Managing a communication session between a user device and an entity

Abstract

A method (100) is disclosed for managing a communication session between a user device and an entity. The method, performed by a privacy management node, comprises obtaining a required security level for the communication session, wherein the required security level is determined by user communication content associated with the communication session (110). The method further comprises determining whether at least one characteristic of the communication session corresponds to the required security level (120), and, if the at least one characteristic of the communication session does not correspond to the required security level, causing the at least one characteristic of the communication session to be changed such that it does correspond to the required security level (130).

Description

[0001] Managing a communication session between a user device and an entity

[0002] Technical Field

[0003] The present disclosure relates to methods for managing a communication session between a user device and an entity. The methods may be performed by a privacy management node. In some examples, the privacy management node may be instantiated in a wireless device, or may be instantiated in a server or cloud location. The present disclosure also relates to a privacy management node, and to a computer program product configured, when run on a computer, to carry out methods for managing a communication session between a user device and an entity.

[0004] Digital communication between devices has been subject to attack, and consequent security measures to prevent such attack, for decades. Transport Layer Security (TLS) is now a well-established protocol standard to protect digital communications, using cryptographically tested algorithms such as Advanced Encryption Standard (AES) and Diffie-Hellman Key Exchange (DHKE). Communication sessions including audio / visual content that may require privacy, owing for example to content of a sensitive or confidential nature, are often conducted using digital devices. It may be very difficult for a user to assess if the digital security provisions are suitable for a privacy-demanding conversation.

[0005] US 2013014266 A1 proposes a method to provide certain meeting communication tools, some of which may include privacy measures, to trusted meeting parties according to different branches, participants and / or organizational trunks of a meeting session. Privacy measures may include a visible indication that “someone less trusted is inside meeting session”. Despite systems such as that proposed in US 2013 014266 A1 , ensuring adequate privacy for sensitive conversations conducted over a digital communication channel remains an ongoing challenge.

[0006] It is an aim of the present disclosure to provide methods, a privacy management node, and a computer program product which at least partially address one or more of the challenges mentioned above. It is a further aim of the present disclosure to provide methods, a privacy management node, and a computer program product which cooperate to facilitate privacy management of a communication session taking place between a user device and an entity. In some examples the privacy management may concern at least one characteristic of the communication session.

[0007] According to a first aspect of the present disclosure, there is provided a method for managing a communication session between a user device and an entity. The method comprises obtaining a required security level for the communication session, wherein the required security level is determined by user communication content associated with the communication session. The method further comprises determining whether at least one characteristic of the communication session correspond to the required security level, and, if the at least one characteristic of the communication session does not correspond to the required security level, causing the at least one characteristic of the communication session to be changed such that it does correspond to the required security level.

[0008] According to another aspect of the present disclosure, there is provided a computer program product comprising a computer readable non-transitory medium, the computer readable medium having computer readable code embodied therein, the computer readable code being configured such that, on execution by a suitable computer or processor, the computer or processor is caused to perform a method according to any one of the aspects or examples of the present disclosure.

[0009] According to another aspect of the present disclosure, there is provided a privacy management node for managing a communication session between a user device and an entity. The privacy management node comprises processing circuitry configured to cause the privacy management node to obtain a required security level for the communication session, wherein the required security level is determined by user communication content associated with the communication session. The processing circuitry is further configured to cause the privacy management node to determine whether at least one characteristic of the communication session correspond to the required security level, and, if the at least one characteristic of the communication session does not correspond to the required security level, cause the at least one characteristic of the communication session to be changed such that it does correspond to the required security level. According to another aspect of the present disclosure, there is provided a privacy management node for managing a communication session between a user device and an entity. The privacy management node is configured to obtain a required security level for the communication session, wherein the required security level is determined by user communication content associated with the communication session. The privacy management node is further configured to determine whether at least one characteristic of the communication session corresponds to the required security level, and, if the at least one characteristic of the communication session does not correspond to the required security level, cause the at least one characteristic of the communication session to be changed such that it does correspond to the required security level.

[0010] Aspects of the present disclosure thus provide methods and nodes that enable management of privacy for a conversation taking place between a user device and an entity. In some examples the privacy management may be based upon user communication content associated with the communication session, such as audio, video or other content that is exchanged during the session, scheduled for exchange or to be made available in the session, or is otherwise associated with the session. The privacy management may concern causing at least one characteristic of the communication session to be adjusted, according to a required security level for the session that is determined by the associated user communication content. In this manner, appropriate security measures may be ensured for the content, without unnecessarily overburdening potentially limited resources.

[0011] Brief Description of the Drawings

[0012] For a better understanding of the present disclosure, and to show more clearly how it may be carried into effect, reference will now be made, by way of example, to the following drawings in which:

[0013] Figure 1a is a flow chart illustrating process steps in a method for managing a communication session between a user device and an entity; Figure 1b is a schematic illustration of a user device and entity participating in a communication session;

[0014] Figures 2a to 2d show flow charts illustrating process steps in another example of a method for managing a communication session between a user device and an entity; and

[0015] Figure 3 is a block diagram illustrating functional modules in an example privacy management node.

[0016] Detailed

[0017] Examples of the present disclosure propose methods that may be operative in a wireless device and / or in the cloud. The methods are performed by a privacy management node, which may be instantiated in a wireless device, in the cloud, or in a combination of a wireless device and a cloud or other location. The example methods and nodes described herein propose a solution that seamlessly manages online communication sessions, changing characteristics of the communication sessions according to changes in confidentiality and privacy requirements, represented as a required security level, appropriate for the communication session. The communication session may be ongoing, and changes in characteristic may for example include changing a processing platform, and or processing platform domain, on which the communication session is hosted, different platforms and / or domains having different trust levels.

[0018] The assessment of a security level required for the communications session may be based on real-time user communication content (communication data), such as audio, video, text-transcriptions of audio and / or video, meeting chat text stream, application data, etc. generated by participants in an online communication session, or in advance of such a session. For example, the required security level may be determined using Natural Language Understanding (NLU) and / or Natural Language Processing (NLP), image processing, etc. and may in some examples be based on individual or a consecutive stream of trigger words (spoken, chat text stream), a number of trigger words during a certain time period, images, other type of meeting audio (such as replay of audio-video stream inside meeting, other type of shared media, etc.) or combinations thereof. In one example, as discussed in greater detail below, consecutive user communication content or data generated by participants in an online communication session may be assessed by one or more privacy management nodes running on any or all of the user devices used to access the communication session, and / or in the cloud. The communication session may be executed on a processing platform with a first trust level. During the communication session a consecutive stream of trigger words (spoken, written chat text, etc.), images, other types of in-meeting audio / video, or combinations thereof from at least one participant may trigger a requirement for a higher security level. Any or all of the devices accessing the communication session may identify this trigger, and may do so in combination, for example via a negotiation. This trigger results in initiation of a seamless transfer of the communication session to another processing platform with a second trust level that is higher than the first trust level.

[0019] Figure 1a is a flow chart illustrating process steps in a method 100 for managing a communication session between a user device 101 and an entity102. The user device 101 and entity 102 of the method 100 of Figure 1a are illustrated schematically in Figure 1 b, participating in a communication session. The user device may in some examples be a wireless device. The entity may also be a user device, or in some examples may be a server or other logical or physical entity operable to participate in a communication session. The method is performed by a privacy management node 103, which may comprise a physical or virtual node, and may be instantiated at least partially in the user device 101 , which may be a wireless device, in the entity 102, and / or in a computer system, computing device or server apparatus and / or in a virtualized environment, for example in a cloud, edge cloud, an Open Radio Access Network, O-RAN, or fog deployment. Examples of a virtual node may include a piece of software or computer program, a code fragment operable to implement a computer program, a virtualised function, or any other logical entity. The privacy management node may encompass multiple logical entities, which may be instantiated in different locations.

[0020] Referring to Figure 1a, the method 100 comprises, in step 110, obtaining a required security level for the communication session, wherein the required security level is determined by user communication content associated with the communication session. According to examples of the present disclosure, user communication content that is associated with the communication session may include user communication content that is exchanged during the communication session, that is pre identified or scheduled to be exchanged during the communication session, and / or that will be made available or become accessible during the communication session.

[0021] In step 120, the method 100 comprises determining whether at least one characteristic of the communication session corresponds to the required security level. In step 130, if the at least one characteristic of the communication session does not correspond to the required security level, the method 100 comprises causing the at least one characteristic of the communication session to be changed such that it does correspond to the required security level. According to examples of the present disclosure, the at least one characteristic of the communication session may be found not to correspond to the required security level by offering either a lower or a higher level of security than that which is required. Causing the characteristic to be changed such that it does correspond to the required security level may therefore ensure that the required level of security is provided, but not exceeded. In this manner, examples of the method 100 may also ensure that communication platforms, domains and other resources that provide a greater level of security are prioritised for those communication sessions that require them, and are not clogged up by communication sessions for which lower security platforms or resources would be acceptable. As discussed in further detail below with reference to Figures 2a to 2d, in some examples, a privacy management node carrying out methods according to the present disclosure may also perform user communication content assessment to determine the required security level, or may receive the required security level, for example from a content assessment node that may be running on a user device or within the entity.

[0022] It will be appreciated that while in many examples, a privacy management node carrying out the method 100 may be instantiated in the user device itself, such that the method 100 is performed in the user device, it may be that at least some of the method could be performed in a location other than the user device, and / or the method may be performed in the entity. The privacy management node could for example be a virtual node comprising multiple logical entities, and while it could be running entirely on the user device and / or on the entity, one or more of if its logical entities could be instantiated in a communication network, for example in a cloud or edge cloud deployment. As discussed above, the entity participating in the communication session could be another user device or could be a logical entity such as a server, a service, an application, an loT device, or other. Figures 2a to 2d show flow charts illustrating another example of a method 200 for managing a communication session between a user device and an entity. As for the method 100 discussed above, the method 200 is performed by a privacy management node, which may comprise a physical or virtual node, and may be instantiated at least partially in the user device, in the entity, in a computer system, computing device or server apparatus and / or in a virtualized environment, for example in a cloud, edge cloud, an Open Radio Access Network, O-RAN, or fog deployment. Examples of a virtual node may include a piece of software or computer program, a code fragment operable to implement a computer program, a virtualised function, or any other logical entity. The privacy management node may encompass multiple logical entities, which may be instantiated in different locations. The method 200 illustrates examples of how the steps of the method 100 may be implemented and supplemented to provide the above discussed and additional functionality.

[0023] Referring initially to Figure 2a, in a first step 210, the privacy management node obtains a required security level for the communication session, wherein the required security level is determined by user communication content associated with the communication session. As illustrated at 210a, this may comprise determining the security level from user communication content associated with the communication session, or may comprise receiving the security level from a content assessment node. For example, in some circumstances, the user communication content may be End-to-End (E2E) encrypted. If the privacy management node is instantiated in the user device or the entity, then it may be in a position to assess the user communication content, and determine a required security level. However, if the privacy management node is at least partially instantiated in the cloud or another location outside of the user device or entity, then the privacy management node may be unable to assess the user communication content and determine a required security level for the communication session. In other examples, if the determination of required security level is being performed in advance of the communication session, then the privacy management node may not have access to user communication content that is scheduled to be made available in the session. In such examples, the user device and / or entity may be provided with a content assessment node, operable to assess user communication content and determine a required security level for the communication session, and the privacy management node may receive the required security level from the content assessment node. As illustrated at 210ai, determining a required security level for the communication session may comprise at least one of using Natural Language Processing (NLP) or image processing to assess the user communication content associated with the communication session. In some examples, as illustrated at 210aii, determining a required security level for the communication session may comprise inspecting a location from which the user communication content associated with the communication session is accessed. For example, if user communication content that is scheduled to be made available during the communication session is saved in a secure location, this may indicate that a higher level of security is required for the communication session in which that content will be shared.

[0024] As illustrated at 210aiii, determining a required security level for the communication session may comprise classifying the user communication content with respect to a security level and selecting the required security level based on the classification. In some examples, one or more classification factors may be extracted from the content and / or the content’s logical or physical location, and those factors may be evaluated against a classification policy that maps the various factors to a required security level. The classification factors could include keywords, a number of times a particular keyword is repeated, a number of keywords within a sliding (configurable) time window, specific storage locations for content requested by a user over the session (e.g., seeking to access enterprise servers or information subject to particular privacy requirements), etc. The factors could also include specific trigger words or phrases that a user could employ to deliberately trigger a higher required security level.

[0025] In some examples, it may be envisaged that different trigger conditions could be used for increasing required security as opposed to reducing required security. For example, the sliding window for a number of keywords may be shorter when triggering a security level increase, such that a threshold number of keywords in a relatively short sliding window might trigger an increase in required security level, whereas an absence of keywords in a much longer sliding window may be required in order to reduce the required security level.

[0026] As illustrated at 210aiv, in some examples, determining a required security level of the communication session may comprise receiving a user input security level. For example, a user may manually require a certain security level for a communication session during which the user knows that sensitive content will be shared. In some examples, the user may request this security level using a specific functionality, or in other examples the user may deliberately use a plurality of key words, a predetermined trigger word, or other audio, haptic, or other cues to request or enforce a given required security level.

[0027] As discussed above, and illustrated at 210b, the user communication content, on the basis of which the required security level is determined, may comprise at least one of: audio content, video content, text content, image content, and / or application data associated with the communication session. The content may be prepared for the session ahead of time, generated and / or input to the session by a user associated with the user device, generated and / or input to the communication session by the entity with which the session is established, or in any other way made available to or accessible via the communication session, and may also include data that describes content that will be made available during the communication session, such as an agenda, summary documents transcripts, etc. For example, a user might access their work servers during a communication session, so the entity participating in the communication session provides content in the form of database access, or access to other enterprise software or accounts, and this may cause the privacy management node, or a content assessment node, to determine that a higher security level should be required for the communication session. As discussed in further detail below, this may include requiring access over a secured connection, and refusing access via an untrusted Wi-Fi hotspot.

[0028] As illustrated at 210c, in some examples, the required security level for the communication session may be specific to a time period during the communication session. The time period may be fixed or open, and may for example be expressed simply as a start time, as a start and end time, or as a start time and duration.

[0029] Referring now to Figure 2b, the privacy management node then determines, in step 220, whether at least one characteristic of the communication session corresponds to the required security level. Different examples of the at least one characteristic are illustrated in steps 220a to 220d.

[0030] In some examples, as illustrated at 220a, the communication session may be hosted over a communication platform, and the at least one characteristic of the communication session may comprise a characteristic of the communication platform. In some examples, the characteristic of the communication platform may comprise a platform domain of the communication platform. As illustrated at 220b, in some examples, the at least one characteristic of the communication session may comprise a communication protocol used by the communication session.

[0031] As illustrated at 220c, in some examples, the at least one characteristic of the communication session may comprise an encryption requirement for user communication content associated with the communication session.

[0032] As illustrated at 220d, in still further examples, the at least one characteristic of the communication session may comprise storage of user communication content associated with the communication session.

[0033] Referring now to Figure 2c, in step 230, if the at least one characteristic of the communication session does not correspond to the required security level, the privacy management node causes the at least one characteristic of the communication session to be changed such that it does correspond to the required security level.

[0034] In some examples, the privacy management may for example evaluate the at least one characteristic against a security policy that maps the various characteristics to a security level provided by the characteristic. The privacy management node may then compare the provided security level with the required security level for the communication session.

[0035] As illustrated at step 230ai, if the characteristic of the communication platform comprises a platform domain of the communication platform, causing the at least one characteristic of the communication session to be changed such that it does correspond to the required security level may comprise transferring the communication session to a different platform domain of the communication platform. The different platform domain may be associated with different security features to the original platform domain of the communication session, and these security features may be operable to provide the required security level. The security features may provide a greater or lesser degree of security than that offered by the original platform domain. In some examples, the different platform domain of the communication platform may comprise at least one of an enterprise domain, a public domain, a residential domain, and / or an ad-hoc domain. An ad-hoc domain may for example comprise a domain according to which the current users involved in the communication session are able to access the content afterwards, but no others.

[0036] According to some examples, the transfer to the different domain may be a transfer for example between enterprise domains having different security levels, or from a public or residential domain to an enterprise domain, or from an enterprise domain to a public or residential domain, or to or from an ad-hoc domain, etc.

[0037] As illustrated at 230aii if the characteristic of the communication platform comprises a platform domain of the communication platform, causing the at least one characteristic of the communication session to be changed such that it does correspond to the required security level may comprise transferring the communication session to a different communication platform. The different communication platform may be associated with different security features to the original communication platform over which the communication session was conducted, and these security features may be operable to provide the required security level. The security features may provide a greater or lesser degree of security than that offered by the original platform domain. Transferring the communication session to a different communication platform may comprise terminating the session in the first communication platform and re-starting the communication session in the different communication platform. The different communication platforms may comprise at least one of an enterprise communication platform, a public communication platform, and / or a private communication platform.

[0038] As illustrated at 230b, if the at least one characteristic of the communication session comprises a communication protocol used by the communication session, causing the at least one characteristic of the communication session to be changed such that it does correspond to the required security level may comprise transferring to a different communication protocol.

[0039] As illustrated at 230c, if the at least one characteristic of the communication session comprises an encryption requirement for user communication content associated with the communication session, causing the at least one characteristic of the communication session to correspond to the current security level may comprise requiring the user device to use or to not use end-to-end encryption. As illustrated at 230d, if the at least one characteristic of the communication session comprises storage of user communication content associated with the communication session, causing the at least one characteristic of the communication session to correspond to the current security level may comprise requiring user communication content associated with the communication session to be stored in a location with restricted access. In some examples, this may apply to any content shared before or during the communication session (documents, images etc.) as well as any recording or transcript of the communication session that is generated during and / or after the session. In some examples, such content may be segmented according to changes in the required security level during the communication session. For example, parts of a meeting transcript that correspond to a meeting time at which the required security level was relatively low may be stored in a location accessible for example by anyone in an enterprise network. In contrast, parts of a meeting transcript that correspond to a meeting time at which the required security level was relatively high may be stored in a location accessible only to specific profiles within an enterprise network. The restriction on access to the location may be digital restriction, for example only allowing access to users with a particular user profile, or to users who participated in the communication session. In other examples, the restriction may also or alternatively include physical access restrictions, for example relating to the server hardware on which the digital location is hosted.

[0040] As illustrated at 230e, in some examples, causing the at least one characteristic of the communication session to correspond to the current security level may comprise terminating and re-starting the communication session.

[0041] Referring now to Figure 2d, in some examples the privacy management node may, in step 240, determine whether a preparation phase condition is fulfilled by the communication session. Steps 240a to 240c illustrate different options for the preparation phase condition. As illustrated at 240a, the preparation phase condition may comprise a detected trend in user communication content.

[0042] As illustrated at 240b, the preparation phase condition may comprise a required security level determined from user communication content scheduled for exchange during the communication session being different to a required security level determined from user communication content currently being exchanged during the communication session. As illustrated at 240c, the preparation phase condition may comprise the at least one characteristic of the communication session not corresponding to the required security level, and an amount of time required to cause the at least one characteristic of the communication session to be changed such that it does correspond to the required security level being above a preparation threshold. Thus, if it is determined that a change in characteristic is to be caused but that change will take a certain amount of time (over a preparation threshold), then the preparation phase condition may be fulfilled.

[0043] It will be appreciated that the trend in user communication content and / or the required security level for scheduled content may be determined in a manner similar to that discussed above for the required security level. For example, the trend or future required security level may be determined on the basis of a number of keywords detected during a sliding window, etc.

[0044] In step 250, if the preparation phase condition is fulfilled by the communication session, the privacy management node may initiate a preparation action in the communication session. As illustrated at 250a, the preparation action may comprise at least one of notifying communication session participants, interrupting the communication session, causing at least one communication session characteristic to be changed, and / or causing a change in a communication session characteristic to be prepared.

[0045] Examples of characteristics of the session that can be changed during a preparation phase may include muting microphones and / or speakers, temporarily suspending the display or playback of video or audio content, etc. Preparing a communication session characteristic change might include for example preparing a second communication platform, or preparing resources to enable a change in processing or storage resources for the communication session.

[0046] Figures 1a, 1b, and 2a to 2d discussed above provide an overview of methods which may be performed by a privacy management node according to different examples of the present disclosure. The methods enable security management of a communication session, including for example changing platform, domain, encryption requirements, storage locations, and / or server attributes such as digital session processing depending on the user communication content associated with the session, in some examples this content may be assessed also with respect to the user participating in the communication session. Dynamic switching of processing platform, attributes, and / or other characteristics can be triggered by user communication content associated with the communication session, including for example selected attributes of spoken topics. The switch may be to a more secure communication session, or to a less secure session.

[0047] It may be the case that some security requirements impose greater or lesser infrastructure requirements and / or processing cost for a given communication session. For example, that high security may require additional protocol overhead, encryption and decryption, more costly or expensive server management. In addition, that some topics may require in-house local compute that may be more scarce but also more costly compared to other commercially available lower security solutions. Examples of the present disclosure ensure that such additional resources are not used for a communication session that no longer requires them. For example, a high security requirement may initially be determined for a communication session on the basis of content scheduled for exchange in the session, and an agenda available before the session starts. However, once the initial business of the meeting is concluded, the communication session participants may then discuss other matters requiring a lower security level. Aspects of the present disclose ensure that this lower security requirement is recognized, and changes are made such that the security level offered by the communication session is appropriate to that required.

[0048] As discussed above, the methods 100 and 200 are performed by a privacy management node, and the present disclosure provides a privacy management node that is adapted to perform any or all of the steps of the above discussed methods. The privacy management node may comprise a physical node such as a computing device, server etc., or may comprise a virtual node. A virtual node may comprise any logical entity, such as a Virtualized Network Function (VNF) which may itself be running in a cloud, edge cloud or fog deployment. In some examples, the privacy management node is instantiated at least partially in the user device, and the present disclosure also provides a user device comprising a privacy management node as disclosed herein. In other examples, the privacy management node may be instantiated in a physical or virtual server in a centralised or cloud based deployment.

[0049] Figure 3 is a block diagram illustrating an example privacy management node 300 which may implement the method 100 and / or 200, as illustrated in Figures 1a, 1b, and 2a to 2d, according to examples of the present disclosure, for example on receipt of suitable instructions from a computer program 350. Referring to Figure 3 the privacy management node 300 comprises a processor or processing circuitry 302, and may comprise a memory 304 and interfaces 306. The processing circuitry 302 is operable to perform some or all of the steps of the method 100 and / or 200 as discussed above with reference to Figures 1a, 1b, and 2a to 2d. The memory 304 may contain instructions executable by the processing circuitry 302 such that the privacy management node 300 is operable to perform some or all of the steps of the method 100 and / or 200, as illustrated in Figures 1a, 1 b, and 2a to 2d. The instructions may also include instructions for executing one or more telecommunications and / or data communications protocols. The instructions may be stored in the form of the computer program 350. In some examples, the processor or processing circuitry 302 may include one or more microprocessors or microcontrollers, as well as other digital hardware, which may include digital signal processors (DSPs), special-purpose digital logic, etc. The processor or processing circuitry 302 may be implemented by any type of integrated circuit, such as an Application Specific Integrated Circuit (ASIC), Field Programmable Gate Array (FPGA) etc. The memory 304 may include one or several types of memory suitable for the processor, such as read-only memory (ROM), random-access memory, cache memory, flash memory devices, optical storage devices, solid state disk, hard disk drive, etc. The privacy management node 300 may further comprise interfaces 306, which may be operable to facilitate communication with a communication network node, content assessment node, and / or other nodes, over suitable communication channels.

[0050] There now follows a detailed discussion of how different process steps illustrated in Figures 1a to 2d and discussed above may be implemented. The functionality and implementation detail described below is discussed with reference to the privacy management node of Figure 3 performing examples of the methods described herein.

[0051] In one example scenario, a person-person conversation may be occurring over a digital communication platform such as Teams, Skype or Zoom. Typically, the meeting managing server may be either public or private, in the sense that information and / or media associated with the conversation are “secure” or “open” and / or that certain security policies apply.

[0052] According to the user content of the conversation, including for examples the topics discussed and any images, video or other files shared during the conversation, it may be determined that a meeting context of the conversation is changing towards something of a more confidential nature, and consequently that a need for a secure session / link has arisen, or that the media session should be terminated and re-initiated / re-stared later on using other communication means (meeting platform, domain, etc.). A typical scenario might include a work meeting that initially involves discussing general (not confidential) topics such as office seating and coffee machine procurements, but later moves to discussing, for example Intellectual Property Rights or confidential company data. Example methods according to the present disclosure can identify such a conversational drift, and ensure that the characteristics of the communication session are suitable to provide the required level of security for the new conversational topic (for example moving to another platform, using other media interface(s), etc.)

[0053] Example implementations of the methods disclosed herein may involve:

[0054] A first communication application, and a first user at first device, in a digital communication session with a second user (over an application hosted by a second device). The first or second users may comprise server entities.

[0055] At least one managing server entity (for example Microsoft Teams or the like) running meeting application for the first and second users.

[0056] A privacy management node running at least partially on either or both user devices, and / or in the cloud.

[0057] A content assessment mechanism (which functionality may be included within or external to a privacy management node) located either in managing server and / or first / second devices.

[0058] The content assessment mechanism (steps 110, 210, 210a, 210ai-210aiv of methods 100, 200) may: assess users’ spoken content and transcribe into text (using for example available tools such as Amazon Web Services Comprehend or similar) classify users’ communication with respect to content, for example by identifying key words such as “invention”, “annual report”, etc. determine a relation of the user-spoken communication content to one or more security levels, and classify the content as requiring a certain security level, e.g., from content metadata, which might for example be “public” or “confidential”, or might be a numeric representation indicating how confidential the conversation is. The classification may apply for some time-duration and / or ratio of confidential-keywords / ”all words” (i.e. speech being determined sufficiently confidential during sufficiently long / consecutive time, etc.) provide the privacy management node with the security level required for the ongoing meeting session, and if applicable, with the determined start-time or time duration.

[0059] The privacy management node may (methods 100, 200): receive a security level associated with a time instance of an ongoing digital meeting session, such as “high / confidential” or “low / public” determine whether the required security level is provided by the current characteristics of the communication session if not, determine a change in characteristic that would cause the communication session to comply with the required confidentiality level. The characteristic may include, inter alia, processing platform (on-premises, external, ...) node communication interface, type of protocol,

[0060] E2E encryption requirement (On / off, algorithm X) media session recording attributes, storage areas for respective high / low security segments, etc. activation / de-activation (time) hysteresis cause the determined characteristic to be applied, for example: apply a “new” setting when / if a change from public / confidential, confidential / public, low / high, etc. occurs consider a hysteresis A going from higher to lower security, and a hysteresis B going from lower to higher security, where hystA / hystB are selected so that transition from lower to higher is triggered faster than in the opposite direction the privacy management node may also apply further actions for privacy preservation to be active during an expected execution delay of previous actions (preparation phase). These actions may include: stalling a meeting during a platform or protocol swap muting participants’ microphones and / or speakers audio / visual participant notations, e.g. sound, blinking application graphics, etc.

[0061] Multiple managing server entities (step 130, 230 of methods 100, 200)

[0062] In some examples, assuming at least two server entities offering different levels of security, a main managing server may handle communication sessions requiring a higher level of security, and the main managing server may offload less demanding (lower required security level) digital meeting sessions to a sever offering a lower level of security. Such offloaded sessions may be transferred to (or back to) the main managing server if the user communication content of those session indicates an increase in the required security level.

[0063] Preparation Phase (steps 240, 250 of method 200)

[0064] In some examples the transition between content requiring different security levels may be difficult to identify. A preparation phase may in such examples allow for the initiation of certain actions as a precursor to session characteristic change that may be required once a change in required security level has been determined. A preparation phase may for example be triggered by a trend in spoken topics, content, keywords and sentiment. In some examples, a combination of thresholds (a compound metric) may be used as a condition for entering a preparation phase. An example compound metric may include:

[0065] Time t1 : [topicA> 0.80, topicB> 0.90, sentinetX> 0.93]

[0066] Time t3: [topicA> 0.85, topicB> 0.92, sentinetX> 0.92]

[0067] Time t4: [topicA> 0.90, topicB> 0.91 , sentinetX> 0.94]

[0068] Time t5: [topicA> 0.95, topicB> 0.90, sentinetX> 0.92]

[0069] A trend of spoken topic(s) can be observed form the above metric towards Topic A. A preparation phase condition might specify that a trend toward Topic A is detected and that the trend has been detected during N consecutive time instances.

[0070] In further examples, a preparation phase condition, used to trigger a preparation phase and associated action(s), might take into account any written content not yet fully shared in the communication, e.g. all slides in a presentation being shared, or the entire text in a document being shared. Shared in this context may refer to sharing over a video stream in the communication session. The analysis of the content may be carried out by a privacy management node or content assessment node that is running on the device of the user sharing the content, if the device has full access to the entire material (prior to the material being disclosed in meeting). In other examples, the analysis of the content may be carried out e.g. in the meeting managing server when possible, such in the case of “power-point live” sharing in Microsoft Teams.

[0071] Preparation phase actions, which may be carried out once a preparation phased is entered (on fulfilment of a preparation phase condition), may include: stalling meeting media processing (this may be applied for example prior to a characteristic change such as a platform, domain or server swap) muting participants’ microphones or speakers audio / visual participant notations, e.g. sound, blinking application graphics, etc. preparation of characteristic change such as preparation of resources, a higher security platform, etc. This preparation may be in anticipation of a coming change in required security level, or following a change in required security level, as discussed below.

[0072] Selection of appropriate preparation phase actions may be guided by identified topic security level, such that a trend towards a particularly high security topic may trigger an action to stall the session during a certain time period, whereas a trend towards a lower security level topic may simply trigger an audio / visual indication to session participants.

[0073] It will be appreciated that the preparation phase can be entered when a change in required security level has been determined, but the actions to change one or more session characteristics require a certain execution time that is above a threshold duration. In such examples, preparation phase actions can be applied while waiting for the characteristic change(s) to be implemented.

[0074] Enter / exit hysteresis (steps 110, 210 of methods 100, 200)

[0075] As discussed above, hysteresis may be used for executing trigger conditions. For example, if a specific keyword has been detected once, that may be insufficient to trigger a change in security requirement, or a preparation phase. However, if “key word density > thresholdT’ is detected during some time-to-trigger duration periodl , actions may be triggered. Similarly, if a current topic is detected to be going out of key word range (“key word density < threshold2” is detected during some other time-to-trigger duration period2). this may also trigger a change in security level requirement.

[0076] Time-to-trigger duration periods periodl and period2 may be subject to security level, duration of discussion, fraction of uttered key / trigger words (and their respective security level), participating persons, participating persons talk rhythms, participating persons relative talk times, etc. In some examples, the hysteresis may be triggered by explicit phrases which trigger a new evaluation of the confidentiality level. For example, it may be that a lower confidentiality level can only be established if users actively trigger a new evaluation.

[0077] Session content storage (step 230d of method 200)

[0078] In some examples, user communication content shared in a communications session, including for example recordings or transcripts of the meeting, may be segmented in relation to the required security level at the time the content was shared in the session. This segmenting of content, including recordings, may be subject to an additional trigger, such as a highest level security requirement being determined during the session, or a change of required security level being determined during the session. The segmented content may then be stored with access requirements appropriate to the required security level in effect at the time the content was shared. Thus, for example, recorded segments of “no-keyword part(s)” of the meeting session may be stored with access attributes A, whereas “keyword part(s) of session” may be stored with access attributes B.

[0079] Initialization (step 210b of method 200)

[0080] In further examples of the present disclosure, the classification of the user communication content may be assisted by any text written prior to (or during) the communication, such as in a chat or in a call for a meeting. This information may be used to set an initial required security level, and / or to initiate the assessment of content shared live in the session such as user-spoken communication content. This may include for example starting a key-word trigger count. In still further examples, a user may trigger a higher security level manually, for example when they know that there is an imminent context switch of topics discussed, from open to confidential topics. It will be appreciated that user communication content includes all content associated with a communication session. Thus, in addition to spoken content, other in-meeting shared media objects such as audio and / or video may trigger security level transitions of the meeting. For example, if a video file is played during the meeting, then audio content of the video, including keywords, may trigger security level transitions of the meeting in same manner as words spoken by meeting participants.

[0081] Examples of the present disclosure thus provide methods and nodes that offer a dynamic solution to privacy management of a communication session. In some examples, meeting communication infrastructure, setup and / or security attributes may be managed and / or changed according to a transition in user communication content associated with the meeting (i.e., shared into the meeting, spoken in the meeting, scheduled for exchange during the meeting, etc.). The transition may be between content that is not subject to privacy or security requirements (suitable for a private or public domain) and content that is subject to privacy or security requirements (suitable only for a more secure corporate or enterprise domain)

[0082] A content transition may for example be determined by identifying a threshold number of particular keywords, such as for example “patent”, “business asset”, “new product launch”, which may be classified at high confidentiality level, whereas casual everyday words such as “kids”, “grocery store”, “lunch” may be classified as a lower confidentiality level. One or more confidentiality protecting actions may be initiated following a detected transition, for example to move the meeting session from a low-trust processing platform to a higher-trust processing platform. In further examples, additional confidential preserving actions can be initiated during preparation and execution time for an action such as a change of processing platform. These additional actions may include for example, changing node communication interface, changing type of protocol E2E encryption requirement, changing media session recording attributes, changing storage areas for respective high / low security segments, activation / de-activation (time) for hysteresis, etc.

[0083] The methods of the present disclosure may be implemented in hardware, or as software modules running on one or more processors. The methods may also be carried out according to the instructions of a computer program, and the present disclosure also provides a computer readable medium having stored thereon a program for carrying out any of the methods described herein. A computer program embodying the disclosure may be stored on a computer readable medium, or it could, for example, be in the form of a signal such as a downloadable data signal provided from an Internet website, or it could be in any other form. It should be noted that the above-mentioned examples illustrate rather than limit the disclosure, and that those skilled in the art will be able to design many alternative embodiments without departing from the scope of the appended claims or numbered embodiments. The word “comprising” does not exclude the presence of elements or steps other than those listed in a claim or embodiment, “a” or “an” does not exclude a plurality, and a single processor or other unit may fulfil the functions of several units recited in the claims or numbered embodiments. Any reference signs in the claims or numbered embodiments shall not be construed so as to limit their scope.

Claims

CLAIMS1. A method (100) for managing a communication session between a user device and an entity, the method, performed by a privacy management node, comprising: obtaining a required security level for the communication session, wherein the required security level is determined by user communication content associated with the communication session (110); determining whether at least one characteristic of the communication session correspond to the required security level (120); and if the at least one characteristic of the communication session does not correspond to the required security level, causing the at least one characteristic of the communication session to be changed such that it does correspond to the required security level (130).

2. The method as claimed in claim 1, wherein obtaining a required security level for the communication session comprises at least one of (210a): determining the security level from user communication content associated with the communication session; or receiving the security level from a content assessment node.

3. The method as claimed in claim 1 or 2, wherein the user communication content comprises at least one of: audio content, video content, text content, image content, and / or application data associated with the communication session (210b).

4. The method as claimed in any one of the preceding claims, wherein the required security level for the communication session is specific to a time period during the communication session (210c).

5. The method as claimed in any one of claims 2 to 4, wherein determining a required security level for the communication session comprises at least one of: using Natural Language Processing, NLP, or image processing to assess the user communication content associated with the communication session (210ai).

6. The method as claimed in any one of claims 2 to 5, wherein determining a required security level for the communication session comprises:inspecting a location from which the user communication content associated with the communication session is accessed (21 Oaii).

7. The method as claimed in any one of claims 2 to 6, wherein determining a required security level for the communication session comprises classifying the user communication content with respect to a security level and selecting the required security level based on the classification (21 Oaiii).

8. The method as claimed in any one of claims 2 to 7, wherein determining a required security level of the communication session comprises receiving a user input security level (210av).

9. The method as claimed in any previous claim, wherein the communication session is hosted over a communication platform, and wherein the at least one characteristic of the communication session comprises a characteristic of the communication platform (220a).

10. The method of claim 9, wherein the characteristic of the communication platform comprises a platform domain of the communication platform (220a), and wherein causing the at least one characteristic of the communication session to be changed such that it does correspond to the required security level comprises: transferring the communication session to a different platform domain of the communication platform (230ai).

11. The method as claimed in claim 9, wherein the different platform domain of the communication platform comprises at least one of (230ai): an enterprise domain; a public domain; a residential domain; an ad-hoc domain.

12. The method of any one of claims 9 to 11 , wherein causing the at least one characteristic of the communication session to be changed such that it does correspond to the required security level comprises: transferring the communication session to a different communication platform (230aii).

13. The method as claimed in claim 12, wherein the different communication platform comprises at least one of (230aii): an enterprise communication platform; a public communication platform; a private communication platform.

14. The method as claimed in any previous claim, wherein the at least one characteristic of the communication session comprises a communication protocol used by the communication session (220b), and wherein causing the at least one characteristic of the communication session to be changed such that it does correspond to the required security level comprises transferring to a different communication protocol (230b).

15. The method as claimed in any previous claim, wherein the at least one characteristic of the communication session comprises an encryption requirement for user communication content associated with the communication session (220c), and wherein causing the at least one characteristic of the communication session to correspond to the current security level comprises requiring the user device to use or to not use end-to-end encryption (230c).

16. The method as claimed in any previous claim, wherein the at least one characteristic of the communication session comprises storage of user communication content associated with the communication session (220d), and wherein causing the at least one characteristic of the communication session to correspond to the current security level comprises requiring user communication content associated with the communication session to be stored in a location with restricted access (230d).

17. The method as claimed in any previous claim, wherein causing the at least one characteristic of the communication session to correspond to the current security level comprises terminating and re-starting the communication session (230e).

18. The method of any previous claim, further comprising: determining whether preparation phase condition is fulfilled by the communication session (240); andif the preparation phase condition is fulfilled by the communication session, initiating a preparation action in the communication session (250).

19. The method of claim 18, wherein the preparation phase condition comprises at least one of: a detected trend in user communication content (240a); a required security level determined from user communication content scheduled for exchange during the communication session being different to a required security level determined from user communication content currently being exchanged during the communication session (240b); the at least one characteristic of the communication session does not correspond to the required security level, and an amount of time required to cause the at least one characteristic of the communication session to be changed such that it does correspond to the required security level is above a preparation threshold (240c).

20. The method of claims 18 or 19, wherein the preparation action comprises at least one of (250a): notifying communication session participants; interrupting the communication session; causing at least one communication session characteristic to be changed; causing a change in a communication session characteristic to be prepared.

21. A computer program product comprising a computer readable medium, the computer readable medium having computer readable code embodied therein, the computer readable code being configured such that, on execution by a suitable computer or processor, the computer or processor is caused to perform a method as claimed in any one of claims22. A privacy management node (300) for managing a communication session between a user device and an entity, the privacy management node comprising processing circuitry (302) configured to cause the privacy management node to: obtain a required security level for the communication session, wherein the required security level is determined by user communication content associated with the communication session; determine whether at least one characteristic of the communication session correspond to the required security level; andif the at least one characteristic of the communication session does not correspond to the required security level, cause the at least one characteristic of the communication session to be changed such that it does correspond to the required security level.

23. A privacy management node (300) as claimed in claim 22, wherein the processing circuitry (302) is further configured to cause the privacy management node to perform a method as claimed in any one of claims 2 to 20.

24. A privacy management node (103) for managing a communication session between a user device and an entity, the privacy management node (103) configured to: obtain a required security level for the communication session, wherein the required security level is determined by user communication content associated with the communication session; determine whether at least one characteristic of the communication session correspond to the required security level; and if the at least one characteristic of the communication session does not correspond to the required security level, cause the at least one characteristic of the communication session to be changed such that it does correspond to the required security level.

25. A privacy management node (103) as claimed in claim 24, wherein the privacy management node (103) is further configured to perform a method as claimed in any one of claims 2 to 20.

26. A wireless device (101) comprising a privacy management node as claimed in any one of claims 22 to 25.

Images