KR100848321B1 - Method and Apparatus for controlling the access of personal information between privacy domains - Google Patents

Abstract

The present invention relates to a method and apparatus for controlling distribution of personal information between privacy domains, and to a privacy related system and method for controlling the distribution of personal information of a user in an Internet environment. When the information is distributed between privacy domains, a Bridge Privacy Controller for controlling this is provided, and the BPC is an attribute consumer that is a trust level of an information user from a privacy controller of each domain by the BPC. ) Collecting a list, generating a Bridge Privacy Policy (BPP) list, and distributing the list to the PCs of respective domains. The PCs of each domain create a BPP policy, which is a privacy policy for the trust level, according to the BPP list, and when receiving a query message about information distribution, recognizes the AC of another domain using the BPP list and the BPP policy. Information distribution can be determined.

Privacy, privacy, privacy controller, privacy policy, privacy domain

Description

Method and Apparatus for controlling the access of personal information between privacy domains}

1 is a view showing a process of distributing personal information between privacy domains using a BPC (Bridge Privacy Controller) according to an embodiment of the present invention.

2 is a diagram illustrating a configuration of a bridge privacy controller according to an embodiment of the present invention.

3 is a view showing the configuration of a privacy controller according to an embodiment of the present invention.

4 is a flowchart illustrating a process of a bridge privacy controller for controlling distribution of personal information between privacy domains on the Internet according to an embodiment of the present invention.

FIG. 5 is a flowchart illustrating a process when a privacy controller processes an inquiry message received from an attribute provider (AP) according to an embodiment of the present invention.

6 is a diagram illustrating a process of processing a request for personal information of a specific site through the bridge privacy controller and the privacy controller according to an embodiment of the present invention.

The present invention relates to a method and apparatus for controlling distribution of personal information between privacy domains, and to a privacy related system and method for controlling the distribution of personal information of a user in an Internet environment.

Many sites on the Internet provide services to users and require users to register. When users join the site to use the service, they enter their important personal information such as name, social security number, address, telephone number, and e-mail. Users sign up for so many sites that it is not easy to remember where their information is and what information they have entered. And many of the tiny sites on the Internet don't consider privacy and privacy concerns at all in managing their customers' information. Even illegal sales of customer information are taking place.

In this environment, technologies for safely managing and distributing user information have been proposed. There is an Internet identity management system. The Internet Identity Management System aims to provide a more convenient and safe environment for users to use the Internet. In other words, the SSO (Single Sign On) service allows users to freely use many sites on the Internet with a single login process, and keeps their information up to date and securely managed by storing the user's information in a secure site. To make it possible. Many standards and technologies are being developed. Representatives include SAML from OASIS Group, ID-FF from Liberty Alliance, ID-WSF, ID-SIS, and WS-Security from IBM and Microsoft.

In addition, standards for safely managing user's personal information include W3C's P3P, OASIS's XACML, and IBM's EPAL.

In the Internet Identity Management System, the user's personal information is managed by the site (Attribute Provider, AP) that the user trusts. When a user uses a service at another site (Attribute Consumer), the AC requests the user's information from the AP when the user information is needed. The AP determines the information provision according to the user rules and acts accordingly. Alternatively, information may be provided with the consent of the user. As such, the Internet Identity Management System allows the trusted site AP to manage the user's information, so that the user can trust the management of his or her information to the AP with peace of mind. Requests information from the AP ensures that personal information is not unnecessarily distributed in multiple places.

In an Internet Identity Management System environment or similar personal information distribution, the distribution of user information should only be based on user rules and policies or agreements between the user and the site. To this end, there is a need for an environment in which a user can express his or her desired method or rules for the distribution of information, and a system for determining whether the user is in violation of the rules expressed by the user when information distribution occurs. This is called a privacy controller (PC).

Information flow control generally occurs in the following flows.

First, the subject (AC), who wants to use the information, tells the subject (AP) who holds the information, "How do you want to use the information of a specific user for a specific purpose? Please provide the information." Send it. The AP then modifies the received message to generate a message that says, "How does a Subject request information to act on a particular user's resource for a specific purpose?" To the PC.

When a PC receives a message, it makes a decision about the distribution of information based on the policies it stores. If the determination is a grant, the PC generates a message "Allow information circulation but must obey certain obligations" and sends it to the AP. If the judgment is prohibited, a message "No information distribution" is generated and transmitted to the AP. The AP then acts upon the received message.

In the above process, the privacy policy on which the information distribution is judged can be expressed in various ways. For example, XACML and EPAL. The components of a policy generally include a subject who wants to use the information, a resource that they want to use, and an action on the information. In addition, there are conditions, purposes, and obligations to use when using information.

As described above, an area in which systems for requesting information, providing information, and determining information distribution operate according to a privacy policy is called a privacy domain.

There may be multiple privacy domains on the Internet. When a user visits a system belonging to a domain other than the domain mainly used by the user and receives a service, information distribution beyond the domain may occur. That is, the AC belonging to the domain B may request information from the AP belonging to the domain A. In this case, the AP of the domain A queries the PC of the domain A a decision about information distribution. In order for the PC to make a decision, it must have a policy on AC in domain B. However, it is not possible for a PC to store the information of all ACs in other domains in its database and to write all related policies. It would be overly burdensome to set up a database for each PC with information about all ACs, and it would be difficult to change the updated information directly to information on a PC that manages another domain when AC information on one domain was changed. .

The present invention proposes a method and apparatus for controlling the distribution of personal information between privacy domains as a technical problem for solving the above problems, and puts a Bridge Privacy Controller in the distribution of personal information of users in the Internet environment. Create a BPP (Bridge Privacy Policy) list, which is a list of trust levels of attributes in the domain, so that each privacy domain can efficiently process requests for personal information from sites in other domains using the BPP list. I want to be able to.

In one preferred embodiment of the present invention for achieving the above technical problem, a bridge privacy controller device for controlling the distribution of personal information between privacy domains on the Internet includes a privacy controller for managing the distribution of personal information between sites in the privacy domain. An AC list receiving unit for receiving AC lists, which are trust level lists for sites in the privacy domain, from the Privacy Controller, wherein the received AC lists are aggregated so that each privacy controller is in a different privacy domain. And a BPP list generator for generating a BPP (Bridge Privacy Policy) list for processing a query for a request for personal information from a specific site, and a BPP list transmitter for transmitting the generated BPP list to each privacy controller. .

As a preferred embodiment of the present invention for achieving the above technical problem, a privacy controller device for processing a determination of a request for personal information of a specific site on the Internet has a list of trust levels of sites in domains other than the privacy domain managed by the privacy controller. A BPP list receiving unit for receiving an included BPP (Bridge Privacy Policy) list; a BPP policy setting unit for setting a BPP policy independent of the BPP list and based on the trust level; Determining whether to accept or reject the personal information request according to a privacy policy set in the domain with respect to the site when the receiving unit receiving the determination query and the specific site are sites in a domain managed by the privacy controller device. Between the specified If the site is a site other than the domain managed by the privacy controller device, the processor may include a processing unit that determines whether to acknowledge or reject the personal information request of the specific site based on the BPP list and the set BPP policy.

According to a preferred embodiment of the present invention for achieving the above technical problem, a processing method of a bridge privacy controller for controlling the distribution of personal information between privacy domains on the Internet may include distribution of personal information between sites in the privacy domain. Receiving AC lists that are a list of trust levels for the attributes in the privacy domain from each Privacy Controller that manages the, the privacy domain is a different privacy domain by combining the received AC list Generating a Bridge Privacy Policy (BPP) list for processing queries for personal information requests from my specific site and transmitting the generated BPP list to each of the privacy controllers.

According to a preferred embodiment of the present invention for achieving the above technical problem, a method for processing a determination of a request for a personal information of a specific site by a privacy controller on the Internet includes trust levels of sites in a domain other than the privacy domain managed by the privacy controller. Receiving a Bridge Privacy Policy (BPP) list containing a list, setting up a BPP policy independent of the BPP list and based on the trust level, judgment quality of the privacy needs of a particular site Determining whether to accept or reject the personal information request according to a predetermined privacy policy in the domain when the specific site is a site in a domain managed by the privacy controller device. And the specific site said In the case of a site other than the domain managed by the privacy controller device, the method may include determining whether to approve or reject the personal information request of the specific site based on the BPP list and the set BPP policy.

Hereinafter, an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating a process of distributing personal information between privacy domains using a BPC (Bridge Privacy Controller) according to an embodiment of the present invention.

This illustrates the configuration of a method and system that allows a PC to recognize AC of another domain and make a decision about information distribution when information distribution occurs over a plurality of privacy domains existing on the Internet.

The embodiment of FIG. 1 is a method in which AC aaa.com of domain B requests the address of user X to the AP of domain A. In order for a domain A PC to make a decision about the distribution of information, it must know aaa.com in domain A and have a policy related to aaa.com.

In order to solve this problem, the present invention proposes a Bridge Privacy Controller (BPC) capable of integrated management of a policy of a privacy domain. The BPC exchanges information with a PC in each domain to recognize ACs in another domain.

Referring to FIG. 1, the PCs 111 and 121 of the privacy domain evaluate trusts of ACs 122 belonging to their domains 110 and 120 to determine respective trust levels. The PCs 111 and 121 prepare an AC list and transmit the AC list to the BPC 100. The AC list contains the confidence level of each AC. Confidence level here is a measure of AC commonly used in all privacy domains. When the BPC 100 receives the AC list from the PCs 111 and 121 of each domain, the BPC 100 generates one BPP (Bridge Privacy Policy) list of the AC lists and transmits the list to the PCs 111 and 121 of each domain. The PCs 111 and 121 may store and analyze the received BPP list to recognize the AC of each domain. On the other hand, the PCs 111 and 121 generate a policy (BPP policy) that matches the trust level independently of the BPP list.

That is, a PC in one domain can create a privacy policy for a trust level instead of creating a privacy policy for all ACs in other domains, thereby reducing the burden on policy creation. The PC recognizes the trust level for the AC of another domain using the BPP list, obtains the BPP policy for the trust level, and determines the query for the information request.

Here, personal information is user's personal information including one or more of a user's social security number, address, telephone number, and e-mail, and the trust level is a measure of a site that is used in all privacy domains. .

1 can be arranged in the following flow. PC 121 of domain B 120 sends AC list to BPC 100 (①). Then, the BPC 100 collects an AC list of each domain, generates a BPP list, and transmits it to each PC 111 (②). The PC 111 has a BPP policy that a subject having a Level 2 trust level can read the address of the user X (③). AC aaa.com 122 of domain B 120 requests the address of user X from AP 112 of domain A 110 (④). The AP 112 of the domain A sends a message to the PC 111 of the domain A 110 that "aaa.com wants the address of X" (⑤). The PC 111 recognizes that aaa.com is Level 2 by looking at the BPP list, searches for the BPP policy for the address of User X of Level 2, determines this, and transmits the result to the AP 112 (6). .

2 is a diagram illustrating a configuration of a bridge privacy controller according to an exemplary embodiment of the present invention.

Referring to FIG. 2, the bridge privacy controller 200 may list trust levels for the attributes in the privacy domain from privacy controllers 210, 220, 230, and 240 that manage distribution of personal information between sites in the privacy domain. An AC list receiving unit 201 that receives incoming AC lists, and aggregates the received AC lists into a bridge privacy policy (BPP) list for each privacy controller to handle personal information requests from a specific site in another privacy domain. The BPP list generating unit 202 to generate and the BPP list transmitting unit 203 for transmitting the generated BPP list to each of the privacy controller (210, 220, 230, 240).

3 is a diagram illustrating a configuration of a privacy controller according to an embodiment of the present invention.

Referring to FIG. 3, the privacy controller 300 receives a BPP list receiving unit 304, a BPP list, which receives a BPP (Bridge Privacy Policy) list including a trust level list of sites in a domain other than the privacy domain managed by the privacy controller. Is a BPP policy setting unit 302 for setting a BPP policy based on a trust level independent of the control unit, a receiving unit 301 for receiving a determination query for a request for personal information of a specific site, and the specific site. In the case of a site in a domain managed by a controller device, the site determines a recognition or rejection of the personal information request according to a predetermined privacy policy in the domain, and the specific site is a domain managed by the privacy controller device. If the site other than the BPP list and the set BPP policy The second is configured to include a processor 303 to determine the determination of recognition or rejection of the privacy requirements of a particular site. Here, personal information is user's personal information including one or more of a user's social security number, address, telephone number, and e-mail, and the trust level is a measure of a site that is used in all privacy domains. .

The processor 303 first analyzes the determination query received by the receiver 301 to determine whether the specific site is a site in a domain managed by the privacy controller device.

The receiver 301 receives a determination query for a personal information request of the specific site from an AP (Attribute Provider) site, which is a trusted site that manages personal information of a user.

In this regard, the privacy policy refers to the pre-set contents of the subjects who can use the personal information, the list of personal information, and the actions that can be taken on the personal information. This may include obligations to do. In addition, the BPP policy determines whether or not the personal information requested by the specific site can be used according to the trust level, and the trust level of the specific site is described in the BPP list.

That is, when the specific site is a site other than the domain managed by the privacy controller device, the processing unit 303 checks the trust level of the specific site in the BPP list and based on the determination method according to the trust level in the set BPP policy. To determine whether to accept or reject the judgment of the personal information request of the particular site.

4 is a flowchart illustrating a process of a bridge privacy controller for controlling distribution of personal information between privacy domains on the Internet according to an exemplary embodiment of the present invention.

Referring to FIG. 4, first, the bridge privacy controller obtains AC lists, which are lists of trust levels for the attributes in the privacy domain, from each privacy controller managing the distribution of personal information between the sites in the privacy domain. Receive (401). The received AC lists are aggregated so that each privacy controller generates a BPP (Bridge Privacy Policy) list for processing a query for a request for personal information from a specific site in another privacy domain (402). It transmits to each of the privacy controller (403).

FIG. 5 is a flowchart illustrating a process when a privacy controller processes an inquiry message received from an attribute provider (AP) according to an embodiment of the present invention.

This shows the flow of determining the query for information distribution in the PC. Referring to FIG. 5, the PC first receives an inquiry message for information distribution from the AP (501). The PC analyzes the query message and extracts a subject, information, action, purpose, etc. (502). As a result, it is discriminated whether or not the information user is an AC of another domain (503).

If the domain is the same as the self, select the privacy policy 511 of the local domain (504), and if it is another domain, retrieve the trust level of the subject from the BPP list (512) (505), the BPP policy corresponding to the trust level 513 is selected (506). Here, the privacy policy is composed of subjects included in the domain, user information list, and possible actions.

The query is determined based on the selected policy as described above (507), the log 514 is generated (508), and a response message is generated based on the determined result (509). In response to this, a response message is transmitted to the AP (510).

6 is a diagram illustrating a process of processing a request for personal information of a specific site through the bridge privacy controller and the privacy controller according to an embodiment of the present invention.

Referring to FIG. 6, description will be made according to the policy generation flow and the policy decision flow.

First, the PC 630 of each domain generates an AC list by setting a trust level to ACs belonging to the domain (601). The PC 630 transmits the generated AC list to the BPC 620 (602). Accordingly, the BPC 620 receives an AC list from a PC of each domain (603) and generates a BPP list based on the received AC lists (604). Next, the BPP list is transmitted to a PC of each domain (605). The PC in each domain receives the BPP list (606). The received BPP list 609 is stored (607).

Apart from the above process, the PC in each domain generates and stores a privacy policy related to the trust level, that is, a BPP policy 610 (608). Then, when the AC 614 of another domain requests information from the AP 613 for any purpose, the AP 613 receiving the request message inquires of the PC 630 about the information distribution, and the PC 630. ) Receives the query message from the AP 613 to determine the policy for the query using the BPP list 609 and the BPP policy 610 (611). The determination result is transmitted to the AP (612).

The invention can also be embodied as computer readable code on a computer readable recording medium. Computer-readable recording media include all kinds of recording devices that store data that can be read by a computer system. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disks, optical data storage devices, and the like, which are also implemented in the form of carrier waves (for example, transmission over the Internet). Include. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion. In addition, functional programs, codes, and code segments for implementing the present invention can be easily inferred by programmers in the art to which the present invention belongs.

Such a method and apparatus of the present invention have been described with reference to the embodiments shown in the drawings for clarity, but these are merely exemplary, and various modifications and equivalent other embodiments are possible to those skilled in the art. Will understand. Therefore, the true technical protection scope of the present invention will be defined by the appended claims.

According to the method and apparatus for controlling the distribution of personal information between the privacy domains of the present inventors, when an individual's personal information is distributed in an Internet environment, an AC list, a BPP list, and the like are exchanged between a BPC and PCs over a BPC, By creating a policy that follows, each PC can efficiently control the distribution of personal information across privacy domains based on the BPP list through the BPC, without having to consider all of the information in all domain sites.

Claims (16)

An AC list receiving unit for receiving AC lists, which are lists of trust levels of attributes in the privacy domain, from each privacy controller managing personal information distribution between sites in a privacy domain; A BPP list generating unit for synthesizing the received AC lists and generating a BPP (Bridge Privacy Policy) list for each privacy controller to process a query for a request for a personal information from a specific site in another privacy domain; And And a BPP list transmitter for transmitting the generated BPP list to each of the privacy controllers. A bridge privacy controller device for controlling distribution of personal information between privacy domains on the Internet. The method of claim 1, The personal information is a bridge privacy controller device for controlling the distribution of personal information between privacy domains on the Internet, characterized in that the user's personal information including at least one of a user's social security number, address, telephone number and e-mail. The method of claim 1, The trust level (trust level) represents the reliability of each site, the bridge privacy controller device for controlling the distribution of personal information between privacy domains (privacy) on the Internet, characterized in that it is a measure of the sites commonly used in all privacy domains. What is claimed is: 1. A privacy controller device for processing a determination of a request for personal information of a specific site on the Internet. A BPP list receiver configured to receive a BPP list including a trust level list of sites in a domain other than the privacy domain managed by the privacy controller device; A BPP policy setting unit that sets a BPP policy independent of the BPP list and based on the trust level; Receiving unit for receiving a query for determining the personal information request of a specific site; And If the specific site is a site in the privacy domain, the recognition or rejection of the personal information request is determined according to a predetermined privacy policy in the domain with respect to the specific site, and the specific site is a site other than the privacy domain. And a processor configured to determine whether to approve or reject a personal information request of the specific site based on the BPP list and the set BPP policy. Privacy controller device for processing. The method of claim 4, wherein And the personal information is personal information of a user including at least one of a user's social security number, an address, a phone number, and an e-mail. The method of claim 4, wherein The trust level (trust level) represents the reliability of each site, the privacy controller device for processing the determination of the request for personal information of a specific site on the Internet, characterized in that it is a measure of the sites commonly used in all privacy domains. The method of claim 4, wherein The receiving unit receives a personal information request of a specific site on the Internet, characterized in that for receiving a decision query for the personal information request of the specific site from an AP (Attribute Provider) site that is a trusted site that manages the user's personal information. Privacy controller device for processing judgments. The method of claim 7, wherein The processing unit analyzes the determination query received by the receiver to determine whether the specific site is a site in a domain managed by the privacy controller device. Privacy controller device to process. The method of claim 4, wherein The predetermined privacy policy in the processing unit is a predetermined content of a subject who can use personal information, a list of personal information, and an action that can be taken with respect to personal information. Privacy controller device for processing the judgment. The method of claim 9, The predetermined privacy policy in the processing unit includes at least one or more of a condition for using information, a purpose for which the subject wants to use the information, and a duty to be observed in using the information. Privacy controller device for processing the judgment. The method of claim 4, wherein The BPP policy is a policy that determines whether or not to use the personal information requested by the specific site according to the trust level on the BPP list of the specific site to process the determination of the personal information request of the specific site on the Internet Privacy controller unit. (a) receiving AC lists, which are trust level lists for sites in the privacy domain, from each privacy controller managing the distribution of personal information between sites in the privacy domain; (b) synthesizing the received AC lists to generate a Bridge Privacy Policy (BPP) list for each privacy controller to process a query for a request for personal information from a particular site in another privacy domain; And (c) transmitting the generated BPP list to each of the privacy controllers; and a method of processing a bridge privacy controller for controlling the distribution of personal information between privacy domains on the Internet. . The method of claim 12, The trust level represents the reliability of each site and is a measure of sites commonly used in all privacy domains. The method of claim 1, wherein the bridge privacy controller controls the distribution of personal information between privacy domains on the Internet. (a) receiving a Bridge Privacy Policy (BPP) list including a trust level list of sites in a domain other than the privacy domain managed by the privacy controller; (b) setting a BPP policy independent of the BPP listing and based on the trust level; (c) receiving a decision query for a privacy request of a specific site; (d) if the specific site is a site in the privacy domain, determining whether to approve or reject the personal information request according to a predetermined privacy policy in the domain with respect to the specific site; And (e) if the specific site is a site other than the privacy domain, determining whether to approve or reject the personal information request of the specific site based on the BPP list and the set BPP policy. A determination process for a request for personal information of a specific site by a privacy controller on the Internet. The method of claim 14, In the step (d), the predetermined privacy policy is a specific site by the privacy controller on the Internet, characterized in that the predetermined content of the subject that can use the personal information, the list of personal information, the action that can be taken with respect to the personal information. How to handle judgment on your personal information request. The method of claim 14, The step (e) confirms the trust level of the specific site in the BPP list, and acknowledges or rejects a judgment on the personal information request of the specific site based on the determination method according to the trust level in the set BPP policy. Determining a request for a personal information request of a specific site by a privacy controller on the Internet.

Images