DE102016207469A1 - SYSTEM AND METHOD FOR STORING BEHAVIOR DATA AND CONTROLLING ACCESS TO THIS - Google Patents

Abstract

A system for storing anonymized personalized behavior data and controlling access thereto at a data engine, comprising: the data engine; a registration token generator configured to generate anonymous registration tokens, and to make the generated registration tokens available to individuals, each registration token representing an authorization to register one or more persons as system users with the data engine ; one or more service provider proxy devices each configured for the one or more persons to: anonymously obtain one of the generated registration tokens from a person, the received registration tokens with the registration token generator authenticate and, subject to the success of the authentication, anonymously register the person at the data machine as a system user by determining an anonymous user ID for the system user and providing the anonymous user ID to the system user and the data engine; the data engine receives the anonymous user ID and registers the received anonymous user ID as a system user; the data engine further comprises a data store and an access control device and is configured to obtain the anonymized personalized behavior data of the registered system users and to store the obtained anonymized personalized behavior data in the data store; the access control device is configured to obtain data requests for specified anonymized personalized behavior data stored by the data store from the one or more service provider proxy devices, and anonymized personalized behavior data specified in the received data request under the condition reply that the received data request specifies the anonymous user ID with which the specified anonymized personalized behavior data is anonymously personalized.

Description

The present invention relates to the field of systems for storing behavior data and controlling access thereto. In particular, the invention relates to controlling access to anonymized personalized behavior data and providing services that use the data for a user.

Protocols and schemes exist for creating, personalizing, storing, and accessing data representing a person's actions in everyday life. A user may register for a service at a service provider, the service provider processing data generated by or on behalf of the user as a service. Results may be provided to the user or a third party.

Such schemes are designed to enable anyone to safely benefit from enhanced computing capabilities, for example, by allowing mobile devices to access a service provided by cloud networks when dealing with behavioral data.

Because storing this kind of highly detailed personal information is enormously sensitive, it is desirable to allow the user to remain anonymous. Therefore, frame structures involve multiple pages to enable personalized data to be stored by a page that is ignorant of the identity of the person whose behavior (or activity) represents the data while other pages are querying the data and the data can process as a service to the person.

In such frame structures, data is stored on a data engine, and a service user over which personalized data is stored on the data engine can not be identified by the data engine. This is advantageous because the data thus stored can not be assigned to the service user and are therefore anonymous in their stored state.

Due to the division in the ecosystem, d. H. Data engine and service providers must be separate entities (to ensure that the service user can not be identified at the data engine), the ecosystem is limited in the flexibility of implementation. For example, a service provider without the skills to design and build complex human behavioral applications can not easily enter the ecosystem. Conversely, a data engine (or entity providing a data engine) with all the skills to develop applications that focus on human behavior can not invade the ecosystem because of the rules designed to protect the user's privacy.

Embodiments include a system for storing anonymized personalized behavior data on a data engine and controlling access thereto, the system comprising: the data engine; a registration token generator configured to generate anonymous registration tokens, and to make the generated registration tokens available to individuals, each registration token representing an authorization to register one or more persons as system users with the data engine ; one or more service provider proxy devices each configured for the one or more persons to: anonymously obtain one of the generated registration tokens from a person, the received registration tokens with the registration token generator authenticate and, subject to the success of the authentication, anonymously register the person at the data machine as a system user by determining an anonymous user ID for the system user and providing the anonymous user ID to the system user and the data engine; the data engine receives the anonymous user ID and registers the received anonymous user ID as a system user; the data engine further comprises a data store and an access control device and is configured to obtain the anonymized personalized behavior data of the registered system users and to store the obtained anonymized personalized behavior data in the data store; the access control device is configured to obtain data requests for specified anonymized personalized behavior data stored by the data store from the one or more service provider proxy devices, and anonymized personalized behavior data specified in the received data request under the condition reply that the received data request specifies the anonymous user ID with which the specified anonymized personalized behavior data is anonymously personalized.

Advantageously, the registration token provides a mechanism for the person to register as a system user without the service provider proxy device knowing the identity of the person. Wherein the person's possession of the registration token is a validation of the person's access data. In this way, a service provider, that is to say an entity, can specify which services (behavior data) Processing services), but does not have the expertise to provide applications / software / services therefor, simply identify registration tokens to distribute to individuals. The service provider proxy device is an entity separate from the service provider and is a service / application / device provided by a third party (not the person or service provider). The service provider proxy device may be operated by or run software provided by the same entity as the data engine. The separation of the service provider and the service provider proxy device means that the anonymity of the service user is not compromised on the data engine.

Where entities are specified as separate pages / entities, the entities may also be considered separate legal entities, independent entities, and / or independent legal entities. The separate entities exist in mutually distinct computing environments, even though they are encrypted with each other in data communication over the Internet or over another data connection. Each separate entity has a distinct security infrastructure so that a security breach on an entity does not compromise the remaining entities.

The service provider proxy device may be implemented as an application or program running on a communication device, such as a mobile phone or tablet computer. The service provider proxy device has the processing capability to coordinate interaction between the person, the token generator, and the data engine.

The service provider proxy device may be configured to register the person at the data machine as a service user by transferring the registration token obtained from the user and the determined anonymous user ID to the data engine. For example, the person's registration token may be provided by a service provider, and the person then enters the registration token into the service provider proxy device. The registration token represents an authorization for the registration, wherein representing an authorization for the registration is an indication that the data engine is configured to accept the registration token as verification that the person is authorized to register as a system user, and therefore, the data engine must store behavior data that has been anonymously personalized with the anonymous user ID, which is obtained with (associated with / corresponding to / determined in response to) the registration token. The registration token can be transmitted to the registration token generator for authentication and to the data engine for registration.

The registration tokens are anonymous. It must be said that the registration token does not identify a person using the registration token. The registration token provides the person anonymous access to the service provider proxy device. The registration token may be used on an ongoing basis as a key by which the system user can access the service provided by the service provider proxy device. The system user is anonymous to the service provider proxy device. Once the anonymous user ID has been determined on behalf of the person and provided to the person, the person (who is now registered at the data engine and therefore a system user) can use the anonymous user ID as a key by which to Service provided by the service provider proxy device. Optionally, the registration token generator is a component of the data engine. For example, a registration token may be a code in which information is encoded. The terms tokens and registration tokens are used interchangeably throughout this specification.

The anonymous user ID may be provided by an ID generation device, such as an identity granting authority, which is an entity separate from the control provider, the data engine, the person, and the service providers. The anonymous user ID may be referred to as an anonymized user ID.

The anonymous user ID is unique, so no two people are assigned to the same anonymous user ID. The ID generator may be configured to perform an irreversible hash function to transfer a transmitted request (from a service provider proxy device), which may be unique in a request space, for example, numbered, to a much larger anonymous user ID. Map space (ie no two requests lead to the same anonymous user ID). A random element may be included in the generation of the anonymous user ID from the transmitted personal identification information. The request for an anonymous user ID provided by the service provider proxy device may be called an anonymous request, and may be generic. In such cases it can For example, the ID generator may extract time and / or date information from a system clock at the time of generation of the anonymous user ID in response to the request received, and use an irreversible hash function that precludes any two different ones Instances of extracted time and / or date information can be mapped to the same anonymous user ID.

From the user's perspective, behavioral data representing the behavior of the user himself may be personalized with a non-identifying (i.e., anonymized) user ID that prevents the physical or legal identity that the user is from being identified. Therefore, the user may upload this behavior data to the data engine, where they are exposed to one or more service provider proxy devices without risk, that the behavior data be associated with the user (i.e., by naming). Thus, the user may benefit from the services of the one or more service provider proxy devices that use the user's personal behavior data without the user being identifiable.

Behavioral data may represent a measured physical characteristic of the user or may represent an interaction of the user with infrastructure acting as a source of the behavioral data. For example, behavioral data may represent an interaction of the user with a device configured to transmit data representing interaction with the data engine, for example in a data structure, which associates the data representing the interaction with the user's anonymous user ID. The behavioral data is personalized by associating with or being associated with a person, the person being the user represented by the anonymous user ID. Therefore, the behavioral data stored by the data store is personalized insofar as it is associated or associated with or attributable to a person, even if a person is represented by only an anonymous user ID and thus is a person who only from an entity that knows the mapping of the anonymous user ID to the user identity can be linked to an individual user. Behavioral data can also be referred to as activity data.

The access control device is configured to control access to the personalized behavior data by requiring service provider data access requests to specify the anonymous user ID with which the behavior data is personalized to access the behavior data.

The access control device is configured to access stored personalized behavior data for service providers upon receiving a request for data from one of the service provider proxy devices specifying the anonymous user ID with which the requested data is anonymously personalized. The access control device is configured to accept only data requests for the behavioral data that is anonymously personalized with a particular anonymous user ID from service provider proxy devices, wherein the access control device may be configured to verify that the service provider proxy device of Authorization Entity is authorized to access the data. The authorization entity may provide an authentication service such that a certificate or signature is included in the data request from the service provider proxy device, and the access control device may transmit the certificate or signature to the authorization entity for validation, and upon validation, the access control device the service provider proxy device will respond with the requested anonymized personalized behavior data.

The data request may also be considered as a data access request or as a data read request.

Optionally, the data engine may process the stored anonymized personalized behavior data in response to a data request. For example, the data engine may be configured to process the anonymized personalized behavior data requested in the data request and to output a processing result to the service provider proxy device, the result comprising the anonymized personalized behavior data.

For example, the data engine may be configured to execute programs that analyze or otherwise process the stored anonymized personalized behavior data so that the form of the anonymized personalized behavior data included in the response to the data request is a processed form. Examples of a processed form include images, graphics, calendars, timelines, maps, etc. Such processed form may be a screen image for display on the screen of the requesting service provider proxy device. The system user can access through the service provider proxy device access the processed form of the data. In this way, the system user obtains a behavior data processing service via the service provider proxy device. Alternatively, the anonymized personalized behavior data may be stored by the data engine and provided in an unprocessed or "raw" format in response to a data request, with data processing performed on the service provider proxy device.

It is assumed that a response to a data request is a transfer to the entity making the request.

Optionally, the service provider proxy device is configured to process the anonymized personalized behavior data received from the data engine in response to the data access request and output an outcome of the processing anonymously to the user.

The processing performed on the anonymized personalized behavior data by the data engine or the service provider proxy device may be, for example, a behavior data processing service from which outputs are generated and provided to the system user (for example, via a web page) which system user can log in using the respective anonymous user ID). The processing may include accessing proprietary data maintained by or otherwise made available by the service provider proxy device. The processing entity may be configured to process the anonymized personalized behavior data of a user by processing the data to generate analysis results such as graphs, graphs, tables, and summaries, the analysis results being output to the system user. The processing entity may be configured to process the anonymized personalized behavior data of a user by processing the data to generate alerts to the user when the processing indicates a health risk to the user.

As a further alternative, the system user may log in with the anonymous user ID via an application or to a web page or through another remote access service performed by the service provider proxy device, and the service provider proxy device will do so Processing result to the system user, for example, by publishing the processing result in an area of the web page / the remote access service, to which a login is required. Login requires at least the anonymous user ID and may also have password protection.

Anonymous output means an output with no information disclosing the identity of the recipient, with the recipient instead being identified by an anonymous user ID.

Optionally, the service provider proxy device is configured to determine the anonymous user ID on behalf of the user by transmitting an ID request corresponding to the obtained registration token to an ID generator and to obtain the anonymous user ID in response. Furthermore, the system may include the ID generation device configured to generate the anonymous user ID by executing irreversible processing in response to receiving the request and output the anonymous user ID to the service provider proxy device.

The request corresponding to the obtained identification information may simply be a non-identifying request, which for example is completely generic, so that all requests are similar at the ID generation device. Alternatively, it is possible that some or all of the information from the token (i.e., the token itself) is included in the request. For example, it is possible for the ID creator to use the token or sub information therefrom to associate the generation of the anonymous user ID with an entity to maintain a count of the generated user IDs per entity for accounting purposes, for example. For example, it is possible for an entity (which may be referred to as a service coordinating entity) to have a token that allows a prescribed number of anonymous user IDs to be generated (and a prescribed number of system users registered to the data engine).

The ID generator can be realized as a stateless entity, in which case it does not retain a record of creating an anonymous user ID. To ensure uniqueness of generated anonymous user IDs, the ID generator may alternatively retain a record of generated anonymous user IDs, and generating an anonymous user ID includes generating an anonymous user ID containing anonymous user IDs generated in the records Does not exist.

The system may also include one or more service coordinating entities each configured to issue one or more registration tokens from the registration token. Receive generator and distribute the one or more registration tokens to one or more persons; wherein the registration token generator is configured to make the registration tokens available to individuals by transmitting the registration tokens to the one or more service coordinating entities. Further, the or each of the one or more service coordinating entities may be entities separate from or from each of the one or more service provider proxy devices such that the individuals to which the registration tokens are distributed by the entity coordinating entities are identifiable and anonymous for the service provider proxy devices.

A service coordinating entity is an entity to which registration tokens are issued. For example, registration tokens can be converted into money or otherwise traded. The service coordinating entity identifies registration tokens on behalf of individuals so that the individuals at the service provider proxy device and the data engine can register anonymously. The service coordinating entity actually appoints the service provider proxy device as a proxy to provide service to the persons. For example, the service coordinating entity (such as an employer) may not be able to provide services based on personalized behavioral data.

In a scenario, such as a health improvement scheme, some aspects that one would like to be aware of can not be addressed in an open data system. For example, treating excessive drinking (i.e., consumption of alcoholic beverages) in the workforce, which lowers productivity. Addressing a schema that observes the behavior of employees by collecting and processing behavioral data representing the drinking of individual employees is significantly limited by the lack of true anonymity within existing systems. If the anonymity of the system user (in this case, the employee) at the data engine must be ensured, then the service can not be provided by the data engine because the employees must use personal identification information to register for the service. Advantageously, by separating the roles of the service coordinating entity (in the employer's scenario) and the service provider proxy device, the service coordinating entity can issue registration tokens which allow individuals to connect to an account of the service provider proxy device and the service provider To register data machine. The persons may register for a service provided by the data engine and the service provider proxy device, wherein the registration is provided by the service coordinating entity, but the service coordinating entity need not have the competence to provide the service itself, and the anonymity of the service users at the data engine (and the service provider proxy device) is ensured.

Optionally, the registration token comprises information identifying the service coordinating entity to which the registration token was issued by the registration token generator.

For example, the registration token may be a code that encodes information identifying the service coordinating entity and / or information indicating an account number on the data engine, the account number associated with the service coordinating entity. The information identifying the service coordinating entity allows the use of the registration token to be recorded in association with an account associated with the service coordinating entity at the data engine so that the data engine coordinates the number of registrations per service Entity can pursue. For example, the data engine may disable registrations for tokens that identify the service coordinating entity when a maximum number of registrations is reached.

Optionally, the data engine is configured to register associations between multiple registered anonymous user IDs and a common group ID for one or more common group IDs; and the access control device is configured to obtain anonymized personalized behavior data request from one of the one or more service provider proxy devices, wherein the data request specifies a polling area and anonymous user ID, the access control device being configured to data request the data request to answer which the query area within the anonymous personalized behavior data stored by the data store and anonymously personalized with the specified anonymous user ID, and if the data request also specifies the shared group ID and the specified anonymous user ID among the various anonymous users. IDs registered to the data engine in association with the shared group ID, the access control device is configured to also include in the response data that satisfies the polling area within the anonymous personalized behavior data stored by the data store and with each of the anonymously personalized to other anonymous user IDs registered in association with the shared group ID.

Furthermore, the one or more service provider proxy devices may each be configured to transmit a group registration request to the data engine, the group registration request specifying the system user's anonymous user ID and a group ID; the data engine is configured to obtain a plurality of the group registration requests from service provider proxy devices, wherein the plurality of group registration requests specify one of the one or more common group IDs as a group ID and respective different anonymous user IDs, and an association between register the specified different anonymous user IDs and the shared group ID.

Advantageously, system users can join a 'group' (via the service provider proxy device) without identifying themselves to address specific health issues. An analysis of the system user's own behavior may be enhanced by presenting data processing results (i.e., the service provided by the service provider proxy device) with reference to group data processing results of other group members / group averages. Present anonymized personalized behavioral data storage and analysis systems do not provide such functionality.

The access control device is configured to accept the specification of the anonymous user ID in the data request as a key that allows access to data that has been anonymously personalized with the specified anonymous user ID. The access control device is configured to accept the specification of the group ID as a key allowing access to data anonymously personalized with anonymous user IDs having registered assignments to the group ID (ie, group members), with an additional one Access Lock The request is that the anonymous user ID of an anonymous user ID having a registered association with the group ID (ie, a group member) is specified in the same data request. This effectively limits access to the group data to service provider proxy devices that can access the anonymously personalized behavior data of a system user who belongs to the group (has a registered association of the respective anonymous user ID with the group ID on the data machine). ,

Optionally, the anonymized personalized behavior data of the other anonymous user IDs registered in association with the single common group ID (which may be referred to as "anonymized personalized behavior data of other group members" or "other group member data"), the service provider proxy Device can be provided in a modified form. The modified form may replace the anonymous user ID that anonymously personalizes the data of the other group members with a corresponding pseudo-ID, the pseudo-ID allowing the data of the other group members of the different anonymous user IDs (which are a have a registered association with the group ID), but the anonymous user ID is not revealed. For example, the pseudo ID may simply be "user 1", "user 2" and so on, or it may be an anonymous user ID hash. There is a one-to-one correspondence between anonymous user IDs and pseudo-IDs such that the number of system users whose behavior is represented by the anonymized personalized behavioral data that is anonymously personalized with an anonymous user ID that is one registered Assignment to the group ID (whose data may also be referred to as "anonymized personalized behavior data of all group members" or "data of all group members") is preserved, and the service provider proxy device can analyze the system user's behavioral data, the anonymous one User ID (whose user may be referred to as the specified user) in the data request is specified in relation to other system users (especially other group members).

The data engine may process the anonymized personalized behavioral data of all group members to generate reports or results that represent the group as a whole and optionally also represent the behavior of individual system users within the group. Where individual system users are represented, it is possible that they are identified by pseudo IDs. The generated reports or results may be provided in response or response to a group data request.

In particular, the system may further include: one or more service coordinating entities each configured to receive one or more registration tokens from the registration token generator and the one or more registration tokens to distribute one or more persons; wherein the registration token generator is configured to make the registration tokens available to persons by transmitting the registration tokens to the one or more service coordinating entities; wherein the access control device is configured to obtain, from one of the one or more service coordinating entities, a group data request specifying a polling area and a group ID, and to respond with data satisfying the polling area among the anonymous personalized behavior data specified by the Data stores are stored and anonymously personalized with each of the anonymous user IDs registered in association with the specified group ID, where the anonymous user IDs can not be inferred from the data that was included in the response. The data satisfying the polling area may be the reports or results generated at the data engine by processing the anonymized personalized behavior data stored in association with the group ID on the data engine.

In this particular system, a service coordinating entity that identifies registration tokens on behalf of individuals is unable to observe the behavior of an individual user, but is able to determine the collective behavior of a group by specifying the group ID to observe in a query to the data engine. As described above, it is possible for the data engine to provide the service providing entity with the data of all group members, with pseudo-IDs replacing the anonymous user IDs.

Optionally, upon receipt of the group data request from the service coordinating entity, the access control device is configured to determine the number of anonymous user IDs registered in association with the specified group ID and under the condition that the number is greater than one and greater or less is equal to a predetermined minimum threshold, to respond with data satisfying the polling area among the anonymous personalized behavior data stored by the data store and anonymously personalized with each of the anonymous user IDs registered in association with the specified group ID are.

The specification of a predetermined minimum threshold, which may be a configurable setting stored by the access control device, is a mechanism to preserve the anonymity of the group members. The fewer members there are in the group, the easier it is to attribute behavioral data to a particular person.

Optionally, the or each of the one or more service coordinating entities is configured to distribute a common group ID to a plurality of system users.

Advantageously, the service coordinating entity may prefer to set up a group to provide a means to observe the collective behavior of the group members.

Optionally, the data engine is configured to associate, for each of a plurality of group IDs, the group ID with a plurality of registered anonymous user IDs and to register the association between the group ID and the plurality of registered anonymous user IDs; and informing the service provider proxy device of each of the multiple registered anonymous user IDs of the respective group ID.

For example, the mapping may be random. The data engine may assign anonymous user IDs to interval ranges by executing a hash function having a number of interval ranges corresponding to the number of group IDs in the plurality of group IDs, each interval range corresponding to a different group ID. This effectively randomly associates anonymous user IDs with group IDs. The service provider proxy device, which provides the service to the system user to which the anonymous user ID belongs, is notified of the group ID to which the anonymous user ID is assigned, such that the service provider proxy device query the group ID and determine comparable behavioral data that can be used to enhance the service provided to the system user.

Systems may also include a behavioral data source device configured to interact with a plurality of system users to generate personalized behavioral data representing interaction with each of the plurality of system users and to transmit the generated personalized behavioral data to an intervening user device of the respective system user; for each of the plurality of system users, having an intermediary user device configured to obtain the generated personalized behavior data from the behavioral data source device to anonymously personalize the personalized behavior data with the respective system user's anonymous user ID and the anonymized personalized behavior data to the data engine Storage in the data store to transfer.

Optionally, the behavioral data source device specifies a group ID, the group ID is included in the generated personalized behavior data and the anonymized personalized behavior data, and the data engine is configured to associate the anonymized personalized behavior data with the anonymized personalized behavior data wherein the obtained anonymized personalized behavior data is anonymously personalized and the group ID is registered as one of the one or more common group IDs.

Advantageously, multiple system users, all of whom use a common behavioral data source device, such as a smart toaster, may associate their respective anonymized personalized behavior data in the data engine with the group ID. The anonymized personalized behavioral data of the group may be accessed by the service provider proxy device of the individual group members such that the service provided to the system user by the service provider proxy device compares the system user's own behavior with that of the other Group members may include.

Embodiments also include a method in a system for storing and controlling access to anonymized personalized behavior data at a data engine, the method comprising: generating anonymous registration tokens at a registration token generator and exposing the generated registration tokens to individuals, wherein Each registration token represents an authorization to register one or more persons as system users by the data engine. The method further comprises at one or more service proxy devices: obtaining one of the generated registration tokens from a person, authenticating the obtained registration token with the registration token generator, and, under the condition that the authentication is successful, anonymously registering the person at the data machine as a system user by determining an anonymous user ID for the system user and providing the anonymous user ID to the system user and to the data engine. The method further comprises at the data engine: obtaining the anonymous user ID and registering the obtained anonymous user ID as a system user; Obtaining the anonymized personalized behavior data of the or each system user and storing the obtained anonymized personalized behavior data; and obtaining data requests for specified stored anonymized personalized behavior data from the one or more service provider proxy devices and responses with anonymized personalized behavior data specified in the received data request, on the condition that the obtained data request specifies the anonymous user ID with which the specified anonymous personalized behavioral data is anonymously personalized.

Preferred features of the present invention will now be described, by way of example only, with reference to the accompanying drawings, in which:

1 a system of an embodiment illustrated;

2 a system of another embodiment illustrated;

3 illustrate a processing performed by a system of an embodiment;

4 illustrate another processing performed by a system of an embodiment; and

5 illustrates a hardware configuration of the components of the systems.

1 illustrates a system of one embodiment. The system includes a data engine 20 which is a data store 22 and an access control device 24 includes. The system further includes one or more service provider proxy devices 30 , While the service provider proxy devices may vary their precise processing capabilities, geographic locations, and other implementation details with respect to the particular service they offer, the description in this specification is believed to include the features of a single service provider proxy. contraption 30 refers to the or each of the one or more service provider proxy devices in a system. Likewise, the person / system user 40 individually discussed, however, it is believed that the description applies to multiple persons / system users 40 refers. The system is a hardware system and therefore the person / system user becomes 40 not considered as a component part of the system, however, is illustrated to show the utility of the system. The system further includes a registration token generator 26 , In 1 is the registration token generator 26 as a component of the system, which is distinct from the data engine 20 is. This is optional, and the registration token generator 26 can as a component of the data engine 20 be realized.

The data engine 20 is configured to register multiple system users. The data engine comprises a data memory 22 and an access control device 24 and is configured to obtain the anonymized personalized behavior data of the multiple system users and the obtained anonymized personalized behavior data in the data store 22 save. The coupling between the system user 40 and the data store 22 represents the transfer of anonymized personalized behavior data to the data store 22 representing the behavior of the system user and anonymously personalized with the system user's anonymous user ID. Access (read access) to the stored anonymized personalized behavior data is provided by the access control device 24 controlled. The access control device 24 is configured to request data for specified anonymized personalized behavioral data generated by the data store 22 stored by the one or more service provider proxy devices 30 and respond with anonymous personalized behavior data specified in the received data request on the condition that the received data request specifies the anonymous user ID with which the specified anonymized personalized behavior data is anonymously personalized. The coupling between the service provider proxy device 30 and the access control device 24 represents the transmission of the data requests from the service provider proxy device 30 to the access control device 24 and the requested anonymized personalized behavior data in response from the access control device 24 to the service provider proxy device 30 be sent. The coupling between the access control device 24 and the data store 22 represents the retrieval of the requested data by the access control device 24 from the data store 22 for inclusion in a response to a data request from a service provider proxy device 30 ,

The data engine 20 can be realized by a single server or by a network of servers. In particular, the access control device 24 be a single server, with the data store 22 is several interconnected storage units. Alternatively, the access control device 24 a service performed by a plurality of data storage servers operating in cooperation with each other, and thus the multiple data storage servers are the data engine 20 which the function of both the data store 22 as well as the access control device 24 performs.

The data engine includes a secure data store 22 , The data engine 20 Provides a mechanism to anonymously register system users (via anonymous user ID). The identity of a system user 40 is at the data engine 20 not known. The data engine 20 is configured to register the anonymous user ID upon receipt of an anonymous user ID and, optionally, upon validation of the anonymous user ID with a grant authority, such as an ID creator. A registration may include, for example, maintaining a list / register of the anonymous user IDs on the data engine and restricting storage of the behavior data in the data store 22 on behavioral data that is anonymously personalized with an anonymous user ID on the registry. A user account may be created, including, for example, a dedicated physical storage location on behalf of the registered anonymous user ID in the data store 22 can be reserved. The data engine 20 may store certain configurable settings on behalf of each registered anonymous user ID, which settings may determine how long anonymized personalized behavior data anonymously personalized with the anonymous user ID will be stored, and optionally how the access control device accesses it 24 is controlled.

Once an anonymous user ID is registered (as a representation of a system user), the data engine is 20 configures behavioral data representing the system user's behavior / activity in the data store 22 save. The behavioral data is anonymously personalized with the anonymous user ID. Personalized behavioral data can be accessed either through the access control device 24 or via another interface to the request of a person and possibly via a behavioral data source device and / or an intermediate device sent to the data engine 20 can be connected, for example via the Internet, in the data store 22 to be written. The data engine 20 includes a mechanism for obtaining anonymized personalized behavior data that verifies that the anonymous user ID with which the anonymized personalized behavior data is anonymously personalized is at the data engine 20 was registered as a representation of a system user, and the received anonymized personalized behavior data into the data store 22 writes. The anonymized personalized behavior data is stored in the data store in a manner in which the anonymous user ID with which they are anonymously personalized is part of the data, for example, as metadata.

The anonymized personalized behavior data may be through the data engine 20 are stored in association with the metadata specifying a value of one or more parameters from the time of data retention, data generation timing, data generation location, data type, activity, model information about the data generation device. A data area, or polling area, which is generated by a data request from a service provider proxy device 30 is specified or otherwise included in it, a specified range of values may be at least one of the one or more parameters, wherein the response to the data query includes all anonymized personalized behavior data that is anonymously personalized with the specified anonymous user ID, and stored in association with a value of the at least one parameter which is within the respective specified range.

The one or more storage units containing the data store 22 form a controlled access environment, which means that subscribers who wish to access the data stored therein must authenticate, for example using passwords, authentication codes or other methods. That way, the data engine can 20 control which subscribers can access the personalized behavior data stored in the data store 22 In particular, it may have access only to authorized service provider proxy devices 30 restrict. Furthermore, the access control device 24 configured to restrict access so that even authorized service providers that have passed authentication can only access certain personalized behavior data when the service provider proxy device 30 the anonymous user ID with which this particular personalized behavioral data is personalized is known and transmitted in a data request. The anonymous user ID is therefore used by the access control device 24 is used as a key through which access is granted to behavioral data (which is anonymously personalized with the user ID), which is stored by the data store 22 The optional further condition is that authentication of the data request from an authorized service provider proxy device 30 comes. The data engine 20 or a higher system authority may be a list of authorized service provider proxy devices 30 to chat.

The access control device 24 may be an interface for data requests from service provider proxy devices 30 provide. Each data request may specify a data area (which may also be referred to as a polling area) in addition to the anonymous user ID, which data area defines a range of or a particular parameter of the data which is included in the response to the data request shall be. The available parameters are specific to the implementation, but may include, for example, a date on which the anonymized personalized behavior data was generated or uploaded to the data engine, a specific activity representing the anonymized personalized behavior data, or another restriction to the anonymized personalized one Behavioral data that is anonymously personalized with the specified anonymous user ID and that should be included in the response to the data request.

The data engine may be configured to perform processing of stored anonymized personalized behavior data and to output the result of the processing as the response to a data request from a service provider proxy device. The anonymized personalized behavior data is included in the result of the processing but may be represented, for example, in the form of a graph, a graphic representation, an image, a timeline or otherwise.

As a specific example of the functionality of the access control device 24 can be the access control device 24 be configured to list the service provider proxy devices 30 to maintain, which are authorized, to the data store 22 to determine if a received data request from any of the listed service provider proxy devices 30 comes or not, and if not, to block the data request (ie either to provide no response or a null response). The list provides a mechanism, the service provider proxy devices 30 to provide access to the data stored by the system. An authentication scheme, such as a PKS, may be used to verify that requests from the service provider proxy devices 30 go out who they claim to be. Service provider proxy devices 30 can be added to the list and removed from it according to agreements with the institution responsible for operating the system. In other words, the service provider proxy devices 30 be at the data engine 20 registered, and the data machine 20 can authenticate the origin of the data access request, verifying that the origin is a registered service provider proxy device 30 is, and with anonymous personalized behavioral data from the data store 22 respond only in the case of successful validation.

The registration token generator 26 is configured to generate anonymous registration tokens and to make the generated registration tokens available to individuals, each registration token having an authorization to register one or more persons 40 as a system user 40 through the data engine 20 represents. The illustrated coupling between the registration token generator 26 and the person 40 represents the registration token generator, which person 40 makes a generated registration token available. It is possible that the exposing is done via an intermediate entity, such as a service coordinating entity.

The registration token generator 26 may be implemented as a computing device, for example as a server or as a network of servers working in cooperation with each other. The registration token generator 26 can be a component of the data engine 20 be. The registration token generator 26 is through the service provider proxy devices 30 and through the data engine 20 authorized to generate registration tokens representing the service provider proxy device 30 recognizes as a command, a processing on behalf of a person 40 execute the registration token to the service provider proxy device 30 transfers. The illustrated coupling between the service provider proxy device 30 and the person 40 represents the person 40 indicating the registration token to the service provider proxy device 30 transfers. The illustrated coupling between the service provider proxy device 30 and the person 40 also represents the anonymous user ID, which is on behalf of the person 40 by the service provider proxy device 30 is determined and the system user 40 is provided, it being noted that the provision may be made to a user communication device (which may also be referred to as an intermediate user device). The registration token entitles the person 40 also to register for a service which is from the service provider proxy device 30 for which registration of the anonymous user ID provided by the service provider proxy device 30 is determined, identification information is (ie it identifies the person 40 as a system user, with the identity of the system user 40 not revealed). The anonymous user ID is through the service provider proxy device 30 at the data machine 20 registered, and therefore the registration token authorizes the person 40 Also, behavioral data that is anonymously personalized with the respective anonymous user ID on the data engine 20 save.

Authentication of the registration token by the service provider proxy device 30 may be transmitted to the registration token generator by transferring the obtained registration token or information derived therefrom 26 be performed. The illustrated coupling between the service provider proxy device 30 and the registration token generator 26 represents the transmission of the received token by the service provider proxy device 30 to the registration token generator 26 and the transmission of the result of the authentication from the registration token generator 26 to the service provider proxy device 30 , As an alternative, it is possible for the service provider proxy device 30 the received (from the person 40 ) Can authenticate registration tokens using, for example, an authentication script generated by the registration token generator 26 is produced. The registration token generator 26 For example, the source of the registration token (as that of the registration token generator) may be configured 26 Coming) and, if necessary, the service provider proxy device 30 to inform about an account to which the registration is attributable. For example, certain legal entities (service coordinating entities) may have accounts for a certain number of users on the data engine 20 have (ie that the data engine 20 stores and processes anonymized personalized behavioral data on behalf of the users) and therefore, the registration token generator can generate tokens that contain information that enables the registration token (or the person who transmits the registration token) to a particular account can be assigned.

The service provider proxy device 30 is configured to process in response to receiving a registration token from a person 40 wherein the processing comprises determining an anonymous user ID on behalf of the user and registering the anonymous user ID with the data engine 20 includes, so the person 40 a system user 40 becomes.

The service provider proxy device 30 is configured, the determined anonymous user ID at the data engine 20 to register. Where the data machine 20 is configured to receive and store only anonymized personalized behavioral data that is anonymously personalized with registered anonymous user IDs. In other words, storage of anonymized personalized behavior data obtained from the data engine is subject to Condition that the anonymous user ID with which the anonymized personalized behavior data is anonymously personalized is at the data engine 20 (as belonging to a system user) is registered.

The service provider proxy device may be, for example, an application or other software running on a mobile phone or other communication device. The service provider proxy device provides a portal for interaction between the system user, the token generator, and the data engine. Processing anonymized personalized behavior data as a service to the user may be performed by the service provider proxy device, by the data engine, or by both entities in cooperation with each other.

The generated registration tokens may include encrypted and / or encoded information. For example, a generated registration token (via encrypted data) may be directed to a particular account on the data engine 20 refer, so that the registration of the person 40 with the specific account at the data engine 20 for example, an account owned by an organization (such as the person's employer 40 ) is entertained. The generated registration token may (via encrypted data) be directed to a particular account at the service provider proxy device 30 refer, so that the registration of the person 40 by the service provider proxy device 30 at the data machine 20 linked to the specific account.

Registration tokens may be bound to a particular data engine or to a particular data processing engine so that a registration token entitles a person in possession of the registration token to register as a system user to the particular data engine and to provide a service to initiate the data engine to the system user. A registration token may be considered to be a manifest of a user license, where the user license is for the data engine and the service provider proxy device.

A data exchange over the Internet or other network between entities of the system and / or entities external to the system may be encrypted.

The service provider proxy device 30 is configured to have a registration token of the person for the or each one or more persons 40 anonymously receive the received registration token with the registration token generator 26 to authenticate, and on the condition that the authentication is successful, the person 40 at the data engine as a system user 40 Anonymously register by determining an anonymous user ID with which the system user 40 Personalize behavioral data anonymously, and the system user 40 and the data engine 20 provide the anonymous user ID for registration. For example, authentication may be achieved by marking with a watermark, by signature verification, or by maintaining a list of generated registration tokens at the registration token generator.

The service provider proxy device 30 is a device which continuously provides data services to system users 40 provides (for example, by providing the result of the data processing performed by the data engine to a system user) and provides an interface and functionality to register persons as system users (via an anonymous registration token). The service provider proxy device 30 is as from the data engine 20 but the service provider proxy device 30 an application that was developed by the same organization as the data engine 20 responsible for. The service provider proxy device 30 may be a server which, via a network, such as the Internet, through a connection which may be encrypted, to the data engine 20 can be connected. A PKS system or an alternative may be on behalf of the data engine 20 operated to identify the identity of the service provider proxy device 30 to authenticate. The service provider proxy device 30 is a device that provides access to behavioral data-based services for system users 40 provides. The service provider proxy device 30 has a mechanism for registering system users 40 (via an anonymous registration token), a mechanism for accessing the data stored in the data store 22 are stored (via the access control device 24 ) and a mechanism either for processing the accessed data or for obtaining processing results of the data from the data engine and outputting the result of processing either to another service provider proxy device 30 , to the system user 40 or to another destination.

• (i) Der Registrierungs-Token-Generator 26 ist als eine Komponente der Datenmaschine 20 einbezogen.
• (ii) Das System umfasst eine ID-Erzeugungsvorrichtung 12;
• (iii) Das System umfasst eine Dienst koordinierende Entität 50;
• (iv) Das System umfasst eine Verhaltensdaten-Quellvorrichtung 42;
• (v) Das System umfasst eine Zwischenbenutzervorrichtung 44.

2 illustrates a system of one embodiment. In the system of 2 certain characteristics are present, which in 1 not illustrated are:

• (i) The Registration Token Generator 26 is as a component of the data engine 20 included.
• (ii) The system includes an ID generation device 12 ;
• (iii) The system comprises a service coordinating entity 50 ;
• (iv) The system includes a behavioral data source device 42 ;
• (v) The system includes an intermediate user device 44 ,

Although the features (i) to (v) together in 2 are independent, and none, one, all, or any combination of features (i) through (v) may be included in embodiments.

• (i) Der Registrierungs-Token-Generator 26 ist eine Komponente der Datenmaschine 20. Eine einzelne Vorrichtung ist deshalb konfiguriert, die Daten zu speichern, einen Zugriff auf die Daten zu kontrollieren und Registrierungs-Token zum Registrieren von Systembenutzern an der Datenmaschine 20 und an der Dienstanbieter-Proxy-Vorrichtung 30 zu erzeugen. Die Dienstanbieter-Proxy-Vorrichtung 30 kann ein Mobiltelefon oder eine andere Benutzerkommunikationsvorrichtung sein, welche eine Anwendung oder ein Programm ausführen, welches von der gleichen Organisation oder juristischen Entität wie die Datenmaschine 20 bereitgestellt wird.
• (ii) Die ID-Erzeugungsvorrichtung 12 ist konfiguriert, eine Anfrage für eine anonyme Benutzer-ID von einer Dienstanbieter-Proxy-Vorrichtung 30 zu erhalten, wobei die Anfrage eine anonymisierte Anfrage für eine anonyme Benutzer-ID von der Dienstanbieter-Proxy-Vorrichtung 30 ist, wobei gesagt werden muss, dass die Identität der Person 40 der Dienstanbieter-Proxy-Vorrichtung 30 oder der ID-Erzeugungsvorrichtung 12 nicht bekannt ist. Die ID-Erzeugungsvorrichtung 12 kann konfiguriert werden, auf die erhaltene Anfrage durch Erzeugen einer anonymen Benutzer-ID entsprechend der erhaltenen Anfrage durch Ausführen einer irreversiblen Verarbeitung der erhaltenen Anfrage zu antworten und die anonyme Benutzer-ID über den Kontrollanbieter 14 an den Benutzer auszugeben.

Like numerals indicate the commonality of the system components between illustrated embodiments. The description of in 2 illustrated system is limited to the features which are different from those of the system 1 differ.

• (i) The Registration Token Generator 26 is a component of the data engine 20 , A single device is therefore configured to store the data, control access to the data, and registration tokens to register system users with the data engine 20 and at the service provider proxy device 30 to create. The service provider proxy device 30 may be a mobile phone or other user communication device that executes an application or program that is from the same organization or legal entity as the data engine 20 provided.
• (ii) The ID generation device 12 is configured to request an anonymous user ID from a service provider proxy device 30 wherein the request is an anonymized request for an anonymous user ID from the service provider proxy device 30 is, it must be said that the identity of the person 40 the service provider proxy device 30 or the ID generating device 12 not known. The ID generation device 12 can be configured to respond to the request received by generating an anonymous user ID according to the received request by performing an irreversible processing of the received request and the anonymous user ID via the control provider 14 to the user.

The ID generation device 12 is a server or other networked computing device that is the service provider proxy device 30 and the data engine 20 for example, via a secure network is accessible. The service provider proxy device 30 can with the ID generating device 12 be certified. The ID generation device 12 can for more than one service provider proxy device 30 so that more than one different entity (e.g., multiple mobile phone devices) plays the role of the service provider proxy device 30 can fill out. The server, which is the role of the ID generation device 12 comprises a network I / O functionality, a memory, a processor configured to execute a program to realize the functionality of the ID generation device, and a memory unit configured to include at least the program (in coded form). The program may be an algorithm which maps a short message (the received request) to a much larger message space (which represents the anonymous user IDs) using a cryptographic hash function. No two requests received result in the same anonymous user ID, thus avoiding conflicts. In some embodiments, a random element may be included such that the mapping of a query to a particular anonymous user ID is at least partially random and therefore not reliably reproducible. The ID generation device 12 may be configured to perform its functionality as a stateless procedure.

• (iii) Es ist möglich, dass das Verfügbarmachen des Registrierungs-Tokens durch den Registrierungs-Token-Generator über eine Zwischenentität geschieht, wie beispielsweise eine Dienst koordinierende Entität 50. Die Dienst koordinierende Entität 50 kann auch als ein Dienstanbieter bezeichnet werden, da die Dienst koordinierende Entität 50 zum Ermitteln der Registrierungs-Token durch den Registrierungsgenerator 26 im Auftrag von Personen 40 verantwortlich ist, wobei er folglich den Personen 40 ermöglicht, Systembenutzer 40 zu werden und folglich einen Verhaltensdaten-basierten Dienst von der Datenmaschine 20 über die Dienstanbieter-Proxy-Vorrichtung 30 zu erhalten, indem Verhaltensdaten erzeugt werden und die Verhaltensdaten in einem anonym personalisierten Format an den Datenspeicher 22 übertragen werden, an welchem sie als ein Dienst verarbeitet werden können, wobei das Ergebnis des Verarbeitens durch die Dienstanbieter-Proxy-Vorrichtung 30 zugänglich ist, um das Ergebnis des Verarbeitens dem Systembenutzer 40 als einen Dienst bereitzustellen. Mit anderen Worten ist die Dienst koordinierende Entität 50 eine Seite, welche versucht, einen Dienst für Personen 40 bereitzustellen, und (durch das Ermitteln und Verteilen der Registrierungs-Token) die Dienstanbieter-Proxy-Vorrichtung 30 in Anspruch nimmt, um dem Systembenutzer zu ermöglichen, auf den Dienst zuzugreifen, wobei der Dienst wiederum durch die Datenmaschine 20 bereitgestellt wird. Die Dienst koordinierende Entität 50 kann nicht auf individuelle Daten (d. h. auf Verhaltensdaten, die einem einzelnen Systembenutzer zuschreibbar sind) von der Datenmaschine 20 zugreifen, bei bestimmten Ausführungsformen kann die Dienst koordinierende Entität 50 jedoch Verhaltensdaten ermitteln, welche das Verhalten einer Gruppe (von mehr als einem) von Systembenutzern 40 repräsentieren.
• (iv) & (v) Die anonymisierten personalisierten Verhaltensdaten werden von dem Systembenutzer 40 an dem Datenspeicher 22 erhalten, jedoch kann der Systembenutzer 40 eine Verhaltensdaten-Quellvorrichtung 42, um die Verhaltensdaten zu erzeugen, welche eine Interaktion zwischen dem Systembenutzer 40 und der Verhaltensdaten-Quellvorrichtung 42 aufzeichnen, und optional eine Zwischenbenutzervorrichtung 44 einsetzen, um die erzeugten Verhaltensdaten mit der anonymen Benutzer-ID des Systembenutzers 40 anonym zu personalisieren. Die Verhaltensdaten-Quellvorrichtung 42 gehört nicht notwendigerweise zu dem Systembenutzer 40, ist jedoch konfiguriert, Verhaltensdaten zu erzeugen, welche dem Systembenutzer 40 zuschreibbar sind, um eine Interaktion mit dem Systembenutzer 40 zu repräsentieren, wobei erzeugte Verhaltensdaten entweder durch die Verhaltensdaten-Quellvorrichtung 42 oder durch eine Zwischenbenutzervorrichtung 44 anonym personalisiert werden und zur Speicherung an den Datenspeicher 22 übertragen werden.

In addition to generating the anonymous user IDs, the ID generation device 12 provide an authentication or validation service. It must be said that the data engine 20 upon receipt of an anonymous user ID for registration as the system user anonymous user ID 40 at the data machine 20 may be configured to transmit the anonymous user ID to a validation service at the ID generator for validation. The validation service may generate a validation or validation failure message in response to the transmission of the anonymous user ID, depending on the result of the validation. The validation is a processing for verifying that the anonymous user ID by the ID generation device 12 was generated.

• (iii) It is possible for the registration token to be made available by the registration token generator through an intermediate entity, such as a service coordinating entity 50 , The service coordinating entity 50 may also be referred to as a service provider as the service coordinating entity 50 to determine the registration tokens by the registry generator 26 on behalf of persons 40 responsible, whereby he is consequently the persons 40 allows, system users 40 and consequently a behavioral data based service from the data engine 20 via the service provider proxy device 30 Obtaining behavioral data and behavioral data in anonymously personalized format to the data store 22 where they can be processed as a service, the result of the processing by the service provider proxy device 30 is accessible to the result of processing the system user 40 as a service. In other words, the service is coordinating entity 50 a page which tries to provide a service for persons 40 and, by determining and distributing the registration tokens, the service provider proxy device 30 in order to allow the system user to access the service, the service in turn through the data engine 20 provided. The service coordinating entity 50 can not rely on individual data (ie behavioral data attributable to a single system user) from the data engine 20 In certain embodiments, the service coordinating entity may 50 however, determine behavioral data that represents the behavior of a group (of more than one) of system users 40 represent.
• (iv) & (v) The anonymized personalized behavior data is provided by the system user 40 at the data store 22 however, the system user may receive 40 a behavior data source device 42 to generate the behavioral data, which is an interaction between the system user 40 and the behavior data source device 42 record, and optionally an intermediate user device 44 use the generated behavior data with the system user's anonymous user ID 40 to personalize anonymously. The behavior data source device 42 does not necessarily belong to the system user 40 However, it is configured to generate behavioral data that the system user 40 are attributable to an interaction with the system user 40 representing generated behavior data either by the behavioral data source device 42 or by an intermediary user device 44 be personalized anonymously and stored for storage at the data store 22 be transmitted.

The service provider proxy device 30 is configured to anonymous user ID on behalf of the person 40 to determine and the person 40 provide the anonymous user ID. The provisioning can be done by sending a message to the person 40 or by publishing a message to a data location done by the person 40 is safely accessible. The provisioning may be performed by the service provider proxy device 30 What an intermediate user device 44 (which may be a device by which the person transmits the registration token to the service provider proxy device and which may be a user communication device) with software that is configured, when executed, to cause the intervening user device to provide behavioral data which are stored on the user communication device, anonymously personalized with the anonymous user ID, and transmit the anonymized personalized behavior data to the data engine, the behavior data representing behavior of the user. Software may provide for downloading software from a server to the intermediate user device 44 , authorizing such downloading or configuring / adapting existing software to operate accordingly (ie, to anonymously personalize behavioral data stored on the intermediary user device with the anonymous user ID and the anonymized personalized behavior data to the data store 22 transferred to). Optionally, the service provider proxy device 30 and the intermediate user device 44 may be the same device, or they may be services realized by software running on the same device.

3 FIG. 10 illustrates an exemplary processing manner in a system of an embodiment. FIG.

In the 3 Illustrated hardware is the same as in 2 , An example processing manner performed by the system will be explained.

At step S1, the service provides coordinating entity, which in this example is a service provider 50 is called the person 40 a token ready. It should be noted that the term token is used here and elsewhere in this specification as a short form for registration tokens.

At step S2, the token is used by the person 40 to the service provider proxy device 30 transfer. The token contains a reference to account information, which both the data engine 20 as well as the ID generation device 12 associated with the service provider proxy device 30 to allow an anonymous user ID from the ID generation device 12 and get them under the account of the service provider on the data machine 20 at the data machine 20 to register.

At step S3, an anonymous user ID request is made by the service provider proxy device 30 to the ID generation device transfer. The person 40 is at the service provider proxy device 30 anonymous, and the request, while distinguishable from other requests for anonymous user IDs, does not contain personal identification information of the person 40 ,

At step S4, the ID generation device responds 12 upon the request from the service provider proxy device 30 by transmitting an anonymous user ID and a signature indicating the anonymous user ID to the service provider proxy device 30 Verified.

In step S5, the service provider proxy device transmits 30 the anonymous user ID to the data engine 20 for registration, so the data machine 20 Behavioral data (from the person 40 ) receives and stores which are anonymously personalized with the anonymous user ID. The registration is made on condition that validation succeeds in step S6.

At step S6, the data engine validates 20 the anonymous user ID used by the service provider proxy device 30 is obtained with the validation service in the ID generation device 12 if the validation succeeds, the data engine becomes 20 and registers the anonymous user ID on the data machine as belonging to a system user.

At step S7, the service provider proxy device 30 the person 40 as a registered system user, the anonymous user ID is ready. This provisioning may be accomplished by sending the anonymous user ID to an intermediate user device 44 happen which belongs to the user, wherein the intermediate user device 44 is configured to obtain behavioral data and the behavioral data for storage in the data engine 20 In particular, the behavioral data is anonymously personalized with the anonymous user ID.

The system user 40 interacts with a behavioral data source device 42 , In step S8, the behavior data source device transmits 42 Data representing the interaction as behavior data to the intermediate user device 44 ,

By formatting at the intermediate user device 44 For example, the behavioral data becomes anonymously personalized behavior data, and at step S9, the anonymously personalized behavior data is acquired from the intermediary user device 44 to the data engine 20 for storage in the data memory 22 transfer.

In step S10, the service provider proxy device transmits 30 a data query to the data engine 20 , The query, which may be referred to as a data request, is performed by the access control device 24 processed. The query specifies an anonymous user ID, and the access control device is configured to anonymize personalized behavior data from the data store 22 to retrieve which through the data store 22 be personalized anonymously with the specified anonymous user ID, and fulfill the query. At step S11, the retrieved data is used as a response to the query to the service provider proxy device 30 transfer. The retrieved data may be used as a consequence of the processing performed by the data engine 20 carried out in a processed form. The processing may be performed in response to receiving the query. For example, the processed form may be monitor images for display on a user communication device (ie, the service provider proxy device).

The service provider proxy device 30 either performs an analysis of the data coming from the data engine 20 and gives a result of the analysis as a service to the person at step S12 40 from or the service provider proxy device 30 obtains the data from the data engine in a processed form (for example, as a monitor image) which is simply displayed, thereby providing a service to the user.

4 illustrates exemplary processing that may be performed using the system of one embodiment. The person 40 is a system user, which is at the data machine 20 is registered and through the service provider proxy device 30 a personalized service from the data engine 20 receives.

The service coordinating entity 50 , optionally in coordination with the data machine 20 and / or the service provider proxy device 30 , determines a unique group ID. The unique group ID does not contain any personal identification information of a system user. For example, the group ID may be "SDHGTR56HG". The service coordinating entity may use the group ID for multiple system users 40 for example, via a web page 52 publish. In step S101, the service publishes coordinating entity 50 the group ID for multiple system users 40 for example via an intranet. The group ID may be published in association with a specified behavioral goal, such as "giving up smoking." In step S102, the system user receives 40 the group ID or becomes aware of it, and at step S103 registers its affiliation with the group at its respective service provider proxy. contraption 30 by transmitting the group ID to the service provider proxy device. The service provider proxy device 30 Saves the association between the system user 40 (in particular, the system user's anonymous user ID) and the group ID.

In step S104, the service provider proxy device registers 30 the mapping between the anonymous user ID and the group ID on the data engine 20 , The group ID may be a common group ID, that is, multiple anonymous user IDs may have a registered association with the same (ie, common) group ID. The data engine 20 maintains a register of mappings between group ID and anonymous user IDs.

An association between a group ID and an anonymous user ID represents a membership of the system user to which the anonymous user ID belongs to the group represented by the group ID. A membership of a group is an agreement to share data in part via the respective service provider proxy devices 30 the group members, which allows behavioral data of the individual group members to be compared over time (ie, progress).

In step S105, the service provider proxy device transmits 30 a query to the access control device 24 , The query specifies a query scope, anonymous user ID, and a group ID. In step S106, the access control device determines 24 from the data store 22 anonymized personalized behavior data within the query area, which is anonymously personalized with the specified anonymous user ID, and answers the query with it. For example, the query may also be the data engine 20 initiate processing the anonymized personalized behavior data as a service, the result of the processing being an image for display to the user by the proxy device providing the service 30 is. The access control device 24 also determines from the data store 22 a version of the anonymized personalized behavior data within the query range for other (ie, other than the specified anonymous user ID) anonymous user IDs with a registered association with the group ID, and answer the query with them. The data engine 20 may be configured to process the anonymized personalized behavior data of all anonymous user IDs with a registered association with the group ID in response to the query. For example, the processing may generate a result or result of the data together, in which case the anonymized personalized behavior data of the individual system users are indistinguishable from one another. The result or result may mask the anonymous user ID in the data, or it may replace the anonymous user ID with a dummy ID.

An optional extension of the processing is illustrated as step S107 and S108. These steps may be performed instead of or in addition to steps S105 to S106. In step S107, the service transmits coordinating entity 50 , which has no knowledge of the anonymous user IDs, a query to the access control device 24 , The query specifies the group ID and can also specify a query scope. In step S108, the access control device determines 24 from the data store 22 a version of the anonymized personalized behavior data within the anonymous user ID query area having a registered association with the group ID and responding to the query with the group ID. The access control device may mask the anonymous user IDs in the version of the data provided to the service coordinating entity, or it may replace the anonymous user IDs with respective pseudo IDs. The answer to the query may be conditional on having a minimum number of anonymous user IDs with a registered association with the group ID, as anonymity may be compromised by group data for a small group. The minimum number may be a default setting on the data engine 20 be.

As a particular implementation example, it is assumed that a wearable device company wishes to offer a government health service a comprehensive fitness logging service according to the rules of an ecosystem that provides personalized services to users in a frame structure that stores personalized data anonymously. The wearable device company has all the technology needed to effectively implement the service, i. H. the bands (as an example of a behavior data source device) for detecting an activity level, the data engine technology for secure storage and analysis of behavior data, and application development capabilities to present meaningful data analysis results (as the data processing service) to both the system users and the government agency. In this example, the wearable device company is the entity providing the data engine, and the government office is the service coordinating entity.

The task is that in many frameworks to provide personalized Behavioral data services, such as the Coelition framework, can not be a single entity, both a service provider and a data engine. The government office wants to operate the service, but does not want the company to become aware of body wearable devices who the users actually are.

The government office wants users on the data engine to be anonymous, but this is not feasible if users need to register with the wearable device company to have their personalized behaviors data analyzed by the wearable device company, and to receive the analysis results.

In the frame structure of the embodiments, the wearable device company may provide an application (ie, a service using a service provider proxy device) based on a registration token which is provided on behalf of the user by its employer (the government office ), allows a system user to benefit from the data processing services associated with a service provider in existing models, such as the Coelition frame structure, but provided by the data engine. Therefore, embodiments retain the anonymity of the user at the data engine, although a single entity is responsible for data storage and processing.

The government office can then generate both random teams and target-specific groups by publishing group IDs, and users can log in to them on a voluntary basis. As individuals, employees can use feedback to improve their performance in terms of goals. For groups that are large enough, individuals and the employer can observe the progress of the schema as a whole and the progress of specific groups.

Optionally, the embodiment may be implemented as an enhanced version of the Coelition frame structure. In such an embodiment, the ID generation device is 12 a Coeltion IDA, the anonymized personalized behavior data is Atoms, the anonymous user ID is a ConsumerID, and the data engine is a Coelition-compliant data engine.

5 FIG. 10 is a block diagram of a computing device, such as a data storage server, that may implement one or more components of a system of an embodiment and that may be used to implement a method of an embodiment. The computing device includes a processor 993 and memory 994 , Optionally, the computing device also includes a network interface 997 for communication with other computing devices, such as other computing devices of embodiments of the invention.

The data engine 20 , the service provider proxy device 30 , the ID generating device 12 , the service coordinating entity 50 , the inter-user device 44 and / or the registration token generator 26 may be performed by one or more computing devices, such as those described in U.S. Pat 5 is illustrated.

For example, one embodiment may be composed of a network of such computing devices. Optionally, the computing device also includes one or more input mechanisms, such as keyboard and mouse 996 , and a display unit, such as one or more monitors 995 , The components can be over a bus 992 be connected to each other.

The memory 994 may comprise a computer-readable medium, which term may designate a single medium or multiple media (eg, a central or distributed database and / or associated caches and servers) configured to execute or execute computer-executable instructions has stored data structures. For example, computer-executable instructions may include instructions and data that are accessible by a general-purpose computer, a specialized computer, or a specialized process unit (eg, one or more processors) and cause them to perform one or more functions or operations. Thus, the term "computer-readable storage medium" may also include any medium capable of storing, encoding, or conveying a set of instructions for execution by the machine, and which cause the machine to perform one or more of the methods of the present invention Perform revelation. Accordingly, the term "computer-readable storage medium" may be understood to include at least semiconductor memory, optical media, and magnetic media. By way of example and not limitation, such computer-readable media may include non-transitory computer readable storage media including random access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), compact disc read only Memory (CD-ROM) or other optical disk storage, magnetic disk storage or other magnetic memory devices include flash memory devices (e.g., semiconductor memory devices).

The processor 993 is configured to control the computing device and perform processing operations, for example, executing code stored in the memory to implement the various functions of the functional components described herein and in the claims. The memory 994 stores data by the processor 993 be read and written. As described herein, a processor may include one or more general purpose processing devices, such as a microprocessor, a central processing unit, or the like. The processor may include a complex instruction set computer microprocessor (CISC), a reduced instruction set computer microprocessor (RISC), a very long instruction word (VLIW) microprocessor, or a processor implementing other instruction sets, or processors having a combination of instruction sets. The processor may also include one or more specialized processing devices, such as an application specific integrated circuit (ASIC), field programmable gate array (FPGA), digital signal processor (DSP), network processor, or the like. In one or more embodiments, a processor is configured to execute instructions for performing the operations and steps discussed herein.

The display unit 997 may display a representation of the data stored by the computing device, and may also display a cursor and dialogs and presentation areas that facilitate interaction between a user and the programs and data stored on the computing device. The input mechanisms 996 may allow a user to enter data and instructions to the computing device.

The network interface (network I / F) 997 may be connected to a network, such as the Internet, and may be connected to other such computing devices via the network. The network I / F 997 can control data input / output from another / to another device over the network. Other peripherals, such as a microphone, speakers, printer, power supply, fan, housing, scanner, trackball, etc., may be incorporated into the computing device.

A service coordinating entity 50 of the 3 to 4 can be a processor 993 its (or can operate it) which executes processing instructions (a program, a script or a compiled program) stored in memory 994 are stored and transmit data over a network I / F to register a person at step S1 of FIG 3 provide. The processor may also execute processing instructions to complete step S101 of FIG 4 perform. The service coordinating entity can also create a web page 52 of the 4 include on an internet server with a processor 993 which executes processing instructions (a program, script, or compiled program) stored in memory 994 are stored, and transfer data over a network I / F, the processor 993 Steps S101 and S102 of FIG 4 performs.

A service provider proxy device 30 of the 1 to 4 can be a processor 993 which executes processing instructions (a program) stored on a memory 994 are stored, and data over a network I / F 997 exchanges and display information for a system user via a display 995 exchanges and inputs from the system user via an input 996 accepts. In particular, the processor performs 993 Processing instructions to the registration token at step S2 of 3 to receive an anonymous user ID request to the ID generator at step S3 of FIG 3 and anonymous user ID from the ID generating device at step S4 of FIG 3 to obtain. The processor 993 can also perform processing to return the anonymous user ID to the data engine 20 at step S5 of 3 transferred to. The processor 993 can also execute processing instructions to over the network I / F 997 a query to the data engine 20 at step S10 of 3 transferred to. The processor 993 can also execute processing commands to give the person the anonymous user ID at step S7 3 provide. The processor 993 may also execute processing commands to provide the system user with the processed anonymized personalized behavior data, for example via the display 995 at step S12 of 3 provide. The processor 993 may also execute processing instructions to perform steps S103, S104, S105, and S106 of FIG 4 perform.

A data machine 20 of the 1 to 4 can be a processor 993 (or several of them) which executes processing instructions (a program) stored on a memory 994 are stored, and data over a network I / F 997 exchanges. In particular, the processor performs 993 Processing commands to send over the network I / F an anonymous user ID from the service provider proxy device 30 and the person as a system user at the data machine at step S5 3 to register. Furthermore, the processor 993 Execute processing commands to send the anonymous user ID over network I / F 997 to the ID generation device 12 for validation at step S6 of 3 transferred to. The processor 993 may also execute processing instructions to obtain the query at step S10, a response to the query by accessing the data memory of the memory 994 optionally generate the retrieved data on the processor 993 and process the result as a response to the query over the network I / F at step S11 of FIG 3 transferred to. The processor 993 may also execute processing instructions to complete steps S107 and S108 of FIG 4 perform.

An ID generating device 12 of the 2 to 3 can be a processor 993 which executes processing instructions (a program, a script, or a compiled program) stored in memory 994 are stored, and data over a network I / F 997 exchanges. For example, the processor may execute processing instructions to obtain the request and generate the anonymous user ID in response to the request and return the response to the service provider proxy device at steps S3 and S4 of FIG 3 and the validation service at step S6 of 3 perform.

A behavioral data source device 42 of the 3 to 4 can be a processor 993 which executes processing instructions (a program, a script, or a compiled program) stored in memory 994 are stored, and data over a network I / F 997 exchanges. In particular, the processor can 993 Processing instructions to perform the step S8 of 3 transferring data representing interaction with the system user to the intermediary user device over the network I / F.

An intermediate user device 44 of the 3 to 4 can be a processor 993 which executes processing instructions (a program, a script, or a compiled program) stored in memory 994 are stored, and data over a network I / F 997 exchanges and display information for a system user via a display 995 exchanges and inputs from the system user via an input 996 accepts. In particular, the processor can 993 Execute processing instructions to perform the step S9 of 3 anonymously personalizing the behavioral data and transmitting it over a network I / F 997 to the data engine 20 perform.

Methods embodying the present invention may be practiced on a computing device, such as those described in U.S. Pat 5 is illustrated. Such a computing device does not have to have all the components included in 5 are illustrated, and may be composed of a subset of these components. A method embodying the present invention may be performed by a single computing device in conjunction with one or more data storage servers over a network.

A method embodying the present invention may be performed by a plurality of computing devices working in cooperation with each other. One or more of the multiple computing devices may be a data storage server that stores at least a portion of the anonymized personalized behavior data.

Claims (18)

A system for storing and controlling access to anonymized personalized behavior data on a data engine, the system comprising: the data engine; a registration token generator configured to generate anonymous registration tokens and to make the generated registration tokens available to individuals, each registration token representing an authorization to register one or more persons as system users with the data engine; one or more service provider proxy devices each configured for the or each one or more persons: to anonymously obtain one of the generated registration tokens from a person to obtain the received registration token with the registration token Generator, and, subject to the condition that the authentication is successful, to anonymously register the person at the data machine as a system user by determining an anonymous user ID for the system user and providing the anonymous user ID to the system user and to the data engine; wherein the data engine receives the anonymous user ID and registers the received anonymous user ID as a system user; wherein the data engine further comprises a data store and an access control device and is configured to obtain the anonymized personalized behavior data of the registered system users and to store the obtained anonymized personalized behavior data in the data memory; wherein the access control device is configured to request data for specified anonymized personalized behavior data stored by the data store from the one or more receive multiple service provider proxy devices, and respond with anonymous personalized behavior data specified in the received data request on the condition that the obtained data request specifies the anonymous user ID with which the specified anonymized personalized behavior data is anonymously personalized , The system of claim 1, wherein the data engine is configured to process the anonymized personalized behavior data requested in the data request and output a processing result to the service provider proxy device, the result comprising the anonymized personalized behavior data. The system of claim 1, wherein the service provider proxy device is configured to determine the anonymous user ID on behalf of the user by transmitting an ID request corresponding to the received registration token to an ID generation device and the anonymous user ID as To get an answer. The system of claim 3, further comprising: the ID generation device configured to generate the anonymous user ID by performing irreversible processing in response to obtaining the request and output the anonymous user ID to the service provider proxy device. The system of any one of claims 1 to 4, further comprising: one or more service coordinating entities each configured to obtain one or more registration tokens from the registration token generator and to distribute the one or more registration tokens to one or more persons; wherein the registration token generator is configured to make the registration tokens available to individuals by transmitting the registration tokens to the one or more service coordinating entities. The system of claim 5, wherein the or each of the one or more service coordinating entities are entities separate from or from each of the one or more service provider proxy devices such that the persons to which the registration tokens are distributed pass through the service coordinating entities are identifiable and anonymous to the service provider proxy devices. The system of claim 5 or 6, wherein the registration token comprises information identifying the service coordinating entity to which the registration token was issued by the registration token generator. A system according to any one of claims 1 to 7, wherein: the data engine is configured to register associations between a plurality of registered anonymous user IDs and a common group ID for one or more common group IDs; and the access control device is configured to receive anonymized personalized behavior data request from one of the one or more service provider proxy devices, wherein the data request specifies a polling area and an anonymous user ID, the access control device being configured to provide the data request with data responding satisfying the polling area within the anonymous personalized behavior data stored by the data store and anonymously personalized with the specified anonymous user ID and, if the data request also specifies the common group ID and the specified anonymous user ID below the various anonymous user IDs registered in association with the shared group ID on the data engine, the access control device is configured to also include in the response data that includes the polling area within the anonymous p reconstituted behavioral data stored by the data store and anonymously personalized with each of the other anonymous user IDs registered in association with the common group ID. The system of claim 8, wherein the one or more service provider proxy devices are each configured to transmit a group registration request to the data engine, the group registration request specifying the anonymous user ID of a system user and a group ID; the data engine is configured to obtain a plurality of the group registration requests from service provider proxy devices, wherein the plurality of group registration requests specify, as a group ID, one of the one or more common group IDs and respective different anonymous user IDs, and an association between register the specified different anonymous user IDs and the shared group ID. The system of claim 8 or 9, further comprising one or more service coordinating entities, each configured to issue one or more registration tokens from the registration token. Receive generator and distribute the one or more registration tokens to one or more persons; wherein the registration token generator is configured to make the registration tokens available to persons by transmitting the registration tokens to the one or more service coordinating entities; wherein the access control device is configured to obtain, from one of the one or more service coordinating entities, a group data request specifying a polling area and a group ID, and to respond with data satisfying the polling area among the anonymous personalized behavior data specified by the Data stores are stored and anonymously personalized with each of the anonymous user IDs registered in association with the specified group ID, wherein the anonymous user IDs can not be inferred from the data included in the response. The system of claim 10, wherein the access control device is configured, upon receipt of the group data request from the service coordinating entity, to determine the number of anonymous user IDs registered in association with the specified group ID and under the condition that the number is greater one and greater than or equal to a predetermined minimum threshold is to respond with data that satisfies the polling area among the anonymous personalized behavior data stored by the data store and anonymously personalized with each of the anonymous user IDs associated with the specified group ID are registered. The system of claim 10 or 11, wherein the or each of the one or more service coordinating entities is configured to distribute a common group ID to a plurality of system users. A system according to any one of claims 8 to 12, wherein: the data engine is configured to associate, for each of a plurality of group IDs, the group ID with a plurality of registered anonymous user IDs and to register the association between the group ID and the plurality of registered anonymous user IDs; and inform the service provider proxy device of each of the multiple registered anonymous user IDs of the respective group ID. The system of any one of the preceding claims, further comprising: a behavioral data source device configured to interact with a plurality of system users, to generate personalized behavioral data representing the interaction with each of the plurality of system users, and to transmit the generated personalized behavioral data to an intervening user device of the respective system user; an intermediary user device for each of the plurality of system users configured to obtain the generated personalized behavior data from the behavioral data source device, anonymously personalize the personalized behavior data with the respective system user's anonymous user ID, and the anonymized personalized behavior data for storage in the data memory to transfer the data engine. The system of claim 14, wherein the behavioral data source device specifies a group ID, the group ID is included in the generated personalized behavior data and the anonymized personalized behavior data, and the data engine is configured to obtain anonymization between the anonymized personalized behavior data User ID with which the obtained anonymized personalized behavior data is anonymously personalized and the group ID registered as one of the one or more common group IDs. A method in a system for storing and controlling access to anonymized personalized behavior data at a data engine, the method comprising: generating anonymous registration tokens at a registration token generator and exposing the generated registration tokens to persons, each registration Token represents an authorization to register one or more persons as system users by the data engine; at one or more service proxy devices: obtaining one of the generated registration tokens from a person, authenticating the received registration token with the registration token generator and, subject to the condition that the authentication is successful, anonymously registering the person at the data engine as a system user by determining an anonymous user ID for the system user and providing the anonymous user ID to the system user and to the data engine; at the data engine: obtaining the anonymous user ID and registering the received anonymous user ID as a system user; Obtaining the anonymized personalized behavior data of the or each system user and storing the obtained anonymized personalized behavior data; Obtaining data requests for specified stored anonymized personalized behavior data from the one or more service provider proxy devices and responses with anonymized personalized behavior data specified in the received data request, on the condition that the obtained data request specifies the anonymous user ID; with which the specified anonymous personalized behavioral data are anonymously personalized. Software that, when executed, causes interconnected computing devices to perform a method according to claim 16. A non-transitory computer-readable storage medium storing the software of claim 17.

Images