PII Token Handler for Consent-Gated Third-Party Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems provide little control to users over their personally identifiable information (PII), which is vulnerable to exposure and misuse, especially when servers are breached or information is sold to third parties.
Innovation Solution
A system that allows users to store PII on personal devices, requiring consent for access and using token handlers to manage encrypted information, generating tokens for access, and employing a key management scheme with periodic key updates to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users store PII on personal devices with consent mechanisms, then user control over information is improved, but system complexity increases
Solution Approach 1:
The patent introduces a token handler as an intermediary component that mediates between users and third-party providers. The token handler manages encrypted PII storage, generates access tokens, and handles consent workflows, thereby implementing user control without requiring complex client-side implementation in user devices. This intermediary absorbs the complexity while providing a simple interface to users.
Solution Approach 2:
The patent extracts the complex security management functions (encryption, token generation, consent handling) from the user's personal device and places them in a separate token handler service. This allows the user device to remain simple while the specialized security infrastructure handles the complexity of user control mechanisms.
2Reliability
If the system encrypts and tokenizes PII before storing on third-party servers, then security against server breaches is improved, but data access complexity increases
Solution Approach 1:
The patent applies preliminary encryption and tokenization to PII before it is stored on third-party servers. The PII is encrypted using the user's public key and then tokenized, so that even if the server is breached, the actual PII remains protected. This preliminary security measure is automated by the token handler, which manages the complexity of the encryption and tokenization processes.
Solution Approach 2:
The patent creates a token copy of the PII that can be stored and transmitted instead of the actual sensitive data. The token handler generates tokens that represent the PII and can be used for access control, while the actual PII remains encrypted and secure. This copying approach allows data access operations to proceed with tokens rather than sensitive information.
3Reliability
If the system implements periodic key updates and multiple encryption keys, then long-term security is improved, but computational overhead increases
Solution Approach 1:
The patent implements periodic key updates as a scheduled action. The token handler periodically generates new key pairs and rotates encryption keys according to a predetermined schedule or security policy. This periodic action ensures long-term security without requiring continuous computational resources, as key management operations are performed at scheduled intervals rather than continuously.
Data Source
AI summary
A system allows a user to store his personally identifiable information (PII) on a personal device. When a third party wants to access the user's PII (e.g., to update the PII or to retrieve the PII), a notification will be presented to the user on the personal device seeking consent to the access. The notification may inform the user as to what information is being requested and which entity is requesting the access. The requested access will be denied unless the user consents to the access. In this manner, the user is given control over the dissemination of his PII. Additionally, the system alters or adjusts the PII that is stored in third-party servers so that even if these servers are breached, the user's actual PII is not exposed.