System for storing and / or enabling, authorized by the user, user-related data of at least one user

Abstract

An apparatus and a method for storing and / or enabling, authorized by the user, user-related data of at least one user.

Description

[0001] System for user-authorized storage and / or release of user-related data of at least one user

[0002] The invention relates to a system for user-authorized storage and / or release of user-related data of at least one user, comprising a data storage device in which one or more user-related data items verified with respect to at least one verification criterion can be stored or are stored, and an authorization device which is configured to communicate with the data storage device via a network connection, in particular to enable access to one or more user-related data items stored in the data storage device and verified with respect to at least one verification criterion.

[0003] Corresponding systems - these are typically computer-implemented systems - for the user-authorised storage and / or release of user-related data of at least one user are known in principle from the prior art and typically comprise a data storage device in which one or more user-related data items verified with regard to at least one verification criterion can be stored or are stored, and an authorisation device which is assignable or assigned to the data storage device and which is set up to communicate with the data storage device via a network connection or a network, in particular in order to enable access to one or more user-related data items stored in the data storage device and verified with regard to at least one verification criterion.

[0004] The authorization device therefore represents a component of a corresponding system that increases security insofar as it forms a computer-implemented access barrier to the user-related and thus highly sensitive data stored in the data storage device; the authorization device is therefore typically configured to grant access to one or more user-related data stored in the data storage device and verified with respect to at least one verification criterion only if at least one authorization criterion is met.

[0005] Although various technical principles for the secure storage and / or release of corresponding user-related data to requesters, such as cryptography or encryption principles, are generally known for corresponding systems, there is still a need for improvement or further development of corresponding systems with regard to the secure storage and / or release of corresponding user-related data of at least one user. The invention is therefore based on the object of providing an improved system for the user-authorized storage and / or release of user-related data of at least one user.

[0006] The object is achieved in particular by a system for user-authorized storage and / or release of user-related data of at least one user according to claim 1. The dependent claims contain possible embodiments of the system according to claim 1.

[0007] A first aspect of the invention relates to a system for the user-authorizable or authorized storage and / or release of user-related data of at least one user. The system is thus configured for the user-authorizable or authorized storage and / or release of user-related data of at least one user.

[0008] As will become apparent below, the system is typically computer-implemented. In particular, the system can be implemented or implemented via a computer network, possibly cloud-based.

[0009] The system includes several functional units that can be implemented or have been implemented in hardware and / or software, the task, function and interaction of which are explained in detail below.

[0010] The system comprises a data storage device implemented in hardware and / or software. The data storage device may comprise at least one non-volatile data memory and / or at least one volatile data memory. The non-volatile data memory may comprise, for example, a read-only memory (ROM), a programmable ROM (PROM), an electrically programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), a flash memory, or a non-volatile random access memory (RAM) (e.g., a ferroelectric RAM (FeRAM)). The volatile memory may comprise, for example, a random access memory (RAM) that functions as an external cache memory. By way of illustration and without limitation, RAM is available in many forms, e.g.,as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), synchlink DRAM (SLDRAM), direct Rambus RAM (DRRAM), direct dynamic Rambus RAM (DRDRAM), and dynamic Rambus RAM.

[0011] The data storage device can form a component of a hardware and / or software-implemented data processing device, or a hardware and / or software-implemented data processing device can be assigned to the data storage device. A corresponding data processing device typically comprises at least one processor unit.

[0012] One or more user-related data items verified with respect to at least one verification criterion can be stored or stored in the data storage device. The corresponding user-related data verified with respect to at least one verification criterion can therefore be data of a user (hereinafter, for the sake of simplicity, the term "user" is used) that is verified with respect to at least one verification criterion. The corresponding user-related data can contain one or more attributes of a user verified with respect to at least one verification criterion, hereinafter referred to as "data attributes."

[0013] The verification of the user-related data can be carried out or have been carried out via a verification device that is assigned to or assigned to the data storage device and is implemented in hardware and / or software and is configured to verify respective user-related data with regard to at least one verification criterion. For this purpose, the verification device can be equipped with one or more verification algorithms that are configured to verify attributes contained in respective data attributes with regard to at least one verification criterion. The verification device can, for example, be configured to compare a first data attribute of a user, such as a user's name, with at least one further data attribute, such as a gender, of the user in order to verify that the data attributes are correct and thus verified. The same applies, for example,for comparing a user's data attributes in various user-related data of a user. For example, a data attribute in the form of a code assigned to a user by an authority, such as a number, i.e. a tax number, health insurance number, etc., which is present in various user data, can be compared in order to verify that the data attributes are correct and thus verified. The verification device can also be set up via appropriate verification algorithms to compare user-provided information or attributes generated from it with information about the respective user that is available, for example, via the internet, an intranet, or other networks, in particular freely accessible information, e.g. information from social networks, websites, etc., and to verify this information accordingly and update it if necessary.

[0014] In all cases, the data storage device therefore contains highly sensitive, verified user-related data, so that there is a particular interest in the security of the user-related data and, associated with this, the security of access to the data storage device or the user-related data stored therein. The system therefore comprises a hardware and / or software-implemented authorization device which is configured to establish or grant access to one or more user-related data stored in the data storage device and verified with regard to at least one verification criterion, if at least one authorization criterion is met. The authorization device can, as will be apparent below, comprise one or more artificial intelligence algorithms (“AI”), i.e.Kl-implemented algorithms, and / or one or more neural networks, which are particularly configured to determine whether at least one authorization criterion is met.

[0015] The authorization device can form a component of a hardware and / or software-implemented data processing device, or a hardware and / or software-implemented data processing device can be assigned to the authorization device. A corresponding data processing device typically comprises at least one processor unit.

[0016] The authorization device is thus configured to establish or grant access to one or more user-related data stored in the data storage device and verified with respect to at least one verification criterion if at least one authorization criterion is met. The authorization device can therefore ensure that access to one or more user-related data stored in the data storage device and verified with respect to at least one verification criterion is only possible if at least one authorization criterion is met. A requester can therefore only obtain access to one or more user-related data stored in the data storage device and verified with respect to at least one verification criterion if the at least one authorization criterion is met.The authorization device thus implements an efficient computer-technical hurdle which makes unauthorized access to the data storage device or user-related data stored in the data storage device impossible without at least one fulfilled authorization criterion, because, as mentioned, corresponding access to the data storage device or user-related data stored in the data storage device is only possible if at least one fulfilled authorization criterion is present.

[0017] The at least one authorization criterion is a match between user identity information derived from at least one biometric feature of a requester and the identity of the user of the user-related data. Therefore, access to one or more user-related data stored in the data storage device and verified with respect to at least one verification criterion is only possible if there is a match between user identity information derived from at least one biometric feature of a requester—this can of course also be the user whose user-related data is stored in the data storage device—and the identity of the user of the user-related data.

[0018] In order to be able to associate user identity information derived from at least one biometric feature of a requester with the identity of the user of respective user-related data, the user-related data can also contain the user identity of the respective user. In particular, the user-related data can contain at least one biometric feature of the respective user, so that user identity information derived from at least one biometric feature of a requester can also be associated with respective user-related data by assigning at least one determined biometric feature of a requester to at least one biometric feature described in user-related data. In particular, an assignment of a determined biometric feature of a requester ora user identity information derived from at least one biometric feature of a requester to respective user-related data via a match of at least one determined biometric feature of a requester with at least one biometric feature described in user-related data.

[0019] The at least one biometric feature can in principle be any feature of a requester or user that enables the identity of the requester or user to be clearly determined or from which user identity information that clearly describes the identity of the requester or user can be derived.

[0020] In principle, the at least one biometric characteristic of a requester or user can be a sensory characteristic, i.e., a sensor element, detectable, e.g., acoustic and / or haptic and / or optical and / or thermal, of the requester or user. Physiognomic and / or physiological characteristics of the requester or user are particularly suitable.

[0021] Advantageously, the at least one biometric feature is the iris (iris) or at least one feature of the iris of the requester or user, as the iris or its features can typically be easily determined and enable unambiguous identification of the requester or user. Alternatively or additionally, the at least one biometric feature can also be at least one feature of a face or a limb, such as a hand, of the requester or user. Likewise alternatively or additionally, acoustic features of the voice, such as pitch, rhythm, of a requester or user can be used as biometric features. Combinations of different biometric features are conceivable.The authorization device is thus configured to determine at least one biometric feature of a requester, derive user identity information from it, and process this user identity information through appropriate data processing to determine whether the user identity information matches the identity of the user of the user-related data. Only if there is a corresponding match is access to one or more user-related data stored in the data storage device and verified with regard to at least one verification criterion possible.

[0022] To determine at least one biometric feature of a requester, the authorization device typically comprises a determination device configured to determine at least one biometric feature of a requester, or a corresponding determination device is assignable or assigned to the authorization device. Specifically, a corresponding determination device can comprise one or more sensor elements, e.g., acoustic and / or optical and / or thermal, which are configured to determine at least one biometric feature of a requester. For this purpose, at least one artificial intelligence algorithm, in particular a neural network, can be assigned or assigned to the determination device, which algorithm is configured to generate corresponding user identity information from information or biometric features determined by corresponding sensor elements.The authorization device can therefore generally be configured to process the at least one biometric feature by means of at least one artificial intelligence algorithm, in particular a neural network, to derive or generate user identity information.

[0023] The at least one authorization criterion is accordingly met if a user identity information derived from at least one biometric feature of a requester matches the identity of the user of the user-related data. This significantly limits the circle of persons who can gain access to the user-related data stored in the data storage device and verified with regard to at least one verification criterion. In particular, only the respective user who has stored his or her user-related data in the data storage device can gain access to the data.To obtain access to the corresponding user-related data, because typically only the user has at least one biometric feature from which unique user identity information can be derived, which in turn can be used to determine that identity exists between the user and the identity of the person whose user-related data is stored in the data storage device.

[0024] This not only results in security-related advantages with regard to general access to the user-related data stored in the data storage device and verified with regard to at least one verification criterion, but it also ensures that a user identified and authorized via the at least one authorization criterion, i.e. via at least one biometric feature or the user identity information derived therefrom, only receives access to the user-related data concerning him, as he generally does not receive any access authorization for other user-related data stored in the data storage device, because there is no identity between the user and the identity of the person whose user-related data is stored in the data storage device.

[0025] The authorization device is configured to communicate with the data storage device via a network connection, in particular to enable, after successful authorization, access to one or more user-related data stored in the data storage device and verified with respect to at least one verification criterion. As mentioned, access to the user-related data stored in the data storage device and verified with respect to at least one verification criterion is only possible if the at least one authorization criterion is met, wherein the at least one authorization criterion is met if a match is given between user identity information derived from at least one biometric feature of a requester and the identity of the user of the user-related data.

[0026] The data storage device therefore typically comprises a hardware and / or software-implemented communication interface via which it can communicate with other components of the system, i.e. in particular the authorization device. Likewise, the authorization device typically comprises a hardware and / or software-implemented communication interface via which it can communicate with other components of the system, i.e. in particular the data storage device. Corresponding communication interfaces of the data storage device and / or the authorization device can in particular be set up to establish or maintain a wired or wireless communication connection. In connection with the establishment or maintenance of wireless communication connections, respective communication interfaces can e.g. be set up to use a standard for wireless orMobile communication, especially 4G or 5G, is to communicate via an internet standard, especially TCP / IP, or an intranet standard. Standards for mobile communication can be, for example, so-called third-generation mobile communications standards, i.e., LTE standards, or extensions thereof, such as LTE-Advanced or 4G.

[0027] The data storage device and the authorization device are therefore connectable or connected to one another via at least one network connection. The network connection can be implemented via at least one communication or network protocol, such as an Internet protocol. The data storage device and the authorization device can thus form components of a data or computer network that communicate with one another directly or indirectly via at least one communication or network protocol. A corresponding data or computer network can be, for example, a GAN (Global Area Network), a WAN (Wide Area Network), a LAN (Local Area Network), or a MAN (Metropolitan Area Network). Data or computer networks that enable communication over short distances, such as PAN or WPAN networks, are also conceivable. In this respect, communication standards such as Bluetooth, Zigbee, etc. can also be used.

[0028] The system can therefore be a data or computer network which provides at least one network connection via which the data storage device and the authorization device can be or are connected to one another, or form a component of such a data or computer network. A corresponding data or computer network can comprise a communication structure, i.e. in particular a network architecture, furthermore in particular a client-server architecture. In a corresponding client-server architecture, the data storage device, optionally together with an associated data processing device, can form the server or a server with which one or more clients, i.e. stationary or mobile terminals typically usable by queryers or users, can communicate via one or more communication interfaces.The authorization device, possibly together with the associated data processing device, can therefore form the client or a client of a corresponding client-server architecture.

[0029] Overall, there is an improved system for the user-authorized storage and / or release of user-related data of at least one user.

[0030] As indicated above, the authorization device can form part of a stationary or mobile terminal device that can be used by a querying party or user.

[0031] A stationary terminal can, for example, be a terminal that can be installed or is installed in a fixed location, possibly also referred to as a touchpoint, which comprises at least the authorization device as a hardware and / or software-implemented component. The terminal can also comprise a corresponding detection device, i.e., in particular, one or more corresponding sensor elements, e.g., in the form of cameras, microphones, etc., via which biometric characteristics of a requester or user can be determined. A data processing device of the terminal can derive user identity information from the correspondingly determined biometric characteristics using corresponding data processing algorithms. Corresponding data processing algorithms can comprise one or more AI-based algorithms or one or more neural networks. The terminal can also comprise a user interface, such as a touchscreen, loudspeakers, microphones, etc., via which any necessary user inputs can be made. The terminal can also comprise a communication interface via which individual, several or all of the aforementioned components of the terminal can communicate with a communication partner, in particular the data storage device. Individual, several or all of the aforementioned components of the terminal can be arranged or formed on or in a housing structure of the terminal. A corresponding housing structure can comprise one or more fastening interfaces via which it can be installed in a stationary manner, e.g. on or a substrate or on or in a building structure.

[0032] A mobile device can be, for example, a cell phone, a smartphone, a smartwatch, smartglasses, a tablet, a laptop computer, a desktop computer, a smart TV, a smart radio, etc., which includes the authorization device as a hardware and / or software-implemented component. Specifically, the authorization device can thus be implemented as a software application (app) that can be installed or is installed on a corresponding mobile device.

[0033] The mobile device can also comprise one or more corresponding detection devices, i.e., in particular corresponding sensor elements, e.g., in the form of cameras, microphones, etc., via which biometric characteristics of a requester or user can be determined. A data processing device of the mobile device can derive user identity information from the correspondingly determined biometric characteristics using corresponding data processing algorithms. Corresponding data processing algorithms can comprise one or more AI-based algorithms or one or more neural networks. The mobile device can also comprise a user interface, such as a touchscreen, loudspeakers, microphones, etc., via which any necessary user inputs can be made.The mobile terminal can also comprise a communication interface via which individual, several, or all of the aforementioned components of the mobile terminal can communicate with a communication partner, in particular the data storage device. Individual, several, or all of the aforementioned components of the mobile terminal can be arranged or formed on or in a housing structure of the mobile terminal.

[0034] The authorization device can also be configured to enable the transfer of one or more user-related data stored in the data storage device and verified with regard to at least one verification criterion to at least one data storage device separate from the data storage device, which can be, for example, a cloud storage device or a component thereof and / or a terminal device of the requester, if the at least one authorization criterion is met. Thus, the system can enable user-related data verified with regard to at least one verification criterion to be downloaded from the data storage device to another data storage device if the at least one authorization criterion is enabled. Accordingly, an authorized user generally has the option of retrieving or storing user-related data as needed at any location and / or at any time with appropriate authorization.to download. This can, for example, be implemented in such a way that the authorization device provides a loading function (download function) - the loading function can therefore be a function of the authorization device implemented as an app, via which an authorized user as described can download one or more user-related data in a specific data format, in particular a human- or machine-readable data format, to a terminal device. This can, for example, be necessary or useful if the user has to identify themselves at a government agency or other governmental or non-governmental institution, has to identify themselves when visiting a doctor, has to identify themselves during a transaction, such as the purchase or sale of goods and / or services, has to identify themselves when entering an event, such as a cultural or sporting event, has to identify themselves when using a means of transport, such asa bus, a train, an airplane, a ship, etc., etc. The system thus gives a user the opportunity to specifically identify themselves, if necessary, without having to carry around corresponding physical means of identification with regard to at least one verification criterion, as the user-related data required for this purpose is stored in the data storage device, secured against unauthorized access by the authorization device, from which the user can download it as needed, as described. Password queries are thus unnecessary, as access to the personal data is based on unique biometric characteristics via the authorization described.

[0035] In an analogous manner, a user can, if necessary, identify himself specifically at a terminal which is installed, for example, at a public authority or other governmental or non-governmental institution, a train station, an airport, a workplace, a means of transport, a hostel such as a hotel, etc., in order to, for example, gain access, to use goods and / or services, etc. As mentioned, the authorization device can also form a component of a corresponding terminal (as an example of a stationary terminal device usable by a querying party or user).

[0036] The data storage device, or an encryption device implemented in hardware and / or software that can be assigned to it or is associated with it, can be configured to encrypt data to be transmitted, such as user-related data to be downloaded. This can further improve the security of the system. Encryption can be achieved, for example, using the principles of cryptographically linked individual block-like data records, thus in particular using blockchain principles. The data storage device can thus comprise a corresponding encryption device. Similarly, alternatively or additionally, the authorization device, or an encryption device implemented in hardware and / or software that can be assigned to it or is associated with it, can be configured to encrypt data to be transmitted, such as determined biometric characteristics or user identity information.In this way, the security of the system can be further improved. Encryption can be achieved, for example, using the principles of cryptographically linked individual block-like data records, thus in particular using blockchain principles. The authorization mechanism can thus include a corresponding encryption mechanism.

[0037] The authorization device can be configured to enable corresponding access to one or more user-related data stored in the data storage device and verified with regard to at least one verification criterion and / or a corresponding transfer of one or more user-related data stored in the data storage device and verified with regard to at least one verification criterion to at least one data storage device separate from the data storage device, depending on the presence of an additional release criterion. The fulfillment or presence of a corresponding authorization criterion can therefore also be linked to the fulfillment or presence of a separate, additional user-side release criterion, so that access to the user-related data stored in the data storage device by a requester orUser access is only possible if both the authorization criterion and a separate user-side release criterion are met. This system configuration thus enables the targeted inclusion of users who have stored their user-related data in the data storage facility in the authorization or release of user-related data to a requester, so that a user-authorizable release of user-related data is possible.

[0038] The additional user-side approval criterion can therefore be provided, for example, by an active approval action by the respective user. The respective user can perform this approval action, for example, by actuating a corresponding hardware and / or software-implemented control element on a terminal device communicating with the system, i.e., in particular, the authorization device. This can be implemented, for example, in such a way that the authorization device installed on a terminal device additionally provides an approval function – the approval function can thus be a function of the authorization device implemented as an app, via which a user can authorize access to the user-related data.

[0039] The additional approval criterion can thus be user approval information describing an active approval action by the user relating to the verified user-related data. Corresponding user approval information can be generated based on a detected active approval action by the user relating to the verified user-related data. In particular, the authorization device can be configured to generate corresponding user approval information based on a detected active approval action by the user relating to the verified user-related data.

[0040] In order to store corresponding user-related data verified with regard to at least one verification criterion in the data storage device, the system may optionally comprise a second authorization device implemented in hardware and / or software.The second authorization device is configured to communicate with the data storage device via a network connection, in particular to enable access to one or more user-related data stored in the data storage device and verified with regard to at least one verification criterion, wherein the authorization device is configured to establish access to the data storage device in order to store one or more user-related data to be stored in the data storage device and verified with regard to at least one verification criterion in the data storage device, and / or to change one or more user-related data stored in the data storage device and verified with regard to at least one verification criterion, if at least one authorization criterion is met.In this case too, the at least one authorization criterion can be a match between user identity information derived from at least one biometric feature of a user and the identity of the user of the user-related data, so that the corresponding statements above apply analogously.

[0041] Based on access to the data storage device enabled or granted via the second authorization device, it is therefore possible for a user to store user-related data in the data storage device or to change stored user-related data, i.e. in particular to modify, supplement or delete it.

[0042] User-related data can, for example, be stored in the data storage facility via an upload, which can involve the deliberate provision of information or information structures by the user, e.g. in the form of data records or documents. A user of the system can therefore specifically provide documents, such as certificates, contracts, CVs, invoices, photographs, videos, etc., at least in part, which can be analyzed or evaluated by a data processing facility that is assigned to or can be assigned to the data storage facility with regard to specific attributes or attribute categories. Specifically, a user can, for example, upload certificates, such as their identity card, their training certificate, etc., or contractual documents, such as employment contracts, purchase contracts, leasing contracts, or other contracts for services and / or goods, such asAudio and / or video content provision contracts, vehicle contracts, financial services contracts, mobile phone contracts, energy supply contracts, insurance contracts, treatment contracts, etc., which are analyzed or evaluated by the data processing facility, e.g. using principles of pattern and / or text recognition, with regard to certain attributes or attribute categories. From a corresponding analysis or evaluation, general contract terms or conditions can therefore be derived as attributes. From a corresponding analysis or evaluation, further attributes can also be derived; for example, it can be recognized that a user concludes long-term contracts with energy suppliers that supply renewable energies or concludes short-term contracts with energy suppliers regardless of whether these suppliers supply renewable energies or not.It is also conceivable that, through appropriate analysis or evaluation of user-provided information, it may be possible to determine whether a user wishes to conclude certain contracts with existing or new providers of all types of services and / or goods in the future, or whether they no longer wish to conclude contracts with existing or new providers of services and / or goods in the future. Of course, a user can also provide such information explicitly.

[0043] All analysis and evaluation algorithms required for this purpose can be implemented using artificial intelligence tools, i.e., in particular, single- or multi-layer artificial neural networks, which receive corresponding user-provided information as input information in an input layer, which is processed via one or more neurons or intermediate layers, and output in an output layer as specific attributes or attribute categories. Corresponding artificial neural networks can be trained using machine learning measures, e.g., with reference data, in order to achieve a more precise assignment of user-provided information or the information contained therein to specific attributes or attribute categories.

[0044] The user-related data obtained by processing corresponding user-provided information can be stored as user-related attribute data records or collections in the, as mentioned, possibly cloud-based, data storage device. The data storage device or a data processing device associated with it can be configured to implement a suitable folder structure for storing the attributes or attribute categories. A corresponding folder structure can implement both a user-specific and a higher-level ordering of stored attributes or attribute categories, so that, for example, queries for specific attributes of a specific user, as well as general queries for users with specific attributes, can be performed.The implementation of an appropriate folder structure can enable simplified computer-based retrieval and, if necessary, further processing of the data stored in the data storage facility.

[0045] The second authorization device can be configured to provide a requester with one or more query criteria, based on which the requester can submit a request for personal data stored in the data storage device. To provide corresponding query criteria, at least one can be provided via which the query criteria can be provided, e.g., to a user-side terminal. The communication interface can form a component of the authorization device or be assigned to it.

[0046] A corresponding query criterion can, for example, relate to or include at least one attribute or at least one attribute category from the following group of attribute categories: personal data of a user, such as name, gender, age, biometrics, size of one or more body parts, weight, health, origin, education, work or employment relationship, professional and / or social status, income, place of work and / or residence, political orientation, religious orientation, sexual orientation, professional and / or leisure intellectual activity, professional and / or leisure physical activity, leisure behavior, eating behavior, drinking behavior, social behavior, work-life balance, and / or contractual agreements of a user with providers of services and / or goods, such as existing communication contracts, leasing contracts, insurance contracts, media usage contracts, treatment contracts.Corresponding attributes or attribute categories can be specified by the user with any level of detail.

[0047] Corresponding query criteria can be generated and / or provided by a hardware- and / or software-implemented data processing device of the system. The data processing device can be configured, in particular, to generate and / or provide query criteria implemented in a user-dialog fashion for specific attributes of one or more attribute categories of at least one user via a communications interface, in particular to a user-side terminal. The data processing device can comprise a hardware- and / or software-implemented device for generating and / or providing corresponding query criteria for specific attributes of one or more attribute categories of at least one user.

[0048] The data processing device can, in particular, be configured to query query criteria in a user-dialog-like manner, following a predefined query sequence or logic. Implementing a corresponding query sequence or logic can make the generation of corresponding attribute data sets more efficient, particularly due to reduced computational effort, as the user-provided information typically has a certain logical relationship, e.g., due to a certain thematic proximity. This can simplify the computer-based assignment of the user-provided information to attributes or attribute categories.

[0049] Specifically, the data processing device can be configured, for example, to implement query criteria in a user-dialog format, possibly via a virtual dialog assistance application, e.g., implemented as an app, or via an audio and / or video dialog. A corresponding virtual dialog assistance application can be implemented, for example, as a chatbot. This allows for efficient and practical collection of user attribute-related data.

[0050] Corresponding query criteria can be provided or transmitted to a user-side terminal (client) as part of a communication that can be implemented via the communication interface, in particular interactively. The communication interface can, for example, comprise a user interface implemented via a website, software application (app), etc., via which corresponding query criteria can be communicated and / or user-side information regarding corresponding query criteria can be provided. Alternatively or additionally, corresponding query criteria can be transmitted to a user-side terminal, e.g., via SMS, push message, instant message, email, etc., so that corresponding query criteria can be transmitted, e.g., in the form of a message chain, i.e., in particular, a chat.

[0051] Such communication can, as mentioned, be implemented, for example, via a software application (app), in particular in the form of a (user) dialogue, i.e., in the simplest case, according to the principle of question-answer, follow-up question-follow-answer, etc.; thus, the data processing device can be configured to ask at least one user questions based on appropriate query criteria—similar to or analogous to a conversation between people—in order to obtain information on specific attributes of specific attribute categories from the at least one user in the form of user-side inputs. Specifically, a user can, for example, request specific information, such as their name, age, gender, place of residence, etc., via an output interface, such as an audio and / or video interface, of a user-side terminal device., and then, via corresponding inputs on their user-side terminal, provide information on query criteria which can be assigned to specific attributes or attribute categories by the data processing device, e.g. via the implementation of artificial intelligence tools. Of course, several users can be asked in parallel or serially in a corresponding manner for specific information and several users can provide information on query criteria in a corresponding manner in parallel or serially. The system, ie in particular the authorization device, can therefore comprise, for example, at least one artificial neural network which is set up to generate and / or provide query criteria, in particular implemented in a user dialogue manner, for specific attributes of one or more attribute categories of a user. In particular, the system, iein particular the authorization device, comprise an artificial neural network which is set up to generate at least one attribute data record containing the at least one user-side information made via the first communication interface regarding at least one query criterion-related attribute in the data storage device.

[0052] The generation and / or provision of corresponding query criteria can thus be implemented using artificial intelligence means, i.e., in particular, artificial neural networks, which can be adapted to specific users if necessary. Thus, the system, i.e., in particular, the authorization device, can comprise artificial intelligence means, i.e., in particular, artificial neural networks, which are configured to generate and / or provide query criteria, in particular taking into account one or more, possibly user-related, input parameters. Corresponding query criteria can thus be created for specific users, e.g., based on user-related input parameters, and adapted or varied within the framework of a corresponding interaction with a user, possibly in real time.For example, it is conceivable that if a possibly unexpected delay in user input regarding certain query criteria is detected, a decision is made not to present a user with other query criteria, perhaps because the delay may indicate that a user does not wish to provide information regarding that query criterion. However, it should be noted at this point that a user naturally has the option of postponing or refusing to provide information regarding one or more query criteria.

[0053] It is conceivable that the same authorization device is configured both to communicate with the data storage device via a network connection in order to enable access to one or more user-related data stored in the data storage device and verified with respect to at least one verification criterion, wherein the authorization device is configured to establish access to one or more user-related data stored in the data storage device and verified with respect to at least one verification criterion if at least one authorization criterion is met, wherein the at least one authorization criterion is a match of user identity information derived from at least one biometric feature of a requester with the identity of the user of the user-related data, and is configured to communicate with the data storage device via a network connection,In particular, to enable access to one or more user-related data stored in the data storage device and verified with respect to at least one verification criterion, wherein the authorization device is configured to establish access to the data storage device in order to store one or more user-related data to be stored in the data storage device and verified with respect to at least one verification criterion in the data storage device, and / or to change one or more user-related data stored in the data storage device and verified with respect to at least one verification criterion, if at least one authorization criterion is met. The first and second authorization devices can thus be implemented as different functions of a common authorization device.

[0054] In all embodiments of the system, the data storage device can be assigned a data anonymization device implemented in hardware and / or software, which is configured to anonymize user-related data stored in the data storage device.

[0055] The data anonymization device can be configured to anonymize user-related data stored in the data storage device using artificial intelligence algorithms, particularly neural networks. Cryptographic principles for anonymizing the user-related data stored in the data storage device are also conceivable. This allows for particularly efficient anonymization of the corresponding user-related data.

[0056] For all embodiments, it further applies that the data storage device can be assigned a data processing device implemented in hardware and / or software, which is configured to process user-related data stored in the data storage device.

[0057] The data anonymization device can be configured to process user-related data stored in the data storage device using artificial intelligence algorithms, in particular neural networks. This enables particularly efficient processing of corresponding user-related data.

[0058] A second aspect of the invention relates to a method for user-authorized storage and / or release of user-related data of at least one user. The method comprises the following steps:

[0059] Providing a data storage device in which one or more user-related data verified with regard to at least one verification criterion can be stored or are stored, and authorizing, by means of an authorization device which communicates with the data storage device via a network connection, an access orAccess to one or more user-related data stored in the data storage device and verified with respect to at least one verification criterion, wherein the authorization device establishes access to one or more user-related data stored in the data storage device and verified with respect to at least one verification criterion if at least one authorization criterion is met, wherein the at least one authorization criterion is a match of user identity information derived from at least one biometric feature of a requester with the identity of the user of the user-related data.

[0060] The method according to the second aspect of the invention can be implemented in particular with the system according to the first aspect of the invention, so that all statements in connection with the system according to the first aspect of the invention apply analogously to the method according to the second aspect of the invention.

[0061] The invention is explained in more detail using exemplary embodiments in the drawings.

[0062] 1 and 2 each show a schematic diagram of a system for the authorized storage and / or release of user-related data of at least one user according to an embodiment.

[0063] Fig. 1 shows a schematic diagram of a computer-implemented system 10 for the authorized storage and / or release of user-related data of at least one user according to a first exemplary embodiment. The system 10 is thus configured for the user-authorizable or authorized storage and / or release of user-related data of at least one user.

[0064] The system 10 includes several functional units that can be implemented or have been implemented in hardware and / or software, the task, function and interaction of which are explained in detail below.

[0065] The system 10 comprises a data storage device 20 implemented in hardware and / or software. The data storage device 20 may comprise at least one non-volatile data memory and / or at least one volatile data memory.

[0066] The data storage device 20 can form a component of a hardware and / or software-implemented data processing device 30, or a hardware and / or software-implemented data processing device 30 can be assigned to the data storage device 20. The data processing device 30 typically comprises at least one processor unit 31. One or more user-related data 21 verified with respect to at least one verification criterion can be stored or stored in the data storage device 20. Corresponding user-related data 21 verified with respect to at least one verification criterion can thus be data of a user that is verified with respect to at least one verification criterion.Corresponding user-related data 21 may include one or more attributes of a user verified with respect to at least one verification criterion, hereinafter referred to as “data attributes”.

[0067] The verification of the user-related data 21 can be carried out or have been carried out via a verification device 40 that is assigned to or assigned to the data storage device and is implemented in hardware and / or software and is configured to verify respective user-related data 21 with regard to at least one verification criterion. For this purpose, the verification device 40 can be equipped with one or more verification algorithms that are configured to verify attributes contained in respective data attributes with regard to at least one verification criterion. The verification device 40 can, for example, be configured to compare a first data attribute of a user, such as a user's name, with at least one further data attribute, such as a gender, of the user in order to verify that the data attributes are correct and thus verified. The same applies, for example,for comparing a user's data attributes in various user-related data of a user. For example, a data attribute in the form of a code assigned to a user, e.g., by an official authority, such as a number, i.e., a tax number, health insurance number, etc., which is present in various data of the user, can be compared in order to verify that the data attributes are correct and thus verified. The verification device 40 can also be configured, via appropriate verification algorithms, to compare user-provided information or attributes generated therefrom with information about the respective user that is available, e.g., via the internet, an intranet, or other networks, in particular freely accessible information, e.g., information from social networks, websites, etc., and to verify this information accordingly and, if necessary, update it.

[0068] In all cases, the data storage device 20 therefore contains highly sensitive, because verified, user-related data 21, so that there is a particular interest with regard to the security of the user-related data 21 and the associated security of access to the data storage device 20 or the user-related data 21 stored therein.

[0069] The system therefore comprises a hardware and / or software-implemented authorization device 50, which is configured to establish or grant access to one or more user-related data 21 stored in the data storage device 20 and verified with respect to at least one verification criterion, if at least one authorization criterion is met. As will become apparent below, the authorization device 50 can have one or more artificial intelligence algorithms ("KI"), i.e., KI-implemented algorithms, and / or one or more neural networks, which are configured, in particular, to determine whether the at least one authorization criterion is met.

[0070] The authorization device 50 can form a component of a hardware and / or software-implemented data processing device 60, or a hardware and / or software-implemented data processing device 60 can be assigned to the authorization device 50. The data processing device 60 typically comprises at least one processor unit 61.

[0071] The authorization device 50 is thus configured to establish or grant access to one or more user-related data 21 stored in the data storage device 20 and verified with respect to at least one verification criterion if at least one authorization criterion is met. Thus, the authorization device 50 can ensure that access to one or more user-related data 21 stored in the data storage device 20 and verified with respect to at least one verification criterion is only possible if at least one authorization criterion is met. A requester can therefore only obtain access to one or more user-related data 21 stored in the data storage device 20 and verified with respect to at least one verification criterion if the at least one authorization criterion is met.An efficient computer-technical hurdle is thus implemented via the authorization device 50, which makes unauthorized access to the data storage device 20 or user-related data 21 stored in the data storage device 20 impossible without the presence of at least one fulfilled authorization criterion, because corresponding access to the data storage device 20 or user-related data 21 stored in the data storage device 20 is, as mentioned, only possible if at least one fulfilled authorization criterion is present.

[0072] The at least one authorization criterion is a match between user identity information derived from at least one biometric feature of a requester and the identity of the user of the user-related data 21. Therefore, access to one or more user-related data 21 stored in the data storage device 20 and verified with regard to at least one verification criterion is only possible if there is a match between user identity information derived from at least one biometric feature of a requester - this can of course also be the user whose user-related data is stored in the data storage device 20 - and the identity of the user of the user-related data 21.

[0073] In order to be able to associate user identity information derived from at least one biometric feature of a requester with the identity of the user of respective user-related data 21, the user-related data 21 can also contain the user identity of the respective user. In particular, the user-related data 21 can contain at least one biometric feature of the respective user, so that user identity information derived from at least one biometric feature of a requester can also be associated with respective user-related data 21 by assigning at least one determined biometric feature of a requester to at least one biometric feature of the respective user described in user-related data 21. In particular, an assignment of a determined biometric feature of a requester ora user identity information derived from at least one biometric feature of a requester to respective user-related data 21 via a match of at least one determined biometric feature of a requester with at least one biometric feature described in user-related data.

[0074] The at least one biometric feature can in principle be any feature of a requester or user that enables the identity of the requester or user to be clearly determined or from which user identity information that clearly describes the identity of the requester or user can be derived.

[0075] In principle, the at least one biometric characteristic of a requester or user can be a sensory characteristic, i.e., a sensor element, detectable, e.g., acoustic and / or haptic and / or optical and / or thermal, of the requester or user. Physiognomic and / or physiological characteristics of the requester or user are particularly suitable.

[0076] Advantageously, the at least one biometric feature is the iris (iris) or at least one feature of the iris of the requester or user, as the iris or its features can typically be easily determined and enable unambiguous identification of the requester or user. Alternatively or additionally, the at least one biometric feature can also be at least one feature of a face or a limb, such as a hand, of the requester or user. Likewise alternatively or additionally, acoustic features of the voice, such as pitch, rhythm, of a requester or user can be used as biometric features. Combinations of different biometric features are conceivable.The authorization device 50 is thus configured to determine at least one biometric feature of a requester, derive user identity information from it, and process this user identity information through appropriate data processing to determine whether the user identity information matches the identity of the user of the user-related data. Only if there is a corresponding match is access to one or more user-related data 21 stored in the data storage device 20 and verified with respect to at least one verification criterion possible.

[0077] To determine at least one biometric feature of a requester, the authorization device 50 typically comprises a determination device 70, which is configured to determine at least one biometric feature of a requester, or a corresponding determination device can be assigned or is assigned to the authorization device. The determination device 70 can comprise one or more, e.g., acoustic and / or optical and / or thermal, sensor elements 71, which are configured to determine at least one biometric feature of a requester. For this purpose, at least one artificial intelligence algorithm, in particular a neural network, can be assigned or is assigned to the determination device 70, which is configured to generate corresponding user identity information from information or biometric features determined by corresponding sensor elements 71.The authorization device 70 can therefore generally be configured to process the at least one biometric feature by means of at least one artificial intelligence algorithm, in particular a neural network, to derive or generate user identity information.

[0078] The at least one authorization criterion is accordingly met when there is a match between user identity information derived from at least one biometric feature of a requester and the identity of the user of the user-related data 21. This significantly limits the circle of persons who can gain access to the user-related data 21 stored in the data storage device 20 and verified with regard to at least one verification criterion. In particular, only the respective user who has stored his or her user-related data in the data storage device 20 can gain access to the data.To obtain access to the corresponding user-related data 21, because typically only the user has at least one biometric feature from which unique user identity information can be derived, which in turn can be used to determine that identity exists between the user and the identity of the person whose user-related data 21 is stored in the data storage device 20.

[0079] This not only results in security-related advantages with regard to general access to the user-related data 21 stored in the data storage device 20 and verified with regard to at least one verification criterion, but it is also ensured that a user identified and authorized via the at least one authorization criterion, thus via at least one biometric feature or the user identity information derived therefrom, only receives access to the user-related data 21 concerning him, as he fundamentally receives no access authorization for other user-related data stored in the data storage device 20, because there is no identity between the user and the identity of the person whose user-related data 21 is stored in the data storage device 20.

[0080] The authorization device 50 is configured to communicate with the data storage device 20 via a network connection indicated by the double arrows P, in particular to enable, after successful authorization, access to one or more user-related data 21 stored in the data storage device 20 and verified with respect to at least one verification criterion. As mentioned, access to the user-related data 21 stored in the data storage device 20 and verified with respect to at least one verification criterion is only possible if the at least one authorization criterion is met, wherein the at least one authorization criterion is met if a match between user identity information derived from at least one biometric feature of a requester and the identity of the user of the user-related data 21 is given.

[0081] The data storage device 20 therefore typically comprises a hardware- and / or software-implemented communication interface 22, via which it can communicate with other components of the system 10, i.e., in particular, the authorization device 50. Likewise, the authorization device 50 typically comprises a hardware- and / or software-implemented communication interface 51, via which it can communicate with other components of the system 10, i.e., in particular, the data storage device 20. Corresponding communication interfaces 22, 51 of the data storage device 20 and / or the authorization device 50 can, in particular, be configured to establish or maintain a wired or wireless communication connection.

[0082] The data storage device 20 and the authorization device 50 are therefore connectable or connected to one another via at least one network connection. The network connection can be implemented via at least one communication or network protocol, such as an Internet protocol. The data storage device 20 and the authorization device 50 can thus form components of a data or computer network that communicate with one another directly or indirectly via at least one communication or network protocol. A corresponding data or computer network can be, for example, a GAN (Global Area Network), a WAN (Wide Area Network), a LAN (Local Area Network), or a MAN (Metropolitan Area Network). Data or computer networks that enable communication over short distances, such as PAN or WPAN networks, are also conceivable. In this respect, communication standards such as Bluetooth, Zigbee, etc., can also be used.be used. Standards for wireless or mobile communication, especially 4G or 5G, are also conceivable. Standards for mobile communication can include, for example, so-called third-generation mobile communications standards, i.e., LTE standards, or extensions to these, such as LTE-Advanced or 4G.

[0083] The system 10 can therefore be a data or computer network which provides at least one network connection via which the data storage device 20 and the authorization device 50 can be or are connected to one another, or the system 10 can form a component of such a data or computer network. A corresponding data or computer network can comprise a communication structure, i.e. in particular a network architecture, further in particular a client-server architecture. In a corresponding client-server architecture, the data storage device 20, optionally together with an associated data processing device 30, can form the server or a server with which one or more clients, i.e. typically stationary or mobile terminals usable by queryers or users, can communicate via one or more communication interfaces.The authorization device 50, optionally together with the associated data processing device, can therefore form the or a client of a corresponding client-server architecture.

[0084] As indicated above, the authorization device 50 can form a component of a stationary or mobile terminal device usable by a queryer or user.

[0085] In the embodiment shown in Fig. 1, the authorization device 50 forms a component of a stationary terminal 80, such as a terminal that can be or is installed in a fixed location and which comprises at least the authorization device 50 as a component implemented in hardware and / or software. The terminal can also comprise a corresponding determination device 70, i.e. in particular one or more corresponding sensor elements 71, e.g. in the form of cameras, microphones, etc., via which biometric characteristics of a requester or user can be determined. The data processing device 60 can also form a component of the terminal and can derive user identity information from correspondingly determined biometric characteristics using corresponding data processing algorithms. Corresponding data processing algorithms can comprise one or more AI-based algorithms or one or more neural networks.The terminal can also comprise a user interface 81, such as a touchscreen, loudspeakers, microphones, etc., via which any required user inputs can be made. The terminal can also comprise a communication interface 82, via which individual, several or all of the aforementioned components of the terminal can communicate with a communication partner, in particular the data storage device 20. Individual, several or all of the aforementioned components of the terminal can be arranged or formed on or in a housing structure 83 of the terminal. A corresponding housing structure 83 can comprise one or more fastening interfaces (not shown), via which it can be installed in a stationary manner, e.g. on or a subsurface or on or in a building structure.

[0086] In the embodiment shown in Fig. 2, the authorization device 50 forms a component of a mobile terminal 90, such as a cell phone, a smartphone, a smartwatch, a smartglass, a tablet, a laptop computer, a desktop computer, a smart TV, a smart radio, etc., which comprises the authorization device 50 as a hardware and / or software-implemented component. Specifically, the authorization device 50 can thus be implemented as a software application (app) that can be installed or is installed on a corresponding mobile terminal 90.

[0087] The mobile terminal 90 can also comprise one or more corresponding determination devices 70, i.e. in particular corresponding sensor elements 71, e.g. in the form of cameras, microphones, etc., via which biometric characteristics of a requester or user can be determined. The data processing device 60 can likewise form a component of the mobile terminal 90 and can derive user identity information from correspondingly determined biometric characteristics using corresponding data processing algorithms. Corresponding data processing algorithms can comprise one or more AI-based algorithms or one or more neural networks. The mobile terminal 90 can also comprise a user interface 91, such as a touchscreen, loudspeakers, microphones, etc., via which any necessary user inputs can be made.The mobile terminal 90 can also include a communication interface 92, via which individual, several, or all of the aforementioned components of the mobile terminal 90 can communicate with a communication partner, in particular the data storage device 20. Individual, several, or all of the aforementioned components of the mobile terminal 90 can be arranged or formed on or in a housing structure 93 of the mobile terminal 90.

[0088] In all exemplary embodiments, the authorization device 50 can be configured to enable the transfer of one or more user-related data 21 stored in the data storage device 20 and verified with respect to at least one verification criterion to at least one data storage device 94 separate from the data storage device 20, which may, for example, be a cloud storage device or a component thereof and / or a terminal of the requester, such as the mobile terminal 90, if the at least one authorization criterion is met. Thus, the system 10 can enable the download of user-related data 21 verified with respect to at least one verification criterion from the data storage device 20 to another data storage device, such as the data storage device 94 of the mobile terminal 90, if the at least one authorization criterion is enabled.An authorized user therefore generally has the option of retrieving or downloading user-related data as needed at any location and / or at any time with appropriate authorization. This can be implemented, for example, in such a way that the authorization device 50 provides a loading function (download function). The loading function can thus be a function of the authorization device 50 implemented as an app, via which a user authorized as described can download one or more user-related data 21 in a specific data format, in particular a human- or machine-readable data format, to a terminal device. This can be necessary or useful, for example, if the user has to identify themselves at a government agency or other governmental or non-governmental institution, has to identify themselves when visiting a doctor, or has to identify themselves during a transaction, such asa purchase or sale of goods and / or services, must identify themselves when entering an event, such as a cultural or sporting event, must identify themselves when using a means of transport, such as a bus, a train, an airplane, a ship, etc., etc. The system therefore gives a user the opportunity to specifically identify themselves with user-related data 21 verified with regard to at least one verification criterion without having to carry around corresponding physical identification means, if this is necessary, as the user-related data 21 required for this purpose is provided by the.

[0089] Authorization device 50 secured against unauthorized access in the

[0090] Data storage device 20, from which he can download them as required as described.

[0091] In an analogous manner, a user can, if necessary, identify himself specifically at a terminal which is installed, for example, at a government agency or other governmental or non-governmental institution, a train station, an airport, a workplace, a means of transport, a hostel such as a hotel, etc., in order to, for example, gain access, to use goods and / or services, etc. As mentioned, the authorization device 50 can also form a component of a corresponding terminal (as an example of a stationary terminal device usable by an interrogator or user) (cf. Fig. 1).

[0092] The data storage device 20, or an encryption device implemented in hardware and / or software that can be assigned to it or is assigned to it, can be configured to encrypt data to be transmitted, such as user-related data to be downloaded. This can further improve the security of the system 10. Encryption can be implemented, for example, using the principles of cryptographically linked individual block-like data records, thus in particular using blockchain principles. The data storage device 20 can thus comprise a corresponding encryption device.

[0093] In a similar manner, alternatively or additionally, the authorization device 50 or an encryption device implemented in hardware and / or software that can be assigned to it or is assigned to it can be configured to encrypt data to be transmitted, such as determined biometric characteristics or user identity information. In this way, the security of the system 10 can be further improved. Encryption can be implemented, for example, using the principles of cryptographically linked individual block-like data records, thus in particular using blockchain principles. The authorization device 50 can therefore comprise a corresponding encryption device.

[0094] In all exemplary embodiments, the authorization device 50 can be configured to enable corresponding access to one or more user-related data 21 stored in the data storage device 20 and verified with respect to at least one verification criterion and / or a corresponding transfer of one or more user-related data 21 stored in the data storage device 20 and verified with respect to at least one verification criterion to at least one data storage device separate from the data storage device 20, such as the data storage device 94, depending on the presence of an additional release criterion. The fulfillment or presence of a corresponding authorization criterion can therefore additionally be linked to the fulfillment or presence of a separate additional user-side release criterion, so that access orAccess to the user-related data 21 stored in the data storage device 20 by a requester or user is only possible if both the authorization criterion and a separate user-side release criterion are present. This configuration of the system 10 thus enables a targeted inclusion of users who have stored their user-related data 21 in the data storage device 20 in the authorization or release of user-related data to a requester, so that a user-authorizable release of user-related data 21 is possible.

[0095] The additional user-side release criterion can therefore be given, for example, by an active release action by the respective user; the respective user can perform this release action, for example, by correspondingly actuating a hardware and / or software-implemented control element on a terminal device communicating with the system 10, i.e., in particular, the authorization device 50. This can be implemented, for example, in such a way that the authorization device 50 installed on a terminal device additionally provides a release function - the release function can thus be a function of the authorization device 50 implemented as an app, via which a user can release access to the user-related data 21. The additional release criterion can thus be user release information describing an active release action by the user to which the verified user-related data relates.Corresponding user release information can be generated based on a detected active release action of the user relating to the verified user-related data 21. In particular, the authorization device 50 can be configured to generate corresponding user release information based on a detected active release action of the user relating to the verified user-related data 21.

[0096] In order to store corresponding user-related data verified with respect to at least one verification criterion in the data storage device 20, the system 10 may optionally comprise a second authorization device implemented in hardware and / or software.The second authorization device is configured to communicate with the data storage device 20 via a network connection, in particular to enable access to one or more user-related data 21 stored in the data storage device 20 and verified with regard to at least one verification criterion, wherein the second authorization device is configured to establish access to the data storage device 20 in order to store one or more user-related data 21 to be stored in the data storage device 20 and verified with regard to at least one verification criterion in the data storage device 20, and / or to change one or more user-related data 21 stored in the data storage device 20 and verified with regard to at least one verification criterion, if at least one authorization criterion is met.In this case too, the at least one authorization criterion can be a match between user identity information derived from at least one biometric feature of a user and the identity of the user of the user-related data 21, so that the corresponding statements above apply analogously.

[0097] Based on access to the data storage device 20 enabled or granted via the second authorization device, it is thus possible for a user to store user-related data 21 in the data storage device 20 or to change stored user-related data, ie in particular to modify, add to or delete it.

[0098] User-related data 21 can be stored in the data storage device 20, for example, via an upload to the data storage device 20, which can involve a deliberate user-side provision of information or information structures, e.g., in the form of data records or documents. Thus, a user of the system 10 can specifically provide documents, such as certificates, contracts, resumes, invoices, photographs, videos, etc., at least in part, which can be analyzed or evaluated by a data processing device 30 that is assigned to or can be assigned to the data storage device 20 with regard to specific attributes or attribute categories.

[0099] Specifically, a user can, for example, provide documents such as their identity card, their training certificate, etc., or contractual documents such as employment, purchase, leasing or other contracts for services and / or goods, such as audio and / or video content provision contracts, vehicle contracts, financial services contracts, mobile phone contracts, energy supply contracts, insurance contracts, treatment contracts, etc., which are analyzed or evaluated by the data processing device 30, e.g. using principles of pattern and / or text recognition, with regard to certain attributes or attribute categories. From a corresponding analysis or evaluation, general contract terms or conditions can therefore be derived as attributes. From a corresponding analysis orFurther attributes can also be derived from the analysis; for example, it can be determined that a user concludes long-term energy supply contracts with energy suppliers that supply renewable energy, or concludes short-term contracts with energy suppliers regardless of whether these suppliers supply renewable energy. It is also conceivable that, through appropriate analysis or evaluation of user-provided information, it can be determined that a user wishes to conclude certain contracts in the future with existing or new providers of all types of services and / or goods, or that they no longer wish to conclude contracts with existing or new providers of services and / or goods in the future. Of course, a user can also provide such information explicitly.

[0100] All analysis and evaluation algorithms required for this purpose can be implemented using artificial intelligence tools, i.e., in particular, single- or multi-layer artificial neural networks, which receive corresponding user-provided information as input information in an input layer, which is processed via one or more neurons or intermediate layers, and output in an output layer as specific attributes or attribute categories. Corresponding artificial neural networks can be trained using machine learning measures, e.g., with reference data, in order to achieve a more precise assignment of user-provided information or the information contained therein to specific attributes or attribute categories.

[0101] The user-related data obtained by processing corresponding user-provided information can be stored as user-related attribute data sets or collections in the, as mentioned, possibly cloud-based, data storage device 20. The data storage device 20 or the data processing device 30 associated therewith can be configured to implement a suitable folder structure for storing the attributes or attribute categories. A corresponding folder structure can implement both a user-related and a higher-level ordering of stored attributes or attribute categories, so that, for example, queries for specific attributes relating to a specific user, as well as general queries for users with specific attributes, can be performed.The implementation of a corresponding folder structure can enable simplified computer-based retrieval and, if necessary, further processing of the data stored in the data storage device 20.

[0102] The second authorization device can be configured to provide a requester with one or more query criteria, based on which the requester can submit a request for personal data 21 stored in the data storage device 20. To provide corresponding query criteria, at least one can be provided via which the query criteria can be provided, e.g., to a user-side terminal. The communication interface can form a component of the authorization device 50 or be assigned to it.

[0103] A corresponding query criterion can, for example, relate to or include at least one attribute or at least one attribute category from the following group of attribute categories: personal data of a user, such as name, gender, age, biometrics, size of one or more body parts, weight, health, origin, education, work or employment relationship, professional and / or social status, income, place of work and / or residence, political orientation, religious orientation, sexual orientation, professional and / or leisure intellectual activity, professional and / or leisure physical activity, leisure behavior, eating behavior, drinking behavior, social behavior, work-life balance, and / or contractual agreements of a user with providers of services and / or goods, such as existing communication contracts, leasing contracts, insurance contracts, media usage contracts, treatment contracts.Corresponding attributes or attribute categories can be specified by the user with any level of detail.

[0104] Corresponding query criteria can be generated and / or provided by a hardware- and / or software-implemented data processing device 30, 60 of the system 10. The data processing device 30, 60 can be configured, in particular, to generate and / or provide query criteria implemented in a user-dialog manner for specific attributes of one or more attribute categories of at least one user via a communication interface 82, 92, in particular a user-side terminal. The data processing device can comprise a hardware- and / or software-implemented device for generating and / or providing corresponding query criteria for specific attributes of one or more attribute categories of at least one user.The data processing device can, in particular, be configured to query query criteria in a user-dialog-like manner, following a predefined query sequence or logic. Implementing a corresponding query sequence or logic can make the generation of corresponding attribute data sets more efficient, particularly due to reduced computational effort, as the user-provided information typically has a certain logical relationship, e.g., due to a certain thematic proximity. This can simplify the computer-based assignment of the user-provided information to attributes or attribute categories.

[0105] Specifically, the data processing device can be configured, for example, to implement query criteria in a user-dialog format, possibly via a virtual dialog assistance application, e.g., implemented as an app, or via an audio and / or video dialog. A corresponding virtual dialog assistance application can be implemented, for example, as a chatbot. This allows for efficient and practical collection of user attribute-related data.

[0106] Corresponding query criteria can be provided or transmitted to a user-side terminal (client) as part of a communication that can be implemented via the communication interface, in particular interactively. The communication interface can, for example, comprise a user interface implemented via a website, software application (app), etc., via which corresponding query criteria can be communicated and / or user-side information regarding corresponding query criteria can be provided. Alternatively or additionally, corresponding query criteria can be transmitted, for example, via SMS, push message, instant message, email, etc., to a user-side terminal, such as the mobile terminal 90, so that corresponding query criteria can be transmitted, for example, in the form of a message chain, i.e., in particular, a chat.

[0107] Such communication can, as mentioned, be implemented, for example, via a software application (app), in particular in a (user) dialog-like manner, i.e., in the simplest case, according to the principle of question-answer, follow-up question-follow-answer, etc.; thus, the data processing device can be configured to ask at least one user questions based on appropriate query criteria—similar to or analogous to a conversation between people—in order to obtain information on specific attributes of specific attribute categories from the at least one user in the form of user-side inputs. Specifically, a user can request specific information, such as their name, age, gender, place of residence, etc., via an output interface, such as an audio and / or video interface, of a user-side terminal, such as the mobile terminal 90., and then, via corresponding inputs on their user-side device, provide information on query criteria, which can be assigned to specific attributes or attribute categories by the data processing device, e.g., through the implementation of artificial intelligence tools. Of course, multiple users can be asked for specific information in parallel or serially, and multiple users can provide information on query criteria in parallel or serially.

[0108] The system 10, i.e. in particular the authorization device 50, can thus comprise, for example, at least one artificial neural network configured to generate and / or provide query criteria, in particular implemented in a user-dialog-like manner, for specific attributes of one or more attribute categories of a user. In particular, the system 10, i.e. in particular the authorization device 50, can comprise an artificial neural network configured to generate at least one attribute data record containing the at least one user-supplied information in the data storage device 20, based on at least one user-supplied information provided via the first communication interface regarding at least one query criterion-related attribute.

[0109] The generation and / or provision of corresponding query criteria can thus be implemented using artificial intelligence means, i.e., in particular, artificial neural networks, which can be adapted to specific users if necessary. Thus, the system 10, i.e., in particular, the authorization device 50, can comprise artificial intelligence means, i.e., in particular, artificial neural networks, which are configured to generate and / or provide query criteria, in particular taking into account one or more, possibly user-related, input parameters. Corresponding query criteria can thus be created for specific users, e.g., based on user-related input parameters, and adapted or varied within the framework of a corresponding interaction with a user, possibly in real time.For example, it is conceivable that if a possibly unexpected delay in user input regarding certain query criteria is detected, a decision is made not to present a user with other query criteria, perhaps because the delay may indicate that a user does not wish to provide information regarding that query criterion. However, it should be noted at this point that a user naturally has the option of postponing or refusing to provide information regarding one or more query criteria.

[0110] It is conceivable that the same authorization device 50 is configured to communicate with the data storage device 20 via a network connection in order to enable access to one or more user-related data 21 stored in the data storage device 20 and verified with respect to at least one verification criterion, wherein the authorization device 50 is configured to establish access to one or more user-related data stored in the data storage device and verified with respect to at least one verification criterion if at least one authorization criterion is met, wherein the at least one authorization criterion is a match of user identity information derived from at least one biometric feature of a requester with the identity of the user of the user-related data, and is configuredto communicate with the data storage device 20 via a network connection, in particular to enable access to one or more user-related data 21 stored in the data storage device 20 and verified with respect to at least one verification criterion, wherein the authorization device 50 is configured to establish access to the data storage device 20 in order to store one or more user-related data 21 to be stored in the data storage device 20 and verified with respect to at least one verification criterion in the data storage device 20, and / or to change or establish one or more user-related data 21 stored in the data storage device 20 and verified with respect to at least one verification criterion,if at least one authorization criterion is met. The first and second authorization devices can thus be implemented as different functions of a common authorization device.

[0111] In all embodiments, the data storage device 20 can be assigned a data anonymization device implemented in hardware and / or software, which is configured to anonymize user-related data stored in the data storage device 20.

[0112] The data anonymization device can be configured to anonymize user-related data 21 stored in the data storage device 20 using artificial intelligence algorithms, in particular neural networks. Cryptographic principles for anonymizing the user-related data 21 stored in the data storage device 20 are also conceivable.

[0113] For all embodiments, it further applies that the data storage device 20 can be assigned a data processing device implemented in hardware and / or software, which is configured to process user-related data 21 stored in the data storage device 20.

[0114] The data anonymization device can be configured to process user-related data 21 stored in the data storage device 20 using artificial intelligence algorithms, in particular neural networks.

[0115] With the systems 10 shown in the figures, a method for user-authorized storage and / or release of user-related data of at least one user can be implemented, which method comprises in particular the following steps: providing a data storage device 20 in which one or more user-related data 21 verified with regard to at least one verification criterion can be stored or are stored; and authorizing, by means of an authorization device 50 which communicates with the data storage device 20 via a network connection, access to one or more user-related data 21 stored in the data storage device 20 and verified with regard to at least one verification criterion, wherein the authorization device 50 provides access to one or more user-related data 21 stored in the

[0116] Data storage device 20 stored, with respect to at least one

[0117] Verification criterion verified user-related data 21 if at least one authorization criterion is met, wherein the at least one authorization criterion is a match of user identity information derived from at least one biometric feature of a requester with the identity of the user of the user-related data 21

Claims

PATEN TAN SAYINGS 1. System for user-authorized storage and / or release of user-related data of at least one user, comprising: - a data storage device in which one or more user-related data verified with regard to at least one verification criterion can be stored or are stored, - an authorization device which is configured to communicate with the data storage device via a network connection, in particular to enable access to one or more user-related data stored in the data storage device and verified with regard to at least one verification criterion, wherein the authorization device is configured to establish access to one or more user-related data stored in the data storage device and verified with regard to at least one verification criterion if at least one authorization criterion is met, wherein the at least one authorization criterion is a match between user identity information derived from at least one biometric feature of a requester and the identity of the user of the user-related data.

2. System according to claim 1, wherein the authorization device is configured to enable a transfer of one or more user-related data stored in the data storage device and verified with respect to at least one verification criterion to at least one data storage device separate from the data storage device if the at least one authorization criterion is met.

3. System according to claim 1 or, wherein the authorization device is configured to transmit data in an encrypted manner, in particular using block chain principles.

4. System according to claim 2 or 3, wherein the separate data storage device forms a cloud storage or a component thereof and / or a terminal device of the requester.

5. System according to one of the preceding claims, wherein the authorization device is configured to enable corresponding access to one or more user-related data stored in the data storage device and verified with respect to at least one verification criterion and / or a corresponding transfer of one or more user-related data stored in the data storage device and verified with respect to at least one verification criterion to at least one data storage device separate from the data storage device depending on the presence of an additional release criterion.

6. The system according to claim 5, wherein the additional release criterion is user release information describing an active release action of the user to which the verified user-related data relates.

7. System according to one of the preceding claims, wherein the at least one biometric feature of a requester is a sensory detectable acoustic and / or haptic and / or optical and / or thermal feature of the requester.

8. The system of claim 7, wherein the at least one biometric feature is at least one feature of the requester's iris.

9. System according to one of the preceding claims, wherein the authorization device is configured to process the at least one biometric feature by means of at least one artificial intelligence algorithm, in particular a neural network, for deriving and generating the user identity information.

10. System according to one of the preceding claims, further comprising: an authorization device which is configured to communicate with the data storage device via a network connection, in particular to enable access to one or more user-related data stored in the data storage device and verified with respect to at least one verification criterion, wherein the authorization device is configured to establish access to the data storage device in order to store one or more user-related data to be stored in the data storage device and verified with respect to at least one verification criterion in the data storage device, and / or to change one or more user-related data stored in the data storage device and verified with respect to at least one verification criterion, if at least one authorization criterion is met,wherein the at least one authorization criterion is a match between user identity information derived from at least one biometric feature of a user and the identity of the user of the user-related data.

11. System according to one of the preceding claims, wherein the authorization device is arranged to provide a requester with one or more query criteria on the basis of which the requester can make a request.

12. System according to claim 11, wherein a query criterion relates to at least one attribute category from the following group of attribute categories: - personal data of a user, such as name, gender, age, biometrics, size of one or more body parts, weight, health, origin, education, employment relationship, professional and / or social status, Income, place of work and / or residence, political orientation, religious orientation, sexual orientation, professional and / or leisure intellectual activity, professional and / or leisure physical activity, leisure behavior, eating behavior, drinking behavior, social behavior, work-life balance, and / or - contractual agreements of a user with providers of services and / or goods, such as existing communication contracts, leasing contracts, insurance contracts, media usage contracts, treatment contracts.

13. System according to one of claims 11 or 12, wherein the data processing device is configured to query query criteria implemented in a user dialog-like manner and ordered according to a predefined query sequence or logic.

14. System according to one of claims 11 to 13, wherein the data processing device is configured to implement query criteria in a user dialogue-like manner, optionally via a virtual dialogue assistance application, via an audio and / or video dialogue.

15. System according to one of the preceding claims, wherein the authorization device is assigned a data anonymization device which is configured to anonymize user-related data stored in the data storage device.

16. System according to claim 15, wherein the data anonymization device is configured to anonymize user-related data stored in the data storage device via artificial intelligence algorithms, in particular neural networks.

17. System according to one of the preceding claims, wherein the authorization device is assigned a data processing device which is configured to process user-related data stored in the data storage device.

18. System according to claim 17, wherein the data anonymization device is configured to process user-related data stored in the data storage device via artificial intelligence algorithms, in particular neural networks.

19. A method for user-authorized storage and / or release of user-related data of at least one user, comprising the steps: - Providing a data storage device (20) in which one or more user-related data (21) verified with regard to at least one verification criterion can be stored or are stored, and authorizing, by means of an authorization device (50) which communicates with the data storage device (20) via a network connection, an access to one or more user-related data (21) stored in the data storage device (20) and verified with regard to at least one verification criterion, wherein the authorization device (50) allows access to one or more user-related data (21) stored in the Data storage device (20) stored user-related data (21) verified with respect to at least one verification criterion, if at least one authorization criterion is met, wherein the at least one authorization criterion is a match of user identity information derived from at least one biometric feature of a requester with the identity of the user of the user-related data (21).

Images