Patent Publication Number: US-11646875-B2

Title: Data stream identity

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
     The present patent application is a continuation of U.S. patent application Ser. No. 16/459,373 filed Jul. 1, 2019, issued as U.S. Pat. No. 10,999,067, which claims the priority benefit of U.S. provisional patent application No. 62/692,371 filed Jun. 29, 2018, the disclosures of which are incorporated by reference herein. 
    
    
     BACKGROUND OF THE INVENTION 
     1. Field of the Invention 
     The present invention generally relates to data stream management. More specifically, the present invention relates to managing identities assigned to data streams. 
     2. Description of the Related Art 
     Multiple different entities may be involved in different capacities as to the content of data streams. For example, different entities may be involved in the generation of the data, other contribution of data, analysis of the data, distribution of the data, consumption of the data, etc. As such, each entity may be associated with different portions of a data stream, as well as entitled to different rights to such portions. Each entity may be associated with different policies and requirements that such entity may wish to apply to their respective portions. 
     For example, a video stream may involve entities associated with the camera that captured the video, entities associated with the processing software (e.g., facial recognition) applied to the video, entities that appear in or are associated with images in the video, distributors of the video, and consumers or other recipients of the video. 
     There is currently no way, however, of associating a data stream (or defining specific segments therein) with entity-specific data of multiple entities with such granularity. For example, specific segments of the video may be associated with different entities, and such segments may overlap to different extents. No presently known system is capable of defining entity-specific segments within a single data stream for multiple different entities, associating such segments with respective entities, nor applying multiple different authorization requirements to different segments (some of which may overlap to different extents) of the same data stream. 
     There is, therefore, a need in the art for systems and methods of assigning, identifying, and managing identities associated with data streams. 
     SUMMARY OF THE CLAIMED INVENTION 
     Embodiments of the present invention allow for data sets to assume their own identity with individual requirements for lifecycle and access control management attached. In particular, individual data sets may be associated with a unique identifier. A data stream may be broken down, for example, into multiple data segments, which may be part of a data set. Such data set may not necessarily be contiguous. For example, an individual may appear, then disappear, then reappear in a video at different points in time. Such individual may further appear in only a small portion of each image frame. As such, that individual may be associated with a data set comprising the respective portions in which he or she appears at the different points in time. 
     Various embodiments may include methods for managing data stream identity. Such methods may include analyzing ownership information regarding a data stream to identify at least one owner, filtering the data stream to identify at least one portion that is associated with the identified owner, assigning a unique identifier to the identified portion, storing the identified portion in memory in association with the assigned unique identifier and information regarding the identified owner, and controlling access to the identified portion based on settings set by the identified owner. 
     Further embodiments may include systems for managing data stream identity. Such systems may include a communication interface that receives a data stream over a communication network, as well as a processor that executes instructions for analyzing ownership information regarding a data stream to identify at least one owner, filtering the data stream to identify at least one portion that is associated with the identified owner, and assigning a unique identifier to the identified portion. Systems may further include memory that stores the identified portion in memory in association with the assigned unique identifier and information regarding the identified owner; and the processor may control access to the identified portion based on settings set by the identified owner. 
     Yet further embodiments may include non-transitory computer-readable storage media having embodied thereon programs that are executable to perform the methods described herein. 
    
    
     
       BRIEF DESCRIPTION OF THE FIGURES 
         FIG.  1    illustrates a simplified network environment in which a system for managing data stream identity may be implemented. 
         FIG.  2    is a flowchart illustrating an exemplary method for managing data stream identity. 
         FIG.  3    illustrates an exemplary computing system that may be used to implement an embodiment of the present invention. 
     
    
    
     DETAILED DESCRIPTION 
     Embodiments of the present invention allow for data sets to assume their own identity with individual requirements for lifecycle and access control management attached. In particular, individual data sets may be associated with a unique identifier. A data stream may be broken down, for example, into multiple data segments, which may be part of a data set. Such data set may not necessarily be contiguous. For example, an individual may appear, then disappear, then reappear in a video at different points in time. Such individual may further appear in only a small portion of each image frame. As such, that individual may be associated with a data set comprising the respective portions in which he or she appears at the different points in time. 
       FIG.  1    illustrates an exemplary network environment in which a system for managing data stream identity may be implemented. As illustrated, an exemplary network environment  100  may include a variety of different entities, including entity A  120 A (e.g., personal user devices), entity B  120 B (e.g., individual users), entity C  120 C (e.g., Internet of Things (IoT) devices), and entity D  120 D (e.g., services/server systems). Such entities  120 A-D may communicate over one or more different types of communication networks  110  with one or more identity servers A  130 A and B  130 B. 
     Communication network  110  may be a local, proprietary network (e.g., an intranet) and/or may be a part of a larger wide-area network. The communications network  110  may be a local area network (LAN), which may be communicatively coupled to a wide area network (WAN) such as the Internet. The Internet is a broad network of interconnected computers and servers allowing for the transmission and exchange of Internet Protocol (IP) data between users connected through a network service provider. Examples of network service providers are the public switched telephone network, cellular or mobile service providers, a cable service provider, a provider of digital subscriber line (DSL) services, or a satellite service provider. Communications network  110  allows for communication between the various components of network environment  100 . 
     In some instances, entities  120 A-D may communicate with identity servers  130  over communication network  110  via an API gateway (not pictured). Such an API gateway may serve as an entry point for an entity  120  to a service mesh. API gateway may expose public endpoints for identification and authentication, as well as inject into a data stream contextual data (e.g., via a token to proxied requests signed using a private key issued exclusively for the API gateway (e.g., by an internal certificate authority in a security plane)). API gateway can enforce rich policies that can be created in identity server  130  (e.g., based on such factors as user attributes, roles, relationships, session attributes, current location, device information, authentication methods used, and risk factor of a transaction user or a device). 
     Entities  120 A-D may use or be embodied in any number of different electronic devices, such as general purpose computers, mobile phones, smartphones, smartwatches, wearable devices, personal digital assistants (PDAs), portable computing devices (e.g., laptop, netbook, tablets), desktop computing devices, handheld computing device, smart sensors, smart appliances, IoT devices, devices networked to controllers for smart control, servers and server systems (including cloud-based servers and server systems), or any other type of computing device capable of communicating over communication network  110 . Such devices associated with entities  120 A-D may also be configured to access data from other storage media, such as local caches, memory cards, or disk drives as may be appropriate in the case of downloaded services. Devices associated with entities  120 -A-D may include standard hardware computing components such as network and media interfaces, non-transitory computer-readable storage (memory), and processors for executing instructions that may be stored in memory. 
     Identity servers  130  may provide a platform for managing data stream identity. Identity server  130  may be installable in the cloud or on-premises. Such identity server  130  may also include a public key infrastructure (PKI) that allows for reading, generation, assignment, and management of digital certificates, security keys, and other encryption data. Identity server  130  may therefore uniquely associate each entity  120  with a set of identification data that allows for entity-specific identification, digital signature, and/or encryption. Entity-specific identity information may be generated by one or more identity servers  130 , as well as other identity providers (e.g., Facebook, OAuth OpenID, biometric signatures). 
     Identity servers  130  may generate a private key (e.g., PKI-based key) that is unique to each identified specific entity  120 , which allows the entity  120  to be identified and allows the entity  120  to manage its associated data portions or segments within a stream. In some instances, identity server  130  may issue a private key to an entity  120  upon registrations. Otherwise, identity server  130  may identify a new entity  120  that has not registered and issue a placeholder or nonce key to the identified new entity  120 . Upon registration or attestation at a later point in time, the nonce key may be correlated with the identified new entity  120 . The key issued by the identity server  130  allows the entity  120  to secure (e.g., encrypt or digitally sign) data portions within the stream with which the entity  120  is associated. As such, each entity  120  may have data-field level control over access to its respective data portions. In some instances, entity-specific identity data may be used to sign authorization policies that may then be packaged with the data stream. As such, if another wishes to access a data portion associated with a specific entity  120 , such access may be governed by the authorization policies of the specific entity  120 . Such authorization policies may govern various conditions under which the data portion is allowed to be accessed, for example, when the data portion may be access, how such data portion may be access, etc. 
     As entities  120  communicate data to each other, data may be added to a data stream that is associated with one or more entities  120 . Different data segments of a data stream may be associated with a different set of entities  120 . Each data portion may therefore be associated with different sets pf authorization policies. By breaking down such collections of data (e.g., a data stream) into data sets that can each be associated with unique identifiers, the different data sets may further be assigned to different entities  120 . Each entity  120  may further exercise certain rights to their respective data set, which may also be subject to different policies and rules based on the entity  120  with which the data set is associated. Referring to the example above, an individual whose image appears in a video may be identified as an owner of the data set comprising the portions (including portions of each image frame) in which he or she appears. As such, the individual may choose to manipulate that data set (e.g., by blacking out, deleting, pixelating the respective portions) or restrict access permissions (e.g., remove from public view, restrict to identified individuals or groups). Moreover, the individual may live in certain jurisdictions with policies and rules that govern privacy rights, rights of publicity, and other rights. Such policies and rules may be applied, specifically to the data set. 
     A single data stream may therefore be associated with different owners assigned to the different data sets identified within the stream and assigned unique identifiers. Such identifier and ownership data may be stored in a database in association with the respective data sets in the data stream (e.g., a video). Ownership data may further reflect the location of the owner, as well as certain access and control rights specified by the set of authorization policies. Certain access and control settings specified by an owner may also be stored in association with the data set. An owner may further be given the authority to manage their respective data set, which may further be stored in an encrypted format. The respective encryption keys may then be shared with other individuals and groups authorized by the owner to access the underlying data set associated with the owner. 
     In some embodiments, the data stream itself may be treated holistically, allowing for association with multiple different encryption keys, different consent patterns, different ownership schemes, etc. based on the different data sets identified within the complete data stream. 
     The data stream may be processed by one or more identity servers  130 , which may make use of various libraries to identify specific entities associated with the stream. For example, image libraries may be used to identify specific entities captured in a video stream. Some membership organizations or other associations, for example, may issue picture identification to its members or associates. Digital libraries that include such pictures may be used to identify when a member or associate is captured in a video stream. Conversely, identity server  130  (or a proxy) may also identify that an entity captured in the video is not a member or associate. As noted above, however, such non-member or non-associate may nevertheless be associated with a nonce key. The nonce key may later be correlated to the identity of the entity upon registration. The identity server  130  may therefore enforce the authorization policies associated with each data portion. Such enforcement may include granting or denying access, modifying the data stream (e.g., blur or pixelate an image of a specific entity), verifying authorization and conditions of the access, etc. 
       FIG.  2    is a flowchart illustrating an exemplary method for managing data stream identity. The method  200  of  FIG.  2    may be embodied as executable instructions in a non-transitory computer readable storage medium including but not limited to a CD, DVD, or non-volatile memory such as a hard drive. The instructions of the storage medium may be executed by a processor (or processors) to cause various hardware components of a computing device hosting or otherwise accessing the storage medium to effectuate the method. The steps identified in  FIG.  2    (and the order thereof) are exemplary and may include various alternatives, equivalents, or derivations thereof including but not limited to the order of execution of the same. 
     In step  210 , an entity  120  is assigned a private key by identity server  130 . Such assignment may occur upon registration with a particular identity server  130  or upon identification as a new entity by the identity server  130 . Such private key may be stored and managed by identity server  130  or associated proxies. 
     In step  220 , a data stream may be generated in associated with one or more entities  120 . Such data generation may include digital communications, capture (e.g., in video or audio) on digital media, or other association. As noted above, each data stream and portions thereof may be associated with a different set of entities  120 . A video stream, for example, may have segments respectively associated with no entities, one entity, or multiple different entities. The 
     In step  230 , identity server  130  may analyze ownership of the data stream. Such analysis may include use of various libraries to identify the presence or association of all entities associated with the data stream, whether known or unknown to the identity server  130 . 
     In step  240  and  250 , identity server  130  may filter the data stream by owner (e.g., each different recognized entity with in the data stream) to identify data segments associated with each entity. In step  260 , the identified segment(s) may then be associated with the private key associated with the owner entity, and in step  270 , the association may be stored in memory of identity server  130  for use in processing future requests related to the data segment(s). 
       FIG.  3    illustrates an exemplary computing system  300  that may be used to implement an embodiment of the present invention. System  300  of  FIG.  3    may be implemented in the contexts of the likes of entity A devices  120 A, entity C  120 C, or entity D  120 D, as well as those used by used by entity B  120 B. The computing system  300  of  FIG.  3    includes one or more processors  310  and memory  310 . Main memory  310  stores, in part, instructions and data for execution by processor  310 . Main memory  310  can store the executable code when in operation. The system  300  of  FIG.  3    further includes a mass storage device  330 , portable storage medium drive(s)  340 , output devices  350 , user input devices  360 , a graphics display  370 , and peripheral devices  380 . 
     The components shown in  FIG.  3    are depicted as being connected via a single bus  390 . However, the components may be connected through one or more data transport means. For example, processor unit  310  and main memory  310  may be connected via a local microprocessor bus  390 , and the mass storage device  330 , peripheral device(s)  380 , portable storage device  340 , and display system  370  may be connected via one or more input/output (I/O) buses  390 . 
     Mass storage device  330 , which may be implemented with a magnetic disk drive or an optical disk drive, is a non-volatile storage device for storing data and instructions for use by processor unit  310 . Mass storage device  330  can store the system software for implementing embodiments of the present invention for purposes of loading that software into main memory  310 . 
     Portable storage device  340  operates in conjunction with a portable non-volatile storage medium, such as a floppy disk, compact disk (CD) or digital video disc (DVD), to input and output data and code to and from the computer system  300  of  FIG.  3   . The system software for implementing embodiments of the present invention may be stored on such a portable medium and input to the computer system  300  via the portable storage device  340 . 
     Input devices  360  provide a portion of a user interface. Input devices  360  may include an alpha-numeric keypad, such as a keyboard, for inputting alpha-numeric and other information, or a pointing device, such as a mouse, a trackball, stylus, or cursor direction keys. Additionally, the system  300  as shown in  FIG.  3    includes output devices  350 . Examples of suitable output devices include speakers, printers, network interfaces, and monitors. 
     Display system  370  may include a liquid crystal display (LCD) or other suitable display device. Display system  370  receives textual and graphical information, and processes the information for output to the display device. 
     Peripherals  380  may include any type of computer support device to add additional functionality to the computer system. For example, peripheral device(s)  380  may include a modem or a router. 
     The components contained in the computer system  300  of  FIG.  3    are those typically found in computer systems that may be suitable for use with embodiments of the present invention and are intended to represent a broad category of such computer components that are well known in the art. Thus, the computer system  300  of  FIG.  3    can be a personal computer, hand held computing device, telephone, mobile computing device, workstation, server, minicomputer, mainframe computer, or any other computing device. The computer can also include different bus configurations, networked platforms, multi-processor platforms, etc. Various operating systems can be used including Unix, Linux, Windows, Macintosh OS, Palm OS, and other suitable operating systems. 
     The present invention may be implemented in an application that may be operable using a variety of devices. Non-transitory computer-readable storage media refer to any medium or media that participate in providing instructions to a central processing unit (CPU) for execution. Such media can take many forms, including, but not limited to, non-volatile and volatile media such as optical or magnetic disks and dynamic memory, respectively. Common forms of non-transitory computer-readable media include, for example, a floppy disk, a flexible disk, a hard disk, magnetic tape, any other magnetic medium, a CD-ROM disk, digital video disk (DVD), any other optical medium, RAM, PROM, EPROM, a FLASHEPROM, and any other memory chip or cartridge. 
     Various forms of transmission media may be involved in carrying one or more sequences of one or more instructions to a CPU for execution. A bus (e.g., bus  390 ) carries the data to system RAM, from which a CPU retrieves and executes the instructions. The instructions received by system RAM can optionally be stored on a fixed disk either before or after execution by a CPU. Various forms of storage may likewise be implemented as well as the necessary network interfaces and network topologies to implement the same. 
     While various embodiments have been described above, it should be understood that they have been presented by way of example only, and not limitation. The descriptions are not intended to limit the scope of the invention to the particular forms set forth herein. Thus, the breadth and scope of a preferred embodiment should not be limited by any of the above-described exemplary embodiments. It should be understood that the above description is illustrative and not restrictive. To the contrary, the present descriptions are intended to cover such alternatives, modifications, and equivalents as may be included within the spirit and scope of the invention as defined by the appended claims and otherwise appreciated by one of ordinary skill in the art. The scope of the invention should, therefore, be determined not with reference to the above description, but instead should be determined with reference to the appended claims along with their full scope of equivalents.