage media of claim 16, further comprising managed-consent instructions for providing the received user information to a responsible person of the user to allow the responsible person of the user to grant consent for the first service provided by the network server to use the received user information.