WO2008043993A1

WO2008043993A1 - Maintaining location information in a mobile wireless communications device

Info

Publication number: WO2008043993A1
Application number: PCT/GB2007/003818
Authority: WO
Inventors: Karl Mcdowall
Original assignee: Symbian Software Limited
Priority date: 2006-10-09
Filing date: 2007-10-09
Publication date: 2008-04-17
Also published as: GB0619961D0; GB2443232A

Abstract

A mobile wireless communications device comprises a plurality of locality privacy profiles and a user of the device can maintain and switch between the profiles to change the set of contacts who are allowed to access data indicative of the location of the device. Each Location Privacy Profile serves to define a set of people who have been granted this privilege, with the user setting up Location Privacy Profiles to conform to their requirements in different situations.

Description

Maintaining Location Information in a Mobile Wireless Communications

Device

This invention is concerned with means by which mobile telephone users can keep their location private, and in particular with means by which mobile telephone users can keep their location private through the use of location privacy profiles.

The term mobile wireless communications device currently applies to mobile telephones and other devices capable of using modern cellular telephone networks, and the description of this invention makes reference to these as being the most readily understandable domain in which this invention might be applied.

However, it is not intended or envisaged that this invention should be limited in its applicability to currently available forms of mobile wireless communications devices. As modern electronic computing devices converge functionally, it is to be expected that many other types of device will also be capable of communicating wirelessly; the term wireless communication device should therefore be expansively construed to include any electronic device which includes an ability to receive wireless communications of any type. This could include personal devices such as desktop computers, laptop computers, Personal Digital Assistants (PDAs), Smartphones, Digital Cameras, Digital Music Players, as well as many other industrial and domestic devices ranging from gaming devices to cash machines (ATMs) to motor vehicles of all forms.

The transmission of the geographical position of a telephone handset to its cellular network has always been an essential feature of mobile telephone technology; this is because if the network does not know the cell in which a phone is situated, it cannot route incoming calls to it. However, cell identity by itself can be a very inaccurate measurement of position, as cell sizes can range from 50 miles across in largely empty rural areas, to under 500 metres across in dense urban areas.

Methods of using various aspects of cellular network technology to ascertain the location of a phone more accurately generally involve triangulation. The simplest, and least accurate, of these methods is to triangulate using the measurements of the relative strength of the signals from nearby base stations; the ability to obtain this data is functionality all mobile telephones possess, since it is essential to their ability to handoff from one cell to another. The reason why this method is relatively inaccurate is because a number of factors, of which distance is only one, affect the strength of the signal received at a handset.

More accurate network-based solutions are possible, such as time difference on arrival (TDOA); if the time taken for a handset signal to reach at least three base stations is known, it becomes possible to work out where the handset is located relative to those base stations. An alternative method known as angle of arrival (AOA) relies on at least two base stations knowing the angle at which signals from a handset arrive. In practice, multipath transmission phenomena mean that the more base stations these methods can be applied to, the more accurate the results will be.

Highly accurate measurements of position are possible by including additional hardware in telephones that makes use of the Global Positioning System (GPS); this generally requires line-of-sight communication with at least three of the 24 GPS satellites and is known to be less reliable in urban and forested areas where line-of-sight communication is not possible.

In practice, therefore, a combination of the above positioning technologies is generally considered to enable the cellular network to have a reasonably accurate estimate of the geographical position of a mobile handset at all times. The inclusion of such positioning technology in mobile telephones, and its use in applications, is known to be an increasing trend.

There are a number of reasons for this, including:

• the perception of the wireless network providers is that positioning technology is necessary for the introduction of Location Based Services (LBS), which may provide an opportunity for increased telephone traffic and added value. • the introduction in the USA of the FCC E911 regulations, phase Il of which mandates that by the end of 2005, the location of all handsets making 911 emergency calls should be specified to an emergency service to an accuracy of within 125 metres.

• the perceived usefulness of incorporating navigation applications in mobile devices, based on the availability and accuracy of the Global Positioning System (GPS). In-car systems and navigation software on mobile phones, such as Route 66 (http://rs0122.66.com/route66/) and Navicore (http://www.navicore.fi) are both becoming increasingly popular.

The ability of the cellular phone networks to derive the location of any handset on a network also gives the networks access to information that can usefully be shared with others. This is because mobile telephone handsets are devices with unique IDs, the overwhelming majority of which are also associated with and personal to a single individual (the normal user of the device). Hence, if the location of a device is known, it can be assumed with reasonable certainty that the location of the user is also known.

Typical use cases of location information include:

• parents being able to find out where their children are

• tracking the location of transport and delivery vehicles to give better estimates of arrival times

• groups of friends sharing their locations with each other

• employers knowing where their staff are whilst conducting business.

It can be seen from this example set of use cases that while there are clear benefits to this technology, there are also significant privacy and commercial confidentiality issues that need to be addressed because it is not universally desirable to give everyone the ability to find out at any time where any arbitrary handset is located. It is clear, therefore, that mobile telephone users require methods of policing who can have access to their location information, and when they can have it. The submission by The Center for Democracy and Technology to the FCC to be found at http://www.cdt.org/ privacy/issues/location/010406 fcc.shtml) states

"consumers should be confident that, whenever they are using a device that relays location information, its use, disclosure and access will be governed by predictable, easily understandable privacy rules."

There is a known standard approach to the issue of location privacy, which is for the user to define a set of people who are allowed to access location information, with any person who is not a member of this set being denied access to this information.

One example of this standard approach can be found in the description of the USCD ActiveCampus project, which

"aims to provide location-based services for educational networks and understand how such systems are used. ActiveCampus Explorer uses a person's context, like location, to help engage them in campus life." (from http://activecampus-dev.ucsd.edu/).

The ActiveCampus project has a restricted universe of people who are members of the network, and the default is for everyone in that network to be able to access location information. Recognising that this may be unsatisfactory, the solution adopted is to allow each member to define a single set of privileged buddies; each member then has the option to restrict access to their location information to this previously defined set of buddies.

The same single set-based approach is taken by current mobile telephone applications such as the Invertix Friend Finder:

"mNET's patent-pending TruePresence™ technology enables users to search for friends based on location and presence. And thanks to mNET Friend Finder's comprehensive privacy management features, users can easily specify the buddies that they want to share presence or location information with which makes mNET Friend Finder the safest and easiest way to find your mobile buddies!" (from http://www.invertix.com/mnet_applications.html#friend). All current solutions are therefore based on a standard approach of defining a single set of individuals, which is generally a subset of those individuals stored in some type of contacts database held on the device. When a remote location request is received and is identified as coming from a particular individual, the device cross checks membership of the predefined set to decide whether to accept or deny the request for location information, or to query the user about granting the request.

The problem with the solution of the prior art is that it does not correspond to the way that the majority of users wish to approach the location privacy issue. It is widely acknowledged that defining a single set of people with privileged access to a user's location information is unsatisfactory for the simple reason that the membership of such a set is not a constant determinant in the user's overall life pattern.

Most obviously, when people are at work, it is quite possible that there will be a requirement for at least some of their work colleagues and their managers to be able to find out where they are. However, allowing work colleagues and managers to know a user's location during leisure hours, or where they are during vacation, is something that the majority of people are likely to find neither necessary nor desirable.

Conversely, people are much more likely to be happy with a small set of close family and close friends having access to their location information when they are not at work; but whether this set of family and friends should be able to find out details of their location during work hours is a completely different question. As well as an individual's own preference in such matters, many companies would regard a user's location information whilst conducting business as confidential and commercially sensitive information which should only be available to the company.

With the current standard approach to location privacy, a user wishing to change the privacy settings for multiple individuals needs to go through a list of all those individuals and separately switch to a new location privacy setting for each. Then, if in the future they wish to reverse this set of changes and revert to the original settings, the user has to go through the same list of individuals and once again set the location privacy setting for each back to what it was previously.

In the best case such a procedure results in much wasted time, wasted power consumption on a mobile device, and a less than satisfactory user experience. In the worst case, where location data is indeed confidential or commercially or personally sensitive, the laborious procedure that a user has to follow is clearly a deterrent to adopting proper security measures, and raises the risk that the mobile device might represent a security threat. There is also a possibility that the user will introduce errors in the amendment and recreation of the original list.

It is clear that the prior art solutions to the process of policing access to location privacy are unsatisfactory and that a less onerous and more flexible solution is required. It is, therefore, an object of the present invention to provide such an improved solution for policing access to location information.

According to a first aspect of the present invention there is provided

According to a second aspect of the present invention there is provided

According to a third aspect of the present invention there is provided

Embodiments of the present invention will now be described, by way of further example only.

The solution provided by the present invention to the problem outlined above is to enable devices to implement a set of Location Privacy Profiles.

The concept of a profile is becoming well-known on advanced mobile phones, where a number of different profiles are commonly provided. These profiles group together the way the phone behaves in respect of user alerts, which include items such as ring tones, ring volumes and vibration only (silent) alerts. Profiles commonly have names such as 'Meeting' 'Outdoor' 'Silent' and 'Normal', and they tailor the device to ensure that it behaves in socially appropriate ways when in specific sets of situations. One of the key user interface benefits of having profiles on phones is that they enable a number of different but related settings to be grouped together and to be easily changed with a single discrete operation. This is referred to as changing the profile.

Location Privacy Profiles as provided by the present invention are somewhat similar in that they enable a number of privacy settings for different individuals sharing a common social context to be grouped together and treated in a common way with a single discrete operation (changing the Location Privacy Profile).

As a straightforward illustration of how this works in practice, consider the work vs. leisure use case described above. A user is able to set up a 'work' Location Privacy Profile, which defines one set of individuals (work colleagues and managers) who are able to access the user's location, but which excludes another set of individuals (friends, non-work acquaintances, and family members) from being able to access this data. The user can also set up a leisure (or home) Location Privacy Profile in which work colleagues and managers are not included in the list of people being able to access their location, but friends and family are. Some individuals (such as spouses, for instance) might be granted privileged to access location data in all profiles.

A Location Privacy Profile does therefore logically consist of a uniquely named set of people who are able to access the user's location when the particular profile is activated; all others revert to the global default behaviour, which would normally be to be excluded from accessing location data. In a preferred embodiment, the Location Privacy Profile physically consists of IDs or other tags uniquely associated with individuals included in the contacts database of the device.

Only one single Location Privacy Profile is active at any one time, and the Location Privacy Profile is capable of being changed in a single operation.

Users are able to set up as many Location Privacy Profiles as they wish; the selection of the currently active Location Privacy Profile can then be made from a list of the currently defined Location Privacy Profiles.

It is also possible optionally to associate presence information with a Location Privacy Profile. This type of information is commonly associated with instant messaging, and is primarily used to convey a potential receiver's status to someone who wants to send them message; the user could be available, available but busy, off-line, out to lunch, and so on. Presence information can also give the best means of contact; for example, if the user is out to lunch, presence information is able to let people know whether the user is answering the phone or not, or whether the user is able to answer an email on their return. If this is done, each Location Privacy Profile can be provided with a default presence status; for example, "At work; please contact via email!" or "At home; please phone!". This presence information is, therefore, a useful extension to this invention.

The operation of a device which implements Location Privacy Profiles is very different to that of a device which does not include the present invention.

In the case of a conventional mobile telephone, location privacy settings are currently included as an item for each individual entry in some type of contacts database. A request from a third party individual to access the user's location information which is received by the mobile phone is linked to a named individual via the phone's address book or contacts database. The device then looks at the location privacy field in that individual's entry in the contacts database in order to decide whether or not to grant the request.

However, in the case of a mobile telephone that implements Location Privacy Profiles according to the present invention, a request from a third party to access a user's location information causes the device to behave very differently. The device interrogates the contacts database, but this is for the purpose of obtaining the ID or similar tag uniquely identifying the party making the request. The device then checks its current Location Privacy Profile, and then looks at the set of unique IDs included in the currently selected Location Privacy Profile in order to decide whether to allow the request.

Note that since Location Privacy Profiles are, in essence, lists of IDs, one Location Privacy Profile can also include (or nest) another Location Privacy Profile, provided that there is a distinct range of IDs identifying other profiles rather than individuals. For each location request coming over the network, all sub-lists of the main list in the currently selected Location Privacy Profile are recursively searched. There is also a restriction implemented within the device preventing a sub-list from being accessed twice during the same search; apart from device efficiency considerations, this measure also prevents infinite recursion taking place.

This type of nested profile also enables more complex use cases. For example, a Location Privacy Profile called 'Bridge Partners' can be removed from the normal 'Leisure' profile if a user calls with an excuse to skip a usual Bridge night in order to go to a football match instead.

In a further aspect of this invention, switching between Location Privacy Profiles can be performed automatically in response to external trigger events as well as being performed under user control. Such a trigger event may be the time of day; so a device can automatically be set to switch into a 'work' Location Privacy Profile at a preset time every morning and switch out of the 'work' profile at a preset time every evening. The switching between profiles can also be triggered according to calendar information so that the switch to the work profile at a preset time in the morning only occurs on weekdays and not at weekends. The switch to the work profile can also be further restricted so that, for example, if the user has appropriately tagged all vacation days in the device calendar, the switch to the work profile does not take place even though the actual day is a weekday on which the user would normally be expected to be at work and have the work profile selected.

Another trigger event may itself be location based; so a user wishing to keep a visit to a particular location entirely unknown could, when approaching that location, set the device to automatically switch to a Location Privacy Profile whose list does not contain any entries; and on leaving that location, the device automatically switches back to a prior profile, which may or may not be the immediately preceding profile. This particular example also shows the usefulness of the device in maintaining a stack memory of a number of its previous location privacy profile states.

The trigger may also, for example, be events based. In this case, the user could flag certain types of events in the calendar held in the device as being events for which a certain type of location privacy profile is adopted. It should be noted that this invention is agnostic about the exact mechanism used for obtaining location information, or about the mechanisms for storing or updating this data; it will work equally well with all positioning technologies.

It should also be noted that while the preferred implementation of this invention described is for the Location Privacy Profiles to be computed by and kept in the memory of the mobile computing device itself, and for the device itself to directly grant permission and provide the data to satisfy location requests, network based implementations of this invention are also possible.

In this case, the one or more Location Privacy Profiles are maintained and kept in the network. The location of the device is computed by the network, and the network itself is able to satisfy requests for location data based on information transmitted to it by the handset. Hybrid variations, where the functionality is split between a handset and the network, are also possible. Those skilled in the art will readily be able to adapt the invention to apply to such variant cases.

It can be seen form the above description that significant advantages accrue through the use of the present invention. Once a user has set up their Location Privacy Profiles, it is very much easier for that user to modify or control who can access their location than on a device without this invention. This enables

• a simpler and more pleasant user experience

• better security in cases where location data is confidential

• more privacy for users

• increased use of location data sharing, driving developments in mobile technologies

Although the present invention has been described with reference to particular embodiments, it will be appreciated that modifications may be effected whilst remaining within the scope of the present invention as defined by the appended claims.

Claims

Claims:

1. A mobile wireless computing device operable to maintain one or more lists containing references to entities to which permission may be granted to obtain data regarding its location; and arranged such that only a single one of the said lists can be in use at any one time; and wherein the device is further operable to determine or select which of the said lists is in use on the device and thereby alter the set of entities which have been granted permission to access the data regarding its location.

2. A device according to claim 1 wherein the determination or selection of which of the said lists is in use is made in response to input by a user of the device.

3 A device according to claim 1 in which the determination or selection of which of the said lists is in use is automatically made by the device in response to one or more external trigger events including:

a. particular times and/or dates

b. particular places or locations

c. particular events.

4 A device according to any one of the preceding claims operable to enable the user of the device to create and name any one or more of the said lists.

5 A device according to any one of the preceding claims operable to enable the user of the device to insert, remove and edit any data relating to any members of any one or more of the said lists.

6 A device according to any one of the preceding claims wherein any one or more of the said lists can include a reference to any one or more of the other lists, and the device is operable to enable the members of the one or more other lists to be treated in the same way as the members of the one or more of the said lists. A device according to any one of the preceding claims operable to maintain one or more memory stores for recording a history of previous usage of any one or more of the said lists.

A device according to claim 7 in which one of the said memories is in the form of a stack.

A device according to any one of the preceding claims wherein the references to entities to which permission may be granted to obtain data regarding the location of the said device comprise indirect references to unique entries in a contact database comprising references to the entities.

A device according to any one of the preceding claims wherein at least one or more of the said lists is associated with presence status information, and in which the selection of any list as being in use sets the default presence status information for the device to that associated with the said list.

A device according to any one of the preceding claims in which one or more of the said lists are kept on the device.

A device according to any one of the preceding claims in which one or more of the said lists are kept externally in the memory of an entity in a communications network to which the said device is connectable.

A method of operating a mobile wireless computing device, the method comprising

a. maintaining one or more lists containing references to entities to which permission may be granted to obtain data regarding the location of the device; and

b. providing that only a single one of the said lists can be in use at any one time; and

c. determining or selecting which of the said lists is in use and thereby alter the set of entities who have been granted permission to access the data regarding the location of the device.

A method according to claim 13 wherein the determination or selection of which of the said lists is in use is made in response to input by a user of the device.

A method according to claim 13 wherein the selection of which of the lists is in use is automatically made by the device in response to one or more external trigger events including:

a. particular times and/or dates

b. particular places or locations

c. particular events.

A method according to any one of claims 13 to 15 wherein any one or more of the lists are arranged such that they can be created by a user of the device.

A method according to any one of claims 13 to 16 wherein any data relating any members of any one or more of the lists is arranged for insertion, removal and editing by a user of the device.

A method according to any one of claims 13 to 17 wherein one or more of the lists are arranged to include references to one or more other lists, the members of the one or more other lists are treated in the same way as the members of the one or more of the said lists.

A method according to any one of claims 13 to 18 wherein a history of previous usage of one or more of the said lists is maintained in one or more memory stores.

A method according to claim 6 wherein one of the said memories is arranged in the form of a stack.

A method according to any one of claims 13 to 20 wherein the references to entities to which permission may be granted to obtain data regarding the location of the device are indirect references to unique entries in a contact database comprising references to the entities.

A method according to any one of claims 13 to 21 wherein at least one or more of the lists has presence status information associated with it, and in which the selection of any list as being in use sets the default presence status information for the device to that associated with the said list.

A method according to any one of claims 13 to 22 wherein at least one or more of the said lists are kept on the device.

A method according to any one of claims 13 to 23 wherein at least one or more of the said lists are kept externally in the memory of an entity in a communications network to which the said device is connected.

An operating system for causing a computing device to operate in accordance with a method as claimed in any one of claims 13 to 24.