Systems and Methods for Joint Privacy Management

Abstract

Systems and methods for joint privacy management are disclosed. In one embodiment, a method for joint privacy management may include: (1) receiving, at a user management node and from a client application executing on an electronic device, a device identifier; (2) receiving, by the user management node from a second layer node in a multi-layer joint privacy management network, data including at least one of browsing data and application data from a web host or server, wherein the data is in response to an Internet Protocol request from the client application via a first layer node and the second layer node to the web host or server, and the data is associated with the device identifier; (3) receiving, at the user management node, a request for the data from the client application using the device identifier; and (4) transmitting the data to the client application.

Description

Technical Field

[0001] Embodiments generally relate to systems and methods for joint privacy management. Background Art

[0002] To protect the privacy of users of online activities such as browsing and application usage, entities providing such services must access the data traffic itself. Thus, users must trust that the entity will not misuse their personal data, rather than trusting the web host or application server to do so. This effectively just transfers the users' trust from one place to another. Summary of the Invention

[0003] Systems and methods for joint privacy management are disclosed. In one embodiment, a method for joint privacy management may include: (1) receiving, at a user management node and from a client application executing on an electronic device, a device identifier; (2) receiving, by the user management node, from a second layer node in a multi-layer joint privacy management network, data including at least one of browsing data and application data from a web host or server, wherein the data is in response to an Internet Protocol request from the client application via a first layer node and the second layer node to the web host or server, and the data is associated with the device identifier; (3) receiving, at the user management node, a request for the data from the client application using the device identifier; and (4) transmitting the data to the client application.

[0004] In one embodiment, the data from the second layer node may include at least one of browsing data and application data from a web host or server.

[0005] In one embodiment, the first layer node may receive an Internet Protocol request and a first IP address associated with the electronic device from the client application, may convert the first IP address into a second IP address, and may transmit the Internet Protocol request and the second IP address to the second layer node.

[0006] In one embodiment, the second layer node may perform a privacy service on the Internet Protocol request.

[0007] In one embodiment, the privacy service may include packet inspection, device fingerprint obfuscation, web security, anti-malware application activity, recording of browsing / application history, etc.

[0008] In one embodiment, the second layer node may convert the second IP address into a third IP address, and may transmit the Internet Protocol request and the third IP address to the web host or server.

[0009] In one embodiment, a private key for a client application can be used to encrypt data.

[0010] In one embodiment, the second-layer nodes can include multiple second-layer nodes.

[0011] In one embodiment, the method can further include: receiving registration information from a client application at a user management node; requesting a rights token from a first-layer node or a second-layer node by the user management node; receiving the rights token from the user management node and the first-layer node or the second-layer node; and transmitting the rights token by the user management node to the client application, wherein the client application registers with the first-layer node or the second-layer node using the rights token.

[0012] According to another embodiment, a method for federated privacy management can include: (1) receiving, by a user management node, data from a second-layer node in a multi-layer federated privacy management network, the data being associated with a session identifier, wherein the data can be in response to an Internet Protocol request from a client application via a first-layer node and the second-layer node to a web host or server; (2) receiving, at the user management node, a request for the data using the session identifier from the client application; and (3) transmitting the data to the client application.

[0013] In one embodiment, the data from the second-layer node can include at least one of browsing data and application data from a web host or server.

[0014] In one embodiment, a first-layer node can receive an Internet Protocol request and a first IP address associated with an electronic device from a client application, can convert the first IP address into a second IP address, and can transmit the Internet Protocol request and the second IP address to a second-layer node.

[0015] In one embodiment, a second-layer node can perform a privacy service on the Internet Protocol request.

[0016] In one embodiment, the privacy service can include packet inspection, device fingerprint obfuscation, web security, anti-malware application activity, recording of browsing / application history, etc.

[0017] In one embodiment, a second-layer node can convert the second IP address into a third IP address, and can transmit the Internet Protocol request and the third IP address to a web host or server.

[0018] In one embodiment, data can be encrypted using the private key of the client application.

[0019] In one embodiment, the second-layer nodes can include multiple second-layer nodes.

[0020] In one embodiment, the method may further include: receiving registration information from a client application at a user management node; requesting a rights token from a first-layer node or a second-layer node by the user management node; receiving the rights token from the user management node and the first-layer node or the second-layer node; and transmitting the rights token by the user management node to the client application, wherein the client application registers with the first-layer node or the second-layer node using the rights token.

[0021] According to another embodiment, a system for federated privacy management may include: a multi-layer federated privacy management network including a first-layer node and a second-layer node; a user management node communicatively coupled to at least one of the first-layer node and the second-layer node; and a client application executed by an electronic device. The user management node may receive a device identifier of the electronic device from the client application. The first-layer node may receive an Internet protocol request and a first IP address associated with the electronic device from the client application, may convert the first IP address into a second IP address, and may transmit the Internet protocol request and the second IP address to the second-layer node. The second-layer node may convert the second IP address into a third IP address and may transmit the Internet protocol request and the third IP address to a web host or server. The second-layer node may receive data including at least one of browsing data and application data from the web host or server, and may associate it with the device identifier or a session identifier, and may transmit the data and the association with the device identifier or the session identifier to the user management node. The user management node may receive the data and store the data. The user management node may receive a request for the data from the client application using the device identifier or the session identifier. The user management node may transmit the data to the client application.

[0022] In one embodiment, the second-layer node may further perform a privacy service on the Internet protocol request, the privacy service including at least one of packet inspection, device fingerprint obfuscation, web security, anti-malware application activity, recording of browsing / application history, etc.

[0023] In one embodiment, the system may further include a plurality of second-layer nodes. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] To facilitate a more comprehensive understanding of the present invention, reference is now made to the accompanying drawings. The drawings should not be construed as limiting the present invention, but are merely intended to illustrate different aspects and embodiments.

[0025] Figure 1A and Figure 1B depicts a system for federated privacy management according to an embodiment;

[0026] Figure 2 depicts a system for joint privacy management according to another embodiment; and

[0027] Figure 3 depicts a method for joint privacy management according to an embodiment. DETAILED DESCRIPTION

[0028] Embodiments relate to systems and methods for joint privacy management.

[0029] In an embodiment, the processing of online browsing or application data can be distributed among multiple independent nodes at multiple levels of a privacy management network. Each node may have different and independent responsibilities, and no node can access all of an individual's personal data and / or online browsing or application data. One or more nodes can be controlled by a user management node.

[0030] Reference Figure 1A and Figure 1B , a system for joint privacy management is provided according to an embodiment. The system can include a client electronic device 110 that executes a client application 115, multiple nodes 120, 130, 140 (e.g., user management node 140, first layer node 120, second layer node 130), a web host or server 160, and a network connection 150 (e.g., Internet connection) between one of the nodes (e.g., second layer node 130) and the web host or server 160.

[0031] In an embodiment, the client application 115 can communicate with the user management node 140, which can provide user management services. In one embodiment, the user management node 140 can maintain the true user identity and can manage the user interface, experience, and / or billing, etc. The user's browsing or application data may not be visible to the user management node 140.

[0032] In one embodiment, the user management node 140 can receive the device identifier of the electronic device 110 through the client application 115. In one embodiment, the device identifier can be associated with the electronic device 110 (e.g., serial number, device fingerprint, etc.), and it can be generated by the operating system, the client application 115, etc. Any suitable device identifier can be used as needed and / or desired.

[0033] The user management node 140 can interact with the second layer node 130 ( Figure 1A ) or the first layer node 120 ( Figure 1B ) to obtain a rights token or the like. For example, after the client application 115 contacts the user management node 140, the user management node 140 can obtain from the first layer node 120 (Figure 1B ) or the second - layer node 130( Figure 1A ) requests a rights token or the like, and the user management node 140 can return the rights token or the like to the client application 115. The rights token can allow the client application 115 to access the first - layer node 120( Figure 1B ) or the second - layer node 130( Figure 1A ) for initial registration purposes.

[0034] In one embodiment, the rights token can expire after a certain amount of time or can expire after it has been used. For example, the rights token can be valid for a long enough time for a user to register with the first node layer 120 or the second node layer 130.

[0035] The client application 115 can use the rights token or the like to register with the first - layer node 120 or the second - layer node 130, and the first - layer node 120 or the second - layer node 130 can collect and retain the device identifier of the client application 115 and use it as authorization for future data traffic through browsing or using the application.

[0036] The client application 115 can hold a key, such as a private key.

[0037] The client application 115 can route data traffic (e.g., browsing data, application data, etc.) to the first - layer node 120. The first - layer node 120 can receive the data traffic from the client application 115 having a first IP address (i.e., IP1), and can provide a pass - through, where the data traffic leaving the first - layer node 120 is associated with a second IP address (i.e., IP2).

[0038] The first - layer node 120 can route the data traffic to the second - layer node 130, and the second - layer node 130 can provide data privacy services (e.g., packet inspection, device fingerprint obfuscation, web security, anti - malware application activities, recording of browsing / application history, etc.). In one embodiment, the privacy services can be associated with a user reference, such as a reference to the user, device (e.g., device identifier), etc. The data traffic can leave the second - layer node 130 associated with a third IP address (IP3).

[0039] As Figure 2 shown, multiple second - layer nodes 1301, 1302, …… 130 n . For example, in response to an Internet protocol request from the client application, the first - layer node can invoke multiple second - layer nodes (e.g., second - layer node 1 1301, second - layer node 2 1302, …… second - layer node n 130 n) to perform the data privacy service. Thus, each second-layer node 1301, 1302, …… 130 n may be exposed to or contain only a part of the browsing / application history of the client application 115.

[0040] The first-layer node 120 may select one or more of the second-layer nodes 1301, 1302, …… 130 n in any suitable manner. For example, it may randomly select the second-layer nodes 1301, 1302, …… 130 n , it may select in rotation (e.g., the first request goes to the second-layer node 1 1301, the second request goes to the second-layer node 2 1302, etc.), it may switch periodically (e.g., it uses the second-layer node 1 1301 for a certain number of interactions or a period of time, and then switches to the second-layer node 2 1302, etc.).

[0041] The second-layer node 130 may receive data from the web host or server 160 and may store the data in the database 135. In one embodiment, the second-layer node 130 may use the public key of the client application 115 to encrypt the data.

[0042] The second-layer node database 135 may store browsing history, application data (including application data from the web host or server 160), etc., and may encrypt the data with the public key of the client application 115. The second-layer node 130 may store the encrypted data in the database 145. In one embodiment, the data may be associated with the session identifier of the session established by the client application 115 and the first-layer node 120 or the second-layer node 130.

[0043] Reference Figure 3 , according to one embodiment, provides a method for joint privacy management.

[0044] In step 305, the user may register with the user management node through the client application to use the privacy service. The user management node may know the true user identity of the user.

[0045] In one embodiment, the user management node may capture the device identifier of the electronic device on which the client application is executed. Any suitable device identifier may be used as needed and / or desired.

[0046] In step 310, the user management node may verify the user. For example, the user management node may perform know-your-customer verification and / or any other suitable verification as needed and / or desired.

[0047] In step 315, the user management node may request a rights token or a similar identifier from a first - layer node or a second - layer node. In one embodiment, the rights token may indicate that the user is authorized to use the routing service of the first - layer node or the privacy management service of the second - layer node.

[0048] In step 320, the first - layer node or the second - layer node may return the rights token to the user management node, and in step 325, the user management node may transmit the rights token to the client application.

[0049] In step 330, the client application may use the rights token to request registration from the first - layer node or the second - layer node, and in step 335, the first - layer node or the second - layer node may register the client application. In one embodiment, the first - layer node and / or the second - layer node may store the device identifier of the device that executes the client application or the user's device.

[0050] In one embodiment, as part of the registration process, the client application may provide its public key to the first - layer node or the second - layer node. The user management node may also provide the client's public key to the first - layer node or the second - layer node during the rights request in step 315.

[0051] In step 340, the client application may establish a session with the second - layer node, and the second - layer node may return a session identifier to the client application.

[0052] In one embodiment, the session identifier may not be used.

[0053] In one embodiment, if multiple second - layer nodes for use are provided, the first - layer node may select one of the second - layer nodes for the session. In one embodiment, the first - layer node may select the second - layer node in any suitable manner, such as randomly, by rotation, periodic switching, etc. Each second - layer node may relay its respective session identifier back to the client application through the first - layer node.

[0054] In step 345, the client application may submit an Internet protocol (e.g., HTTP, HTTPS, HTTP / 2, QUIC, etc.) request to the first - layer node having a first IP address. In one embodiment, the first IP address may be the IP address of the electronic device that hosts the client application.

[0055] In step 350, the first - layer node may convert the first IP address into a second IP address and may route the Internet protocol request to the selected second - layer node. For example, the first - layer node may replace the first IP address with the second IP address.

[0056] In step 355, the second-layer node may perform one or more privacy services on the Internet Protocol request, such as packet inspection, device fingerprint obfuscation, web security, anti-malware application activities, recording of browsing / application history, etc. The second-layer node may translate the second IP address and use the third IP address for browsing. Any suitable method for translating the second IP address may be used as needed and / or desired.

[0057] In another embodiment, the second-layer node may translate the second IP address into a third IP address instead of fabricating the second IP address.

[0058] In step 360, the second-layer node may interact with a web host or server via the Internet using the third IP address. The second-layer node may receive data from the web host or server.

[0059] In step 365, the second-layer node may encrypt some, all of the user's browsing and / or application data or not encrypt the user's browsing and / or application data using the public key of the client application, which includes data from the web host or server, and in step 370, may push the encrypted browsing and / or application data to the user management node using the device identifier and / or session identifier. If the device identifier is used to push data, the user management node will know the client application associated with the data. If the session identifier is used to push data, the user management node will not know the client application associated with the session identifier until the client application requests the data associated with the session identifier.

[0060] In step 375, the client application may request the encrypted browsing / application history from the user management node using the session identifier and / or device identifier, and the user management node may provide the encrypted data to the client application.

[0061] In step 380, the client application may decrypt the encrypted browsing and / or application data using the private key of the client application.

[0062] Hereinafter, general aspects of the implementation of the system and method of the embodiments will be described.

[0063] An embodiment of a system or a part of a system may be in the form of a "processor", such as a general-purpose computer. As used herein, the term "processor" should be understood to include at least one processor using at least one memory. The at least one memory stores an instruction set. The instructions may be stored permanently or temporarily in one or more memories of the processor. The processor executes the instructions stored in one or more memories to process data. The instruction set may include various instructions for performing one or more specific tasks, such as those tasks described above. Such an instruction set for performing a specific task may be characterized as a program, a software program, or simply software.

[0064] In one embodiment, the processor may be a dedicated processor.

[0065] As described above, the processor executes the instructions stored in one or more memories to process data. Such processing of the data may, for example, be in response to commands from one or more users of the processor, in response to previous processing, in response to a request from another processor, and / or any other input.

[0066] As described above, the processor for implementing an embodiment may be a general-purpose computer. However, the above-described processor may also utilize any of a variety of other technologies, including dedicated computers, computer systems including, for example, microcomputers, minicomputers, or mainframes, programmed microprocessors, microcontrollers, peripheral integrated circuit elements, CSICs (customer-specific integrated circuits) or ASICs (application-specific integrated circuits), or other integrated circuits, logic circuits, digital signal processors, programmable logic devices (e.g., FPGAs, PLDs, PLAs, or PALs), or any other device or arrangement of devices capable of implementing the steps of the processes disclosed herein.

[0067] The processor for implementing an embodiment may utilize a suitable operating system. Thus, embodiments may include running the iOS operating system, the OS X operating system, the Android operating system, the Microsoft Windows TM (Microsoft Windows) operating system, the Unix operating system, the Linux operating system, the Xenix operating system, the IBM AIX TM operating system, the Hewlett-Packard (HP) UX TM operating system, the Novell Netware TM operating system, the Sun Microsystems Solaris TM operating system, the OS / 2T TM operating system, the BeOS TM operating system, the Macintosh operating system, the Apache operating system, OpenStep TMA processor of an operating system or another operating system or platform.

[0068] It should be understood that, in order to practice the methods of the embodiments described above, the processor and / or memory of the processor need not be physically located in the same geographical location. That is, each of the processor and memory used by the processor can be located in geographically different locations and connected so as to communicate in any suitable manner. Additionally, it should be understood that each of the processor and / or memory can be composed of different physical components. Thus, the processor need not be a single piece of equipment in one location and the memory be another single piece of equipment in another location. That is, it is contemplated that the processor can be two pieces of equipment located in two different physical locations. The two different pieces of equipment can be connected in any suitable manner. Additionally, the memory can include two or more portions of the memory in two or more physical locations.

[0069] For further explanation, as described above, the processing is performed by various components and various memories. However, it should be understood that, according to another embodiment, as described above, the processing performed by two different components can be performed by a single component. Additionally, as described above, the processing performed by one different component can be performed by two different components.

[0070] In a similar manner, according to another embodiment, as described above, the memory storage performed by two different memory portions can be performed by a single memory portion. Additionally, as described above, the memory storage performed by one different memory portion can be performed by two memory portions.

[0071] Furthermore, various techniques can be used to provide communication between various processors and / or memories and to allow the processors and / or memories to communicate with any other entity; that is, for example, in order to obtain further instructions or to access and use remote memory storage. Such techniques for providing such communication may include, for example, networks, the Internet, intranets, extranets, local area networks, Ethernet, wireless communication via cellular towers or satellites, or any client-server system that provides communication. Such communication techniques can use any suitable protocol, such as TCP / IP, UDP, or OSI.

[0072] As described above, instruction sets can be used in the processing of the embodiments. The instruction sets can be in the form of a program or software. The software can be, for example, in the form of system software or application software. The software can also be, for example, in the form of a collection of individual programs, program modules within a larger program, or a part of a program module. The software used may also include modular programming in the form of object-oriented programming. The software tells the processor how to process the data being processed.

[0073] In addition, it should be understood that the instructions or instruction sets used in the implementation and operation of the embodiments may be in a suitable form such that the processor can read the instructions. For example, the instructions forming the program may be in the form of an appropriate programming language, which is converted into machine language or object code to allow one or more processors to read the instructions. That is, the written lines of programming code or source code in a particular programming language are converted into machine language using a compiler, assembler, or interpreter. Machine language is binary-coded machine instructions that are specific to a particular type of processor (i.e., for example, a particular type of computer). A computer understands machine language.

[0074] According to various embodiments, any suitable programming language may be used. Illustratively, the programming language used may include, for example, assembly language, Ada, APL, Basic, C, C++, COBOL, dBase, Forth, Fortran, Java, Modula-2, Pascal, Prolog, REXX, Visual Basic, and / or JavaScript. In addition, it is not necessary to utilize a single type of instruction or a single programming language in connection with the operation of the system and method. Rather, any number of different programming languages may be utilized as needed and / or desired.

[0075] Similarly, the instructions and / or data used in the practice of the embodiments may utilize any compression or encryption technology or algorithm as needed. An encryption module may be used to encrypt the data. In addition, for example, an appropriate decryption module may be used to decrypt a file or other data.

[0076] As described above, the embodiments may illustratively be embodied in the form of a processor (including, for example, a computer or computer system) that includes at least one memory. It should be understood that, as needed, the instruction set (i.e., software, for example) that enables a computer operating system to perform the above operations may be included on any one of a variety of one or more media. In addition, the data processed by the instruction set may also be included on any one of a variety of one or more media. That is, the particular medium (i.e., the memory in the processor) for storing the instruction set and / or data used in the embodiments may, for example, take any of a variety of physical forms or transmissions. Illustratively, the medium may be in the form of paper, paper transparency, optical disc, DVD, integrated circuit, hard disk, floppy disk, optical disc, magnetic tape, RAM, ROM, PROM, EPROM, wire, cable, optical fiber, communication channel, satellite transmission, memory card, SIM card, or other remote transmission, and any other medium or data source that may be read by a processor.

[0077] In addition, one or more memories used in the processors implementing the embodiments may be in any of a variety of forms to allow the memory to store instructions, data, or other information as needed. Thus, the memory may take the form of a database to store data. The database may use any desired file arrangement, such as a flat file arrangement or a relational database arrangement.

[0078] In the system and method, various "user interfaces" may be utilized to allow a user to interface with one or more processors used to implement the embodiments. As used herein, a user interface includes any hardware, software, or combination of hardware and software used by a processor that allows a user to interact with the processor. The user interface may be, for example, in the form of a dialogue screen. The user interface may also include any one of a mouse, touch screen, keyboard, keypad, voice reader, voice recognizer, dialogue screen, menu box, list, checkbox, toggle switch, button, or any other device that allows a user to receive information about the operation of the processor while the processor is processing an instruction set and / or provide information to the processor. Thus, a user interface is any device that provides communication between a user and a processor. Information provided by a user to a processor through the user interface may be, for example, in the form of a command, data selection, or some other input.

[0079] As described above, a processor that executes an instruction set utilizes a user interface such that the processor processes data for a user. The user interface is typically used by the processor to interact with the user to transfer information or receive information from the user. However, it should be understood that according to some embodiments of the system and method, a human user need not actually interact with the user interface used by the processor. Instead, it is also contemplated that the user interface may interact with another processor rather than a human user (i.e., transfer and receive information). Thus, another processor may be characterized as a user. In addition, it is contemplated that the user interface utilized in the system and method may interact partially with another processor or processors while also interacting partially with a human user.

[0080] Those skilled in the art will readily appreciate that the embodiments are susceptible to broad use and application. Without departing from the substance or scope thereof, many embodiments and adaptations of the invention in addition to those described herein, as well as many variations, modifications, and equivalent arrangements will be apparent or reasonably suggested by the foregoing description.

[0081] Accordingly, although exemplary embodiments related to embodiments of the invention have been described in detail herein, it should be understood that the present disclosure is merely illustrative and exemplary of the invention and provides an enabling disclosure thereof. Thus, the foregoing disclosure is not intended to interpret or limit the invention or otherwise exclude any other such embodiments, adaptations, variations, modifications, or equivalent arrangements.

Claims

1. A method for joint privacy management, comprising: providing privacy services by component nodes of a multi-layer joint privacy management network; maintaining references by the multi-layer joint privacy management network, wherein the references associate the privacy services with users of client devices; receiving a device identifier at a user management node of the multi-layer joint privacy management network and from a client application executed on an electronic device; in response to receiving the device identifier, requesting a rights token from component nodes of the multi-layer joint privacy management network by the user management node, wherein the rights token indicates that the user of the client application is authorized to use the privacy services based on the reference; receiving the rights token by the user management node; sending the rights token by the user management node to the client application; registering the rights token by the client application with the component nodes of the privacy services; storing the device identifier by the component nodes; receiving an Internet Protocol request from the client application by the component nodes; receiving, by the user management node, data from a web host or server from a plurality of second-layer nodes in the multi-layer joint privacy management network, wherein the data is in response to the Internet Protocol request from the client application via a first-layer node and the plurality of second-layer nodes to the web host or the server, and the data is associated with the device identifier; receiving, at the user management node, a request for the data from the client application using the device identifier; and transmitting the data to the client application.

2. The method according to claim 1, wherein the data from the second-layer nodes comprises at least one of browsing data and application data from the web host or the server.

3. The method according to claim 1, wherein the component nodes are the first-layer nodes, and wherein the first-layer nodes receive the Internet Protocol request and a first IP address associated with the electronic device from the client application, convert the first IP address into a second IP address, and transmit the Internet Protocol request and the second IP address to the second-layer nodes.

4. The method according to claim 3, wherein the second-layer nodes perform the privacy services on the Internet Protocol request.

5. The method according to claim 4, wherein the privacy services comprise at least one of packet inspection, device fingerprint obfuscation, web security, anti-malware application activities, and recording of browsing / application history.

6. The method according to claim 3, wherein the second-layer nodes convert the second IP address into a third IP address and transmit the Internet Protocol request and the third IP address to the web host or the server.

7. The method according to claim 1, wherein the data is encrypted using a private key for the client application.

8. The method according to claim 1, wherein the second layer nodes include a plurality of second layer nodes.

9. The method according to claim 1, further comprising: receiving, at the user management node, registration information from the client application.

10. The method according to claim 1, wherein no node among the plurality of second layer nodes can access all personal data of an individual and / or online browsing or application data.

11. A system for federated privacy management, comprising: a multi-layer federated privacy management network including first layer nodes and second layer nodes; a user management node communicatively coupled to at least one of the first layer nodes and the second layer nodes; and a client application executed by an electronic device; wherein: the multi-layer federated privacy management network maintains references that associate privacy services with users of client devices; the user management node receives a device identifier of the electronic device from the client application; in response to receiving the device identifier, the user management node requests a rights token from the first layer node, wherein the rights token indicates that the user of the client application is authorized to use the privacy service based on the reference; the user management node receives the rights token; the user management node sends the rights token to the client application; the client application registers the rights token with the first layer node of the privacy service; the first layer nodes and the second layer nodes store the device identifier; the first layer node receives an Internet Protocol request and a first IP address associated with the electronic device from the client application, converts the first IP address into a second IP address, and transmits the Internet Protocol request and the second IP address to the second layer node; the second layer node converts the second IP address into a third IP address and transmits the Internet Protocol request and the third IP address to a web host or server; the second layer node receives data including at least one of browsing data and application data from the web host or the server, associates the data with the device identifier or a session identifier, and transmits the data and the association with the device identifier or the session identifier to the user management node; the user management node receives the data and stores the data; the user management node receives a request for the data from the client application using the device identifier or the session identifier; and the user management node transmits the data to the client application.

12. The system according to claim 11, wherein the second layer node further performs a privacy service on the Internet Protocol request, the privacy service including at least one of packet inspection, device fingerprint obfuscation, web security, anti-malware application activity, and recording of browsing / application history.

13. The system according to claim 11, further comprising a plurality of second layer nodes.

Images