Patent Application
20110289007
The present invention relates to a method and associated system for managing sensitive user data.
Providing a trusted source for securing information typically comprises an inefficient process with little flexibility. A single entity is typically used for securing and usage of information. Using a single entity for securing and usage of information may result in a breach of the information.
The present invention provides a method comprising: receiving, by a computer processor of a negotiable sensitive user data service (NSUDS) computing system from a consumer accessing a consumer computer, a request for verifying if a service provider computing system is associated with an NSUDS registry, wherein the consumer computer is communicating with the service provider computing system, wherein the consumer computer transmits an order request to the service provider computing system, wherein the NSUDS computing system is independent from the service provider computing system and the consumer computer; verifying, by the computer processor in response to the request, that the service provider computing system is associated with the NSUDS registry; connecting, by the computer processor in response to results of the verifying, the NSUDS computing system to the consumer computer; presenting, by the computer processor in response to the connecting, default sensitive user terms associated with sensitive user data for the consumer, wherein the sensitive user data is associated with the order request; and receiving, by the computer processor from the consumer in response to the default sensitive user terms, a command associated with the default sensitive user terms.
The present invention provides a negotiable content sensitive user data service (NSUDS) computing system comprising a computer processor coupled to a computer-readable memory unit, the memory unit comprising instructions that when enabled by the computer processor implement a method, the method comprising: receiving, by the computer processor from a consumer accessing a consumer computer, a request for verifying if a service provider computing system is associated with an NSUDS registry, wherein the consumer computer is communicating with the service provider computing system, wherein the consumer computer transmits an order request to the service provider computing system, wherein the NSUDS computing system is independent from the service provider computing system and the consumer computer; verifying, by the computer processor in response to the request, that the service provider computing system is associated with the NSUDS registry; connecting, by the computer processor in response to results of the verifying, the NSUDS computing system to the consumer computer; presenting, by the computer processor in response to the connecting, default sensitive user terms associated with sensitive user data for the consumer, wherein the sensitive user data is associated with the order request; and receiving, by the computer processor from the consumer in response to the default sensitive user terms, a command associated with the default sensitive user terms.
The present invention advantageously provides a simple method and associated system capable of providing a trusted source for securing information.
1. NSUDS computing system 10 manages a schedule for purging sensitive user data upon an expiration of a sensitive user term as dictated by a web consumer.
2. NSUDS computing system 10 notifies consumers when sensitive user terms are maintained.
3. NSUDS computing system 10 provides a general framework for separating sensitive user data separation from a service/product provider.
4. NSUDS computing system 10 intelligently delineates data streams and provides a separation of sensitive user data enablement and purging.
5. NSUDS computing system 10 handles the sensitive user data while a service/product provider handles an e-commerce portion of a transaction (e.g., a sale portion).
System 5 of
NSUDS computing system 10 enables a retention and management process for managing user sensitive user data used for completing an e-commerce transaction. Based on set of criteria of an operating environment (e.g., government, regulatory, legal, vendor, client, technology etc) transaction type, e-commerce vendors/companies (e.g., via provider computing systems 20a . . . 20n) are required to gather specified sensitive user data (sensitive user terms) from their clients. NSUDS computing system 10 retrieves the user sensitive user data in order to:
1. Present (i.e., to e-commerce clients) sensitive user terms and enable an opportunity for e-commerce clients to express specified preferences regarding the sensitive user data by overriding the sensitive user terms.
2. Promote a negotiation process (associated with the sensitive user terms) between the e-commerce clients and the e-commerce vendors/companies.
3. Establish a trust environment by engaging an authorized trust agency and entrust the sensitive user data management responsibilities to a third party agency. Additionally, NSUDS computing system 10 enables a high speed filter acting as an agent of a trust agency which intercepts client requests (i.e., associated with a transaction or sale). The client requests are parsed and rewritten thereby replacing sensitive user data with symbolic pointers that refer actual information. The rewritten requests are forwarded to the vendor systems (e.g., provider computing systems 20a . . . 20n) for order processing. The sensitive user data and sensitive user terms are forwarded to NSUDS computing system 10 through a secured Web service to be processed and stored in database 12. Additionally, NSUDS computing system 10 establishes a sensitive user transaction with e-commerce clients by providing special headers recognized by Web browsers thereby guarantying that the vendors are bound by an NSUDS agency agreement. The trust agency (i.e., via NSUDS computing system 10 in the form of secured web services) provides the following services:
1. Service provider or vendor registry services (e.g., add, delete, change, search vendors, etc).
2. Sensitive user data hosting and retrieval services (e.g., digital escrow).
3. Negotiation services.
4. Trust enforcement services to fulfill negotiated terms.
5. Communication services to update the status of sensitive user data to interested parties.
NSUDS computing system 10 enables a process comprising mutual negotiations between a Web user (e.g., a consumer) and a service provider (e.g., e-commerce vendors/companies) as to how long the service provider will retain (store) the web consumer's sensitive user data. A time period for retaining (i.e., by the service provider) the Web consumer's sensitive user data (e.g., credit card number, social security number, drivers license number etc) may be influenced by several factors such as, inter alia, a vendor preference, fulfillment requirements, environmental factors, government requirements, legal requirements etc. For example, a credit card number may have to be retained by a service provider for at least 30 days due to:
1. Environmental reasons—The credit card may comprise a foreign credit card requiring the credit card number to be held for 30 days.
2. Government regulations—Certain state or federal government regulations may require service providers to hold the credit card number for 2 years for various purposes.
3. Fulfillment requirements—If a purchased product is coming from another country, a longer lead time may be required and a service provider may want to retain a credit card number for a longer time period.
4. Service provider preference—A vendor may want to retain a credit card number for longer than typical periods for business analytics or due to competition practices.
If in step 214, it is determined that the consumer has declined the default sensitive user terms then the process is terminated in step 245.
If in step 214, it is determined that the consumer has accepted the default sensitive user terms then in step 222, the computer processor receives (i.e., from the consumer) the sensitive user data in accordance with the default sensitive user terms. In step 224, the computer processor transmits (i.e., to the service provider computing system) authorization (e.g., a payment and mailing address) for completing the order request resulting in a completed order for a product or service for the consumer. In step 225, the NSUDS computing system retains the sensitive user data in accordance with the default sensitive user terms and the process is terminated in step 240.
If in step 214, it is determined that the consumer would like to negotiate the default sensitive user terms then in step 218, the computer processor receives (i.e., in response to a negotiation command from the consumer) selections for modified sensitive user terms associated with the default sensitive user terms. In step 219, the computer processor determines (verifies) if the modified sensitive user terms are acceptable (e.g., in accordance with company regulations). The modified sensitive user terms may be determined to be acceptable/unacceptable by assigning the modified sensitive user terms a confidence factor. A confidence factor comprises a numeric computed empirical value that provides guidance to a Web consumer as to a sensitive user terms grading policy (e.g., should a user go ahead with a transaction).
If in step 219, the computer processor determines that the modified sensitive user terms are not acceptable (e.g., in accordance with company regulations) then in step 232, the computer processor denies changes to the default sensitive user terms (e.g., disabling the modified sensitive user terms). In step 235, the computer processor generates and transmits a new sensitive user terms request for the consumer. In step 237, the computer processor receives (from the consumer in response to the new sensitive user terms request) new selections for new modified sensitive user terms associated with the default sensitive user terms and step 227 is repeated to determine if the new selections for the new modified sensitive user terms are acceptable (e.g., in accordance with company regulations).
If in step 219, the computer processor determines (verifies) that the modified sensitive user terms are acceptable (e.g., in accordance with company regulations) then in step 227, the computer processor determines (verifies) if the modified sensitive user terms are in accordance with specified regulations (e.g., vendor preference regulations, fulfillment requirements regulations, environmental/legal regulations, government regulations, etc).
If in step 227, the computer processor determines that the modified sensitive user terms are in accordance with the specified regulations then in step 228, the computer processor modifies the default sensitive user terms in accordance with the selections for modified sensitive user terms from step 218. Modifying the default sensitive user terms may include replacing at least one of the default sensitive user terms with at least one of the modified sensitive user terms. In step 234, the computer processor receives (from the consumer) the sensitive user data. In step 236, the computer processor transmits (i.e., to the service provider computing system) authorization (e.g., a payment and mailing address) for completing the order request resulting in a completed order for a product or service for the consumer. In step 238, the NSUDS computing system retains the sensitive user data in accordance with the modified sensitive user terms and the process is terminated in step 240.
If in step 227, the computer processor determines that the modified sensitive user terms are not in accordance with the specified regulations then in step 232, the computer processor denies changes to the default sensitive user terms (e.g., disabling the modified sensitive user terms). In step 235, the computer processor generates and transmits a new sensitive user terms request for the consumer. In step 237, the computer processor receives (from the consumer in response to the new sensitive user terms request) new selections for new modified sensitive user terms associated with the default sensitive user terms and step 227 is repeated to determine if the new selections for the new modified sensitive user terms are in accordance with the specified regulations.
Generally, a computer program product (or, alternatively, an article of manufacture) of the computer system 90 may comprise the computer usable medium (or the program storage device).
Still yet, any of the components of the present invention could be created, integrated, hosted, maintained, deployed, managed, serviced, etc. by a service provider who offers to for manage and protect sensitive user information. Thus the present invention discloses a process for deploying, creating, integrating, hosting, maintaining, and/or integrating computing infrastructure, comprising integrating computer-readable code into the computer system 90, wherein the code in combination with the computer system 90 is capable of performing a method for managing and protecting sensitive user information. In another embodiment, the invention provides a method that performs the process steps of the invention on a subscription, advertising, and/or fee basis. That is, a service provider, such as a Solution Integrator, could offer to manage and protect sensitive user information. In this case, the service provider can create, maintain, support, etc. a computer infrastructure that performs the process steps of the invention for one or more customers. In return, the service provider can receive payment from the customer(s) under a subscription and/or fee agreement and/or the service provider can receive payment from the sale of advertising content to one or more third parties.
While
While embodiments of the present invention have been described herein for purposes of illustration, many modifications and changes will become apparent to those skilled in the art. Accordingly, the appended claims are intended to encompass all such modifications and changes as fall within the true spirit and scope of this invention.
