Tokenized PII Access Control With User-Consent Data Release
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users have little control over their personally identifiable information (PII) and it is vulnerable to exposure and misuse, especially when stored on third-party servers, which can be breached by malicious users.
Innovation Solution
A system that allows users to store PII on personal devices, requiring consent for access and using encrypted tokens and anonymized data to protect information, with a token handler managing access and encryption keys to enhance security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If users store PII on provider servers for easy access and service delivery, then service convenience is improved, but security and user control deteriorate because servers can be breached and information sold without user consent
Solution Approach 1:
The patent introduces a token handler as an intermediary component that mediates between users and service providers. The token handler stores tokens representing PII and controls access to this information, preventing direct access to raw PII while enabling service delivery. This intermediary architecture allows service convenience to be maintained through token-based access while improving security by eliminating direct server storage of sensitive PII.
2Adaptability or versatility
If providers maintain user information on servers for service delivery, then service functionality is improved, but user control over information deteriorates
Solution Approach 1:
The token handler serves as a mediator that enables service functionality through token-based access control while simultaneously restoring user control. Users can grant or revoke access permissions through the token handler interface, and the system maintains adaptability by allowing different service providers to access specific tokens as needed. This resolves the contradiction by decoupling service functionality from direct server storage of PII.
Solution Approach 2:
The patent segments user information control into two parts: tokens representing PII stored in the token handler, and actual PII stored locally on user devices. This segmentation allows service providers to access only the token portion through controlled interfaces, maintaining service functionality while giving users direct control over their actual PII through local storage and consent mechanisms.
3Adaptability or versatility
If multiple providers access user PII for various services, then service versatility is improved, but security risk increases due to multiple access points
Solution Approach 1:
The token handler acts as a centralized intermediary that manages access for multiple service providers. Instead of each provider having direct access to user PII, all access requests must go through the token handler, which validates permissions and grants access only to authorized providers. This maintains service versatility while reducing security risk by eliminating multiple direct access points to sensitive data.
Data Source
AI summary
When a third party wants to redeem a user's personally identifiable information (PII), the third party presents to the system a token representing the PII, which indicates a request for the PII. The system seeks consent from the user for sending the PII to the third party. If the user grants consent, then the system prepares the PII for the third party. In some embodiments, the third party can initiate a telephone call with a dispatch to receive the PII. In some embodiments, the third party can receive the PII directly from the system.