Consent management
There is provided a computer-implemented method for a first party to control permission for access to first party information to a second party while preserving privacy, the method comprising the following steps taken by the first party at first party computing apparatus: establishing with the second party a set of information classes for first party information to be provided to the second party and establishing permitted use for the first party information in the set of information classes; providing a first party consent to the permitted use for the first party information in the set of information classes, encrypting the first party consent for inspection limited to the first party and the second party, and providing the first party consent to the second party in a first party digitally signed consent grant structure for the second party to decrypt, validate and sign the first party consent and for a consent validating party to store the first and second party digitally signed consent grant structure on a blockchain. There is also provided a computer-implemented method for a second party to obtain permission from a first party for access to first party information while preserving privacy. There is also provided a computer-implemented method for a consent validating party to manage permissions given by a first party for access to first party information to a second party while preserving privacy.
1. A computer-implemented method for a grantor to control permission for access to grantor information to a grantee while preserving privacy and enabling grantor control of grantor information to be processed, the method comprising the following steps taken by the grantor at a computing apparatus of the grantor:
establishing with the grantee a set of information classes for grantor information to be provided to the grantee and establishing permitted use for the grantor information in the set of information classes;
providing a grantor consent to the permitted use for the grantor information in the set of information classes;
encrypting the grantor consent for inspection limited to the grantor and the grantee; and
providing the encrypted grantor consent to the grantee in a grantor digitally signed consent grant structure for the grantee to decrypt, validate and sign the grantor consent and for a consent validating party to store the grantor and grantee digitally signed consent grant structure on a blockchain, wherein the consent grant structure comprises the consent to the permitted use for the grantor information in the set of information classes.
2. The method of claim 1 , wherein the set of information classes and the permitted use are established in an application on the grantor computing device relating to provision of goods or services by the grantee.
3. The method of claim 2 , wherein the application on the grantor computing device relates to provision of goods or services by multiple grantees, and the determination of the set of information classes and the permitted use relates to use by multiple grantees.
4. The method as claimed in claim 1 , further comprising the grantor providing a revoke grant structure revoking the consent grant structure, wherein the revoke grant structure identifies the consent grant structure and is encrypted by the revoking party for inspection limited to the grantor and the grantee and is digitally signed by the revoking party.
5. The method as claimed in claim 1 , wherein encrypting data for inspection limited to the grantor and grantee comprises establishing a symmetric key for use by the grantor and the grantee using elliptic curve Diffie-Hellman key exchange.
6. The method as claimed in claim 1 , wherein the grantor uses a plurality of private keys for encrypting and digital signing.
7. The method of claim 6 , wherein each of the plurality of private keys is generated by an iterative process from an original master private key.
8. The method of claim 7 , wherein a private key is generated from a preceding private key by splitting the preceding private key into a first part and a second part, and by performing a first process to generate the first part of the private key and a second process to generate the second part of the private key.
9. The method of claim 8 , wherein one of the first process and the second process is an XOR of the first part and the second part of the preceding master private key followed by a hash of the XOR, and wherein the other of the first process and the second process is a hash of the first part or the second part of the preceding master private key.
10. The method of claim 5 , further comprising regenerating private keys after the consent event, determining corresponding public keys from the private keys, and using the determined public keys to identify consent events.
11. The method of claim 1 , wherein the consent grant structure further comprises a time of the provision of grantor consent.
12. The method of claim 1 , wherein the consent grant structure further comprises a period of time of validity of the grantor consent.
13. A computer-implemented method for a grantee to obtain permission from a grantor for access to grantor information while preserving privacy and enabling grantor control of grantor information to be processed, the method comprising the grantee at a computing apparatus of the grantee:
establishing with the grantor a set of information classes for grantor information to be provided to the grantee and establishing with the grantor permitted use for the grantor information in the set of information classes;
receiving from the grantor a grantor consent to the permitted use for the grantor information in the set of information classes, wherein the grantor consent is encrypted by the grantor for inspection limited to the grantor and the grantee, the encrypted grantor consent being provided in a grantor digitally signed consent grant structure;
decrypting and validating the encrypted grantor consent, and providing the grantor consent to a consent validating party in a grantor and grantee digitally signed consent grant structure, wherein the consent validating party is able to determine that the grantor and grantee digitally signed consent structure is valid, and is further able to store the grantor and grantee digitally signed consent grant structure on a blockchain, wherein the consent grant structure comprises the consent to the permitted use for the grantor information in the set of information classes.
14. The method as claimed in claim 13 , further comprising the grantee providing a revoke grant structure revoking the consent grant structure, wherein the revoke grant structure identifies the consent grant structure and is encrypted by the revoking party for inspection limited to the grantor and the grantee and is digitally signed by the revoking party.
15. The method as claimed in claim 13 , wherein encrypting data for inspection limited to the grantor and the grantee comprises establishing a symmetric key for use by the grantor and the grantee using elliptic curve Diffie-Hellman key exchange.
16. The method as claimed in claim 13 , wherein the grantee uses a plurality of private keys for encrypting and digital signing, the method further comprising regenerating private keys after the consent event, determining corresponding public keys from the private keys, and using the determined public keys to identify consent events.
17. The method of claim 13 , wherein the consent grant structure further comprises a time of the provision of grantor consent.
18. The method of claim 13 , wherein the consent grant structure further comprises a period of time of validity of the grantor consent.