CALL FOR PRIOR ART: (Uniloc) Personal Control of Personal Information

Question

Information

• App Number: 13/586,057
• Publication Number: US 20130055357 A1
• Assignee: Uniloc Luxembourg S.A.
• Prior Art Cutoff Date: predating August 15, 2010

Summary: A personal information server provides personal information about an individual to a third-party only when authorized by the individual through use of a previously authenticated computing device. The personal information server authenticates both the computing device used by the third-party to access the personal data and the device used by the individual to grant or deny such access using highly secure digital fingerprints of each. The individual can allow the third-party multiple instances of access to the personal information within restrictions specified by the individual. Other advantages also arise from large-scale tracking of which devices access and control personal information of many people--particularly with respect to identifying and preventing fraud and identity theft.

Claim 1 recites:

A method for controlling access to personal information about an individual, the method comprising: receiving data from a third-party device through a computer network that represents a request for the personal information about the individual and that includes a digital fingerprint of the third-party device; sending data representing notification of the request for the personal information of the individual to the individual; receiving authorization data that indicates whether the individual intends to grant the request for the personal information of the individual and a digital fingerprint of a device from which the authorization data is sent; and upon a condition in which both (i) the authorization data indicates that the individual intends to grant the request for the personal information of the individual and (ii) the digital fingerprint of the authorization data matches a digital fingerprint of at least one predetermined authorized device, sending the personal information to the third-party device.

Claim 11 recites:

A computer system comprising: at least one processor; a computer readable medium that is operatively coupled to the processor; network access circuitry that is operatively coupled to the processor; and personal information server logic (i) that executes in the processor from the computer readable medium and (ii) that, when executed by the processor, causes the computer to control access to personal information about an individual by at least: receiving data from a third-party device through a computer network that represents a request for the personal information about the individual and that includes a digital fingerprint of the third-party device; sending data representing notification of the request for the personal information of the individual to the individual; receiving authorization data that indicates whether the individual intends to grant the request for the personal information of the individual and a digital fingerprint of a device from which the authorization data is sent; and upon a condition in which both (i) the authorization data indicates that the individual intends to grant the request for the personal information of the individual and (ii) the digital fingerprint of the authorization data matches a digital fingerprint of at least one predetermined authorized device, sending the personal information to the third-party device.

Sample Figures

WHY IT MATTERS: The primary claim to uniqueness of the personal information server described in this application relates to the ability of the individual to fully control who has access to the personal information.

QUESTION: Have you seen anything that was published before August 15, 2010 that describes claim 1 or claim 11, especially a personal information server that gives an individual full control over what other entities have access to personal information about the individual?

If so, please submit evidence of that prior art as an answer below. Please submit only one piece of prior art per answer below. We welcome multiple prior art proposals from the same individual; please create separate answers for each one. This is so the community can vet each individual piece of prior art independently.

For details about what makes good prior art, please see our FAQ. Once you have submitted prior art, check back soon to see if the Ask Patents community have chosen your prior art to be submitted to the United States Patent & Trademark Office.

If you'd like to contribute in another way, please vote or comment on submissions made below. And we welcome you to post your own request for prior art if you know of another questionable patent or patent application.

Answer 1

Here's a patent application that was published in Jan 2010 that seems very relevant:

US 20100015975 A1 - "Profile service for sharing rights-enabled mobile profiles" https://www.google.com/patents/US20100015975

From the abstract:

In general, each user defines a user profile and associated access rights, where the user profile and access rights are stored by or accessible to a profile service. When a voice session, or call, is initiated between a first and second user, a device of the first user requests a profile of the second user from the profile service. In response, the profile service determines whether the first user has been granted access rights to the user profile of the second user. If so, the profile service provides the user profile of the second user, or a portion thereof, to the device of the first user according to the access rights of the first user, and the user profile is presented to the first user.

This one does not appear to disclose "digital fingerprinting" of devices, but fingerprinting of devices is an old topic, so there must be some pretty early references for that which could be combined with this one for a 103-type rejection.

Answer 2

The authorization of data and access permissions seems very close to OpenID/OAuth which have been around since about 2005:

https://en.wikipedia.org/wiki/OAuth and https://en.wikipedia.org/wiki/OpenID

Those systems allow to share data between your profile and any third party and implement control of which parts. I remember Google's implementation of OAuth using this for a long time already.

Answer 3

This sounds like the Chip Authentication Program (CAP):

http://en.wikipedia.org/wiki/Chip_Authentication_Program

I use CAP when I purchase things on the internet. When I click the "buy" button on a web site, the third party (eg Amazon) sends a request for my personal information to my bank; the bank sends me a notification of the request in my browser window; I am required to respond with a 4 digit confirmation code to indicate that i intend to grant the request for my personal information; the autorization code includes a digital fingerprint from the hardware device shown in the wikipedia article; the bank acts upon that information and may send my personal information to the third party and withdraw funds from my account.

The personal information controlled by the CAP system includes but is not limited to:

• whether i have sufficient funds to purchase the item(s)
• my full name and other identifying information
• my address
• information for taxation purposes (eg national insurance number)
• information for fraud and identity theft prevention purposes

Answer 4

I registered a website early 2011 "payformy.info" (http://www.networksolutions.com/whois/results.jsp?domain=payformy.info) and was speaking to investors in 2010 about the same concept in 2010, prior to this filing. Does this help in any way? Steph van Schalkwyk