RU2772570C2 - Method for updating user data on storage medium - Google Patents

Abstract

FIELD: computer technology.

SUBSTANCE: method for the transmission of missing user data to a storage medium includes blocking the processing of user data on the side of at least one user device for processing tools; collecting user data in accordance with current policies; receiving a request for processing blocked user data from a processing tool; determining access rights for the processing tool to user data; detecting the absence of requested data for processing on the storage medium; transmitting missing user data from the device to the storage medium.

EFFECT: openness of mechanisms for updating user data on a storage medium, while maintaining security.

17 cl, 5 dwg

Description

Technical field

The invention relates to anonymization methods and systems for protecting the confidentiality of user data and ensuring privacy.

State of the art

The amount of data collected from users' devices is growing every year. The variety and number of devices from which data is collected is also growing, as IoT devices are added to personal computers, laptops, smartphones. Often, data is collected from devices without explicit consent from the user, but even with such consent, the user does not always understand the full consequences of his decision. Subsequently, data collected from devices spreads uncontrollably over the network and can harm the user. For example, a user may become a victim of scammers who obtained his phone or credit card number. But not only intruders cause inconvenience, unscrupulous employers use data from users' devices to monitor their employees. The result of uncontrolled data collection is also intrusive targeted advertising of special categories of goods.

Device manufacturers are trying to protect the user from hidden data collection and streamline work with data. An example is Google's Firebase system, which syncs data across different Android device apps and makes that data available to a third party. So publication US9838830B2 describes how to manage data from devices stored in structures on the server. Another publication US20160134932A1 describes methods for obtaining video data from user devices and providing it to a third party.

Apple has a similar platform - the Apple Security Framework, which is used to protect information, establish a trusted connection and control access to software on the device. The platform is used to identify the user, ensure the security of data both in storage and during transmission over the network, to confirm the validity of the code. So the publication US9124637B2 describes the technology for ensuring data protection when synchronizing key sets for various devices.

These solutions allow you to share data from devices with third parties, but these mechanisms are not transparent to the user, are irreversible and do little to prevent tracking by third party applications.

Disclosure of invention

The present invention is intended to securely and transparently update user data collected from user devices on a storage medium.

The technical result of the present invention is to ensure the transfer of missing user data to the storage medium. An object of the present invention is a method for transferring missing user data to a storage means in which the processing of user data on the side of at least one user device for the processing means is blocked. Next, a request is received for processing the blocked user data from the processing means, where the access rights for the processing means to the user data are determined and the absence of the requested data for processing on the storage means is detected. The missing user data from the device is transferred to the storage means. In a particular case, a request for data processing by the user's device is received from the processor. If the request is received by the device, then the request of the processing means is specifically redirected from the user's device to the user's storage means.

Data processing may mean at least:

• collection of user data;

• recording user data;

• accumulation of user data;

• use of user data;

• transfer of user data.

In a particular case, the processing means is a client application installed on the user's device and a remote server associated with the client application as part of a client-server interaction. With such an implementation, in a particular case, the processing of data that is not related to the main functionality of the application installed on the device is blocked. In a particular case, the processing request is a request to transfer data to the server, so the blocking may consist in breaking the associative link between the set of sequentially transmitted data to the processing means.

In a particular case, data processing is blocked on devices for marketing purposes. User devices in a particular case is a group of devices in the local network.

In a particular case, on the first request for processing, the processor is additionally granted access rights.

The means of storing user data in a particular case is located remotely.

The storage means not only places the received locked data, but also generates data for processing by the processing means in accordance with access rights, where further access to the generated user data is provided to the processing means.

In a particular case, the device blocks the processing of user data transferred to the storage medium.

There can be at least two user devices. In a particular case, the data received from at least two devices is associated with the user of the devices by the storage means.

The storage means may further receive user data from the processing means.

Brief description of the drawings

The accompanying drawings are included to provide a further understanding of the invention and form a part of this specification, show embodiments of the invention and together with the description serve to explain the principles of the invention.

The claimed invention is illustrated by the following drawings, in which:

Fig. 1 - depicts a system for exchanging data from user devices.

Fig. 2 depicts a method for granting access to user data to a processor.

Fig. 2a depicts an embodiment of a method for providing a user data structure to processing means while transferring the data structure to a remote storage means from the user device.

Fig. 2b shows an embodiment of a method for providing a user data structure to the processing means when the data structure is transferred from the storage means to the processing means.

Fig. 3 depicts a method for updating user data on the storage medium.

Fig. 3a depicts an embodiment of a method for updating user data when transferring a data structure to a remote storage medium.

3b shows an embodiment of a method for updating user data when an updated data structure is transmitted to a storage medium.

Fig. 4 - shows an example of setting data permissions.

Fig. 5 depicts an example of a general purpose computer system.

Although the invention may have various modifications and alternative forms, the characteristic features shown by way of example in the drawings will be described in detail. It should be understood, however, that the purpose of the description is not to limit the invention to a particular embodiment thereof. On the contrary, the purpose of the description is to cover all changes, modifications, included in the scope of this invention, as defined by the attached claims.

Description of the invention

The objects and features of the present invention, methods for achieving these objects and features will become apparent by reference to exemplary embodiments. However, the present invention is not limited to the exemplary embodiments disclosed below, but may be embodied in various forms. The foregoing description is intended to assist a person skilled in the art in a thorough understanding of the invention, which is defined only within the scope of the appended claims.

On FIG. 1 shows a system for exchanging data received from user devices 100. The system 100 is designed to transparently and securely process data from users of devices 101. Device user data in the framework of this invention refers to data from devices from the user's environment created on the device by various software, this can be both user-entered data and data created as part of the operation of programs and applications, for example, a stream of clicks (syn. clickstream from English clickstream), messages in instant messengers, location data, data from smart home IoT devices or other IoT devices from the user's ecosystem, such as a personal car. The system 100 consists of a blocking tool 110, a collection tool 120, a rights management tool 130, a modification tool 140, a storage tool 150, an anonymization tool 160, an aggregation and analytics tool 170, a logging tool 180.

The blocking tool 110 is designed to block the processing of data on the user's device (including personal data) by processing tools 102. Any processing tools 102 can be blocked: both third-party and belonging to the platform that controls the device (for example, Apple software and services, Google , Huawei, Xiaomi) on which the locking tool is installed, or which is available to the locking tool (for example, the locking tool 110 is installed on the router through which the user's personal devices 101a, IoT devices access the Internet, and the locking tool analyzes the network traffic passing through him). A special case of the processing means may be a client 102b (eg, an application) that collects user data 101 on the device upon request from the server 102a with which the application is associated as part of a client-server interaction. Data processing is understood as any action (operation) or a set of actions (operations) performed using automation tools with data, including: collection, recording, systematization, accumulation, storage, clarification (updating, changing), retrieval, use, transfer (distribution , provision, access), depersonalization, blocking, deletion, destruction of data. In a particular case, the collection of not any data is blocked, but only critical data. Critical data refers to data in respect of which the law or an authorized entity imposes restrictions on collection, storage, access, distribution and processing. These data, as a rule, are sensitive to disclosure, distribution, leakage, since the occurrence of these events leads to a violation of the rights and legally protected interests of the subjects and provides for liability for subjects who violate the rules for collecting, storing, accessing, processing such data. A special case of critical data is confidential data ¹ ( ¹ or confidential information, in the framework of this invention, confidential data and confidential information are synonyms) (eng. sensitive data). Confidential data refers to data that is protected in accordance with the laws of the country in whose jurisdiction is the user using the device that is the client in the described system. Confidential data in a particular case includes personal data (PD) and data containing:

• trade secret;

• tax secret;

• banking secrecy;

• medical confidentiality;

• notarial secret;

• attorney-client privilege;

• audit secrecy;

• secrecy of communication;

• secrecy of insurance;

• secret of the will;

• secrecy of adoption;

• the secret of confession;

• secrecy of the investigation;

• secrecy of legal proceedings;

• information about protected persons;

• state secret.

In another particular case, the processing of user data for marketing purposes is blocked. In another particular case, the processing of any user data by processing means 102 that is not related to the direct functionality of applications or programs using such processing tools is blocked. It also blocks, in particular, processing by processing means 102 that are not in the list of allowed (trusted). Blocking data processing can be carried out by various methods, both direct, when the actions associated with data processing are blocked, and indirect blocking methods, when data processing is not directly prevented, but the processing does not achieve the goals, although it is carried out. Direct blocking methods may include the prohibition of access to user data by processing tools. Indirect processing methods, in particular, include breaking the associative link between the data sent from the user's devices, for example, by deleting cookies or replacing user identifiers set by tracking networks on the device.

The data rights manager 130 is designed to control access to data. The tool 130 formalizes the rights to the processing tools 102 to access data, revokes the rights from the processing tools, generates lists of allowed (trusted) processing tools 102. The tool 130 stores or generates a structure format (data model) for user data intended for placement on the storage tool 150 The tool 130 can be configured either by third-party updatable policies, custom policies, or direct user input. Tool 130 also updates the data model ² ( ² GOST 20886-85: Organization of data in data processing systems. Terms and definitions) of the user, intended for sending to the storage means (work scenarios will be described below).

The user data collection means 120 is designed to collect user data to be transmitted to the storage means 150 from the user's devices. The means 120 fills in the fields of the data structure received from the data rights manager 130. The collector 120 then passes the completed data structure to the modifyer 140. In a particular case, the collector 120 sends the completed data structure to the storage means 150 directly. In general, blocking by means 110 and data collection by means 120 are performed independently of the needs of processing means 102 for data. For example, in accordance with the settings, the blocking tool 110 blocks web tracking, and the collection tool 120 collects all the data that the tool 110 preventively (prior to attempts to process by means 102) blocked on the device 101, then the collected data is placed on the storage means 150.

The device 101 includes a modifier 140 for parsing the data in the fields of the structure received from the means 120 to determine the content of the data, to split the data structure into substructures, and to choose a route to send the data to a remote storage medium for the received substructures. Modifier 140 determines whether the structure should be divided into substructures depending on the fields of the structure. The criteria for dividing a data structure into substructures can be different, one of these criteria is the presence of personal data (Eng. Personal Identification Information - PII) or their special categories (for example, according to GDPR terminology), in which the data structure is divided in such a way that one the substructure contains personal data (hereinafter referred to as PD, eng. PII) or their special categories, the other substructure includes data that is not personal. The relation of data to personal is determined, for example, by the legislation of the country in whose jurisdiction is the user using the device that is the client in the described system (in other words, by the location of the data source). Another more general criterion is the presence of critical data. In a particular case, the modifier 140 is designed to transform the data structures on the device before sending the data to the storage means 150. In a particular case, the methods for converting these substructures are:

• quantization;

• sorting;

• merging (gluing);

• grouping;

• setting up a data set;

• tabular substitution of values;

• calculated values;

• data coding;

• encryption;

• convolution;

• normalization (scaling).

Some types of transformation can be applied not only to individual data (fields) in the substructure, but also to the substructure as a whole, for example, tokenization and / or encryption. In this case, the transformation in a particular case is carried out without the possibility of inverse transformation by any means, except for the modification means 140 and/or the storage means 150. A transformation is understood as a mapping (function) of a set into itself or mappings that transfer a certain set to another set.

In a particular case, the modifier 140 selects a network route along which the structure or substructures will be sent to the store 150. This route may include an anonymizer 160. The anonymizer 160 is designed to transform the structures and substructures passing through it, both direct transformation and reverse (examples will be discussed below). The anonymizer is not located on the same local network or intranet (for example, a network of the same organization) as the device 101 and in the particular case with the storage 150. Associated with the anonymizer, as well as with the storage 150, is a logging engine 180.

Logging tool 180 is designed to track operations with user data and record all acts of alienation of user data from storage means 150. Based on the log maintained by this tool 180, it is always possible to check the legality of using user data by third parties. For example, the history of the user's search queries was transferred to the network N without the right to transfer to third parties, which was recorded by the logging tool 180, but the user receives advertising offers from the network Μ based on his search queries, which is recorded by additional means of the system 100 (not shown in Fig. 1) , based on the data from the device and from the logger 180, the system 100 will record the incident. Further, depending on additional add-ons on the system 100, this incident can be processed. For example, the additional means of the system 100: will constitute a network claim N; send a data deletion request to network M; send a notification to the regulator, etc.

The storage means 150 is designed to accommodate user data. The storage facility can both transfer user data to processing facilities 102, and allows data to be processed without transmission directly on the facility 150. An aggregation and analytics facility 170 is associated with the storage facility 150, designed for automated data analysis and the construction of various analytical reports and aggregates based on this analysis. , which are also placed on the storage facility 150 and can be transferred to third-party processing facilities 102 if the latter have the right to do so. Means 170 also links data from various devices 101 of the same user/household. The storage engine 150 is also associated with the rights management engine (eg, via the agent 130a) since the storage engine determines the access rights of the processing engines to the user's data. The storage medium 150 may be located on the device 101, on the local network of the device 101, or remotely, as shown in FIG. 1. The storage facility in a particular case receives user data, including from processing facilities. For example, from social media processing tools, online and offline stores, advertising networks, data exchanges, etc.

The described system is used to implement a method 200 for granting access to user data to a processor (FIG. 2). At step 210, the blocking means 110 blocks the processing of user data on the side of the user's devices for the processing means. Block different processing methods and for different processing means. In particular, they block:

• mobile and web tracking, for example, through:

отслеживания и удаления трекеров с устройств,

tracking and removing trackers from devices,

использования VPN сервиса, который позволяет вырезать трекеры и рекламу из сетевого трафика;

using a VPN service that allows you to cut trackers and ads from network traffic;

• collection of information about geolocation, for example, through:

использования виртуальных операторов,

use of virtual operators,

подмены (англ. spoofing) геолокации,

spoofing geolocations,

отключения GPS, Wi-Fi, Bluetooth модулей в моменты неиспользования их пользователем;

disable GPS, Wi-Fi, Bluetooth modules when they are not used by the user;

• collection of search queries, for example, through:

использования приватных поисковых систем (например, DuckDuckGo),

use of private search engines (for example, DuckDuckGo),

проксирования исходящих поисковых запросов,

proxying outgoing search queries,

подмены (англ. spoofing) идентификаторов поисковых систем в исходящем трафике,

spoofing search engine identifiers in outgoing traffic,

удаления идентификаторов поисковых систем в исходящем трафике;

removal of search engine identifiers in outgoing traffic;

• collection of registration data, for example, through:

анонимных номеров телефонов и почтовых ящиков,

anonymous phone numbers and mailboxes,

анонимных одноразовых карт.

anonymous disposable cards.

At step 220, user data (in the particular case that is blocked for processing by third-party processors 102) in accordance with applicable policies (applied by the rights management tool 130 and implemented through the data model/structure described above) is collected by the collection tool 120 and transferred to the storage tool 150, in a particular case, through a modification tool 140 and/or an anonymization tool 160. In a particular case, access to this data of the processing tool 102, which are not, for example, in the list of allowed ones or for which the specified data is not necessary to ensure the main functionality, can be obtained only from the storage medium 150. In the next step 230, the system 100 receives a request to process user data on the device 101. This request may be received by various means of the system 100, depending on how it is performed. For example, when attempting to process user data on the device, this will detect blocker 110 (implicit request). With an explicit request for permission to process, this request will be received by the access rights management tool 130. In the particular case, if the processing request is received by the blocking engine 110, then this request is redirected to the access rights management tool 130 and, if this tool is known to the system 100 (this tool has already rights are assigned), then the next step 240 is performed, at which the request is redirected to the user data storage means 150. In another particular case, when the processing means 102 is unknown to the system, access rights are determined for it and then step 240 is performed. processing 102 is in the list of trusted or access to this data is within the framework of the main functionality adopted by the user, or in other cases indicated above, the processing engine 102 is allowed to process the user data without redirecting to the storage engine 150. In the next step 250, the storage engine 150 define access rights for processing means to user data, the storage means can use both its copy of the access rights database for processing means 102, generated by the rights management tool 130, and directly access the means 130, for example, through the agent 130a. After the rights are determined, at step 260, access to the user data is provided to the processor in accordance with the determined rights. In a particular case, access is provided through an anonymization tool that performs a reverse transformation of the user data located on the storage means 150. Information about this is recorded by the logging means 180, the fixation in the particular case is based on blockchain technology, and the technology for providing data for processing from the user to the processing means 102 can be implemented as a smart contract, where the counter provision on the part of the owner of the processing tool in a particular case is the non-monetary use of the functionality of the application / program (user data in exchange for functionality). In this example, after gaining access to the processing of user data, the user who granted access to his data can use the functionality of some application, service, or any other product or service, not necessarily digital, will be available to him (for example, a discount on insurance in case of providing telemetry from a car ).

On FIG. 2a shows an embodiment of a method for providing user data to processing means. The blocking tool 110 blocks the processing of data for the advertising network M. Blocking is carried out by removing from the web data 103, including those created by the browser 102b, cookies at step 211, which contain an advertising identifier, and substituting the user ID in the network traffic at step 212 in advertising network M. This prevents the processors 102, which are used in this case to profile users (they are profiling tools), from working. Thus, the advertising network cannot target without having a user profile, which drastically reduces the conversion (the number of clicks on an advertisement), and since the advertising network's operating model is CPC (from the English cost-per-click), revenue decreases accordingly per user ARPU (from English average revenue per user). This blocking is used by the user because the user wants to avoid ads for certain categories X of products in his browser (for example, drugs, medical clinics and other objects from the Health category). But at the same time, the user is ready to receive targeted advertising from other categories of goods and services from this advertising network M. Thus, after the specified settings at step 221, the access rights management tool 130 issues rights for the network Μ to the history of search queries and the flow of clicks, excluding search queries and clicks associated with category X. Related information is sent to the system tools 100 at step 222, in particular, the collector 120 receives a data structure with fields to fill in, the modifyer 140 receives the categories of data prohibited from transmission, and the storage engine receives access rights for the M advertising network. Further, in special cases, different scenarios are possible, for example:

• the collection tool 120 collects all search queries and clicks from the user's devices 101, and all data is sent to the storage tool 150, and the storage tool 150 will independently form (in a particular case, fill in) the structure for processing by the processing tools 102 of the advertising network Μ in accordance with access rights, excluding clicks and searches from category X;

• Collector 120 collects all search queries and clicks from user's devices 102 and all data is sent to modifyer 140 and modifyer 140 removes substructures belonging to category X and the modified structure is placed on storage means 150, as such it will be transferred an advertising network M processing means 102;

• collection means 120 collects search queries and clicks not belonging to category X, and the structure is placed on the storage means 150, as such it will be transferred to the processing means 102 of the advertising network M;

• Collector 120 collects searches from all categories and clicks not related to category X, and the structure is passed to the modification engine 140, the modification engine 140 removes the search queries related to category X from the received structure, and the modified structure is transferred to the storage engine 150, in in this form, it will be passed to the processing engine 102 of the advertising network M (this scenario includes the example in Fig. 2a, which will be discussed later).

In general, such scenarios apply not only to clicks and searches, but also to other types of user data, where possible, processing tools 102 apply not only to ad networks, and user devices can also be more than one. In the particular case where storage means 150 is hosted at a remote site, as in FIG. 2a, the modified structure from the modification means is not sent directly to the storage means 150.

Next, we continue to consider the example of the last scenario. After the engine 130 has issued rights to the M network processor 102 at step 221, the rights management engine 130 passes the format of the structure to the collector 120 to populate the fields at step 222. The structure contains at least a "search queries" field and a "clickstream" field, in turn, the clickstream field contains web resource category fields that lack a field for category X. In step 222a, collector 120 fills in the fields. The data to be populated in a particular case is selected from the stored web data 103 accumulated during the user's network activity. This data is generated both by the browser 102a and additional tools of the system 100, such as plug-ins in the browser or UI interceptors (not shown in Fig. 2a and in a particular case are modules of the tool 120). At step 223, the collector 120 passes the completed structure to the modifyer 140, which in turn, based on the format of the structure also received at step 222 from the rights management tool 130, analyzes the fields of search queries for queries belonging to category X, after which these queries are removed. The modifier 140 obtains from the processor 102 at step 224 the advertising network user ID Μ (UserIDM) (e.g., from a cookie or from a browser profile) and the system user ID 100 (UserID100) from the rights management tool 130 (in FIG. 2a is not indicated). Next, the user data structure is encrypted with a public key and a pair of identical random tokens is generated, and one of the tokens is associated with identifiers, the second token is associated with the user data structure (for example, it is added as an additional field to the structure, this stage is not indicated in Fig. 2a). Next, at step 225a, the user data structure is sent to storage means 150, and the identifiers with the second token are sent to anonymizer 160 at step 225b. The anonymization engine 160 converts the identifiers in step 225b, and the converted UserID'100 and UserID'M are passed to the storage engine 150 in step 225d. associates the resulting data structure with other data structures for that user in step 227. The transformation engine 160 changes the original user ID in the system 100 and the ID for the advertising network Μ in order to protect the user's data in the event of a data leak from the storage engine 150, as with the changed IDs the owner of the data cannot be identified. Now, data requests from the advertising network Μ for data processing are redirected to the storage means 150 via the anonymization means 160, as shown in FIG. 2b. As can be seen from FIG. 2b, the request can be sent by both the server via the client at step 230, and the client itself, in accordance with its functionality, at step 230a and/or at step 230b. The request in a particular case contains a user ID in the advertising network Μ UserIDM. At step 240, the request is redirected to the anonymizer 160. When the request is redirected, the user identifier in the system 100 is attached to the request, and in a particular case, information about the requested data, for example, listing structure fields, the format can be different - XML, JSON, etc. In step 241, the anonymizer 160 converts the user ID in the system 100 and the ID in the advertising network Μ, and passes the converted identifiers to the storage engine in step 242. The storage engine 150 detects, in step 243, data associated with the user based on the UserID'100 and determines the rights for advertising network Μ at step 250 (not shown in Fig. 2b), and data is generated by storage means 150 for processing by processing means 102 in accordance with access rights. In this example, this is done by looking up the UserID'M and its associated data structure. When the data is found, it is returned along with the UserID'M to the anonymizer 160 at step 251, the anonymizer 160 returns the network user ID Μ to the original value at step 252, and the user data along with the original UserIDM is passed to the ad network processor 102, with the fact transmission is captured by the logger 180.

In a particular case, the advertising network can directly contact the anonymizer without redirecting requests from the device 101, in this case, the processing tool itself redirects the request - instead of the device, it addresses the storage medium, in a particular case, through the anonymizer. In another particular case, the data is not transferred to the processing means 102, but access is provided to a copy of the data located on the storage means 150.

Also, the system shown in Fig. 1 is used to implement a method for updating user data 300. This method is performed when not all of the data to be processed is located on the storage medium and/or when the user has more than one device from which it is possible to receive data. In this method, steps 210, 230, 240, 250 are similar to those of the method shown in FIG. 2. At step 310, the storage medium detects that the data to which the processing engine has obtained access rights is not located on the storage medium. Therefore, at step 320, the missing user data is transferred from the device to the storage medium. In a particular case, upon detecting missing data, storage engine 150 calls access control engine 130. Engine 130 updates the data model, according to which collection engine 120 populates new fields in the structure (in our example, those related to location). Next, the tool 130 sends the data to the storage tool 150. In a particular case, sending is carried out using the modification tool 140 (the tool 140 analyzes the data for criticality and other compliance with the rights set by the access control tool 130) and the anonymization tool 160, if the detected data requires additional transformations.

On FIG. 3a shows an embodiment of method 300. Let's continue with the ad network M example. But in this case, system 100 works in the following scenario:

• on device 101b (PC in our example), web tracking is preventively blocked (steps 211, 212),

• collection tool 120 collects all searches and clicks of the user at step 222a (as the most common data to process),

• the collected data is sent to the storage means 150 (steps 225a - 227), and the storage means 150 will subsequently independently form a structure for processing by the processing means in accordance with their access rights.

In addition to information about search queries and clicks, the advertising network Μ in this example requested location information - at step 230, the server 102a sent a request to the client 102b, which forwarded it to the access control 130 at step 230b. The user has granted such permission at step 221, and the access rights manager 130 has issued rights to the location data as well.

Since the storage means 150 independently generates or fills data structures for processing by processing means 102, then at step 240 (hereinafter, see Fig. 3b) when redirecting the request, in addition to the user ID UserID100, information about the data is added to the request, to which advertising network Μ has rights, for example, in the form of data structure fields (in Fig. 3b this is designated as "Model"). The storage engine 150 at step 242 receives from the anonymization engine 160 the converted user identifier UserID'100 and data structure fields. And at step 243 finds the user data placed in the storage. Next, the storage means 150 determines the access rights to the data, for this, in our example, the means 150 of the structure fields (taken from the "Model") attached to the request, compares with the data hosted by itself, and detects at step 310 (in Fig. 3b not shown) that the location information of UserID'100 was not placed on the means 150 (resulting in a padding error, for example). The storage engine 150 calls the access rights management engine 130 with a request for data specified in the structure, but not present on the storage engine 150. The storage engine 130 is accessed, for example, through the agent 130a, which at step 311 will contact the anonymization engine 160 and perform the transformation of the UserID identifier '100 in a request to the original UserID100 using the transform engine 160 at step 312 and will pass the request to the rights management tool 130 at step 313. The management tool 130 will update the information about the collected data based on the results of the request from the storage engine 150, where the update includes at least two stages :

• discovery among the user's devices of devices that can provide the requested data (in this example, this is a mobile phone 101a);

• updating structure fields (in our example, adding the "location" field) for collection tools 120, in particular on these devices, where fields with requested data are added, in this example this is step 314.

Next, at step 320, the storage means receives the requested data. In this example, step 320 of FIG. 3 consists of several sub-steps (320a - 320e) in FIG. 3b. In step 320a, the updated user data structure with information including location is sent to the store 150, and the user ID in the system 100 with the second token is sent to the anonymizer 160 in step 3206. The anonymizer 160 transforms the identifier in step 320b, and the transformed UserID' 100 is passed to store 150 in step 320d. At store 150, the identifier is combined with the updated user data structure based on the identical tokens in step 320e. The storage engine 150 then associates the received data structure with other data structures for that user in step 320e. The storage engine can now fill in the required fields at the request of the processing engine 102.

Based on Fig. 2a-2b, consider an example implementation of a method 200 for providing user data to processing means. The blocking means 110 blocks data processing for the advertising network M, namely, blocks the collection of URLs/resources visited by the user (clickstream) and the history of search queries. Blocking is carried out due to:

• removal from the web data 103, including those created by the browser 102b, of cookies at step 211, which contain a temporary user ID in the advertising network M, set by web page scripts;

• substitution in network traffic at step 212 of a permanent user ID in the advertising network M, which is identical to the login of the account with which the user logged into the browser;

• substitution in the network traffic of the identifier of the installation of the browser 102b.

Based on the flow of clicks and search queries, the advertising network Μ performs profiling and subsequent targeting of advertising messages. Thus, the advertising network cannot target without having a user profile, which drastically reduces the conversion (the number of clicks on an advertisement), and since the advertising network's operating model is CPC (from the English cost-per-click), revenue decreases accordingly per user ARPU (from English average revenue per user). This blocking is used by the user because the user wants to avoid ads from the Health category of products in his browser (for example, medicines, medical clinics and other objects from the Health category). But at the same time, the user is ready to receive targeted advertising from other categories of goods and services from this advertising network Μ (“Sports”, “Education”, “Books”, ..., “N”). At the same time, the user for profiling is ready to share only the history of search queries and visited web resources. These settings are set at step 221, and an example of such settings is shown in FIG. 4. Additionally, the system 100 will block any advertisements that are undesirable for the user by the blocking tool 110, namely, at step 212, it will remove from traffic and block the download of advertising data with unwanted content, namely those related to the Health category. Thus, after the specified settings at step 221, the access rights manager 130 issues rights to the advertising network Μ for the entire history of searches and clicks, excluding searches and clicks associated with the category "Health". The information related to this is sent to the means of the system 100 at step 222. The collector 120 at step 222 receives a data structure with fields to fill in, the structure contains the fields:

• search queries

• visited web resources

искусство

art

развлечения

entertainment

бизнес

business

игры

games

общие

general

поиск работы

job search

и т.д

etc

At this point, the collector 120 is directed to collect all search queries and all visited web resources that cannot be classified as health. Profiling to target promotional materials in the Health category can use different categories of web resources, so the tool 130, when generating the structure for the tool 120, reduces the general category "Health" to more specific categories (subcategories) of web resources and does not include them in the fields of the structure for tool 120, for example, subcategories of web resources such as: drugs, medical services, medical information portals, etc. For example, the structure might look like this:

Modifier 140 at step 222 receives categories of search queries that are prohibited from transmission. Modifier 140 uses natural language processing techniques to analyze search queries and classify them. The storage medium 150 acquires access rights for the advertising network M in step 222.

Next, at step 222a, the collection tool 120 collects search queries from all categories and visited web resources that are not related to the Health category, and fills in the fields of the structure. Collector 120 selects data to populate the structure from stored web data 103 accumulated during the user's network activity. This data is generated both by the browser 102a and additional tools of the system 100, such as plug-ins in the browser or UI interceptors (not shown in Fig. 2a and are modules of the tool 120).

The completed structure is passed to modifier 140 at step 223. Modifier 140 analyzes the search query field for queries relating to the category "Health" based on the information about prohibited categories received at step 222 from the rights management tool 130. Further, search queries relating to the category "Health" are removed from the resulting structure, in this example, this is the query R3. The modifier 140 receives from the processor 102 at step 224 the advertising network user ID Μ (UserIDM) from the browser cookie or profile and the system user ID 100 (UserID100) from the rights management tool 130 (not shown in Fig. 2a). Next, the user data structure containing search queries and URL resources is encrypted with a public key (Rn→Rn', URLn→URLn'). Modifier 140 generates a pair of identical random tokens. One of the tokens is associated with the UserIDM and UserID100 identifiers:

The second token is associated with the user data structure (added by an additional field to the structure):

Next, at step 225a, the user data structure is sent to storage means 150, and the identifiers with the second token are sent to anonymizer 160 at step 225b. The anonymizer 160 converts the identifiers in step 225c. The anonymization tool 160 changes the original user ID in the system 100 and the ID for the advertising network Μ in order to protect user data in case of data leakage from the storage tool 150, since the owner of the data cannot be identified with the changed IDs:

The converted UserID'100 and UserID'M are passed to the storage means 150 in step 225 g. user at step 227:

Now, data requests from the advertising network Μ for data processing are redirected to the storage means 150 via the anonymization means 160, as shown in FIG. 2b. As can be seen from FIG. 2b, the request is sent by the server 102a through the browser 102b in step 230. The request contains a user ID in the advertising network Μ UserIDM. At step 240, the request is redirected to the anonymizer 160. When the request is redirected, the user ID in the system 100 is attached to the request:

In step 241, the anonymizer 160 converts the user ID in the system 100 and the ID in the advertising network M:

And, in step 242, passes the translated identities to store 150. Store 150 detects, in step 243, data associated with the user based on UserID'100, and determines the rights for the advertising network Μ, in step 250, in this example, this is done by looking up UserID'M and its associated data structure. When the data is found, it is returned along with the UserID'M to the anonymizer 160 at step 251, the anonymizer 160 returns the network user ID Μ to the original value at step 252, and the user data along with the original UserIDM is passed to the ad network processor 102, with the fact of transmission captured by logger 180.

In a particular case, the advertising network can directly contact the anonymizer without redirecting requests from the device 101, in this case, the processing tool itself redirects the request - instead of the device, it addresses the storage medium, in a particular case, through the anonymizer. In another particular case, the data is not transferred to the processing means 102, but access is provided to a copy of the data located on the storage means 150.

Also, the system shown in Fig. 1 is used to implement a method for updating user data 300. This method is performed when not all of the data to be processed is located on the storage medium and/or when the user has more than one device from which it is possible to receive data. In this method, steps 210, 230, 240, 250 are similar to those of the method shown in FIG. 2. At step 310, the storage medium detects that the data to which the processing engine has obtained access rights is not located on the storage medium. Therefore, at step 320, the missing user data is transferred from the device to the storage medium. In a particular case, upon detecting missing data, storage engine 150 calls access control engine 130. Engine 130 updates the data model, according to which collection engine 120 populates new fields in the structure (in our example, those related to location). Next, the tool 130 sends the data to the storage tool 150. In a particular case, sending is carried out using the modification tool 140 (the tool 140 analyzes the data for criticality and other compliance with the rights set by the access control tool 130) and the anonymization tool 160, if the detected data requires additional transformations.

Under the locking tool 110, collecting tool 120, rights management tool 130, modifying tool 140, storage tool 150, anonymization tool 160, aggregation and analytics tool 170, logging tool 180 in the present invention refers to real devices, systems, components, a group of components implemented using hardware such as an application-specific integrated circuit (ASIC) or a field-programmable gate array (FPGA) or, for example, a combination of software and hardware such as a microprocessor a system and a set of software instructions, as well as on neuromorphic chips (eng. neurosynaptic chips) The functionality of these tools can be implemented exclusively by hardware, as well as in the form of a combination, where part of the functionality is implemented by software, and part by hardware. In some embodiments, the means may be executed on a general purpose computer processor (eg, as depicted in FIG. 5). Databases can be implemented in all possible ways and be contained both on the same physical media and on different ones, located both locally and remotely.

Fig. 5 shows an example of a general purpose computer system, a personal computer or a server 20, comprising a central processing unit 21, a system memory 22, and a system bus 23 that contains various system components, including memory associated with the central processing unit 21. The system bus 23 is implemented as any bus structure known from the prior art, which in turn contains a bus memory or bus memory controller, a peripheral bus, and a local bus that is capable of interfacing with any other bus architecture. The system memory contains read-only memory (ROM) 24, random access memory (RAM) 25. The main input/output system (BIOS) 26 contains the basic procedures that ensure the transfer of information between the elements of a personal computer 20, for example, at the time of loading the operating systems using ROM 24.

The personal computer 20 in turn comprises a hard disk 27 for reading and writing data, a magnetic disk drive 28 for reading and writing to removable magnetic disks 29 and an optical drive 30 for reading and writing to removable optical disks 31, such as CD-ROM, DVD -ROM and other optical storage media. The hard disk 27, the magnetic disk drive 28, the optical drive 30 are connected to the system bus 23 via the hard disk interface 32, the magnetic disk interface 33, and the optical drive interface 34, respectively. Drives and related computer storage media are non-volatile means of storing computer instructions, data structures, program modules, and other data of the personal computer 20.

The present description discloses an implementation of a system that uses a hard disk 27, a removable magnetic disk 29, and a removable optical disk 31, but it should be understood that other types of computer storage media 56 that are capable of storing data in a computer-readable form (solid-state drives, flash memory cards, digital disks, random access memory (RAM), etc.), which are connected to the system bus 23 through the controller 55.

The computer 20 has a file system 36 where the recorded operating system 35 is stored, as well as additional software applications 37, other program modules 38 and program data 39. The user has the ability to enter commands and information into the personal computer 20 through input devices (keyboard 40, manipulator " mouse" 42). Other input devices (not shown) may be used: microphone, joystick, game console, scanner, etc. Such input devices are typically connected to computer system 20 via serial port 46, which in turn is connected to the system bus, but may be connected in other ways, such as through a parallel port, game port, or universal serial bus (USB). A monitor 47 or other type of display device is also connected to the system bus 23 via an interface such as a video adapter 48. In addition to the monitor 47, the personal computer may be equipped with other peripheral output devices (not shown), such as speakers, a printer, etc. .

The personal computer 20 is capable of operating in a networked environment, using a network connection to another or more remote computers 49. The remote computer (or computers) 49 are the same personal computers or servers that have most or all of the elements mentioned earlier in the description of the entity. personal computer 20 shown in FIG. 5. Other devices may also be present in the computer network, such as routers, network stations, peering devices, or other network nodes.

The network connections may form a local area network (LAN) 50 and a wide area network (WAN). Such networks are used in corporate computer networks, internal company networks and, as a rule, have access to the Internet. In LAN or WAN networks, a personal computer 20 is connected to a local network 50 through a network adapter or network interface 51. When using networks, a personal computer 20 may use a modem 54 or other means to communicate with a wide area network, such as the Internet. Modem 54, which is an internal or external device, is connected to system bus 23 via serial port 46. It should be clarified that network connections are only exemplary and are not required to represent the exact network configuration, i. in fact, there are other ways to establish a connection by technical means of communication from one computer to another.

In conclusion, it should be noted that the information given in the description are examples that do not limit the scope of the present invention defined by the formula. A person skilled in the art will appreciate that there may be other embodiments of the present invention consistent with the spirit and scope of the present invention.

Claims (28)

1. A method for transferring missing user data to a storage medium, wherein: a) blocking by means of blocking the processing of user data on the side of at least one device of the user for processing means; b) collect user data in accordance with applicable policies; c) receive a request to process the blocked user data from the processor; d) determine the access rights for the processing tool to the user's data by the data access rights management tool; e) detect the absence of the requested data for processing on the storage means; f) transfer the missing user data from the user device to the storage means using a modification tool and/or an anonymization tool, where the said anonymization tool is configured to transform the structures and substructures passing through it, both direct transformation and reverse, and the mentioned modification tool selects a network route The on which the structure or substructure will be sent to the storage medium. 2. The method according to claim 1, in which a request for data processing by the user's device is received from the processing means. 3. The method according to claim 2, which redirects the request of the processing means from the user's device to the user data storage means. 4. The method according to claim 1, in which processing means at least: collection of user data, recording user data, accumulation of user data, use of user data, transfer of user data. 5. The method according to claim 1, in which the processing means is a client application installed on the user's device and a remote server connected within the client-server interaction. 6. The method according to claim 5, in which the processing of data not related to the main functionality of the application installed on the device is blocked. 7. The method according to claim 1, in which the processing of data for marketing purposes is blocked 8. The method according to claim 1, in which the user's devices are a group of devices in the local network. 9. The method of claim 1, further comprising granting access rights to the processor on the first request for processing. 10. The method of claim 1, wherein the user data storage means is located remotely. 11. The method of claim 1, wherein the processing request is a request to transfer data to the server of claim 5. 12. The method according to claim 11, in which the blocking consists in breaking the association between a set of sequentially transmitted data to the server. 13. The method of claim. 1, which further generates the data storage means for processing by the processing means in accordance with the access rights. 14. The method according to claim 13, which provides access to the generated user data to the processing means. 15. The method according to claim. 1, which blocks the processing of user data on the device transferred to the storage medium. 16. The method of claim 1, wherein there are at least two user devices. 17. The method of claim 16, wherein the storage means associates data received from at least two user devices with a user of the devices.

Images