Method and apparatus for securing the privacy of a computer network

Abstract

A method and apparatus for secure access to a computer network and for safeguarding the confidentiality and privacy of data stored and distributed by the network is disclosed. The method and apparatus addresses both limiting access to the computer network to those who are authorized to have access as well as the privacy of the information stored in the network.

We claim: 
     
         1 . A method of secure privacy notification, said method comprising the steps:
 determining the regulatory compliance requirements for privacy notification of data subjects;   transforming said requirements into electronic and non-electronic database query screens and forms;   querying a remote and/or resident database for information fields contained within said query screens and forms;   human or automated completion of said data screens;   encryption/decryption of said data screens;   human and/or automated conversion of data screens into privacy notification human readable formats;   electronic and/or non-electronic data subject feedback response methods and means; and   conversion of said data subjects feedback responses into database deletion, modification or correction of the data subject's information in accordance with said regulatory requirements.   
     
     
         2 . The method of  claim 1  wherein said electronic privacy notification and feedback response is accomplished via a secure web portal. 
     
     
         3 . The method of  claim 1  wherein said electronic privacy notification and feedback response is accomplished via a secure e-mail system. 
     
     
         4 . The method of  claim 1  wherein said electronic privacy notification and feedback response is accomplished using digital certificates comprising:
 a public or private, commercial or government registration authority; 
 a public or private, commercial or government certificate authority; 
 a digital signature encryption algorithm′ 
 a unique non-reputable uer electronic identity; 
 issuance of x.509 compliant certificates specifically encoded via extension to alert data processor of the data subjects privacy preferences; and 
 issuance of x.509 standard certificates specifically encoded via extension to alert data processors of legal and regulatory compliance requirements relevant to the data subjects privacy preferences. 
 
     
     
         5 . The method of  claim 4  wherein said digital signature algorithm is SHA-1 with DSA. 
     
     
         6 . The method of  claim 4  wherein said digital signature algorithm is an elliptic curve. 
     
     
         7 . The method of  claim 6  wherein said elliptic curve is a Koblitz binary curve. 
     
     
         8 . The method of  claim 4  wherein said digital signature algorithm is a block cipher such as Rijndael. 
     
     
         9 . The method of  claim 4  wherein the data subjects privacy preference is to “opt out” and where encoding the digital certificate to be easily read by visual inspection by distinct color coding. 
     
     
         10 . The method of  claim 4  wherein the data subjects privacy preference is to “opt in” and where encoding the digital certificate to be easily read by visual inspection by distinct color coding. 
     
     
         11 . The method of  claim 4  including third party archiving of certificate for non-repudiation, compliance audit and send and receive functions. 
     
     
         12 . The method in  claim 4  including the binding of a users identity and access authorizations to a physical device, such as a USB key, and challenging the key at a remote email server in order to gain access to the users authorized email box and messages.