This invention relates to a device for generating a virtual network user, that, for the purpose of privacy, can be used as a pseudonym under which a physical person or legal entity may gain access to the Internet or a comparable network and engage services that can be implemented via the network, without revealing the identity of the physical person or legal entity concealed behind the pseudonym to third parties who deal with the virtual network user for business or personal relationship purposes, or who do so by snooping on the network. A selectable predetermined combination of attributes, which—in principle—are arbitrarily predetermined, serves to implement the virtual network user. In practice, legal regulations must be met and certain attributes may be required e.g. majority age. These must be combined with real and verifiable attributes. Such a device is, generally speaking, realizable through a transformation system, which can be activated by the input of these attributes into the personal computer of a user and consequently the generation of the virtual network user conveying data streams that are stored in a memory of the transformation system in the order they incurred, so that with the virtual network user contact can be established.
Devices of this kind (David Chaum, “Security without identification: Transaction Systems to make big brother obsolete”, CHCM (28,10), October 1985, pp. 1030-1044; Stuart Stubblebine and Paul F. Syverson, “Authentic attributes with fine-grained anonymity protection”, Financial Cryptography 2000, LNCS serious, Springer-Verlag, 2000), given a careful implementation, have the property to conceal the identity of the user who is behind the pseudonym used as virtual network user, as far as possible, and for this reason the function can provide a “stealth”, under which the identity of the user of the pseudonym is hidden or at least can remain undetected.
Systems of this kind thus have the advantage that they protect protected physical persons or legal entities against publishing of personal data and properties, or even against harassment or attack efficiently, but also have the disadvantage, that a carrier of such protection deprives the state authority of lawful access and, without fear of sanctions, can develop activities, which can lead to considerable social harm.
Although it can be assumed that criminal use of such devices cannot remain hidden, and tracing the data track, which is also left by virtual network users, to its creator and thus a prosecution of crime is possible, this undertaking is however so substantially complex that it is no longer proportionate to the reasons of the rule of law, e.g. protecting the public from crime.
The object of this invention is therefore to design a device of the aforementioned kind such that, with due respect for the interests of the user under pseudonym to keep his identity secret, in case of urgent need, e.g. for the purpose of preventing a crime or its investigation, a reasonable possibility of access for the state authority to the identity of the user of the pseudonym is provided.
Hereafter—in addition to the user-related transformation system(s)—at least one other similarly structured aforementioned transformation system is provided, that is associated with an independent authority, for example the state law enforcement authority, that can activate this system and thereby initiate the reading of data from a user-related transformation system, namely data containing information about the network access device over which the virtual network user has been accessing the network and is under suspicion of planning or committing illegal acts.
The implementation of the accessibility of the independent authority, such as law enforcement officers, is simple because of the structural analogy of the access device to the device for generating the virtual network user, and therefore possible to realize with little extra effort and in a cost-effective manner. The inventive design of the device implies a limitation of the user's interests in anonymity which seems however properly balanced, since this limitation is conditional on constitutional measures that in turn serve a good balance of individual and societal interests.
In the preferred embodiment of the inventive device according to claim 2, for the data that after authentication are made available to the independent authority, such as law enforcement, a separate register is provided from where the data foreseen for legal access can be read from memory of the transformation system.
This is an additional security provided so that the independent authority, can view only those data which are necessary for the investigation of a crime or its prevention, however not highly personal data that are not connected with the crime.
By a further preferred embodiment of the inventive device according to claim 3, it can also be used for evidentiary purposes by the user, which controls the virtual network user, when—with a recourse to the actions of the virtual network user—it is proven when and for what purpose they are made.
It is particularly advantageous if, as provided in claim 4, the registers, the independent authority can access, are located in separate rooms, from which there is no—physical—access for a person to the memory of a transformation system, which provides, from the perspective of privacy, additional security.
If in a particularly preferred embodiment an inventive device comprises at least and preferably two transformation systems, which can alternatively operate to generate the virtual network user, a simple time-continuous implementation is possible, where in a purposive embodiment of the alternatively operating transformation systems, only one set of access registers for the various categories of data to which access is available, is provided.
Herein it may, for reasons of an effective privacy, more precisely to identify a breach of privacy, which may be possible in the course of maintenance as provided in accordance with claim 7, in the alternative devices generating virtual network users respective data can be a correlated, and, for the case that identical data is simultaneously present in both transformation systems, immediately leads to the discovery of a violation of privacy.
If, as provided according to claim 8, the transformation systems of the various devices generating virtual network users are connected through mixing nodes with a plurality of network access devices. These nodes provide the function of a data “mix” through which the origin of the data is disguised for the desired privacy.
By the features of claim 9 with respect to the independent authority that—in a narrow range defined by the law—is supposed to be able to gain access to user-characteristic data, and by the features of claim 10 with respect to the user, who wants to operate as legally permissible in the network and thereby remain anonymous, simple-to-implement and plausible embodiments of media and readers are given that are assigned to the independent authority or the users respectively, and by the features of claims 11 to 12 simple and practical ways of implementing such devices are specified.
In a particularly advantageous embodiment of the invention, a mobile reader device is provided, which is coupled to the network access device of the user, e.g. via Bluetooth; such a device can be designed for one type of virtual network users, that for example can solely by activated, when the user proves his entitlement, using a fingerprint sensor appropriately or also for multiple virtual network user roles to which a corresponding plurality of storage media—Role Cards—is assigned, which can be housed in a storage area of the reader, so that after a reaction of the fingerprint sensor, all roles are available.
Further in an advantageous embodiment of the invention an input device is provided by which the virtual network user can be activated alone by control commands the user can enter via an input device, i.e. solely by software means, to allow an activation of a virtual network user, if the said storage media is not available, e.g. has been forgotten or is damaged.
This invention is also using the inventive device to reliably implement a method for generating a virtual network user, that, for the purpose of privacy, can be used as a pseudonym under which a physical person or legal entity to engage services that can be implemented via the network, as well as with the other, in the preamble of claim 15 said process features, whose main characteristic is that only those data that contains information about the network access device(s) over which the virtual network user(s) got into the network—traffic data—is stored in memories of the transformation systems and is accessible to an independent authority, such as the law enforcement authority, whereas storage of the role data that is generated by all the network activity of the user is in volatile memory of the transformation system, which will be deleted when the users session ends.
Hereby with technical means a high level of privacy is achieved.
It is particularly advantageous here if, as in claim 16, the data concerning the virtual network user—role data, on the one hand, and the data concerning the user—traffic data, on the other hand, are encrypted with different keys.
A particularly high degree of security against unauthorized access to personal data can be achieved if, as proposed in claim 17, the key, which allows reading the role data, is entered into the transmission system for each session by the user himself.
This procedure ensures that the operator of the facility 10 has no more data available that would point to the identity of the user. It is impossible in principle that the operator can assume the role of a “Big Brother”, which is thus largely obsolete.
The inventive device is suitable, thanks to the options given to the user for the generation of different types of virtual network users, to vary the virtual network users between the habitus of an imaginative avatar and a realistic “human” design.
Further details and features of the invention will become apparent from the following description of a preferred implementation illustrated in the drawings.
In the drawings:
a illustrates a schematically simplified perspective illustration of a device in accordance with the applicable authentication module according to
b and 3c illustrates readers in a corresponding representation to
d illustrates another reader module functionally corresponding to the reader module of
For the device, designated in
For this purpose the device 10 is designed so that a virtual network user will be generated according to the wishes of the user, which, however, before he can be active in the network, has to prove its access permission, e.g. substantiate it by evidence of its legal capacity, in order to satisfy legal requirements. The design of the device 10 also implies that the user agrees that the state authority, of course under the rule of law, has the option to identify the user to pursue investigations if any crimes are committed under the pseudonym, or take preventive measures, if the behavior of the virtual network user raises suspicions of criminal acts.
To implement this underlying concept of the device 10, a designated transformation system 12 is functionally inserted between the personal space of the user, represented through its network of access device 17 (its PC) and the network area 11. The transformation system is operated and controlled by a role provider that provides the user with the service of helping him to create a virtual identity by which it can appear and act in the network.
The role provider is shown in the simplified block diagram representation of
Register 16 is part of a collectively designated storage device 20 (
If required, i.e. law enforcement as a possible representative of the independent authority can request access to data, which is stored in the register 16. Access can be granted depending on the design of the transformation system 12, either for the authority directly by its input device 14, or through the intermediation of the role provider role over its access unit 13.
The conception of the natural—real—user in the network 11 quasi representing virtual network user—a role that it plays is provided in the way of a service by a role provider, who offers to the user a selection of roles, by creating a special individual combination of attributes, the virtual network user profile. Here, the “personality” of the virtual network user can be very similar to that of the real user, and a combination of real and verifiable as well as arbitrary attributes, or even, in extreme cases the user can chose attributes completely arbitrarily and correspond to a pseudo-character, immediately recognizable as a product of imagination; nevertheless it can act as a physical person or legal entity. Furthermore, it must be ensured that the state's authority can exercise its right of access to data, to disclose the physical person or legal entity controlling the virtual network user, given a legitimate interest exists and the users interests and rights are protected within the legally defined scope.
In a special embodiment of the device generating the virtual network user, the user acquires the role from a role provider, for example in the form of a chip card (
Typically, the record, that is created during the acquisition of the role card 18, which characterizes the appearance of the virtual network user, comprises beside the role identity and possibly a password also more comprehensive data—in principle, any—freely modular selectable data, characteristic for the user, verifiable data, e.g. biometric data, that was stored, in addition to data already existing on role card 18, when the card was created and given to the user. The preparation or adaptation for such matter of the reader module 19, which can be provided as standard equipment by the role provider, can take place during or after preparing the role card, for its delivery to the user at the merely schematically indicated authentication station 21 as shown in
In a further register 15 in the storage device 20 of the central access unit 12 on the user request data can be stored, e.g. a combination of verifiable attributes of the user and the timing of activities of the respective virtual network user, and can be viewed on the user request under the mediation of the role provider.
As evidence of real features of the user, e.g. for the certification of a certain age, the true indication of sex and/or nationality, the authentication station 21 is equipped with an authentication module 22 (
Such authentication can be realized in a way that e.g. both fingerprints: a fingerprint of the user and a fingerprint of the certified representative of the role provider are stored to the role card 18. This occurs after the person certified by the role provider has verified the authenticity of the attribute e.g. by inspecting the identity card of the user or buyer of the role and verifying in this example the legal age, e.g. the buyer is older than eighteen years.
The authentication module 22 of
The thus obtained authentic biometric data, in the example given, together with the data of the certified representative of the role provider are stored in in a designated schematically indicated registers 27 of the transformation system 12.
The reader module 19 (
At the reader 19, more “blind” pockets for additional role cards 18/1, 18/2 and 18/3 are provided, for additional roles and configuration of virtual network users respectively, that can be used as pseudonyms—substitute—by the user.
Instead of a reading module 19, as illustrated by
The selection of a different role card to change the role identity can be done by selection elements which are not be shown in embodiment, i.e. can be realized as electronic or electromechanical elements in common ways.
Also the reader module 31 (
This access is implemented in detail as follows:
The authentication process with the activation of the virtual network user leads to a user-to-role mapping, which is stored in the access unit 12, for example, in a row, the first data block as the role identity, the second data block associated with the user identity, for example the characterizing data of the network access device 17. Here, the role identity on one hand and the user related relevant traffic data on the other hand are encrypted with different keys. The role provider is, according to this important aspect of the invention, neither able to read the role data, i.e. role identity, nor other data that relates to the user data, i.e. user identity. The role provider is only able to read those data, to authenticate the user, i.e. to recognize the user as legitimate customer, whereby the user can appear even under a pseudonym.
The key with which the role data can be decrypted is not stored at the role provider, but is entered by the user in the transformation system for every session as a preparation of service usage. The key with which the user data is readable, is only known to the state authority, which in turn is not able to decipher the role identity. If a virtual network user is suspected of having committed a crime, the state authority, such as the prosecutor who is in possession of the key for the user data, can ask the role provider to transfer records linked to the role of the virtual network user into the access register 16. In this case information becomes readable to the prosecutor necessary to determine at least the network access device 17 used by the actual perpetrator.
Analogue to this approach, additional access for third parties can be foreseen, to enable the implementation of new services. For example a new service for another service provider, e.g. the verified delivery address can be made available to a logistics company for certain deliveries of purchases made in an “online shop”.
As shown in
These transformation channels 34/1 and 34/2 are connected to the network via a plurality of network nodes 36/1 to 36/4 with each other and with other network access devices from other users of the network 11. The network nodes 36/1 to 36/4 provide also the function of mix-nodes, in which the data streams are collected, repetitions deleted, data streams recoded and resorted so that the origin of messages is obscured. The mix node thus mediates the function of technical data mix, a mix cascade respectively.
This type of insertion of the inventive device 10 in the “local” structure of the network 11 results in an increased population in the access area of the virtual network users thus improving protection against unwanted identification. Such an increase in population of the considered network area can also be achieved in a way that the transformation system 12 automatically generates phantom virtual network users corresponding to an increase of the virtual total user population.
Without loss of generality, we assume that the two transition channels 34/1 and 34/2 of the transformation system 12 are alternately engaged in the implementation of the user as the virtual network user, e.g. so that always only one of the two channels in terms of generating the virtual network user is active, and both channels alternate in this function, e.g. implement in such a way that they perform alternately for equal periods of time, the transformation function by which the virtual network user is created; it is further assumed that in the event of a malfunction of one channel 34/1 or 34/2 the other channel 34/2 or 34/1 takes over immediately the function of the failed channel, so that a time-continuous implementation of the transformation function is guaranteed to the user. Based on this “redundant” design of the transformation unit 12, the virtual network user's presence is ensured over time, and disclosure of the true identity of its users avoided from a malfunction of the device 10.
Of significance here is that the person who carries out maintenance of one channel of the two transformation channels, has no access to the other active transformation channel which handles all traffic. Therefore in a preferred design of the transformation system 12 according to
In the 2-channel version of the transformation system 12, it is important that the channels are working strictly alternative, i.e. data, documenting the activity of the virtual network user is generated and stored in only one of the two channels. In an appropriate design of the device 10 therefore all data is stored only transiently in the channels 34/1 and 34/2 of the transformation system 12. Accordingly, when a channel of the transformation system is opened by one person for maintenance, before being released into the channel for access, all memory of the channel will be erased with information-free data sets, such as “zeros” (“data flush”). This also applies in case of data that is generally stored within the channels on a non-volatile storage media, i.e. such as a computer hard disk. This can for example be the case at a swap out of content due to insufficient memory from volatile memory to non-volatile storage media (so-called “paging”) or saving the contents of a volatile memory within a channel on non volatile medium in the event of a malfunction in the processor (called “core dump”).
For related verification of such strict alternative operation, a correlator, which is not shown, is suitable. The correlator is capable of performing a correlation function of generated data from time to time from the two alternative channels that are stored in chronological order. If this correlation leads to a positive result, it is an indication of an at least temporary combination of the two channels with each other and thus an indication of a malfunction or failure of privacy, and a trigger for an inspection of the device 10.
Number | Date | Country | Kind |
---|---|---|---|
10 2009 005810.9 | Jan 2009 | DE | national |
The present application is a continuation of U.S. patent application Ser. No. 13/187,027, filed Jul. 20, 2011, which is a continuation of International Application No. PCT/EP2010/000392, filed on Jan. 22, 2010, which claims priority to German Patent Application No. 10 2009 005 810.9, filed on Jan. 22, 2009, the entire contents of each of which are incorporated herein by reference.
Number | Date | Country | |
---|---|---|---|
Parent | 13187027 | Jul 2011 | US |
Child | 14261153 | US | |
Parent | PCT/EP2010/000392 | Jan 2010 | US |
Child | 13187027 | US |