Patent Issued for Data processing permits system with keys (USPTO 11811907): Ketch Kloud Inc.
2023 NOV 23 (NewsRx) -- By a
Patent number 11811907 is assigned to
The following quote was obtained by the news editors from the background information supplied by the inventors: “Any system, company, or organization that interacts with data may need to follow regulations to correctly handle the data. For example, a system may store or handle data if the system has a legitimate reason to store or handle that data, and otherwise the system may not store the data. These regulations may apply to any personal data, including both “hard” identifiers explicitly indicating a user and “soft” identifiers implicitly indicating a user. Some examples of such regulations may include the European Union’s General Data Protection Regulation (GDPR), the Health Insurance Portability and Accountability Act (HIPAA) for health-related data privacy, and the Federal Trade Commission’s (FTC’s) data and privacy regulations for financial institutions, among other such regulations. Additionally, the regulations for data handling may change based on new laws, new industries, new security concerns, etc., and these regulations may be different for different jurisdictions. As such, a static system for handling data protection is not sufficient for following rapidly changing regulations or managing regulations across multiple jurisdictions. Furthermore, implementing a system that handles user consent separately from data processing may fail to ensure technically that the system uses the data in the proper manner, resulting in a great deal of risk for the organization running the system. That is, simply claiming to follow the rules may not meet the high standards of some data protection regulations, leaving an organization liable or facing prohibitive cost if the system uses any user data incorrectly (e.g., without the proper consent or legitimizing reason). Furthermore, some regulations may require a system to provide, to a user upon request, a vast amount of information about how the user’s data is managed. Many systems may have no structures or functionality in place to support receiving such requests, processing such requests, or sending the requested information to the user.”
In addition to the background information obtained for this patent, NewsRx journalists also obtained the inventors’ summary information for this patent: “Data regulations may set rules and/or restrictions for how a data management system may collect, store, and process user data. For example, in some cases, a data management system may not store user data without specific consent from the relevant user. Additionally or alternatively, the system may provide information to the user upon request indicating how the user’s data is used within the system. The data regulations for a system may change based on new laws, new industries, new security concerns, etc., and may be different across different jurisdictions. To handle these data regulations, the system may implement data processing permits and cryptographic techniques to tie legitimizing reasons for using data (e.g., user consent) to data handling. For example, by tying user consent to data handling at a technical level, the system may automatically comply with data regulations and efficiently update to handle changing data regulations and/or regulations across different jurisdictions.
“For example, the system may support a system of record (SOR) for data processing permits. The SOR for data processing permits may manage legitimizing reasons for data use (e.g., user consent information) by generating data processing permits that indicate the legitimizing reason (e.g., a user’s consent). If a user consents to the system using the user’s personal data for one or more data processing activities, the system may automatically create a permit indicating this consent. The permit may be user-specific and data processing activity-specific. Additionally, the permit may be associated with a permit key (e.g., a key encrypting key or key chain). For example, the permit key may include a pointer to the permit, and the permit may include a key identifier (ID) for the permit key. In some cases, the system may support creating, updating, and revoking data processing permits (e.g., based on user inputs to a consent management user interface (UI)). In some such cases, the permit key’s pointer may update to point to a latest relevant permit (e.g., based on a new or updated data processing permit stored in the system).
“To tie these permits to data, the system may implement one or more cryptographic techniques. For example, when the system receives data for a user, the system may search for any applicable data processing permits indicating that the system can store the received data (e.g., based on the relevant user’s consent or another legitimizing reason for storing the data). If the system can store the data (i.e., the system identified a relevant permit), the system may generate a nonce, such as a cryptographic nonce or data encrypting key, to encrypt the user’s data and obtain an encrypted data object. The system may additionally encrypt the nonce using the permit keys for any relevant permits. The system may store the encrypted data object with the encrypted nonces and key IDs of the relevant permit keys (e.g., one or more permit keys pointing to the relevant data processing permits), for example, in an encrypted datum bundle. If the system receives a data processing request requesting to use the user’s data, the system may check the corresponding permits. If any of the permits (e.g., the currently active permits) indicate that the user has consented for the system to use the data for the requested data process, the system may use the permit key for the consenting permit (e.g., the permit key pointing to the consenting permit, the permit key pointed to by the consenting permit, etc.) to decrypt the corresponding nonce (e.g., an encrypted cryptographic nonce stored with the encrypted data in the encrypted datum bundle). The system may use this cryptographic nonce to decrypt the data such that the data is accessible for the system (or an external system) to perform the requested data processing activity. In this way, if the system receives a data processing request that is not consented to by the relevant user, the system may fail to identify a corresponding data processing permit and may correspondingly fail to decrypt the data. This may technically ensure that personal data for a user stored in the data management system is used for the data processing activities consented to by the user and is not used for other (non-consented to) activities.
“Aspects of the disclosure are initially described in the context of systems supporting data processing permits with keys. Additional aspects of the disclosure are described with reference to systems for data management, encryption, differential privacy, and permit creation. Aspects of the disclosure are further illustrated by and described with reference to process flows, apparatus diagrams, system diagrams, and flowcharts that relate to data processing permits systems with keys.”
The claims supplied by the inventors are:
“1. A method for managing data privacy at a system supporting a blockchain network, comprising: storing, at a set of peer nodes for the blockchain network, a smart contract configured for data processing permit management and a distributed ledger comprising a plurality of data processing permits and a plurality of permit keys, wherein each peer node of the set of peer nodes comprises the smart contract and the distributed ledger; receiving, at a peer node of the set of peer nodes, user-specific data corresponding to a user; querying the distributed ledger of the peer node using the smart contract of the peer node for identifying a data processing permit of the plurality of data processing permits indicating permission to store the user-specific data; identifying, at the peer node and from the plurality of permit keys of the distributed ledger of the peer node, a permit key associated with the data processing permit in response to the querying identifying the data processing permit indicating the permission to store the use r-specific data; encrypting the user-specific data using a cryptographic nonce and encrypting the cryptographic nonce using the permit key based at least in part on the identifying the permit key; and storing the encrypted user-specific data and the encrypted cryptographic nonce in an encrypted database.
“2. The method of claim 1, further comprising: receiving, at the peer node and from a user device operated by the user, information indicating consent by the user for the system to store the user-specific data corresponding to the user; creating the data processing permit indicating the permission to store the user-specific data based at least in part on the receiving the information indicating the consent by the user; and adding the created data processing permit to the distributed ledger of the peer node.
“3. The method of claim 2, further comprising: sharing, from the peer node to one or more other peer nodes of the set of peer nodes, the created data processing permit.
“4. The method of claim 1, further comprising: receiving, at the peer node and from a user device operated by the user, information revoking consent by the user for the system to store the user-specific data corresponding to the user; searching the distributed ledger of the peer node using the smart contract of the peer node for one or more data processing permits of the plurality of data processing permits indicating one or more permissions to store the user-specific data; and deleting, from the distributed ledger of the peer node, at least one or more permit keys corresponding to the one or more data processing permits indicating the one or more permissions to store the user-specific data based at least in part on the searching and in response to the information revoking the consent.
“5. The method of claim 4, further comprising: updating the distributed ledger at one or more other peer nodes of the set of peer nodes based at least in part on the deleting the at least one or more permit keys from the distributed ledger of the peer node.
“6. The method of claim 1, wherein the data processing permit indicates the permission to store the user-specific data for use in a data processing activity, the method further comprising: receiving, at the peer node, a data request to use the user-specific data for the data processing activity; querying the distributed ledger of the peer node using the smart contract of the peer node for the data processing permit indicating the permission to store the user-specific data for use in the data processing activity in response to the data request; further identifying, at the peer node and from the distributed ledger of the peer node, the permit key associated with the data processing permit indicating the permission to store the user-specific data for use in the data processing activity based at least in part on the querying the distributed ledger of the peer node for the data processing permit in response to the data request; retrieving, from the encrypted database, the encrypted user-specific data and the encrypted cryptographic nonce based at least in part on the further identifying the permit key; decrypting the encrypted cryptographic nonce using the permit key based at least in part on the retrieving the encrypted cryptographic nonce and on the further identifying the permit key; decrypting the encrypted user-specific data using the cryptographic nonce based at least in part on the decrypting the encrypted cryptographic nonce; and transmitting, from the peer node, the user-specific data in response to the data request based at least in part on the decrypting the encrypted user-specific data.
“7. The method of claim 6, further comprising: identifying, in the user-specific data, one or more soft identifiers for the user; and adding local noise to the user-specific data based at least in part on the identifying the one or more soft identifiers, wherein the transmitting the user-specific data is based at least in part on the adding the local noise to the user-specific data.
“8. The method of claim 1, wherein the data processing permit indicates the permission to store the user-specific data for use in a first data processing activity, further comprising: receiving, at the peer node, a data request to use the user-specific data for a second data processing activity; querying the distributed ledger of the peer node using the smart contract of the peer node for a second data processing permit of the plurality of data processing permits indicating second permission to store the user-specific data for use in the second data processing activity in response to the data request; failing to identify the second data processing permit indicating the second permission to store the user-specific data for use in the second data processing activity based at least in part on the querying; and transmitting, from the peer node, an indication that the data request has failed based at least in part on the failing to identify the second data processing permit.
“9. The method of claim 1, wherein the data processing permit indicates the permission to store the user-specific data for use in a data processing activity, further comprising: receiving, at the peer node, a data request to use second user-specific data corresponding to the user for the data processing activity; querying the distributed ledger of the peer node using the smart contract of the peer node for a second data processing permit of the plurality of data processing permits indicating second permission to store the second user-specific data for use in the data processing activity in response to the data request; failing to identify the second data processing permit indicating the second permission to store the second user-specific data for use in the data processing activity based at least in part on the querying; and transmitting, from the peer node, an indication that the data request has failed based at least in part on the failing to identify the second data processing permit.
“10. The method of claim 1, further comprising: identifying, in the user-specific data, a hard identifier for the user; and setting the hard identifier for the user to a token value based at least in part on the identifying the hard identifier, wherein the encrypting the user-specific data is based at least in part on the setting the hard identifier for the user to the token value.
“11. The method of claim 1, wherein the peer node of the set of peer nodes hosts a first instance of the smart contract and a first instance of the distributed ledger.
“12. An apparatus for managing data privacy at a system supporting a blockchain network, comprising: a processor; memory coupled with the processor; and instructions stored in the memory and executable by the processor to cause the apparatus to: store, at a set of peer nodes for the blockchain network, a smart contract configured for data processing permit management and a distributed ledger comprising a plurality of data processing permits and a plurality of permit keys, wherein each peer node of the set of peer nodes comprises the smart contract and the distributed ledger; receive, at a peer node of the set of peer nodes, user-specific data corresponding to a user; query the distributed ledger of the peer node using the smart contract of the peer node for identifying a data processing permit of the plurality of data processing permits indicating permission to store the user-specific data; identify, at the peer node and from the plurality of permit keys of the distributed ledger of the peer node, a permit key associated with the data processing permit in response to the querying identifying the data processing permit indicating the permission to store the use r-specific data; encrypt the use r-specific data using a cryptographic nonce and encrypt the cryptographic nonce using the permit key based at least in part on the identifying the permit key; and store the encrypted user-specific data and the encrypted cryptographic nonce in an encrypted database.
“13. The apparatus of claim 12, wherein the instructions are further executable by the processor to cause the apparatus to: receive, at the peer node and from a user device operated by the user, information indicating consent by the user for the system to store the user-specific data corresponding to the user; create the data processing permit indicating the permission to store the user-specific data based at least in part on the receiving the information indicating the consent by the user; and add the created data processing permit to the distributed ledger of the peer node.
“14. The apparatus of claim 13, wherein the instructions are further executable by the processor to cause the apparatus to: share, from the peer node to one or more other peer nodes of the set of peer nodes, the created data processing permit.”
There are additional claims. Please visit full patent to read further.
URL and more information on this patent, see: Alexander, Samuel. Data processing permits system with keys.
(Our reports deliver fact-based news of research and discoveries from around the world.)
Division of Pediatric Gastroenterology Hepatology and Nutrition Researcher Highlights Recent Research in Inflammatory Bowel Disease (Patient, Parent, and Provider Perceptions of Barriers to Pediatric Inflammatory Bowel Disease Care): Digestive System Diseases and Conditions – Inflammatory Bowel Disease
Patent Issued for Disclosure quality assurance (USPTO 11810042): United Services Automobile Association
Advisor News
- Goldman Sachs, others weigh in on what’s ahead for the market in 2025
- How is consumers’ investing confidence impacting the need for advisors?
- Can a balance of withdrawals and annuities outshine the 4% rule?
- Economy ‘in a sweet spot’ but some concerns ahead
- Trump, Capitol allies likely looking at quick cryptocurrency legislation
More Advisor NewsAnnuity News
Health/Employee Benefits News
- The business case for selling LTC insurance to small-business owners
- Donald Trump vows executive order to 'keep men out of women's sports': 'Transgender lunacy'
- Consumer protection on the line
- University of Texas Southwestern Researcher Updates Current Data on Hemophilia (Experiences with Emicizumab: A Retrospective Review of Patients on Emicizumab Therapy at the North Texas Hemophilia Treatment Center): Hematologic Diseases and Conditions – Hemophilia
- Research Conducted at University of Utah Has Updated Our Knowledge about CDC and FDA (Public Health Insurance Expansion and Financial Well-being Indicators Directly Evaluated By the Eligible: Evidence From the United States): CDC and FDA
More Health/Employee Benefits NewsLife Insurance News