AU2002217630A1 - System of databases of personal data and a method of governing access to databases of personal data - Google Patents

Description

System of databases of personal data and a method of governing access to databases of personal data

The invention relates to a system of databases of personal data arranged in multiaccess configurations of various possible scopes, for example on the Internet or a local or internal network, or even within one appliance, and to a method of governing access to the personal databases by individual entities who are the owners of the unitary personal databases. These owners can be persons, groups of people, organisations or devices.

In the conventional systems used until now, the controller of the personal data concerning a subject is the entity physically owning the media used for the storage of the data. Traditional databases may be centralised or distributed with respect to the entity controlling the database, and are usually distributed with respect to the subject of the data. Due to the institutional centralisation of administration and alienation of the subject which this causes, conventional databases storing personal data, in the principle of their operation violate the rights of the individual citizen, and require additional security measures, legal safeguards, and procedures, in order to ensure the observation of these rights. The dynamic growth of the Internet and its widespread acceptance at every level and in every aspect of society have revolutionised global and regional communications, making easier the storage of information, including personal data, on servers in any place in the world, which can then be read by users from any place in the world. This ease of access to information has given rise to a significant development of systems for controlling access to data, for effectively preventing illegal access, and also of methods of verifying documents in electronic form. The problem of controlling access to data in the computer network has been widely discussed in the literature. Certain particular aspects of this problem were taken up in the description of the Polish invention nr P-331496 (PCT/GB97/00164), wherein was set out a system containing: the elements for establishing the first communications connection between a client's computer and the server's computer, elements needed to send a request from the client to the server for the obtaining of data object from the server by the client, elements in the server for selecting the requested data object from the storage memory in response to the request from the client, elements in the server to bind each data object in the memory with the service telephone number, elements in the server for identifying the telephone number of the subscriber submitting the request, other elements for the establishment of a second connection between the sever and the telephone device, elements in the server for the control of the telephone system and elements for the delivery of the requested data object from the server to the client. Data processing systems protect the data by performing an encryption operation on the plaintext of the input data object, using an encryption key, and create the encrypted ciphertext on the output. The recipient of the information in ciphertext form performs the corresponding action of decryption, using the decryption key, in order to retrieve the plaintext of data object. Encryption systems belong to two broad categories. Symmetrical cryptography uses a single key for the encryption of the data object and for its subsequent decryption. It is usually fast and inexpensive, and is used for the basic encryption of large objects, but with an eye to safety and difficulty of management, it is rarely used on its own. Asymmetrical cryptography uses a pair of keys comprising the public and the private keys. The data object encrypted using the public key can be decrypted only with the private key and vice-versa. Asymmetrical cryptography is generally stronger than symmetrical, but it is more complicated in calculation, and therefore fairly slow, lending itself to the encryption of small objects only. Moreover, there exist methods for recovering keys using asymmetrical cryptography. One of them has been set out in the description of the Polish invention P-331313 (PCT/GB97/01982), wherein is shown a system for recovering the cryptographic key, working with existing systems designed for estabilishing keys between communicating sides. Futher, one of the methods of verifying electronic documents has been set out in the description of the Polish invention P-326075 (PCT/US96/14159). That invention concerns, in principle, a system of verification of the document, a system of its archival and locating, a method of authenticating documents sent electronically, a method of authenticating the electronic document, a device for the authentication of the electronic document and a method for realising transactions through the sending of authenticated information objects and use of the device tools for the realisation of this transaction. The system ensures authenticity, privacy and integrity of the transmitted information. By authenticity should be understood the verification of the identity of the one signing the document. By privacy should be understood the protection against unauthorised access of the information contained in the document, and by integrity should be understood the facility to uncover any changes whatsoever in the content of the document. The most commonly used physical medium for the transfer of the key is a smart card with an electronic circuit. Under the designation "card" should be understood generally, any material object in the form of a portable tool, which used to carry the key or a part of the key. Smart cards are increasingly being used for performing electronic transactions. A description of one of such cards and the method of performing transactions using it is set out in the description of the Polish invention P-336938 (PCT/SE98/00897).

The object of the invention is the creation of a system of databases of personal data founded on recognised computer technologies. The application of the system will be a natural, physical incarnation of the right of every citizen to the ownership, protection and management of his own personal data. The administration of access is based on the principle that each personal database is centralised from the point of view of its owner and administrator, being the individual entity whom the data concern. At the same, time such unitary database forms a component of a distributed database from the point of view of other entities accessing the data by virtue of access licences granted for individual objects.

According to a first aspect of the invention consists of a system of personal databases using known data storage means, for example servers or compact discs, in which the database consists of the sum of unitary personal databases. Each of these abovementioned unitary personal databases comprises the owner of the unitary personal database and the storage space for the data of this unitary personal database, which the space contains individually encrypted data objects. Storage spaces for different unitary personal databases can be situated in one place, for example on one server, or can be distributed, for example on different servers. Thus, the implementation^' of the personal databases is founded on combining known and recognised computer technologies, but its structure transfers the management of data from the owner and manager of the storage and transmission media to the individual entity being the rightful owner of the data. According to a further aspect of the invention consists of a method of managing access to personal data bases. There, the sole owner and ultimate manager of the unitary personal data base, especially the individual whom the data concern and/or are his own property, exercises the original right of access to his data through the handing out or recalling of access licences to data objects in the storage space. The abovementioned licences define the range and conditions of access to the data objects in the unitary personal database. A licence of access to the object for the owner of the unitary personal database compuisorily accompanies every creation of a data object in the unitary personal database. The said licence can be created automatically, and at the same time as the object and specifically for it, or it can be a pre-existing licence, and the newly created object added to previously licensed data objects. Access to some data objects can require the presence of one or more licences. Data objects in the storage space are secured by symmetrical cryptography, and access to the data objects by asymmetrical cryptography. Access to the data happens in the place of use of the data, by the fetching of the data from the storage space in encrypted form and the decryption of the data object. This method of managing access to the personal databases provides the protection of each data object still before placing it in the storage space, through encrypting it with an individually generated symmetrical key in the place of this object original creation or introduction. A data object encrypted in this way is subsequently placed in the storage space. Individually generated keys mean that the cost of unauthorised access to data contained in the object or group of objects must be borne for each object or group of objects individually, whereas the placement of an object in storage space requires no special security technologies within the transmission channel. The access licence to a given object contains the value of the symmetrical key used for encrypting the object, which key is itself encrypted using the asymmetrical public key of the licensed entity. A licensee accesses the data by fetching the data object from the storage space in encrypted form, and then decrypting the data object with the symmetrical key previously decrypted from the associated license, using the private asymmetrical key of the licensee. Licences can accompany the data object in the storage space or they can be separately produced and distributed. The giving out of a licence consists of decrypting the symmetrical key in the licence of the data object's owner, through the use of the owner's private asymmetrical key, and then encrypting it again, this time with the asymmetrical public key of the licensee. The embodiment of the invention is described with reference to the accompanying drawings in which:

Fig. 1 sets out a schema of the system of personal databases

Fig. 2 shows a schema of a unitary personal data base accessed by licensed entities

Fig. 3 shows the application of the invention for storing personal medical data in the context of the patient-owner of the unitary personal database Fig. 4 shows the encryption and decryption of data within the system with the help of symmetrical and asymmetrical cryptographies.

As shown in Fig. 1 , the personal data base PDB comprises the combined unitary personal databases UPDBi, UPDB₂, UPDB , ..., UPDB_X, in which each unitary personal data base UPDBi, UPDB₂, UPDB₃, ..., UPDB_X comprises the owner Pi, P₂, P₃, ..., P_x of the unitary database UPDBi, UPDB₂, UPDB₃, ..., UPDB_X and the storage space Si, S₂, S₃, ..., S_x of the data of owner P,, P₂, P₃, ..., P_x of the unitary data base UPDBi, UPDB₂, UPDB₃, ..., UPDB_X. Each storage space Si, S₂, S₃, ..., S_x contains individually encrypted objects O¹, O², ..., O^y. Storage spaces Si, S₂, S₃, ..., S_x can be situated in one place, for example on one server, on one computer hard disk or one compact disk, or they can be located in various freely chosen places, for example different servers on the Internet.

Fig. 2 shows an example unitary personal database UPDB, whose storage space S contains four data objects O¹, O², ..., O^y"\ O^y. By default, for each of the data objects O, the owner P possesses an access licence Lp_,o, correspondingly licence Lp.o" for object O¹, licence Lp_o² for object O², licence Lp.o⁵"¹ for object O^y"', and licence L ^ for object O^y. On the other hand, other users Ui, U₂, U₃, ..., U_n, in order to obtain access to data object O in the storage space S, must obtain access licence Lu_,o from owner P. In the example, the owner P provided access licence Lu_ι,o' for data object O¹ for the single user Ui only. For data object O² he provided access licence Lu₃,o² for user U_3, whereas for data object O⁵"¹ he provided access licence Lu„o^y'' for user Ui, access licence Lu₂,o^y~' for user U₂ and access licence Lu„,o^y_1 for user U_n. For data object O^y the owner provided access licence Lu,,o^y for user Ui and access licence Lu„,o^y for user U_n. Fig. 3 is analogous to Fig. 2, and it shows example application of the invention to implement a unitary database of personal medical data UPDBM for the owner-patient P. Data objects O in the particular storage space S are: diagnosis O¹, prescription O², sickness leave O¹⁰, summary of critical medical data O²⁵, laboratory test result O⁴⁴ and epidemiological data O⁵⁰. The users of the data are: Hospital HO, house doctor HD, specialist doctor SD, dentist DS, pharmacy PH, employer EM and statistical agency SA. Patient P and each user: HO, HD, SD, DS, PH, EM, SA has access to a computer connected to the Internet and equipped with a device D enabling the use of cryptography. All data objects stored in the storage space S are individually encrypted; this means that for each object O a separate cryptographic key is created and used. Patient P holds access licence Lp,o for all objects O. Hospital HO was given access licence L_HO._O to diagnosis O¹, critical data O²⁵, laboratory test result O⁴⁴, and epidemiological data O⁵⁰. Other users: house doctor HD holds access licences L_HD._O to diagnosis O , critical data O²⁵ and laboratory test result O⁴⁴, specialist doctor SD holds access licences L_SD,O to prescription O², sickness leave O¹⁰ and critical data O²⁵, dentist DS holds access licence L_DS,O ²⁵ to critical data O²⁵, statistical agency SA holds access licences L_SA,O to sickness leave O¹⁰ and epidemiological data O⁵⁰, employer EM holds an access licence L_EM._O ¹⁰ to sickness leave O¹⁰, and pharmacy PH holds access licence L_PH,O ² to prescription O². The given example does not exhaust the possibilities of utilising the system of personal medical databases UPDBM, but only indicates the method of organisation and management of this system. This is because patient P may provide access licences L to other selected entities on individually set conditions. Licence L can be granted for an indefinite period, it can be made non-revocable to guarantee access by doctors to their own entries or it can be on a one time basis, for example to a doctor outwith one's place of residence. Prescription O² can be made accessible to pharmacy PH for the purpose of dispensing medicine, registering this transaction and reconciling the payment with the relevant health care agency. Critical data O²⁵, in situations demanding immediate intervention, can be automatically made accessible to the nearest hospital, which allows it to be appropriately prepared for the reception of the patient P. Epidemiological data O⁵⁰ can be made accessible to selected agencies, while not allowing access to the object containing patient P identity, thus preserving his anonymity. It is implicit, that each licensed entity may obtain access to the data of other owners, stored on the same or other servers, upon obtaining licences from those owners.

Fig. 4 sets out an example of the encryption of data into object O and the granting of access licence Lu to user U by owner P. In the point of the creation of the data PCD the owner encrypts his data with the individually generated symmetric key SK, making data object O. He encrypts key SK with the asymmetric public key PuAK-U of user U, making access licence Lu- The data object O and access licence Lu thus created are placed in storage space S. To access the data, user U fetches data object O and access licence Lu to the place of use of the data PUD, where by means of his own private asymmetric key PrAK-U he decrypts the symmetric key SK, with the help of which he then decrypts the data of object O. Owner P likewise creates and uses his own licence Lp using his own asymmetric keys, public PuAK-P and private PrAK-P.

The system of personal databases PDB according to the invention can be successfully used for storing documents of especial value to the owner P. Such a database enables the secure storage of documents, for example those which loss through theft, misplacement or fire would have serious material or legal consequences, or cause a strong feeling of personal loss. Personal documents may be stored in unitary database UPDB by the owner P himself, legal documents such as notarial acts or birth certificates should be first digitally signed by a notary, and identity documents such as an identity card, a passport, driver's licence, certificate of professional qualification or of academic status, should be stored in the database UPDB as duplicates first digitally signed by the body issuing the original document. Documents stored in the base UPDB can be accessed by the owner P anywhere, where the need for them to be shown arises, for example on a national border when the original passport has been lost or stolen. Strong cryptographic technologies will make documents more immune to forgery than paper or plastic based originals and may even end up being used in place of those originals. The system of personal databases PDB may be used to protect and licence intellectual property. Computer programmes, digitally recorded audio items, literature, graphic productions, teaching materials and others can be encrypted symmetrically and stored in the unitary personal data base UPDB of the original owner P: the author, agent or studio. From there, the owner P can make these items individually available other licensed users U. For the distribution of encrypted data objects O, especially repeatedly usable ones, like audio or video material, use can be made of mass media such as the Internet, compact discs, kiosks or Digital Audio Broadcast channels. At this point, the distributed data object O still belongs only to unitary personal database UPDB of owner P, as its content is only accessible to him and is not accessible by unauthorised entities. Obtaining licence L makes data object O accessible to user U. In the case of obtaining many licences L to many different data objects O from one or more owners P, such user U becomes the manager of a distributed personal data base comprising a collection of different data objects O, to which user U gains access by means of his private asymmetrical key PrAK-U.

Another example of utilisation of the invention is in the field of controlling access to motor vehicles, especially motorcars. There, the ultimate manager, and the licensing entity is the owner of the vehicle. The collection of data objects, i.e. the unitary database UPDB contains the full range of functions of the vehicle, in which each function can be treated as a single data object O; the data recorded therein allow the controlling of the relevant function, and the readings provide indicators of its use. The original owner P of the vehicle and of UPDB database within can issue licences L to other entities, modify or revoke them. These may be licences for selected functions with established limits of working, for example limiting speed for young drivers. The full range of functions of the vehicle accessible to the original owner P is his unitary personal database UPDB. The collection of access licences to many different vehicles, composed of licences given to a third party by the original owners of the vehicles, comprises the distributed personal database of access of that party.

It is evident, that the system of personal databases PDB, as also the unitary personal data base UPDB, can contain data objects O from many fields. The same asymmetric key pair can be used to access personal medical data, digital copy of one's passport, to open a musical file one has purchased, to direct a whole fleet of company cars or to manage access to a private vehicle.

Claims (10)

1. A system of databases of personal data using known storage media, for example servers or compact discs, characterised in that the database of personal data (PDB) comprises the sum of unitary personal databases (UPDB,, UPDB₂, UPDB₃, ... , UPDB_X) of which each is made up of the owner (Pi, P₂, P₃, ..., P_x) of unitary personal database (UPDB,, UPDB₂, UPDB₃, ..., UPDBx) and storage space (Si, S₂, S₃, ..., S_x) for the data of the owner (Pi, P₂, P₃, ..., P_x) of the unitary personal database (UPDBi, UPDB₂, UPDB₃, ... , UPDB_X), and where each storage space (Si, S₂, S₃, ..., S_x) contains individually encrypted data objects (O¹, 0², O³, ..., O^y).

2. A system according to claim 1 characterised in that the storage spaces (Si, S₂, S₃, ..., S_x) of different unitary databases of personal data (UPDBi, UPDB₂, UPDB₃, ... , UPDB_X) are situated in one place.

3. A system according to claim 1 characterised in that the individual storage spaces (Si, S₂, S₃, ..., S_x) of different unitary databases of personal data (UPDBi, UPDB₂, UPDB₃, ..., UPDB_X) are distributed.

4. A method of managing access to the database of personal data comprising a collection of unitary databases of personal data, characterised in that the sole owner and ultimate manager of the unitary database of personal data, specially an individual whom these data concern and/or are his property, exercises the original right of access to the storage space through provision or withdrawal of access licences to data objects within that storage space.

5. A method according to claim 4 characterised in that the licence defines the scope and conditions of access to the data objects within the unitary database of personal data.

6. A method according to claim 4 characterised in that the creation of a data object in the unitary database of personal data is automatically accompanied by the creation of an access licence for that object for the owner of that unitary database of personal data.

7. A method according to claim 5 characterised in that access to certain data objects in the storage facility requires the presence of one licence.

8. A method according to claim 5 characterised in that access to certain data objects requires the presence of more than one licence.

9. A method according to claim 4 or claim 5 characterised in that the data objects in the storage space are encrypted using symmetrical cryptography, and access to data objects in the storage space is managed through asymmetrical cryptography.

10. A method according to claim 9 characterised in that access to data takes place in the place of use of the data through the fetching of the data object from the storage space in encrypted form and then the decrypting of the data object.