Protection of sensitive data of a user from being utilized by web services

Systems and methods for preventing web services from using sensitive data in customizing web pages for a user. In one embodiment, a protection system is implemented between the user and the web service. The protection system identifies past interactions of the user with the web service, identifies text in the past interactions between the user and the web service, and identifies subjects discussed in the text. The protection system then communicates with the user to determine which of the subjects are sensitive to the user, and deletes a history stored by the web service for the user that relates to the sensitive subjects.

FIELD OF THE INVENTION

The invention is related to the field of communications and, in particular, to web services.

BACKGROUND

Web services (also referred to as online services) are becoming very popular as more and more web sites and applications are available to consumers. Some common types of web services are email, Instant Messaging (IM), blogs, internet search engines, social networking, etc. Because of the popularity of web services, service providers are continually looking for ways to improve the quality of the web services from the point of view of the consumer. One way to improve the quality of web services is to personalize the experience of the consumer. A web service can personalize the experience of a consumer by customizing web pages that are displayed to the consumer. The web service can customize content on the web page, the layout of the web page, external links displayed on the web page, advertisements, etc. To customize the web pages, the web service builds a profile for the consumer by collecting historical data for the consumer's prior usage of the web service. The historical data may be prior search queries, links selected, time spent on a particular web page, etc. For example, if a consumer surfs the internet using a search engine such as Google search, then the search engine (e.g., Google) may build a profile for the consumer that indicates the prior searches performed by the consumer.

Unfortunately, a consumer may not have control over what data is utilized by the web service when generating customized web pages. Some data may be sensitive to the consumer, and he/she may not want web pages customized using sensitive data. For example, if a consumer searches the internet for information about a disease, the consumer may not want the search engine to display advertisements related to the disease each time the consumer performs a search. Thus, consumers may want more control over what data a web service is able to use to personalize the consumer's experience.

SUMMARY

Embodiments described herein prevent web services from customizing web pages for a user based on subjects that may be sensitive to the user. The systems described herein, for example, monitor past and real-time interactions (e.g., emails, search queries, search results, web pages visited, etc) of a user with web services, and determines if some of the interactions relate to sensitive subjects. If so, the systems are able to selectively delete a past history of the user from the web service, and prevent sensitive data from being shared with the web service on future interactions. This advantageously allows the user more control over what types of potentially sensitive data is being used by a web service when personalizing a web page for the user.

Some web services provide tools where a user may change settings or preferences to completely stop personalization of web pages. This essentially makes the user autonomous to the web service. However, autonomous web services are not as useful as personalized web services, and disabling all personalization can severely affect the quality of the service. Some web services also provide tools for deleting or changing specific information in a user's profile. Although the user has fine-grained control over the data available to the web service, it is impractical for the user to repeatedly parse through vast amounts data to determine what may be sensitive and what should be changed.

The systems described herein are implemented between the user and the web service. Therefore, the systems can automatically monitor the interactions between the user and the web service, and identify if potentially sensitive subjects are involved in the interactions. If so, the systems can automatically prevent the web service from customizing web pages based on the sensitive subjects. Thus, the user can still receive customized web pages that relate to other subjects that are not sensitive, such as news, weather, sports, etc., but don't need to worry about a customized web page that may be embarrassing. Also, the systems described herein can be used with different types of web services, such as search engines, social networking sites, email, etc. Thus, a user does not need to figure out how to disable personalization features in many different types of web services.

In one embodiment, a protection system is implemented between a user and a web service. The protection system is configured to identify past interactions of the user with the web service, to identify text in the past interactions between the user and the web service, and to identify subjects discussed in the text. The protection system is further configured to communicate with the user to determine which of the subjects are sensitive to the user, and to delete a history stored by the web service for the user that relates to the sensitive subjects.

In another embodiment, the protection system is further configured to query the web service for the past interactions between the user and the web service.

In another embodiment, the protection system is further configured to monitor real-time interactions between the user and the web service over time.

In another embodiment, the protection system is further configured to query a device of the user for cookies stored by the device.

In another embodiment, the protection system is further configured to assign sensitive scores to the subjects, and display the sensitivity scores for the subjects to the user.

In another embodiment, the protection system is further configured to receive input from the user on the sensitivity scores, and to adjust the sensitivity scores for the subjects based on the input from the user.

In another embodiment, the protection system is further configured to intercept a request for the web service as initiated by the user, to parse the request to determine if the request includes text that relates to a sensitive subject, and to send an alert to the user that includes at least one option for handling the request.

In another embodiment, the protection system is further configured to anonymize the request before sending the request to the web service in response to input from the user.

In another embodiment, the protection system is further configured to block the request from being sent to the web service in response to input from the user.

Another embodiment comprises a method of preventing a web service from customizing web pages for a user based on sensitive subjects. The method includes identifying past interactions of a user with a web service, identifying text in the past interactions between the user and the web service, and identifying subjects discussed in the text. The method further includes communicating with the user to determine which of the subjects are sensitive to the user, and deleting a history stored by the web service for the user that relates to the sensitive subjects.

In another embodiment, the method step of identifying past interactions of a user with a web service comprises querying the web service for the past interactions between the user and the web service.

In another embodiment, the method step of identifying past interactions of a user with a web service comprises monitoring real-time interactions between the user and the web service over time.

In another embodiment, the method step of identifying past interactions of a user with a web service comprises querying a device of the user for cookies stored by the device.

In another embodiment, the method further comprises assigning sensitive scores to the subjects, and displaying the sensitivity scores for the subjects to the user.

In another embodiment, the method further comprises receiving input from the user on the sensitivity scores, and adjusting the sensitivity scores for the subjects based on the input from the user.

In another embodiment, the method further comprises intercepting a request for the web service as initiated by the user, parsing the request to determine if the request includes text that relates to a sensitive subject, and sending an alert to the user that includes at least one option for handling the request.

In another embodiment, the method further comprises anonymizing the request before sending the request to the web service in response to input from the user.

In another embodiment, the method further comprises blocking the request from being sent to the web service in response to input from the user.

Another embodiment includes a non-transitory computer readable medium that stores instructions that when executed by a computing system, causes the computing system to perform a method of identifying past interactions of a user with a web service, identifying text in the past interactions between the user and the web service, and identifying subjects discussed in the text. The method further includes communicating with the user to determine which of the subjects are sensitive to the user, and deleting a history stored by the web service for the user that relates to the sensitive subjects.

In another embodiment, the method further comprises intercepting a request for the web service as initiated by the user, parsing the request to determine if the request includes text that relates to a sensitive subject, and sending an alert to the user that includes at least one option for handling the request.

Other exemplary embodiments may be described below.

DESCRIPTION OF EMBODIMENTS

FIG. 1illustrates a communication system100in an exemplary embodiment. Communication system100includes an end user device110that is able to access one or more web services. Some examples of device110are a PC, a laptop, a phone, etc. The term “web services” is used herein to refer to services that are provided over a network, such as the internet, and that store a history for a user in order to customize web pages for the user. Web services may also be referred to herein as “online services”. Device110is operated by a person that is referred to herein as a user112. Device110is able to execute a dedicated application or browser-based application to access one or more web services over network120. Network120comprises any type of communication network that allows a device to access a web service. Network may include an IP-based data network, such as the internet, an enterprise network, the World Wide Web, etc., and/or a Packet-Switched (PS) telecommunication (telecom) domain, such as an IP Multimedia Subsystem (IMS) network, a Long Term Evolution (LTE) network, etc. Those skilled in the art will appreciate that multiple elements, servers, or routers (not shown) of network120may commit resources to provide a device access to a web service.

FIG. 1further shows that the web service is provided by a service platform130. Service platform130may include one or more servers that provide a web service132. For example, service platform130may represent one or more servers that provide an internet search engine. In some embodiments, an open Application Programming Interface (API) may be implemented between device110and service platform130. The open API allows device110to issue requests to service platform130using standardized or generic commands. For example, the requests from device110may be formatted according to RESTful, SOAP, Parlay X, etc. Service platform130, or an intermediate gateway (not shown), may be able to convert the requests from the API into a protocol used for the web service.

In the following embodiments, a protection system122is implemented between user112and web service132. Protection system122provides a tool that is able to control what information or data the web service132is allowed to use to provide customized web pages for user112. Protection system122may be implemented in any data path between the user's device110and web service132. For instance, protection system122may be implemented in device110, such as an application or a browser plugin. Protection system122may alternatively be implemented in network120, such as a proxy server. There are many locations between user112and web service132where protection system122may be implemented, as long as protection system122is able to access data that is exchanged between the user's device110and web service132. As an example, protection system122may sit in an internet path between user112and web service132so that protection system122can intercept search requests from device110(such as for a web search), intercept search results returned to device110from web service132, etc.

Because protection system122can control what data is used by web service132, protection system122is able to stop or inhibit web service132from using data that relates to a potentially sensitive subject. For instance, if user112were to perform an internet search on the subject of a particular disease, user112may not want web service132to customize web pages in the future with advertisements related to the disease. In this embodiment, protection system122includes an interface124and a controller126. Interface124comprises any component or element operable to communicate with user's device110, and to communicate with web service132. Controller126comprises any component or element operable to process or parse communications exchanged between the user's device110and web service132, and to control which the data web service132is allowed to use in customizing web pages. By controlling the data that web service132is allowed to use, protection system122can prevent web service132from customizing web pages for user112based on potentially sensitive subjects. An exemplary operation of protection system122is illustrated inFIG. 2

FIG. 2is a flow chart illustrating a method200of preventing web service132from customizing web pages for user112based on sensitive subjects in an exemplary embodiment. The steps of method200will be described with reference to protection system122inFIG. 1, but those skilled in the art will appreciate that methods described herein may be performed in other systems. The steps of the flow charts described herein are not all inclusive and may include other steps not shown. The steps may also be performed in an alternative order.

In step202, controller126identifies past interactions of user112with web service132. An interaction comprises a communication from a user to a web service, and possibly a response provided by the web service to the user. The following gives some examples of interactions with web services. For a search engine (e.g., Google, Yahoo, Bing, etc.), interactions include a user's past queries, results clicked, etc. For social networking websites (e.g., Facebook, Twitter, etc.), interactions include social interactions of the users, such as status updates, wall posts, comments, Instant Messages (IM), etc. For email providers, interactions include emails, replies, importance flags, tags/folders, chat history, etc. For online storage providers, interactions include the documents uploaded by the user, read/writes, etc.

To identify the past interactions of user112, controller126may query web service132to extract a history for user112that is maintained by web service132. The user history may include a search history of past queries made to web service132by user112, links browsed by user112when accessing web service132, etc. Controller126may also monitor the user's real-time requests to web service132over time, and monitor the responses provided by the web service132. Controller126can then build a history for user112based on the real-time interactions. Controller126may also contact other sources to obtain a history for user112by querying device110(e.g., for cookies stored by device110), by querying other web services, by searching documents on a disk, etc. Based the interactions between user112and web service132, controller126is able to build a profile for user112that shows a history of user112accessing web service132. Protection system122may first ask user112for permission to access information on the user's history, such as by providing a login or another type of authentication mechanism.

In step204, controller126identifies text in the past interactions between user112and web service132. One assumption is that the interactions include some type of textual information that is exchanged. As an example, for a search query, controller126may extract terms (words) from a search request, and extract text from the results (links, snippets) of the search request as provided by web service132. For a web page, controller126may extract text from the title and body of the web page. For an email or IM message, controller126may extract text from the subject and/or body. Controller126is able to parse any desired portion of an “interaction” to extract text.

After extracting text from the past interactions, controller126identifies one or more subjects discussed or described in the text in step206. In other words, controller126may categorize the text found in the past interactions it into different subjects or topics. The subjects could be from an identifiable topic such as “medical”, “health”, “financial”, “sports”, “weather”, “news”, etc., or could be built automatically by extracting frequent words, such as “Friends TV series”, “Alcatel-Lucent”, etc. A subject as described herein may include a name, such as “medical”, and one or more terms that relate to the subject, such as “doctor”, “hospital”, “disease”, etc. In addition to identifying the subjects found in the text, controller126may assign a sensitivity score to each of the subjects. Controller126may use information learned from user112(and global information from other users) to find words or terms that are considered sensitive topics. Controller126can then assign a sensitivity score to the subjects that are considered sensitive.

In step208, controller126communicates with user112through interface124to determine which of the subjects are sensitive to user112. Interface124may display the subjects to user112(such as through device110), and user112may provide input or feedback to controller126as to which of the subjects are sensitive to user112.FIG. 3illustrates an exemplary display provided to user112by protection system122in an exemplary embodiment. InFIG. 3, interface124provides a display to user112having the following subjects: “medical”, “health”, “financial”, “sports”, “weather”, and “news”. User112may then decide which of these subjects are sensitive, and provide input to protection system122.

In one embodiment, interface124may also display the sensitivity scores to user112that are assigned to each subject by protection system122.FIG. 4illustrates another exemplary display provided to user112by protection system122in an exemplary embodiment. InFIG. 4, interface124displays the same subjects to user112as inFIG. 3, but also displays a sensitivity score assigned to each subject. User112may decide which of these subjects are sensitive, and adjust the sensitivity scores for each subject. User112may also manually create one or more subjects, and assign a sensitivity score to them. Protection system122will treat the manual categories similar to the categories automatically created by protection system122based on the user's history.

Controller126then receives the input from user112through interface124. At this point, protection system122has identified one or more subjects that are considered sensitive to user112. In step210, controller126deletes a history that is stored by web service132for user112that relates to the sensitive subject(s). For instance, controller126may interact with the web service APIs and delete each query made to web service132by user112, each link browsed by user122when accessing web service132, or any other data from the user's history that relates to a sensitive subject. By deleting the history for user112, web service132will not be able to customize web pages for user112based on sensitive information. For example, if user112previously used a search engine to search for a cure for baldness, the search engine will not customize web pages for user112with hair growth products the next time the search engine is used.

For the operation of protection system122discussed above, protection system122is able to delete a history of user112from web service132that relates to a sensitive subject. Protection system122is also able to monitor real-time interactions of user112with web service132to protect future interactions.

FIG. 5is a flow chart illustrating a method500of protecting real-time requests from a user to a web service in an exemplary embodiment. The steps of method500will be described with reference to protection system122inFIG. 1, but those skilled in the art will appreciate that methods described herein may be performed in other systems.

One assumption for method500is that protection system122stores a profile for user112that indicates one or more subjects that are sensitive to user112. The profile for user112may also indicate a sensitivity score for each of the subjects. With the profile being stored in protection system122, user112sends a request to web service132(through device110). For example, if web service132is a search engine, then the request may be a search request with one or more search terms.

According to method500, interface124of protection system122intercepts the requests for web service132as initiated by user112in step502. Controller126then parses the request (or a response to the request) to determine if the request includes text that relates to a sensitive subject in step504. If the request does not include text that relates to a sensitive subject, then controller126sends the request to web service132as-is in step514. If the request includes text that relates to a sensitive subject, then controller126sends an alert to user122in step506. The alert indicates that the request from user112relates to a sensitive subject. The alert from protection system122may also include one or more options for handling the request. One option is to make the request anonymous before the request is sent to web service132. Another option is to block the request from web service132.

In response to the alert sent to user112, interface124receives input or feedback from user122in step508. If the input from user112is to make the request anonymous, then controller126sends the request to web service132without identification information for user112in step510. For example, controller126may remove all cookies that identify user112or the current session from the request before sending to web service132. Controller126may alternatively send the request to web service132through an IP-anonymizer so that web service132is not able to track the IP address of user112. Step510may also be referred to as “anonymizing” the request before it is sent to web service132. If the input from user112is not to make the request anonymous, then controller126sends the request to web service132as-is in step514.

If the input from user112is to block the request, then controller126stops the request from being sent to web service132in step512, and deletes the request. If the input from user112is not to block the request, then controller126sends the request to web service132as-is in step514.

Once a term or subject is determined to be sensitive to user112, controller126may determine whether or not to anonymize requests without asking user112.

Based on method500, requests that contain sensitive information are either sent anonymously to web service132or are not sent at all. That way, web service132cannot build a history for user112that includes sensitive information. If web service132does not have a history for user112that includes sensitive information, then web service132advantageously cannot customize web pages for user112based on sensitive information. Therefore, user112will have a more pleasant experience with web service132.

The following illustrates an example of how protection system122may identify subjects discussed in the text of the past interactions between user112and web service132. For this algorithm, any interaction between user112and web service132is referred to as an “entity”, and the subjects found in the text are referred to as “clusters” of text. For this algorithm, the inputs are entities (E1 . . . En). The algorithm then works as follows:

1. Put each entity in a separate cluster.

2. Pick the pair of clusters Ci and Cj with max similarity (ClusterSim(Ci, Cj)).

4. If ClusterSim(Ci, Cj)>=cluster_threshold, then merge Ci and Cj into a single cluster and repeat.

The following illustrates the ClusterSim Algorithm. The inputs for this algorithm are clusters C1 and C2. The algorithm then works as follows:

1. Extract the normalized word frequencies Wi(C1) and Wi(C2) for each word in each entity of C1 and C2.

The following illustrates an exemplary algorithm for computing the sensitivity scores for a cluster. The input for this algorithm (SenseScore Algorithm) is cluster C which contains entities (E1 . . . En). The algorithm works as follows:

1. Compute sensitivity of word Wi as:

sensitivity⁡(Wi)=∑c⁢⁢(Wi⁡(C)⁢SensitivityUser⁡(C))/∑c⁢⁢(Wi⁡(C))
where SensitivityUser(C) is the sensitivity score allocated by the user to cluster C.

2. Compute sensitivity of cluster C as:
sensitivity(C)=Σi=1n(Wi(C)sensitivity(Wi)