Managing exchanges of sensitive data

• US 9,565,211 B2
• Filed: 03/15/2013
• Issued: 02/07/2017
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: TrustArc, Inc.
• Original Assignee: True Ultimate Standards Everywhere, Inc.
• Inventors: Guinan, Daniel J.
• Primary Examiner(s): AVERY, JEREMIAH L
• Application Number:
  US13/841,543
• Publication Number:
  US 20140282834A1
• Time in Patent Office: 1,425 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method, system or computer usable program product for managing exchanges of sensitive data including utilizing a processor to request a service across a network from an application, the service requiring a disclosure of a first set of sensitive data by the application; providing a set of certified policy commitments regarding the first set of sensitive data to the application for a determination of acceptability; and upon a positive determination, receiving the service including the disclosure of the first set of sensitive data.

Claims

1. A method of managing exchanges of sensitive data comprising:

establishing a secure connection between a first application and a second application across a network;

the first application utilizing a processing device to request a service across the network from the second application utilizing a separate processing device, the service requiring a disclosure of a first set of sensitive data by the second application;

responsive to the second application requesting a set of certified policy commitments of the first application in response to the service request, providing across the network the set of certified policy commitments of the first application regarding the first set of sensitive data to the second application for authentication of the set of certified policy commitments and for a determination of acceptability of data handling policies included in the set of certified policy commitments, wherein the set of certified policy commitments provided by the first application includes data handling policies that the first application commits to utilize in handling and protecting the set of sensitive data of the second application; and

upon a positive authentication of the set of certified policy commitments and a positive determination of acceptability of the included data handling policies by the second application, receiving the service including the disclosure of the first set of sensitive data from the second application through the secure connection;

wherein the first set of sensitive data can be provided by the second application to the first application pursuant to the set of certified policy commitments provided by the first application if the second application determines that the included data handling policies satisfy a set of predetermined policy requirements of the second application.

2. The method of claim 1 wherein the first application is located at a first node and a first node identifier is provided with the set of certified policy commitments.

3. The method of claim 2 wherein the first node identifier is stored in a memory and wherein multiple applications commonly share the first node identifier.

4. The method of claim 2 wherein the first node identifier is a public key.

5. The method of claim 4 further comprising receiving a challenge from the second application whereby a response is provided using a private key corresponding to the public key.

6. The method of claim 1 further comprising receiving a request from the second application to disclose a second set of sensitive data by the first application to the second application;

the first application requesting a second set of certified policy commitments from the second application;

comparing the second set of certified policy commitments to a second set of predetermined set of policy requirements of the first application to determine acceptability; and

upon a positive determination of acceptability of the second set of certified policy commitments, providing the second set of sensitive data to the second application.

7. The method of claim 6 wherein the set of certified policy commitments and the second set of certified commitments can be authenticated by utilizing a public key of a certifying authority.

8. The method of claim 1 wherein the first set of policy commitments and the predetermined set of policy requirements are selected by a developer of the first application from a standard set of policies.

9. The method of claim 6 wherein the second application is located at a second node and a second node identifier is provided with the set of certified policy commitments.

10. The method of claim 9 wherein the second node identifier is utilized to verify the authenticity of the second node.

11. The method of claim 6 wherein the first node identifier is provided to the second application with the second set of certified policy commitments for verification of identity.

12. The method of claim 11 wherein a first node identifier is provided with the set of certified policy commitments;

wherein the first node identifier is stored in a memory and wherein multiple applications commonly share the first node identifier;

wherein the first node identifier is a public key;

wherein the set of certified policy commitments and the second set of certified commitments can be authenticated by utilizing a public key of a certifying authority;

wherein the second set of policy commitments and the predetermined set of policy requirements are selected from a standard set of policies;

wherein the second application is located at a second node and a second node identifier is provided with the set of certified policy commitments; and

wherein the second node identifier is utilized to verify the authenticity of the second node.

35. The method of claim 1 further comprising the first application registering with a certifying authority with a first node public key upon being downloaded to the first node.

13. A computer usable program product comprising a non-transitory computer usable storage medium including computer usable code for use in managing exchanges of sensitive data, the computer usable program product comprising code for performing the steps of:

establishing a secure connection between a first application and a second application across a network;

the first application utilizing a processing device to request a service across the network from the second application utilizing a separate processing device, the service requiring a disclosure of a first set of sensitive data by the second application;

responsive to the second application requesting a set of certified policy commitments of the first application in response to the service request, providing across the network the set of certified policy commitments of the first application regarding the first set of sensitive data to the second application for authentication of the set of certified policy commitments and for a determination of acceptability of data handling policies included in the set of certified policy commitments, wherein the set of certified policy commitments provided by the first application includes data handling policies that the first application commits to utilize in handling and protecting the set of sensitive data of the second application; and

upon a positive authentication of the set of certified policy commitments and a positive determination of acceptability of the included data handling policies by the second application, receiving the service including the disclosure of the first set of sensitive data from the second application through the secure connection;

wherein the first set of sensitive data can be provided by the second application to the first application pursuant to the set of certified policy commitments provided by the first application if the second application determines that the included data handling policies satisfy a set of predetermined policy requirements of the second application.

14. The computer usable program product of claim 13 wherein the first application is located at a first node and a first node identifier is provided with the set of certified policy commitments.

15. The computer usable program product of claim 14 wherein the first node identifier is stored in a memory and wherein multiple applications commonly share the first node identifier.

16. The computer usable program product of claim 14 wherein the first node identifier is a public key.

17. The computer usable program product of claim 16 further comprising code for performing the step of receiving a challenge from the second application whereby a response is provided using a private key corresponding to the public key.

18. The computer usable program product of claim 13 further comprising code for performing the steps of receiving a request from the second application to disclose a second set of sensitive data by the first application to the second application;

the first application requesting a second set of certified policy commitments from the second application;

comparing the second set of certified policy commitments to a second set of predetermined set of policy requirements of the first application to determine acceptability; and

upon a positive determination of acceptability of the second set of certified policy commitments, providing the second set of sensitive data to the second application.

19. The computer usable program product of claim 18 wherein the set of certified policy commitments and the second set of certified commitments can be authenticated by utilizing a public key of a certifying authority.

20. The computer usable program product of claim 13 wherein the first set of policy commitments and the predetermined set of policy requirements are selected by a developer of the first application from a standard set of policies.

21. The computer usable program product of claim 18 wherein the second application is located at a second node and a second node identifier is provided with the set of certified policy commitments.

22. The computer usable program product of claim 18 wherein the second node identifier is utilized to verify the authenticity of the second node.

23. The computer usable program product of claim 18 wherein the first node identifier is provided to the second application with the second set of certified policy commitments for verification of identity.

24. A data processing system for managing exchanges of sensitive data, the data processing system comprising:

a processing device; and

a memory storing program instructions which when executed by the processing device execute the steps of;

establishing a secure connection between a first application and a second application across a network;

the first application utilizing the processing device to request a service across the network from the second application utilizing a separate processing device, the service requiring a disclosure of a first set of sensitive data by the second application;

responsive to the second application requesting a set of certified policy commitments of the first application in response to the service request, providing across the network the set of certified policy commitments of the first application regarding the first set of sensitive data to the second application for authentication of the set of certified policy commitments and for a determination of acceptability of data handling policies included in the set of certified policy commitments, wherein the set of certified policy commitments provided by the first application includes data handling policies that the first application commits to utilize in handling and protecting the set of sensitive data of the second application; and

upon a positive authentication of the set of certified policy commitments and a positive determination of acceptability of the included data handling policies by the second application, receiving the service including the disclosure of the first set of sensitive data from the second application through the secure connection;

wherein the first set of sensitive data can be provided by the second application to the first application pursuant to the set of certified policy commitments provided by the first application if the second application determines that the included data handling policies satisfy a set of predetermined policy requirements of the second application.

25. The data processing system of claim 24 wherein the first application is located at a first node and a first node identifier is provided with the set of certified policy commitments.

26. The data processing system of claim 25 wherein the first node identifier is stored in the memory and wherein multiple applications commonly share the first node identifier.

27. The data processing system of claim 25 wherein the first node identifier is a public key.

28. The data processing system of claim 27 further comprising receiving a challenge from the second application whereby a response is provided using a private key corresponding to the public key.

29. The data processing system of claim 24 further comprising receiving a request from the second application to disclose a second set of sensitive data by the first application to the second application;

the first application requesting a second set of certified policy commitments from the second application;

comparing the second set of certified policy commitments to a second set of predetermined set of policy requirements of the first application to determine acceptability; and

upon a positive determination of acceptability of the second set of certified policy commitments, providing the second set of sensitive data to the second application.

30. The data processing system of claim 29 wherein the set of certified policy commitments and the second set of certified commitments can be authenticated by utilizing a public key of a certifying authority.

31. The data processing system of claim 24 wherein the first set of policy commitments and the predetermined set of policy requirements are selected by a developer of the first application from a standard set of policies.

32. The data processing system of claim 29 wherein the second application is located at a second node and a second node identifier is provided with the set of certified policy commitments.

33. The data processing system of claim 32 wherein the second node identifier is utilized to verify the authenticity of the second node.

34. The data processing system of claim 29 wherein the first node identifier is provided to the second application with the second set of certified policy commitments for verification of identity.