EP4652559A1

EP4652559A1 - User data directives for networked computer systems

Info

Publication number: EP4652559A1
Application number: EP24744484.7A
Authority: EP
Inventors: Tristan Michael FALCK; Roman Norbert MAGIS; Perry J. Roach; John Alexander ROBB; Geoffrey Wells
Original assignee: Netsweeper Barbados Inc
Current assignee: Netsweeper Barbados Inc
Priority date: 2023-01-20
Filing date: 2024-01-22
Publication date: 2025-11-26
Also published as: WO2024154111A1

Abstract

A processor receives configuration input from a user device at a configurable parameter matrix that defines classifications of data and directives associated with the classifications of data. A directive determines whether data of a respective classification is allowed or blocked for transmission to the user device. The configurable parameter matrix is applied to an artificial intelligence system to determine a category of a user of the user device. The category of the user is transmitted to hosts responsive to requests for data from the user device. The category enables the hosts to transmit data matching the category of the user to the user device.

Description

USER DATA DIRECTIVES FOR NETWORKED COMPUTER

SYSTEMS

BACKGROUND

[0001] The present disclosure related to networked computer systems.

[0002] Tracking user behavior on network devices, so as to enable the delivery relevant data, is a growing area of technological development. Accuracy and privacy are two prime concerns that are often in tension.

SUMMARY

[0003] According to an aspect of the present disclosure, a non-transitory machine-readable medium comprising instructions that, when executed by a processor, cause the processor to receive configuration input from a user device at a configurable parameter matrix that defines classifications of data and directives associated with the classifications of data. A directive determines whether data of a respective classification is allowed or blocked for transmission to the user device. The instructions further apply the configurable parameter matrix to an artificial intelligence system to determine a category of a user of the user device and transmit the category of the user to a plurality of hosts responsive to requests for data from the user device. The category enables the plurality of hosts to transmit data matching the category of the user to the user device.

[0004] A directive may be associated with a function operable on the requests for data and/ or data responsive to the requests for data.

[0005] The function may include accessing of unencrypted requests for data and/or unencrypted data responsive to the requests for data.

[0006] The function may include decryption of the requests for data and/ or the data responsive to the requests for data.

[0007] The configurable parameter matrix may further define personal data of the user and directives associated with the personal data of the user.

[0008] According to another aspect of the present disclosure, a method includes communicating request and/ or response data between a user device and a host and applying a first directive to the request and/or response data to expose the request and/or response data. The first directive is obtained from a configurable parameter matrix that associates directives to parameters including associating the first directive to a parameter. The method further includes determining a relevance of the exposed request and/or response data to the parameter and, if the exposed request and/or response data is relevant to the parameter, applying a second directive to the request and/or response data to allow or block communication of the request and/or response data between the user device and the host.

[0009] The method may further include determining another relevance of the exposed request and/or response data to another parameter and, if the exposed request and/or response data is relevant to the other parameter, applying another second directive, which is associated to the other parameter, to the request and/or response data to allow or block communication of the request and/ or response data between the user device and the host.

[0010] The method may further include determining usage data from the exposed request and/or response data, providing the usage data to an artificial intelligence system that is operable to categorize a user of the user device, and providing a category of the user to the host.

[0011] The method may further include applying a first directive to the request and/ or response data to expose the request and/or response data by decryption the request and/or response data.

[0012] According to another aspect of the present disclosure, a non-transitory machine- readable medium may include instructions that, when executed by a processor, cause the processor to perform any of the above methods.

[0013] According to another aspect of the present disclosure, a system may include one or more computing devices configured to perform any of the above methods.

BRIEF DESCRIPTION OF THE FIGURES

[0014] FIG. 1 is a diagram of an example computer system with a computing device to control data communications between user devices and hosts.

[0015] FIG. 2 is a diagram of an example computer system to provide data to a user device according to a configurable parameter matrix.

[0016] FIG. 3 is a diagram of an example profile useful to assert data communication rules for a user device.

[0017] FIG. 4 is a diagram of an example user interface for user selection of parameters and directives for content preferences. [0018] FIG. 5 is a diagram of an example computer system to provide data to a user device according to a configurable parameter matrix with analysis of unencrypted communications.

[0019] FIG. 6 is a flowchart of an example method to provide data to a user device according to a configurable parameter matrix with analysis of unencrypted communications.

DETAILED DESCRIPTION

[0020] The information on the internet is increasingly controlled by a small number of technology companies or is, at least, influenced by the algorithms created by such technology companies. Many internet users would like to have more control in what information is presented to them either by declaring specific interests or by blocking content they are not interested in.

[0021] Thus, a technical problem is how to deliver data according to a user’s interests in an established and controlled networked computer environment that is controlled by other interests. More specifically, the technical problem may be considered as how to deliver data of sought by one party in a computer network that contains existing algorithms that seek to deliver data according to interests of other parties. In other words, how to improve the accuracy and utility of data delivery.

[0022] The invention provides a technical solution in the form of automation that allows users to select the types of required to be delivered from a selection of categories. A user is provided an interface that allows them to shift a bias for any given category, so that the user is delivered more or less information from that category. User input may be incorporated into existing data delivery processes such that information that the user receives will be biased based on the interests declared.

[0023] Should a user wish, they can also configure the invention to block information from categories they select. The invention thus serves to give the user a way to influence the content they see all the way through to blocking content they do not wish to see. As such, a user gains more control over the data they receive.

[0024] FIG. 1 shows an example system 100 to implement the present invention. The system 100 includes a plurality of hosts 102 that provide data (e.p., information, content, media, services, e-commerce, etc.) to a plurality or user device 104. Hosts 102 may be termed servers or services. User devices 104 may include computing device, such as notebook computers, desktop computers, smartphones, smart watches, tablet computers, and the like. The user devices 104 may communicate with the hosts 102 via a large computer network, such as the internet 106. Communications between the user devices 104 and the hosts 102 maybe encrypted. Such encryption may include end-to-end encryption, in that only a user device 104 and the respective communicating host 102 possess the requisite cryptographic keys. The user devices 104 may be provided access to the internet 106 by an internet service provider (ISP) 108.

[0025] A computing device 110 and datastore 112 maybe connected to ISP 108 core network infrastructure to implement or assist in implementing various techniques discussed herein. In various examples, the computing device 110 has access to network traffic between the user devices 104 and hosts 102. In other examples, the computing device 110 is not directly connected to the ISP 108 and is connected to the internet 106 similar to a host 102, i.e., as any other server or service connected to the internet 106. Any number and configuration of computing devices 110 and datastores 112 maybe used. Certain functions maybe assigned to certain computing devices 110 and datastores 112. An additional computing device 110 or datastore 112 may provide redundancy. For sake of explanation, this disclosure will reference an example computing device 110 and datastore 112.

[0026] The computing device 110 includes a processor capable of executing instructions to implement the techniques discussed herein. Example processors include a central processing unit (CPU), a field-programmable gate array (FPGA), and an application-specific integrated circuit (ASIC). Instructions and related data may be stored in a non-transitory machine- readable medium, which maybe volatile or non-volatile. Examples of such a medium include random-access memory (RAM), read-only memory (ROM), electrically-erasable programmable read-only memory (EEPROM), flash memory, a hard disk drive (HDD), a solid-state drive (SSD), and other electronic, magnetic, or optical physical media.

[0027] Instructions may be directly executed, such as binary or machine code, and/ or may include interpretable code, bytecode, source code, or similar instructions that may undergo additional processing to be executed. All of such examples may be considered executable instructions. A set of instructions for a particular purpose may be referred to as an agent.

[0028] A user device 104, which may be termed a client device, includes a processor and non- transitory machine-readable medium, with examples discussed above, to store and execute instructions to implement the functionality discussed herein.

[0029] The computing device 110 may intercept data packets in transit between a user device 104 and a host 102 through the ISP 108 core network.

[0030] The computing device 110 may collect data via existing network infrastructure (routers or other capable devices) at the ISP 108. The ISP’s infrastructure maybe configured to send a copy of all network packets to an agent running on the computing device 110. The original packet will continue onto the intended destination, but a copy will be sent to the agent for analysis and logging. [0031] For a given packet, the computing device 110 may first assess the packet to determine if it represents the initiation of a new request from a user device 104 to a host 102. If the packet does represent a new request, the computing device 100 may log a source IP address, destination IP address, packet time to live, and the time (e.p., timestamp, date-time) that the packet was sent. Where possible (e.p., if the network protocol allows data to be readily inspected), additional information may be captured such as the resource path (URL/URI) as well as attributes of the user device 104 such as screen size, operating system and version, the client application and version and any additional third-party unique identifiers that can be used for tracking (such as third-party cookies).

[0032] Logged data for a given packet may include:

• Source IP Address

• Destination IP Address

• Time to Live

• Date/Time

• Category

• URL/URI

• User Identifier

• Operating System and Version

• Device Type

• Display Attributes

• Third-party Unique Identifiers

[0033] The computing device 110 may analyze the data packet to obtain a user identifier of the data packet. The user identifier uniquely identifies a user of the user device 104. Analyzing a data packet may be achieved by parsing log data. The computing device 110 may extract a user identifier from a data packet by processing the relevant log data for that packet. The user identifier may be explicitly present in the log data. When not explicitly present, a user identifier may be selected from a set of known user identifiers based on identifying information, such as third-party identifiers and/or hardware/ software fingerprints, explicitly present in or derived from the log data for the data packet.

[0034] FIG. 2 shows an example of a computing device 110 configured to generate a category 200 for a user operating a user device 104 based on a profile 202 of the user. User identifiers may be used to uniquely distinguish user profiles 202. The computing device 110 may provide the user category 200 to hosts 102, so that hosts 102 may provide relevant content 204 to the user device 104. A given user maybe assigned any number of categories. In some examples, a category 200 is a cohort and the user may be assigned to a single cohort. Any number of users and user devices 104 may operate in this way, as supported by the computing device 110.

[0035] The user of the device 104 is associated with a profile 202, which may be stored at the computing device 110 or the user device 104. Each profile 202 may be unique to each user. A profile may be assigned to a user via a unique identifier, such as a user identifier as discussed above.

[0036] The profile 202 may include usage data 210 indicative of past content 204 delivered to the user device 104. Usage data 210 maybe distilled into express interests based of classification of the content 204. In some examples, instances of content 204 are classified in topics. Example topics include work, health, home and garden, sports, cars, specific hobbies, etc. Classification may be performed on the basis of host 102, website, or URL. For example, an entire website may be classified as relating to a particular topic. In another example, each page (e.p., each unique URL) of a website may be separately classified into one or more topics. In still another example, a host 102 may be classified in that it hosts a certain type of content, such as a search engine, file share, or blogs. As such, usage data 210 may map host, website, or address (generally “content address”) to topics.

[0037] The profile 202 may further include personal data 212, such as name, age, gender, location, income, etc. of the user. Location may be general, specific, or exact, and may include an address, geographic region, city, state/province, country, etc. Personal data 212 may also include household data, such as household income, number of members of the household, etc.

[0038] The profile 202 may further include a configurable parameter matrix 214 that controls the elements of the usage data 210 and personal data 212 that are exposed to the computing device 110. The configurable parameter matrix 214 is configurable by the user via the user device.

[0039] The computing device 110 includes an artificial intelligence (Al) system 220 that takes the user profile 202 as input and categorizes the user to obtain the user category 200. The Al system 200 may include a convolutional neural network (CNN). The Al system 200 may be trained on data volunteered by users.

[0040] A feedback loop operates via the user device 104 obtaining content 204 from the hosts 102. The delivery of data (consumption of content) is distilled into usage data 210, which informs the computing device 110 in assigning the user of the user device 104 to a user category 200, which in turn informs the host 102 as to the nature of content 204 desired by the user of the user device 104. The feedback loop may be moderated or controlled by the configurable parameter matrix 214, which is controllable by the user of the user device 104. As such, the user has control of the nature of the content 204 delivered to them. [0041] With reference to FIG. 3, a configurable parameter matrix 214 may include parameters and associated directives 302.

[0042] Parameters 300 relate to elements of usage data 210 and personal data 212. A parameter 300 may map to one or more topics of usage data 210. For example, if usage data 210 is classified as work, health, home and garden, sports, cars, and boats, then one parameter 300 may be provided for each of such topics. In another example, multiple topics may be mapped to one parameter 300 (e.p., a parameter called “vehicles” may map to the topics boats and cars). Similarly, a parameter 300 may map to one or more elements of personal data 212. For example, a parameter 300 may be applied to each element of personal data 212 (e.p., name, location, income, etc.). In some examples, a given parameter may map to an element of usage data 210 and an element of personal data 212. In short, the parameters 300 are a parameterization of the usage data 210 and personal data 212.

[0043] Each parameter 300 is associated with a directive 302. A directive may include a function such as “block,” “allow,” and “invite.”

[0044] An example “block” directive 302 indicates that the associated parameter 300 is to be excluded from the determination of what content 204 to deliver to the user device 104 (FIG. 2). In the case of content topics, a block directive 302 indicates that the topic is to be excluded. In the case of personal data 212, a block directive 302 indicates that the element of personal data is not to be shared with the computing device 110.

[0045] An example “allow” directive 302 indicates that the associated parameter 300 may be included in the determination of what content 204 to deliver to the user device 104 (FIG. 2). In the case of content topics, an allow directive 302 indicates that the topic may be of interest to the user. In the case of personal data 212, an allow directive 302 indicates that the element of personal data maybe shared with the computing device 110. That is, the user grants access to the element of personal data should the computing device 110 be configured to reference it.

[0046] An example “invite” directive 302 indicates that the associated parameter 300 is to be provided for the determination of what content 204 to deliver to the user device 104 (FIG. 2). In the case of content topics, an invite directive 302 indicates that the topic is of interest. In the case of personal data 212, an invite directive 302 affirms that the element of personal data should be shared with the computing device 110.

[0047] The directives 302 may be unitary or scalar. A unitary directive allows the selection of only one option for the parameter 300, such as selecting from block, allow, or invite. A scalar directive provides a numerical quantity to the parameter 300, such a real number between -1 and +1, where -1 signifies block, 0 signifies allow, and +1 signifies invite. [0048] A directive 302 may determine respective content, as identified by a parameter 300, that is to be blocked, allowed, or invited. In addition, a directive 302 may determine additional functionality that may be required to carry out the blocking, allowing, or invitation of content. For example, a directive 302 that blocks content identified to be malware may also trigger decryption of data communicated with the user device 104. Decryption may be useful to determine whether or not the data actually contains malware. Alternatively, a directive 302 may allow access to unencrypted data, such as access to requests before they are encrypted or access to response data after it is decrypted.

[0049] Accordingly, a directive 302 may have one or more attached functions, such as packet inspection and/or decryption, to facilitate execution of the directive 302. For example, a directive that specifies blocking data associated with a parameter 302 may also specify that data packets are to be analyzed in unencrypted form to facilitate execution of the directive 302 on the parameter 300.

[0050] FIG. 4 shows an example user interface 400 for user selection of parameters and directives. The user interfaces 400 may include user input elements 402, such as checkboxes or radio buttons, to select a directive 404 for each of a set of parameters 406.

[0051] FIG. 5 shows an example computer system to provide content to a user device according to a configurable parameter matrix with analysis of unencrypted communications at the user device. The system is similar to that shown in FIG. 2, and above description may be referenced for details not repeated here.

[0052] A client program 500 is executed at the user device 104. The client program 500 may be configured to allow user input to a configurable parameter matrix 214, such as by allowing directives for various parameters, as discussed above with regard to FIGs. 3 and 4. The client program 500 may include, for example, a web browser, a plugin/modification of a web browser, or a program that cooperates with a web browser.

[0053] The client program 500 may contain or communicate with an encryption function 502 of the user device 104. The encryption function 502 normally encrypts and decrypts data communicated with a host 102.

[0054] The client program 500 may selectively expose unencrypted data to allow application of a directive provided for a parameter. For example, should the user select that malware is to be blocked, the client program 500 may reference that directive and provide unencrypted access to data communicated with a host 102 to effect the directive by, for example, determining whether the data contains malware or whether the host 102 is associated with malware. [0055] Alternatively, the client program 500 may instruct the encryption function 502 to decrypt data, at least temporarily, to allow application of a directive provided for a parameter. For example, should the user select that malware is to be blocked, the client program 500 may reference that directive and decrypt data communicated with a host 102 to effect the directive by, for example, determining whether the data contains malware or whether the host 102 is associated with malware.

[0056] In the case of known malware hosts, such determinations may be made by analyzing the address or URL of requested content or by passing the address or URL of requested content to a policy or filter service that performs such analysis.

[0057] Further, in various examples, data that is exposed or decrypted by the client program 500 to carry out directives may be used to train the Al system 220 to improve execution of the directives. For example, if the user selects a directive that blocks malware, but analysis of unencrypted data communicated between the user device 104 and host 102 indicates the presence of malware, then the address or URL of such data may be used to train the Al system 220, so that future requests to such host 102 will be blocked on the basis of an expressed directive, which may reduce the need to expose or decrypt data.

[0058] In addition, data that is exposed or decrypted by the client program 500 to execute directives may be used to train the Al system 220 even when not related to the directive that necessitated the decryption. For example, as discussed above, decryption may be necessary to enforce a malware directive. Even when no malware is found, the client program 500 may still store the address or URL of the decrypted data for future training of the Al system 220. Large quantities of addresses or URLs of content communicated between the user device 104 and the hosts 102 may be stored, so that such information may be provided to train the Al system 220 in conjunction with the preferences expressed in the configurable parameter matrix 214. The configurable parameter matrix 214 maybe considered a goal for training while classification of stored addresses or URLs of content may be considered the actual results pertaining to that goal. The training may then be configured to reduce or minimize the difference between the goal and the actual results.

[0059] Considering online advertising as an example use-case of the above, whether it is influencing what kinds of advertisements they see or if they see any ads at all, many users are looking for granular control of ads that are presented to them. Companies operating in the online advertising space today do not give users useful opportunities to influence what is presented to them. Advertisers, publishers, ad exchanges and the other various interested parties control the user data and, aside from perhaps providing a way for the user to delete their information from a system, they do not offer a way for a user to selectively influence the advertising process. As such, the accuracy of the information delivered is low and user privacy is often given insufficient consideration. [0060] With regard to FIG. 5, in this example, a user device 104 may routinely request and obtain content 204 from hosts 102 using a client program 500. The client program 500 may include a web browser for requesting and receiving web pages from hosts 102. Without using the techniques discussed herein, hosts 102 may provide advertisements and other content according to known algorithms, of which the user of the user device 104 has little or no control. With the techniques discussed herein, the user device 104 or user thereof is associated with a profile 202, which maybe maintained at the ISP. The profile 202 tracks usage data 210 and personal data 212. Usage data 210 maybe indications of interest in content of various categories of the content offered by hosts 102. For example, a category, such as “cars” may be assigned a value from 0 to 1 based on the proportion of content 204 delivered to the user device 104 that is associated with “cars.” The client program 500 may be used to configure a configurable parameter matrix 214 that indicates which elements of usage data 210 and personal data 212 may be released to the computing device 110 to categorize the user of the user device 104. A user interface 400, such as a web page, may be provide by the client program 500 or ISP to do this. For example, the user may wish to block all personal data 212 from being used for categorization, block certain categories of data (e.p., “clothing”) from being used for categorization, and allow certain categories of data (e.p., “cars”) to be used for categorization. The Al system 220 then obtains usage data 210 and personal data 212 permitted by the matrix 214 from the profile 202 and operates on such data to categorize the user to obtain a user category 200. The user category 200 may then be provided to the hosts 102 so that known or new algorithms used by the hosts 102 to deliver content 204 may use the user category 200 to provide content of greater relevance to the user of the user device 104.

[0061] FIG. 6 shows a method 600 that incorporates various techniques discussed above. The method 600 may be implemented as processor-executable instructions. For example, the method may be implemented as a client program 500 (see FIG. 5).

[0062] The method 600 may be performed continuously to provide data to a user device according to a configurable parameter matrix 214 with analysis of exposed or decrypted communications .

[0063] At block 602, a setup process may be selected by the user. If the user wishes to configure the configurable parameter matrix 214, the user is authenticated (e.p., by name and password), at block 604, and then a user interface (see FIG. 4) is provided to allow the user to select directives for various parameters, as discussed above.

[0064] At block 608, the main process operates on user requests for data from hosts or data- bearing responses from the hosts. Such requests and responses are communicated with the hosts. [0065] At block 610, directives of the configurable parameter matrix 214 that are operable to determine whether subsequent directives are to be performed are applied to request and/or response data communicated with a host. For example, such a “first” directive may expose unencrypted request and/ or response data from block 608 for further processing. In another example, the first directive may decrypt request and/or response data from block 608 for further processing.

[0066] At block 612, it is determined whether request and/or response data is relevant for further directives. This may include determining whether the data matches parameters of the configurable parameter matrix 214. For example, the request and/or response data maybe categorized to determine any applicable parameters that define categories of data for which one or more “second” directives are to be applied.

[0067] If the request and/or response data is determined to be not relevant, at block 614, then no directive is applied, at block 616, and the method 600 repeats.

[0068] If the request and/or response data is determined to be not relevant, at block 614, then the associated directive is applied, at block 618, and the method 600 repeats. For example, the data may be determined to match a blocked category, so the second directive may block or redirect the associated request and/or response.

[0069] Accordingly, as can be seen, the configurable parameter matrix 214 may provide directives that are executed on data before the relevance of the data is evaluated and additional directives that are performed after the relevance of the data is evaluated. For example, a first directive may expose all request and/or response data, at block 610, so that the data maybe analyzed to determined whether it contains malware, at blocks 612, 614, and then requests and/or responses determined to contain malware maybe blocked by a second directive, at block 618. At the same time, another second directive may categorize the request and/or response data, which is exposed by the malware-related first directive, for future use by hosts when determining the categories of data that interest the user. The user benefits by having malware blocked and, in exchange, the user grants permission to categorize and use their data for other purposes, such as delivering more data of high relevance.

[0070] As discussed above, the present disclosure provides techniques to enable users to select the type of information they are most interested in seeing from a selection of categories presented to them. A user may assert a bias for any given category, so that they are provided with more or less content in the category.

Claims

1. A non-transitory machine-readable medium comprising instructions that, when executed by a processor, cause the processor to: receive configuration input from a user device at a configurable parameter matrix that defines classifications of data and directives associated with the classifications of data, a directive determining whether data of a respective classification is allowed or blocked for transmission to the user device; apply the configurable parameter matrix to an artificial intelligence system to determine a category of a user of the user device; and transmit the category of the user to a plurality of hosts responsive to requests for data from the user device, wherein the category enables the plurality of hosts to transmit data matching the category of the user to the user device.

2. The non-transitory machine-readable medium of claim 1, wherein the directive is associated with a function operable on the requests for data and/ or data responsive to the requests for data.

3. The non-transitory machine-readable medium of claim 2, wherein the function comprises accessing of unencrypted requests for data and/or unencrypted data responsive to the requests for data.

4. The non-transitory machine-readable medium of claim 2, wherein the function comprises decryption of the requests for data and/or the data responsive to the requests for data.

5. The non-transitory machine-readable medium of claim 1, wherein the configurable parameter matrix further defines personal data of the user and directives associated with the personal data of the user.

6. A method comprising: communicating request and/or response data between a user device and a host; applying a first directive to the request and/or response data to expose the request and/or response data, the first directive being obtained from a configurable parameter matrix that associates directives to parameters including associating the first directive to a parameter; determining a relevance of the exposed request and/or response data to the parameter; if the exposed request and/or response data is relevant to the parameter, applying a second directive to the request and/or response data to allow or block communication of the request and/ or response data between the user device and the host.

7. The method of claim 6, further comprising: determining another relevance of the exposed request and/or response data to another parameter; and if the exposed request and/or response data is relevant to the other parameter, applying another second directive, which is associated to the other parameter, to the request and/or response data to allow or block communication of the request and/or response data between the user device and the host.

8. The method of claim 6, further comprising: determining usage data from the exposed request and/or response data; and providing the usage data to an artificial intelligence system that is operable to categorize a user of the user device; and providing a category of the user to the host.

9. The method of claim 6, further comprising: comprising applying a first directive to the request and/ or response data to expose the request and/or response data by decryption the request and/or response data.

10. A non-transitory machine-readable medium comprising instructions that, when executed by a processor, cause the processor to perform the method of claim 6.