TECHNICAL FIELD

This disclosure relates generally to a system that protects against unwanted access to stored information (e.g., a user's personally identifiable information).

BACKGROUND

Users provide their information (e.g., name, address, telephone number, email address, social security number, etc.) in a variety of contexts (e.g., mortgage applications, credit card applications, financial account applications, air travel ticket orders, medical office visits, etc.). If this information were exposed to or taken by a malicious user, then the malicious user would be able to use this information to impersonate the users to conduct undesired or unwanted transactions.

SUMMARY OF THE DISCLOSURE

Users provide information (e.g., name, address, telephone number, email address, social security number, etc.) in a variety of contexts (e.g., mortgage applications, credit card applications, financial account applications, air travel ticket orders, medical office visits, etc.). If this information were exposed to or taken by a malicious user, then the malicious user would be able to use this information to impersonate the users to conduct undesired or unwanted transactions.

In conventional systems, the users have very little control over this information. The users provide their information to a provider to gain access to goods or services from the provider. The provider maintains the information (e.g., on a server). If that server were to be breached by a malicious user, the information would be exposed to the malicious user. Additionally, some providers even sell the information to other providers, often unbeknownst to the users. This sale and movement of the information further exposes the information to malicious users and lessens the control that the users have over such information.

This disclosure contemplates an unconventional system for securing information (e.g., a user's personally identifiable information (PII)). Generally, the system allows the user to store his PII on a personal device, such as a smartphone. When a third party wants to access the user's PII (e.g., to update the PII or to retrieve the PII), a notification will be presented to the user on the personal device seeking consent to the access. The notification may inform the user as to what information is being requested and which entity is requesting the access. The requested access will be denied unless the user consents to the access. In this manner, the user is given control over the dissemination of his PII. Additionally, the system alters or adjusts the PII that is stored in third-party servers so that even if these servers are breached, the user's actual PII is not exposed.

According to an embodiment, a system includes a device of a user and a token handler separate from the device. The device receives personally identifiable information the user and encrypts the personally identifiable information to produce first encrypted personally identifiable information. The token handler receives the first encrypted personally identifiable information from the device of the user, decrypts the first encrypted personally identifiable information to produce the personally identifiable information, generates a token representing the personally identifiable information, and receives the token indicating a request for the personally identifiable information. The device receives consent from the user to provide the personally identifiable information in response to the request for the personally identifiable information, in response to receiving the consent from the user, encrypts the personally identifiable information to produce second encrypted personally identifiable information, and communicates the second encrypted personally identifiable information to the token handler.

When PII is to be stored or updated, the system first seeks consent from the user for the PII store or update. If the user grants consent, then the system stores the PII in the user's personal device or updates the PII stored in the user's personal device. The system then generates a token representing the PII. The token can be presented at a later time to redeem or access the PII, subject to the user's consent. Even if the token were taken by a malicious user, it would not be possible for the malicious user to determine the user's actual PII from the token. In this manner, the security of the PII is improved over conventional systems.

According to an embodiment, a system includes a token handler and a device of a user separate from the token handler. The token handler receives, from a data originator, a request to store a user's personally identifiable information, the request to store comprising the user's personally identifiable information encrypted using a public encryption key of the token handler and inserts into a first queue the request to store. The device establishes a connection with the token handler. The token handler updates a status of the request to store in a second queue in response to determining that the device has established the connection. In response to the updated status of the request to store in the second queue and after establishing the connection, the device presents a notification message to the user seeking consent to store the user's personally identifiable information and in response to receiving the consent from the user, the device encrypts, using a salted passphrase of the user, the user's personally identifiable information encrypted using the public encryption key of the token handler to produce the user's personally identifiable information encrypted using the public encryption key of the token handler and the salted passphrase and stores the user's personally identifiable information encrypted using the public encryption key of the token handler and the salted passphrase in a local repository. The token handler, in response to determining that the device has stored the user's personally identifiable information encrypted using the public encryption key of the token handler and the salted passphrase, generates a token representing the personally identifiable information, and further updates the status of the request to store in the second queue.

When a third party wants to redeem the user's PII, the third party presents to the system the token, which indicates a request for the PII represented by the token. The system seeks consent from the user for sending the PII to the third party. If the user grants consent, then the system prepares the PII for the third party. In some embodiments, the third party can receive the PII directly from the system.

In certain embodiments, tokens are not directly accessible by third parties. Instead, when a third party wants to redeem the user's PII, the third party presents to the system anonymized data, which indicates a request for the PII used to form the anonymized data. The token handler then uses the anonymized data to select a suitable data access token.

In some embodiments, the objective of presenting anonymized data or a data access token is to obtain a service. During redemption, the PII is dispatched to a third party service to be used to make a request for that service. For example, consider an organization wishing to grant a consultant temporary access to a database when she joins that organization, and revoke that access when her employment concludes. The database is accessed by a database server and is protected by a username and a password. With the contemplated system, the organization can give the consultant temporary credentials and later revoke them without revealing or altering the true database credentials. Additionally, assume there is another server that can proxy the database server. When presented with anonymized versions of the username and password in a database query submitted by the consultant, the proxy server can look up a token to redeem the anonymized credentials for the real database credential on the employee's behalf. Subsequently, the token handler obtains the real database credentials and injects the real credentials into the database query. The proxy then submits the query to the database server for processing. Thus, the consultant gained access to the database but not access to the real database credentials. When the consultant's employment concludes, the data access token associated with her anonymized username and password is removed from the token handler. If subsequent database queries are submitted with her credentials, they will fail. In such a scenario, the PII is secrets belonging to an organization. The data access tokens are entitlements.

In an embodiment, the credentials injected into the final database query in the above example are encrypted with a public key of the database server, securing them in transit between the proxy and the database server.

In an embodiment, the token may not be associated with any data; instead, it is simply an entitlement. For example, it may represent an entitlement to activate a subscription or service, potentially a free trial to a content streaming service. In this example, the anonymized data represents a code for access to the service. That access is controlled by the token, which may be updated, replaced, deleted, or configured to expire or throttle the user's access.

According to certain embodiments, a system includes a token handler and a device separate from the token handler. The token handler receives, from a data originator, a token representing personally identifiable information and in response to receiving the token from the data originator, inserts into a first queue a request to redeem personally identifiable information of a user corresponding to the personally identifiable information. The device stores the personally identifiable information encrypted using a public encryption key of the token handler and establishes a connection with the token handler. The token handler updates a status of the request to redeem in a second queue in response to determining that the device has established the connection. In response to the status of the request to redeem in the second queue and after establishing the connection, the device presents a notification message to the user seeking consent to redeem the personally identifiable information and in response to receiving the consent from the user, the device encrypts, using a public encryption key of the data originator, the personally identifiable information encrypted using the public encryption key of the token handler to produce the personally identifiable information encrypted using the public encryption key of the token handler and the public encryption key of the data originator and communicates the personally identifiable information encrypted using the public encryption key of the token handler and the public encryption key of the data originator to the token handler.

The system further protects PII by implementing an unconventional key management scheme. In this scheme, the system uses a set of keys rather than an individual key for encrypting PII. Different portions of the PII are encrypted using different keys from the set of keys. In this manner, even if a malicious user were to access a key, that key would not give the malicious user the ability to decrypt all of the PII. Additionally, the system generates a new set of keys periodically (e.g., once a month). The system also deletes sets of keys that are too old (e.g., six months old). As a result, even if a malicious user were to access a key, the usefulness of that key would be time limited.

According to an embodiment, a token handler includes a memory and a hardware processor. The processor generates a set of public encryption keys of the token handler and communicates the set of public encryption keys of the token handler to a data originator. The processor also receives, from the data originator, a request to store a user's personally identifiable information. The request to store includes a first portion of the user's personally identifiable information encrypted using a first public encryption key of the token handler from the set and a second portion of the user's personally identifiable information encrypted using a second public encryption key of the token handler from the set. The processor further adds, to an encryption schedule, an indication that the first portion of the user's personally identifiable information was encrypted using the first public encryption key and an indication that the second portion of the user's personally identifiable information was encrypted using the second public encryption key and receives, from the data originator, a token indicating a request for redemption of the first and second portions of the user's personally identifiable information. The processor also selects, based on the encryption schedule, a first private encryption key of the token handler corresponding to the first public encryption key and decrypts, using the first private encryption key, the first portion of the user's personally identifiable information encrypted using the first public encryption key to produce the first portion of the user's personally identifiable information. The processor further selects, based on the encryption schedule, a second private encryption key of the token handler corresponding to the second public encryption key and decrypts, using the second private encryption key, the second portion of the user's personally identifiable information encrypted using the second public encryption key to produce the second portion of the user's personally identifiable information.

Certain embodiments provide one or more technical advantages. For example, an embodiment gives users more control over their PII by allowing users to give consent before access to the PII is granted. As another example, an embodiment improves the security of PII by storing the PII on a user's personal device and/or by storing tokens representing the PII on third-party servers. As yet another example, an embodiment improves the security of PII by maintaining sets of keys and by generating new sets of keys and deleting old sets of keys periodically. Certain embodiments may include none, some, or all of the above technical advantages. One or more other technical advantages may be readily apparent to one skilled in the art from the figures, descriptions, and claims included herein.

