US-12619748-B2 - End-to-end privacy ecosystem

Abstract

A system includes one or more privacy vaults. At least one of the one or more privacy vaults is associated with at least one individual user, stores contents associated with the associated at least one individual user, and stores specific identification of a plurality of third-party entities, authorized to access at least a portion of the contents stored by the one or more privacy vaults, along with access permissions, one or more of the access permissions defined for each of the plurality of third-party entities. At least one of the access permissions defines accessibility of the contents for at least one of the plurality of third-party entities for which the at least one access permission is defined.

Inventors

• Marvin Lu
• Timothy W. Gibson
• Thomas J. Wilson
• Aleksandr Likhterman
• Raja Sekhar THIRUVATHURU

Assignees

• ALLSTATE INSURANCE COMPANY

Dates

Publication Date

20260505

Application Date

20231222

Claims (20)

1. 1 . A system comprising: one or more privacy vaults, wherein at least one of the one or more privacy vaults: is associated with at least one individual user; stores contents associated with the associated at least one individual user, the contents reflective of digitally trackable user activity; and stores specific identification of a plurality of third-party entities, authorized to access at least a portion of the contents stored by the one or more privacy vaults, along with access permissions, one or more of the access permissions defined for each of the plurality of third-party entities, wherein at least one of the access permissions defines accessibility of the contents, for at least one of the plurality of third-party entities and wherein one or more of the identified third party entities has an access permission assigned thereto; and one or more processors configured to: analyze, for the at least one user, each of the one or more identified third-party entities having an access permission assigned thereto, to correlate characteristics of each analyzed third-party entity with a particular access permission respectively assigned to each analyzed third-party entity; devise, based at least in part on the correlated characteristics, a model for application of at least one access permission aspect for a new third party entity, defined to be applied based at least in part on third-party entity characteristics having correlations, in the model, to one or more aspects of the access permission including at least one of: one or more access permissions for contents, one or more retention permissions for content, one or more deletion requirements for content, or one or more use permissions for content.
2. 2 . The system of claim 1 , wherein the digitally trackable user activity includes at least one of: personal information, browsing history, website interactions, digitally-maintained account activity, digitally-recorded relationships, digital purchase activity, email contents, digital records of travel information, or digitally trackable device usages.
3. 3 . The system of claim 2 , wherein the digitally trackable activity is indicative of at least one of: spending habits, eating habits, travel habits, browsing habits, daily routines, user privacy settings, or prior user response to permission modifications suggested by the devised policy.
4. 4 . The system of claim 1 , wherein the analysis includes determining a relationship type, based on a predefined plurality of possible relationship type definitions, applicable to a relationship between the at least one user and each respective one of the one or more analyzed third party entities.
5. 5 . The system of claim 4 , wherein at least one of the third party entity characteristics having the correlation to the one or more aspects of the access permission includes the relationship type.
6. 6 . The system of claim 1 , wherein the one or more processors are further configured to: receive identification of the new third-party as a third-party entity for which an access permission is to be defined; determine applicable characteristics, based on the third-party entity characteristics defined in the model, of the new third-party entity; determine corresponding aspects of the access permissions that the model indicates should be applied to the new third-party based on the new third-party entity having the new third-party entity characteristics; create a new access permission for application to the new third-party entity based on the corresponding aspects of the access permissions; present, to the at least one user, the new access permission as a suggested access permission, including at least one characteristic of the new third party and at least one aspect of the permission correlated to the at least one characteristic; receive user feedback indicating at least one of acceptability of application of the permission, acceptability of the at least one characteristic as a usable characteristic, or acceptability of the correlation between the at least one characteristic and the at least one aspect; and modify the devised model in light of the user feedback to correspondingly increase or decrease a stored strength of relationship, between the at least one characteristic and the at least one aspect, which affects whether the at least one aspect should be applied to a different new third party when the different new third party has the at least one characteristic.
7. 7 . The system of claim 6 , wherein, responsive to the feedback indicating acceptability of application of the permission, the one or more processors are further configured to apply the suggested access permission as the access permission assigned to the new third party entity.
8. 8 . A system comprising: one or more privacy vaults, wherein at least one of the one or more privacy vaults: is associated with at least one individual user; stores contents associated with the associated at least one individual user, the contents reflective of digitally trackable user activity; and stores specific identification of a plurality of third-party entities, authorized to access at least a portion of the contents stored by the one or more privacy vaults, along with access permissions, one or more of the access permissions defined for each of the plurality of third-party entities, wherein at least one of the access permissions defines accessibility of the contents, for at least one of the plurality of third-party entities and wherein one or more of the identified third party entities has an access permission assigned thereto; and one or more processors configured to: analyze, for the at least one user, each of the one or more identified third-party entities having an access permission assigned thereto, to correlate characteristics of each analyzed third-party entity with a particular access permission respectively assigned to each analyzed third-party entity; devise, based at least in part on the correlated characteristics, a model for application of at least one access permission aspect for a new third party entity, defined to be applied based at least in part on third-party entity characteristics having correlations, in the model, to one or more aspects of the access permission including at least one of: one or more access permissions for contents, one or more retention permissions for content, one or more deletion requirements for content, or one or more use permissions for content; receive identification of the new third-party as a third-party entity for which an access permission is to be defined; determine applicable characteristics, based on the third-party entity characteristics defined in the model, of the new third-party entity; determine corresponding aspects of the access permissions that the model indicates should be applied to the new third-party based on the new third-party entity having the new third-party entity characteristics; create a new access permission for application to the new third-party entity based on the corresponding aspects of the access permissions; and apply the suggested access permission as the access permission assigned to the new third party entity.
9. 9 . The system of claim 8 , wherein the digitally trackable user activity includes at least one of: personal information, browsing history, website interactions, digitally-maintained account activity, digitally-recorded relationships, digital purchase activity, email contents, digital records of travel information, or digitally trackable device usages.
10. 10 . The system of claim 9 , wherein the digitally trackable activity is indicative of at least one of: spending habits, eating habits, travel habits, browsing habits, daily routines, user privacy settings, or prior user response to permission modifications suggested by the devised policy.
11. 11 . The system of claim 8 , wherein the analysis includes determining a relationship type, based on a predefined plurality of possible relationship type definitions, applicable to a relationship between the at least one user and each respective one of the one or more analyzed third party entities.
12. 12 . The system of claim 11 , wherein at least one of the third party entity characteristics having the correlation to the one or more aspects of the access permission includes the relationship type.
13. 13 . The system of claim 8 , wherein the one or more processors are further configured to: present, to the at least one user, the new access permission as a suggested access permission, including at least one characteristic of the new third party and at least one aspect of the permission correlated to the at least one characteristic; receive user feedback indicating at least one of acceptability of application of the permission, acceptability of the at least one characteristic as a usable characteristic, or acceptability of the correlation between the at least one characteristic and the at least one aspect; and modify the devised model in light of the user feedback to correspondingly increase or decrease a stored strength of relationship, between the at least one characteristic and the at least one aspect, which affects whether the at least one aspect should be applied to a different new third party when the different new third party has the at least one characteristic.
14. 14 . The system of claim 6 , wherein, the application the suggested access permission as the access permission assigned to the new third party entity is further responsive to the feedback indicating acceptability of application of the permission.
15. 15 . A system comprising: one or more privacy vaults, wherein at least one of the one or more privacy vaults: is associated with at least one individual user; stores contents associated with the associated at least one individual user, the contents reflective of digitally trackable user activity; and stores specific identification of a plurality of third-party entities, authorized to access at least a portion of the contents stored by the one or more privacy vaults, along with access permissions, one or more of the access permissions defined for each of the plurality of third-party entities, wherein at least one of the access permissions defines accessibility of the contents, for at least one of the plurality of third-party entities and wherein one or more of the identified third party entities has an access permission assigned thereto; and one or more processors configured to: analyze, for the at least one user, each of the one or more identified third-party entities having an access permission assigned thereto, to correlate characteristics of each analyzed third-party entity with a particular access permission respectively assigned to each analyzed third-party entity; devise, based at least in part on the correlated characteristics, a model for application of at least one access permission aspect for a new third party entity, defined to be applied based at least in part on third-party entity characteristics having correlations, in the model, to a plurality of aspects of the access permission including: one or more access permissions for contents, one or more retention permissions for content, one or more deletion requirements for content, and one or more use permissions for content; receive identification of the new third-party as a third-party entity for which an access permission is to be defined; determine applicable characteristics, based on the third-party entity characteristics defined in the model, of the new third-party entity; determine corresponding aspects of the access permissions that the model indicates should be applied to the new third-party based on the new third-party entity having the new third-party entity characteristics; create a new access permission for application to the new third-party entity based on the corresponding aspects of the access permissions; and apply the suggested access permission as the access permission assigned to the new third party entity.
16. 16 . The system of claim 15 , wherein the digitally trackable user activity includes at least one of: personal information, browsing history, website interactions, digitally-maintained account activity, digitally-recorded relationships, digital purchase activity, email contents, digital records of travel information, or digitally trackable device usages.
17. 17 . The system of claim 16 , wherein the digitally trackable activity is indicative of at least one of: spending habits, eating habits, travel habits, browsing habits, daily routines, user privacy settings, or prior user response to permission modifications suggested by the devised policy.
18. 18 . The system of claim 15 , wherein the analysis includes determining a relationship type, based on a predefined plurality of possible relationship type definitions, applicable to a relationship between the at least one user and each respective one of the one or more analyzed third party entities.
19. 19 . The system of claim 18 , wherein at least one of the third party entity characteristics having the correlation to the one or more aspects of the access permission includes the relationship type.
20. 20 . The system of claim 15 , wherein the one or more processors are further configured to: present, to the at least one user, the new access permission as a suggested access permission, including at least one characteristic of the new third party and at least one aspect of the permission correlated to the at least one characteristic; receive user feedback indicating at least one of acceptability of application of the permission, acceptability of the at least one characteristic as a usable characteristic, or acceptability of the correlation between the at least one characteristic and the at least one aspect; and modify the devised model in light of the user feedback to correspondingly increase or decrease a stored strength of relationship, between the at least one characteristic and the at least one aspect, which affects whether the at least one aspect should be applied to a different new third party when the different new third party has the at least one characteristic.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS This application is a continuation-in-part of U.S. application Ser. No. 18/164,223, filed Feb. 3, 2023, which is a continuation of U.S. application Ser. No. 17/587,799 filed Jan. 28, 2022, now U.S. Pat. No. 11,599,652, issued Mar. 7, 2023, which, in turn, claims the benefit of U.S. provisional application Ser. No. 63/239,215 filed Aug. 31, 2021, the disclosure of which is hereby incorporated in its entirety by reference herein. TECHNICAL FIELD The illustrative embodiments generally relate to an end-to-end privacy ecosystem. BACKGROUND Digital user privacy, consumer data collection and data monetization are becoming ever-more prevalent issues in modern society. Computing devices, software, hardware, and websites continually gather data on users to build profiles, offer advertisements, and plan strategies. Many times, users are not even aware of what data is being gathered and how that data is being used, and software or websites may frequently offer services in exchange for data, such as a “free” search engine or social media site that exchanges services for gathering of user data. For a long time, users were willing to accept these services in exchange for the data, believing the data to be limited in scope, the use and business-to-business sharing of the data to be limited in scope, or being unaware of the true value of their personal data in the aggregate. The financial success of these services, predicated largely on data, has revealed some of the true value of user data. At the same time, data gathering and processing has grown much more sophisticated, allowing for the unlocking of significant value in large data sets about individual users and groups of users. Problematically, users have already often agreed to have this data gathered and enjoy using the free services. Moreover, users still frequently have no idea as to what data is or was gathered about them. Far more than a simple location or demographic, these data sets can range far and wide, and user behavior itself is often monitored and compiled into complex evaluations of what that user represents in terms of merchant or advertiser opportunity. At the same time, there are limited opportunities to determine what data has been gathered and how the data is being used, and most frequently the impact and scope is observed anecdotally, where a user continually sees advertisements, for example, that appear to be highly targeted. The scope of data is also hinted at when software provides recommendations and seems almost prescient in its understanding of what the user would like. While many users may not object to the targeted and precise nature of at least some of these incidents, and may even welcome them in some cases, such as a requested and subsequently on-point recommendation, many users may ultimately be somewhat disturbed at the scope and scale of their own personal information stored and used to assemble these offerings. But, since users can never see the backend data store, and since they typically lack granular control over data, and/or notification when and what data is specifically gathered, people tend to remain somewhat blissfully ignorant, even if they would be distressed if they saw the volume of personal information being gathered, understood the value of what they were exchanging, and understood the full scope of the conclusions that were being drawn about them. Because it may be rare that the user's data is used exclusively to provide a requested and subsequently on-point recommendation, consumers may ultimately prefer a solution that provides better optics into usage, consumer-centric control and permissioning of such usage and value-sharing opportunities related to a consumer's personal information. SUMMARY In a first illustrative embodiment, a system includes one or more privacy vaults, wherein at least one of the one or more privacy vaults is associated with at least one individual user, stores contents associated with the associated at least one individual user, and stores specific identification of a plurality of third-party entities, authorized to access at least a portion of the contents stored by the one or more privacy vaults, along with access permissions, one or more of the access permissions defined for each of the plurality of third-party entities, at least one of the access permissions defining accessibility of the contents for at least one of the plurality of third-party entities for which the at least one access permission is defined. The system further includes one or more processors configured to provide gateway services for accessing contents stored by the one or more privacy vaults, including handling access requests, for contents from the one or more privacy vaults, wherein an access request, from the at least one third-party entity, is handled in accordance with at least one of the access permissions defined for the at least one third-party entity in each of a plurality o