Patent Description:
At present, the volume of data to be collected from users' devices continues to grow. At the same time, there is growth in the variety and number of the devices from which data is collected. The devices from which data is collected include Internet of Things (IoT) devices, personal computers, notebooks, and smartphones. The data is commonly collected from devices without any clear consent by the user. However, even if such consent is given, the user does not always understand all the consequences of his/her decision. Data collected from devices is subsequently distributed around the network in an uncontrolled way, and may cause harm to the user. For example, a user may become a victim of criminals who have obtained his/her telephone or credit card number. Moreover, malicious parties are not always the only ones that cause problems. For instance, unscrupulous employers may use data from users' devices to track their employees. Another result of uncontrolled data collection is the annoying targeting of advertisements for special categories of merchandise.

Device manufacturers attempt to defend the user from concealed data collection and to regulate data operations. One example is Google's Firebase system, which synchronizes data between different applications on Android devices and grants access to these data to a third party.

In products manufactured by Apple corporation, there is a similar platform that attempts to defend the user. The platform on Apple products is called the Apple Security Framework and its primary goal is to protect information, establish a trusted connection, and control access to software on a device. For example, the Apple Security Framework is used to establish a user's identity, ensure the security of data both in a storage and during transmission over a network, and confirm the validity of code.

However, the above device manufacturer attempts have shortcomings. The mechanisms to allow data from devices to be shared with third parties are not transparent for the user, are irreversible, and only provide weak protection against tracking by third-party applications. An example of a system and a method of granting access to data of a user is disclosed in <CIT>.

Therefore, there is a need for a more optimal and effective way of granting access to data of a user while ensuring privacy.

Aspects of the disclosure relate to granting access to data of a user while ensuring privacy. The data is exchanged between a user's data storage and computing devices of parties interested in the data.

In one exemplary aspect, a method is provided for granting access to data of a user, the method comprising: blocking the processing of data of a user, transferring the data of the user to a storage device, receiving a request for data processing from a collected data processor of a device, redirecting the received request to the storage device, determining, by the storage device, data access rights for the collected data processor of the device from which the request for data processing is received in accordance with data access rights established by a data access rights manager, and providing access to the data in accordance with the determined data access rights.

In one aspect, the method further comprises detecting an absence of the requested data, and transferring information about the absent data to the storage device.

In one aspect, the transferring of the data of the user to the storage device is performed through at least one of a route modifier and an anonymizer, wherein the rout modifier analyzes the data in fields of data structure received from a data collector, divide the data structure into substructures in order to determine the state of the data, and select the route for sending data to the storage device for the resulting substructure, and wherein the anonymizer anonymizes user identifiers.

In one aspect, the request is processed without redirecting to the storage device when the collected data processor is on the list of trusted devices or when the request is related to a basic functionality accepted by a user device.

In one aspect, the blocking of the processing includes blocking at least one of: mobile and web tracking; collecting geolocation information; collecting search queries; and collecting registration data.

In one aspect, the blocking of the processing of the data blocks the processing by the collected data processor of an external device.

In one aspect, the request for data processing is received from the collected data processor implicitly by a blocker or directly by a data access rights manager, and wherein when the request is received by the blocker, the request is forwarded to the data access rights manager.

According to one aspect of the disclosure, a system is provided for granting access to data of a user, the system comprising a hardware processor configured to: block the processing of data of a user, transfer the data of the user to a storage device, receive a request for data processing from a collected data processor of a device, redirect the received request to the storage device, determine, by the storage device, data access rights for the collected data processor of the device from which the request for data processing is received in accordance with data access rights established by a data access rights manager, and provide access to the data in accordance with the determined data access rights.

The method and system of the present disclosure are designed to provide data security, while allowing the user's data to be transmitted between the computing devices of the parties interested in the data and any number of devices of the user from which the data is being gathered and transmitted.

Exemplary embodiments of the invention are described herein in the context of a system, method, and a computer program for granting access to data of a user. For instance, the method of the present disclosure may be used for exchanging data between a device of a user and a device of an entity interested in the user's data. Those of ordinary skill in the art will realize that the following description is illustrative only and is not intended to be in any way limiting. Other examples will readily suggest themselves to those skilled in the art having the benefit of the disclosure. Reference will now be made in detail to implementations of the example embodiments as illustrated in the accompanying drawings. The same reference indicators will be used to the extent possible throughout the drawings and the following description to refer to the same or like items.

<FIG> illustrates a system <NUM> for exchanging data received from devices of a user. The system <NUM> is intended for a transparent and secure processing of the data of users of any number of devices <NUM>. In the context of the present disclosure, "data of a user of a device" refers to data received from any number of devices in the user's environment. The data may be created on a device by various types of software, and includes both data input by the user and data created in the operation of programs and applications. For example, the data may be for a stream of clicks (also known as a "clickstream"), communications in messaging services, location data, data from smart home IoT devices, data from other IoT devices in the user's ecosystem, such as a private car, and the like.

In one example, the system <NUM> includes a blocker <NUM>, a data collector <NUM>, a data access rights manager <NUM>, a modifier <NUM>, a storage device <NUM>, an anonymizer <NUM>, data analyzer <NUM>, and a data tracker <NUM>.

In the present disclosure, the blocker <NUM>, data collector <NUM>, data access rights manager <NUM>, modifier <NUM>, storage device <NUM>, anonymizer <NUM>, data analyzer <NUM> and data tracker <NUM> are considered to denote real devices, systems, components and groups of components constructed with the use of hardware such as integrated microcircuits (in English, "application-specific integrated circuit", ASIC) or programmable gate arrays (in English, "field-programmable gate array", FPGA), or, for example, in the form of a combination of software and hardware such as a microprocessor system and a set of program instructions, and also on neuromorphic chips (in English, "neurosynaptic chips"). The functionality of the various modules or components of the system <NUM> may be implemented solely by hardware, or additionally in the form of a combination in which some of the functionality is implemented by software and some by hardware. In one example, the various functionalities may be implemented on the processor of a general-purpose computer (as shown in <FIG>, for example). Databases may be implemented by any feasible methods and may be contained on a single physical medium or on various media located either locally or remotely.

The blocker <NUM> is intended to block the processing of data (including personal data) on the user's device by a collected data processor <NUM>. Blocking can be carried out on any collected data processor <NUM>, including third-party means and those belonging to the platform by which the device is controlled (for example, Apple, Google, Huawei and Xiaomi software) on which the blocker is installed, or which are accessible to the blocker. For example, the blocker <NUM> may be installed on a router through which the user's personal devices 101a communicate with the internet, IoT devices. Then, the blocker analyzes the network traffic flowing through the router on which the blocker <NUM> is installed. A particular case of a collected data processor may be a client 102b (for example, an application) that collects the user's data <NUM> on the device at the request of a server 102a connected to the application in the context of a client-server interaction. "Data processing" refers to any action (operation) or combination of actions (operations) carried out with the use of data automation means (e.g., computing devices), including the collection, recording, arrangement, accumulation, storage, adjustment (updating, changing), extraction, use, transmission (distribution, supply, access), depersonalization, blocking, removal and deletion of data.

In one example, the collection of critical data is blocked, rather than the collection of any data. Critical data include data in respect of which the law or an authorized party imposes restrictions on collection, storage, access,, distribution and processing. Critical data is usually sensitive to disclosure, distribution, or leakage. Occurrences of disclosure, distribution and/or leakage typically results in an infringement of the rights and legally protected interests of parties. Moreover, the occurrences of these types of events may create a for parties who have permitted the infringement of the rules for collection, storage, access, processing specified for these data to occur. A particular case of critical data is that of confidential data ("sensitive data"). In the context of the present disclosure, confidential data and confidential information are synonymous. Confidential data includes data stored in accordance with the law of the country whose jurisdiction covers the user of the device (i.e., the client in the system described above).

In one example, confidential data include personal data (PD) and data containing:.

In one example, the processing of a user's data for marketing purposes is blocked.

In another example, the processing of any of a user's data by the collected data processor <NUM> is blocked where the data are not concerned with the direct functionality of applications or programs using these collected data processor <NUM>. In another example, any processing by the collected data processor <NUM> not included on the list of permitted (trusted) devices or servers is blocked. The blocking of data processing may be carried out by various methods directly or indirectly. When the blocking of data processing is performed directly, the actions associated with the data processing are blocked. When the blocking of data processing is performed via an indirect blocking method, the data processing is not directly impeded, but the processing does not achieve its objectives even though it is executed. In one example, a direct blocking method includes prohibiting access to a user's data by the collected data processor <NUM>. In one example, an indirect processing method includes a method for disabling links between data to be sent from a device of a user and the identifier of the user. For example, the method may remove cookie files or spoof the identifier of the user that is set up by tracking networks on the device of the user.

The data access rights manager <NUM> is intended to manage access to data. The data access rights manager <NUM> formulates the rights of the collected data processor <NUM> to access data, withdraws data access rights from collected data processor, and creates lists of permitted (trusted) collected data processors <NUM>.

The data access rights manager <NUM> stores or establishes the structure format (data model) for the user's data specified for allocation on the storage device <NUM>. In one example, the data access rights manager <NUM> may be customized by external updatable policies or by user policies or directly by the user's input. The data access rights manager <NUM> also updates the user's data model specified for sending to the storage device (operating scenarios will be described below). The data model may be using known techniques for data organization.

The data collector <NUM> is intended to collect data of a user which is specified as being data suitable for transmission to the storage device <NUM> from the user's devices. The data collector <NUM> receives fields of data structure from the access rights manager <NUM>, and completes the received fields of the data structure. The data collector <NUM> then transfers the completed data structure to the modifier <NUM>. In one example, the data collector <NUM> sends the completed data structure to the storage device <NUM> directly. Usually, the blocking by the blocker <NUM> and the collection of data by the data collector <NUM> take place independently of the data requirements of the collected data processor <NUM>. For example, according to the settings, the blocker <NUM> blocks web tracking, and the data collector <NUM> collects all the data whose processing was blocked in advance (before the attempted processing by the means <NUM>) on the device <NUM> by the blocker <NUM>; the collected data are then stored in the storage device <NUM>.

In one example, the device <NUM> comprises a modifier <NUM> which is intended to: analyze the data in the fields of the structure received from the data collector <NUM>; in order to determine the state of the data, divide the data structure into substructures; and for the resulting substructures, select the route for sending data to the remote storage device. The modifier <NUM> determines the necessity of dividing the structure into substructures according to the fields of the structure. There may be various criteria for the division of the data structure into substructures, one of these criteria being the presence of personal data ("Personal Identification Information" (PII)) or special categories thereof (according to the terminology of General Data Protection Regulation (GDPR), for example). When personal data is present, the data structure is divided in such a way that one substructure contains personal data or special categories thereof, while the other substructure contains data that are not personal. The relationship of the data to personal data is determined, for example, by the law of the country whose jurisdiction covers the user of the device that constitutes the client in the system described (in other words, according to the location of the data source). Another, more general, criterion is the presence of critical data. In a particular case, the modifier <NUM> is intended to convert the data structures on the device before sending the data to the storage device <NUM>. In one example, the methods for converting the data substructures include:.

Some kinds of conversion may be used not only for individual data (fields) in a substructure, but also for a substructure as a whole, for example tokenization and/or encryption. In one example, the conversion is performed such that reversing the conversion is not possible without the use of the modifier <NUM> and/or the storage device <NUM>. In this case, the term "conversion" refers to a transformation or mapping of a quantity to another quantity, e.g., using a function that operates on the first quantity to obtain a second quantity.

In one example, the modifier <NUM> selects a network route along which the structure or substructure will be sent to the storage device <NUM>. This route may include an anonymizer <NUM>. The anonymizer <NUM> is intended to convert the structures and substructures passing through it by both direct and reverse conversion (examples will be discussed below). The anonymizer is not located in a single local network or intranet (the network of a single organization, for example) with the device <NUM>, and in a particular case with the storage device <NUM>. The data tracker <NUM> is connected to the anonymizer and to the storage device <NUM>.

The data tracker <NUM> is intended to track operations with the user's data and to record all acts of retrieval of the user's data from the storage device <NUM>. The data tracked <NUM> maintains a log of retrieval of the user's data. Based on the content of the log, the data tracker <NUM> checks the legality of the use of the user's data by third parties. For example, the history of the user's search queries may be transmitted to a network N without the right of transmission to third parties, as recorded by the data tracker <NUM>. Suppose subsequently, the user receives advertising offers from network M, wherein the advertising offers are based on the user's search queries, as recorded by an additional means of the system <NUM> (not shown in <FIG>). Then, based on the data obtained from the user's device and the content of the data tracker <NUM>, the system <NUM> records the incident. This incident may be processed subsequently according to supplementary devices (add-ons) of the system <NUM>. For example, the supplementary devices of the system <NUM> may perform any of: creating a complaint to be sent to network N, sending a demand to network M demanding for a removal of the data, sending information to a regulator, etc..

The storage device <NUM> is intended for the location of data of a user. The storage device may transfer the user's data to the collected data processor <NUM> and also allow the data to be processed without direct transmission in the storage device <NUM>. The storage device <NUM> is connected to a data analyzer <NUM>. The data analyzer <NUM> is intended to be used for an automated data analysis, based on the data analysis, constructing various analytical accounts, aggregating results, and storing the aggregated results in the storage device <NUM>. In one example, the aggregated results may be transferred to an external collected data processor <NUM>, if the latter has rights for accessing the aggregated results. The data analyzer <NUM> also links the data from various devices <NUM> of a single user/household. The storage device <NUM> is also connected to a data access rights manager <NUM> (through an agent 130a, for example), since the storage device determines the rights of access of the collected data processor to the user's data.

The storage device <NUM> may be located in the device <NUM>, in the local network of the device <NUM>, or remotely, as shown in <FIG>. In a particular case, the storage device receives the user's data, including data from collected data processor. For example, it receives data from the collected data processor of social networks, online and offline retail stores, advertising networks, data exchanges, and others.

<FIG> illustrates an exemplary method <NUM> for granting access to data of a user. The access is granted to a computing device of a third party. In one example, the method <NUM> for granting access to the data of the user starts in step <NUM> and proceeds to step <NUM>.

In step <NUM>, by the blocker <NUM>, method <NUM> blocks the processing of the data of the user at the user's devices for a collected data processor <NUM>.

In one example, the blocking of the processing of the data of the user comprises: blocking a predetermined list of processing methods for usage by any collected data processor.

In one example, the blocking of the processing includes the blocking of at least one of:.

In step <NUM>, by the data collector <NUM>, method <NUM> collects the data of the user and transfers the collected data to a storage device <NUM>. In one example, the collected data comprises data that is blocked from being processed by an external collected data processor <NUM>. The blocking of the data from being processed by the external collected data processor <NUM> is performed in accordance with current policies specified by a data access rights manager <NUM>. In one example, the data collector <NUM> collects and transfers data to the storage device <NUM> using a data model and structure described above.

In one example, the data collector <NUM> transfers the data to the storage device <NUM> through a route modifier <NUM> and/or an anonymizer <NUM>.

In one example, access to these data, by collected data processor <NUM>, may only be received from the storage device <NUM>. For example, the collected data processor <NUM>, may not be on the list of permitted devices. For instance, the data may not be necessary for carrying out basic functions of the collected data processor <NUM>.

In step <NUM>, the system <NUM> receives a request for processing the data of the user on the user device <NUM>. This request may be received by various means of the system <NUM>, depending on the method for its implementation. For example, if there is an attempt to process the user's data on the device, this is detected by the blocker <NUM> (implicit request). For an explicit request, permission for processing this request will be received by the data access rights manager <NUM>.

In one example, when the data processing request is received by the blocker <NUM>, the request is redirected to the data access rights manager <NUM>.

In one example, when device <NUM> is known to the system <NUM> (if rights have already been allocated to device <NUM>), the method proceeds to step <NUM>. In step <NUM>, the request is redirected to the storage device <NUM> in which the data of the user is stored.

In another example, when the collected data processor <NUM> is not known to the system, the access rights are determined for the collected data processor <NUM>. Then, the method proceeds to step <NUM>.

In step <NUM>, method <NUM> permits the collected data processor <NUM> to process the user's data without redirecting the request to the storage device <NUM>.

In one example, method <NUM> permits the collected data processor <NUM> to process the user's data without redirecting the request when at least one of the following conditions is met: the collected data processor <NUM> is on the list of trusted devices; access to the data takes place in a context of a basic functionality accepted by the user; or similar scenario mentioned above,.

In step <NUM>, the storage device <NUM> determines the data access rights of the collected data processor to the user's data, and for which purpose the storage device <NUM> may use the stored copy of the data access rights for the collected data processor <NUM>. In one example, the storage device <NUM> stores the copy of the data access rights which were previously determined by the data access rights manager <NUM> for use during this step. In another example, the storage device <NUM> contacts the data access rights manager <NUM> directly when the information is needed, through the agent 130a, for example. Thus, the storage device <NUM> may not be relying on a previously stored copy. After the determination of the data access rights, the method proceeds to step <NUM>.

In step <NUM> access to the user's data is granted to the collected data processor in accordance with the determined rights. In a particular case, access is granted through the anonymizer, which executes the reverse conversion of the user's data located in the storage device <NUM>. Information about this is recorded by the data tracker <NUM>, the recording in a particular case being based on blockchain technology, and the technology for providing data for processing from the user to the collected data processor <NUM> may be implemented as a smart contract, in which the incoming offer from the owner of the collected data processor in a particular case is the cashless use of an application/program functionality (user's data in exchange for the functionality). In this example, after access to the processing of the user's data has been received, the user who has granted access to his data may use the functionality of a certain application or service, or he will be able to access any other product or service, optionally encrypted (for example, an insurance discount in the case of providing remote metering from a car).

<FIG> shows an exemplary method for providing user's data to a collected data processor <NUM>. The blocker <NUM> blocks the processing of data for an advertising network M. In one example, the blocking comprises at least one of: removing from web data <NUM>, including data created by a browser 102b and cookie files containing an advertising identifier, as shown in step <NUM>; and spoofing the user's identifier in the advertising network M in network traffic, as shown in step <NUM>. This impedes the operation of the collected data processor <NUM>, which in the present case is used for user profiling (i.e., the collected data processor <NUM> is a profiling means). Thus, the advertising network will not be able to carry out targeting since it does not have the user profile. In turn, the reduction in the targeting results in a marked reduction in conversion (the number of clicks on an advertising announcement). Since the operating model of the advertising network is cost per click (CPC), there is a corresponding decline in average revenue per user (ARPU ). Similar blocking is may be used by the user, since the user wishes to avoid the appearance of advertising for certain categories X of goods in his browser (for example, medicines, medical clinics and other items in the "health" category). However, the user may be prepared to receive targeted advertising for other categories of goods and services from said advertising network M. Thus, after the specified settings, in step <NUM>, the data access rights manager <NUM> creates (establishes) access rights for the network M, wherein the access is for granting access to a history of search queries and clickstream, while excluding all search queries and clicks related to category X. The relevant information is sent to the various components of system <NUM>,in step <NUM>; in particular, the data collector <NUM> receives the data structure with fields for completion, the modifier <NUM> receives categories of data whose transmission is prohibited, and the storage device <NUM> receives the access rights for the advertising network M. In particular cases, various scenarios are then possible, for example:.

As a general rule, such scenarios apply not only to clicks and search queries, but also to other types of user's data, where this is possible, the collected data processor <NUM> do not only relate to advertising networks, and the user may have more than one device. In a particular case, when the storage device <NUM> is located in a remote unit, as in <FIG>, the modified structure from the modifier is not sent directly to the storage device <NUM>.

An example according to the last scenario is examined further below. After the rights for the collected data processor <NUM> of network M have been drawn up by the means <NUM> in step <NUM>, the data access rights manager <NUM> transfers the format of the structure to the data collector <NUM> for the completion of the fields in step <NUM>. The structure comprises at least a "search queries" field and a "clickstream" field, and in turn the clickstream field comprises a field of categories of web resources in which a field for category X is absent. In step 222a, the data collector <NUM> completes the fields. The data for the completion in a particular case are selected from the retained web data <NUM> accumulated in the course of the user's network activity. These data are formulated both by the browser 102a and by additional components of the system <NUM>, such as plug-ins in the browser or UI interceptors (these are not shown in <FIG>, and in a particular case are modules of the data collector <NUM>). In step <NUM>, the data collector <NUM> transfers the completed structure to the modifier <NUM>, which in turn, on the basis of the structure format received also in step <NUM> from the data access rights manager <NUM>, analyzes the fields of the search queries for the presence of queries relating to category X, after which the query data are removed. In step <NUM>, the modifier <NUM> receives from the collected data processor <NUM> the user identifier in the advertising network M (UserIDM) (from the cookie file or from a profile in the browser, for example) and the user identifier in the system <NUM> (UserID100) from the data access rights manager <NUM> (not shown in <FIG>). The structure with the user's data is then encrypted with a public key, and a pair of identical random tokens is generated, one of the tokens being linked to the identifiers while the second token is linked to the user's data structure (for example, it is added in an additional field to the structure, this step not being shown in <FIG>). In step 225a, the user's data structure is then sent to the storage device <NUM>, and the identifiers with the second token are sent to the anonymizer <NUM> in step 225b. The anonymizer <NUM> converts the identifiers in step 225c, and the converted identifiers UserID' <NUM> and UserID'M are transferred in step 225r to the storage device <NUM>. In the storage device <NUM>, the identifiers are linked with the user's data structure on the basis of identical tokens in step <NUM>. The storage device <NUM> links the received data structure with other data structures for this user in step <NUM>. The conversion means <NUM> changes the original user identifier in the system <NUM> and the identifier for the advertising network M, in order to protect the user's data in case of a data leak from the storage device <NUM>, since the data owner cannot be recognized with the changed identifiers. The data requests from the advertising network M for the processing of the data are redirected to the storage device <NUM> through the anonymizer <NUM>, as shown in <FIG>. As can be seen in <FIG>, the request can be directed by the server through the client in step <NUM>, or by the client itself in accordance with its functionality in step 230a and/or in step 230b. In a particular case, the request comprises a user identifier in the advertising network Mm, UserIDM. In step <NUM>, the request is redirected to the anonymizer <NUM>. When the request is redirected, the user identifier in the system <NUM> is attached to the request, and, in a particular case, information about the requested data, for example the enumeration of the fields of the structure is added; there may be various formats such as XML, JSON, etc. In step <NUM>, the anonymizer <NUM> converts the user identifier in the system <NUM> and the identifier in the advertising network M, and it transfers the converted identifiers to the storage device in step <NUM>. The storage device <NUM> detects, in step <NUM> the data linked to the user, on the basis of UserID' <NUM>, and determines the rights for the advertising network M in step <NUM> (not shown in <FIG>), and the storage device <NUM> prepares the data for processing by the collected data processor <NUM> in accordance with the access rights. In the present example, this takes place by means of the detection of UserID'M and the data structure related thereto. When the data are detected, they are returned, together with the UserID'M, to the anonymizer <NUM> in step <NUM>, the anonymizer <NUM> returns the original value to the user identifier in the network M in step <NUM>, and the user's data, together with the original UserIDM, is transferred to the collected data processor <NUM> of the advertising network, while the occurrence of the transmission is recorded by the data tracker <NUM>.

In a particular case, the advertising network may contact the anonymizer directly without the redirection of requests by the device <NUM>, while in the present case the collected data processor itself redirects the request: instead of the device it contacts the storage device, in a particular case through the anonymizer <NUM>. In another particular case, the data are not transferred to the collected data processor <NUM>, but access to a copy of the data placed in the storage device <NUM> is granted.

In one example, the present disclosure also describes a method <NUM> for updating the user's data. The system shown in <FIG> is also used for implementing the method <NUM>. This method is implemented when not all the data for processing are placed in the storage device and/or when the user has more than one device from which data may be received. In method <NUM>, steps <NUM>, <NUM>, <NUM> and <NUM> are similar to the steps of the method shown in <FIG>.

In step <NUM>, by the storage device <NUM>, method <NUM> detects that the data for which the collected data processor have received access rights are not located in the storage device.

In step <NUM>, method <NUM> transfers information about the absent data to the storage device <NUM>. In a particular case, when the absence of the data is detected, the storage device <NUM> contacts the data access rights manager <NUM>. The data access rights manager <NUM> updates the data model, in accordance with which the data collector <NUM> completes new fields in the structure (in our example, those relating to the location). The data access rights manager <NUM> then sends the data to the storage device <NUM>. In a particular case, the data are sent with the use of the modifier <NUM> (the modifier <NUM> carries out an analysis of the data for criticality and other conformity with the rights established by the data access rights manager <NUM>) and the anonymizer <NUM>, if the detected data require further conversion.

<FIG> an exemplary implementation of the method <NUM> for updating the user's data. The example with the advertising network M will be examined further. In the present case, however, the system <NUM> operates according to the following scenario:.

In addition to information on search queries and clicks, the advertising network M in the present example has requested information on the location: in step <NUM>, the server 102a sent a request to the client 102b, which sent it to the data access rights manager <NUM> in step 230b. The user issued this permission in step <NUM>, and the data access rights manager <NUM> drew up rights, including rights to location data.

Since the storage device <NUM> independently creates or completes data structures for processing by the collected data processor <NUM>, in step <NUM> (here and hereafter, see <FIG>), when the request is redirected, through the user identifier UserID100, information about the data to which rights have been drawn up for the advertising network M is added to the request, in the form of fields of the data structure for example (in <FIG>, this is denoted "Model"). In step <NUM>, the storage device <NUM> receive the converted user identifier UserID'<NUM> and the fields of the data structure from the anonymizer <NUM>. In step <NUM>, it finds the user's data located in the store. The storage device <NUM> then determines the access rights to the data, for which, in our example, the means <NUM> compares the fields of the structure (taken from the "Model") attached to the request with the data located in the storage device, and in step <NUM> detects (not shown in <FIG>) that the information about the user's location UserID'<NUM> has not been placed on the means <NUM> (as a result, a completion error, for example, appears). The storage device <NUM> contacts the data access rights manager <NUM> with a request for data shown in the structure but absent from the means <NUM>. The data access rights manager <NUM> is contacted, for example, through an agent 130a, which in step <NUM> will contact the anonymizer <NUM> and convert the identifier UserID' <NUM> in the request to the original UserID <NUM> with the aid of the anonymizer <NUM> in step <NUM>, and will transfer the request to the data access rights manager <NUM> in step <NUM>. According to the results of the request from the storage device <NUM>, the data access rights manager <NUM> updates the information about the data to be collected, where the updating includes at least two steps:.

In step <NUM>, the storage device then receives the requested data. In the example under examination, step <NUM> from <FIG> consists of a number of sub-steps (320a - 320f) in <FIG>.

In step 320a, the updated user's data structure with information including the location is sent to the storage device <NUM>, and the user identifier in the system <NUM> with the second token is sent to the anonymizer <NUM> in step 320b. The anonymizer <NUM> converts the identifier in step 320c, and the converted identifier UserID' <NUM> is transferred in step 320d to the storage device <NUM>. In the storage device <NUM>, the identifier is linked with the updated user's data structure on the basis of identical tokens in step 320e. The storage device <NUM> then links the received data structure to other data structures for this user in step 320f. The storage device can then complete the necessary fields at the request of the collected data processor <NUM>.

An example of the implementation of the method <NUM> for providing user's data to collected data processor will now be examined on the basis of <FIG>. The blocker <NUM> blocks the processing of data for an advertising network M; more specifically, it blocks the collection of URL addresses/resources that the user visits (clickstream) and the history of search queries. The blocking is carried out by:.

On the basis of the clickstream and search queries, the advertising network M carries out profiling, followed by targeting of advertising messages. Thus the advertising network will not be able to carry out targeting since it does not have the user profile, resulting in a marked reduction in conversion (the number of clicks on an advertising announcement), and since the operating model of the advertising network is cost per click (CPC), there is a corresponding decline in average revenue per user (ARPU) (. Similar blocking is used by the user, since the user wishes to avoid the appearance of advertising of goods in the "health" category in his browser (for example, medicines, medical clinics and other items from the "health" category). However, the user is prepared to receive targeted advertising for other categories of goods and services from said advertising network M ("Sport", "Education", "Books",. The user is prepared to share only the history of search queries and the web resources visited for profiling. The setting data are specified, in step <NUM>, and an example of such settings is shown in <FIG>. The system <NUM> also blocks any advertising announcements not wanted by the user, by the blocker <NUM>. In step <NUM>, it will remove advertising data with unwanted content from the traffic, and block the loading of advertising data with unwanted content, namely advertising data relating to the "health" category is blocked from being loaded and removed.

Thus, after the specified settings, in step <NUM>, the data access rights manager <NUM> creates access rights for the advertising network M to the whole history of search queries and the clickstream, excluding search queries and clicks relating to the "health" category. The information relating to this is sent out to the various components of the system <NUM> in step <NUM>.

In step <NUM>, the data collector <NUM> receives the data structure with fields for completion, and the structure comprises the following fields:.

In step <NUM>, the data collector <NUM> is ordered to collect all the search queries and all the web resources visited that cannot be assigned to the health category. Profiling for targeting advertising materials in the "health" category may be used by various categories of web resources, and therefore the data access rights manager <NUM>, when creating a structure for the data collector <NUM>, reduces the general category of "health" to more partial categories (subcategories) of web resources, and does not include them in the fields of the structure for the data collector <NUM>, for example, such subcategories of web resources as medicines, medical services, medical information portals and the like. For example, the structure may look like this:
<IMG>.

In step <NUM>, the modifier <NUM> receives the categories of search queries whose transmission is prohibited. The modifier <NUM> uses a natural language processing technology to analyze and classify the search queries. In step <NUM>, the storage device <NUM> also receives the access rights for the advertising network M.

Then, in step 222a, the data collector <NUM> collects the search queries from all categories and the web resources visited that do not relate to the "health" category, and completes the fields of the structure. The data for the completion of the structure are selected by the data collector <NUM> from the retained web data <NUM> accumulated in the course of the user's network activity. These data are created both by the browser 102a and by additional means of the system <NUM>, such as plug-ins in the browser or UI interceptors (these are not shown in <FIG>, and are modules of the data collector <NUM>). <IMG>
<IMG>.

In step <NUM>, the completed structure is transferred to the modifier <NUM>. On the basis of the information about the prohibited categories received in step <NUM> from the data access rights manager <NUM>, the modifier <NUM> analyzes the fields of the search queries for the presence of queries relating to the "health" category. The search queries relating to the "health" category (in the present example, this is query R3) are then removed from the received structure.

In step <NUM>, the modifier <NUM> receives from the collected data processor <NUM> the user identifier in the advertising network M (UserIDM) from the cookie file or from a profile in the browser, and the user identifier in the system <NUM> (UserID100) from the data access rights manager <NUM> (not shown in <FIG>). The structure with the user's data, comprising the search queries and URL-resources, is encrypted with a public key (Rn→Rn', URLn→URLn'). The modifier <NUM> generates a pair of identical random tokens. One of the tokens is linked to the identifiers UserIDM and UserID100:
<IMG>.

The second token is linked to the user's data structure (it is added in an additional field to the structure) as follows:
<IMG>
<IMG>.

In step 225a, the user's data structure is then sent to the storage device <NUM>, and the identifiers with the second token are sent to the anonymizer <NUM> in step 225b.

The anonymizer <NUM> converts the identifiers in step 225c. The anonymizer <NUM> changes the original user identifier in the system <NUM> and the identifier for the advertising network M, in order to protect the user's data in case of a data leak from the storage device <NUM>, since the data owner cannot be recognized with the changed identifiers:
<IMG>.

The converted identifiers UserID'<NUM> and UserID'M are transferred in step 225d to the storage device <NUM>. In the storage device <NUM>, the identifiers are linked with the user's data structure on the basis of identical tokens in step <NUM>. The storage device <NUM> links the received data structure with other data structures for this user in step <NUM>:
<IMG>.

The data requests from the advertising network M for the processing of the data are then redirected to the storage device <NUM> through the anonymizer <NUM>, as shown in <FIG>. As can be seen in <FIG>, the request is sent by the server 102a through the browser 102b in step <NUM>. The request comprises a user identifier in the advertising network M, UserIDM. In step <NUM>, the request is redirected to the anonymizer <NUM>. When the request is redirected, the user identifier in the system <NUM> is attached to the request:
<IMG>.

In step <NUM>, the anonymizer <NUM> converts the user identifier in the system <NUM> and the identifier in the advertising network M:
<IMG>.

In step <NUM>, it transfers the converted identifiers to the storage device <NUM>. The storage device <NUM> detects, in step <NUM>, the data linked to the user, on the basis of UserID'<NUM>, and determines the rights for the advertising network M in step <NUM>; in the present example, this takes place by means of a search for UserID'M and its associated data structure. When the data are detected, they are returned, together with UserID'M, to the anonymizer <NUM> in step <NUM>, the anonymizer <NUM> returns the original value to the user identifier in the network M in step <NUM>, and the user's data, together with the original UserIDM, is transferred to the collected data processor <NUM> of the advertising network, while the occurrence of the transmission is recorded by the data tracker <NUM>.

In a particular case, the advertising network may contact the anonymizer directly without the redirection of requests by the device <NUM>, while in the present case the collected data processor itself redirects the request: instead of the device it contacts the storage device, in a particular case through the anonymizer. In another particular case, the data are not transferred to the collected data processor <NUM>, but access to a copy of the data placed in the storage device <NUM> is granted.

As noted above, the system shown in <FIG> is also used for implementing the method of updating the user's data <NUM>. Thus, methods <NUM> and <NUM> are implemented using the system of <FIG>. This method is implemented when not all the data for processing are placed in the storage device and/or when the user has more than one device from which data may be received. For example, for method <NUM>, in step <NUM>, the storage device <NUM> detects that the data for which the collected data processor <NUM> has received access rights are not located in the storage device <NUM>. In step <NUM>, therefore, the missing user's data are transferred from the device to the storage device <NUM>. In a particular case, when the absence of the data is detected, the storage device <NUM> contacts the data access rights manager <NUM>. The data access rights manager <NUM> updates the data model, in accordance with which the data collector <NUM> completes new fields in the structure (in our example, those relating to the location). The data access rights manager <NUM> then sends the data to the storage device <NUM>. In a particular case, the data are sent with the use of the modifier <NUM> (the modifier <NUM> carries out an analysis of the data for criticality and other conformity with the rights established by the data access rights manager <NUM>) and the anonymizer <NUM>, if the detected data require further conversion.

<FIG> is a block diagram illustrating a computer system <NUM> on which examples of systems and methods for granting access to data of a user and for updating the data of a user may be implemented. The computer system <NUM> can be in the form of multiple computing devices, or in the form of a single computing device, for example, a desktop computer, a notebook computer, a laptop computer, a mobile computing device, a smart phone, a tablet computer, a server, a mainframe, an embedded device, and other forms of computing devices.

As shown, the computer system <NUM> includes a central processing unit (CPU) <NUM>, a system memory <NUM>, and a system bus <NUM> connecting the various system components, including the memory associated with the central processing unit <NUM>. The system bus <NUM> may comprise a bus memory or bus memory controller, a peripheral bus, and a local bus that is able to interact with any other bus architecture. Examples of the buses may include PCI, ISA, PCI-Express, HyperTransport™, InfiniBand™, Serial ATA, I<NUM>C, and other suitable interconnects. The central processing unit <NUM> (also referred to as a processor) can include a single or multiple sets of processors having single or multiple cores. The processor <NUM> may execute one or more computer-executable code implementing the techniques of the present disclosure. The system memory <NUM> may be any memory for storing data used herein and/or computer programs that are executable by the processor <NUM>. The system memory <NUM> may include volatile memory such as a random access memory (RAM) <NUM> and non-volatile memory such as a read only memory (ROM) <NUM>, flash memory, etc., or any combination thereof. The basic input/output system (BIOS) <NUM> may store the basic procedures for transfer of information between elements of the computer system <NUM>, such as those at the time of loading the operating system with the use of the ROM <NUM>.

Embodiment of the present disclosure may be a system, a method, and/or a computer program product.

Computer readable program instructions for carrying out operations of the present disclosure may be assembly instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language, and conventional procedural programming languages. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a LAN or WAN, or the connection may be made to an external computer (for example, through the Internet). In some examples, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform embodiments of the present disclosure.

In various examples, the systems and methods described in the present disclosure can be addressed in terms of modules. The term "module" as used herein refers to a real-world device, component, or arrangement of components implemented using hardware, such as by an application specific integrated circuit (ASIC) or FPGA, for example, or as a combination of hardware and software, such as by a microprocessor system and a set of instructions to implement the module's functionality, which (while being executed) transform the microprocessor system into a special-purpose device. A module may also be implemented as a combination of the two, with certain functions facilitated by hardware alone, and other functions facilitated by a combination of hardware and software. In certain implementations, at least a portion, and in some cases, all, of a module may be executed on the processor of a computer system (such as the one described in greater detail in <FIG>, above). Accordingly, each module may be realized in a variety of suitable configurations, and should not be limited to any particular implementation exemplified herein.

Furthermore, it is to be understood that the phraseology or terminology used herein is for the purpose of description and not of restriction, such that the terminology or phraseology of the present specification is to be interpreted by the skilled in the art in light of the teachings and guidance presented herein, in combination with the knowledge of those skilled in the relevant art(s). Moreover, it is not intended for any term in the specification or claims to be ascribed an uncommon or special meaning unless explicitly set forth as such.

Claim 1:
A method for granting access to data of a user, the method comprising:
blocking the processing of data of a user;
transferring the data of the user to a storage device (<NUM>);
receiving a request for data processing from a collected data processor (<NUM>) of a device;
redirecting the received request to the storage device (<NUM>);
determining, by the storage device (<NUM>), data access rights for the collected data processor (<NUM>) of the device from which the redirected request for data processing is received in accordance with data access rights established by a data access rights manager (<NUM>), wherein the determination of the data access rights comprises formulating rights of the collected data processors to access data, withdrawing data access rights from the collected data processors, and creating lists of collected data processors that are permitted to access the data; and
providing access to the data in accordance with the determined data access rights.