WO2009021529A1

WO2009021529A1 - Method for gathering and providing aggregated information on a group of users of a specific service

Info

Publication number: WO2009021529A1
Application number: PCT/EP2007/007118
Authority: WO
Inventors: Joao Girao; Daniele Abbadessa
Original assignee: NEC Europe Ltd
Current assignee: NEC Europe Ltd
Priority date: 2007-08-10
Filing date: 2007-08-10
Publication date: 2009-02-19
Anticipated expiration: 2010-02-10

Abstract

Method for gathering and providing aggregated information on a group of users of a specific service, is characterized in that information related to the users' service usage behaviour is transmitted from the users' service use devices to a collector entity, wherein the users' identity is referred to under pseudonyms, the pseudonyms being registered at an identity provider, that the collected information is relayed to a third party, wherein the third party performs an internal analysis of the received information thereby filtering out a set of pseudonyms, that the third party contacts the identity provider with a query comprising said filtered set of pseudonyms and at least one query parameter, and that the query is analysed and answered with a reply by the identity provider on the basis of pre-configurable policies.

Description

METHOD FOR GATHERING AND PROVIDING AGGREGATED INFORMATION ON A GROUP OF USERS OF A SPECIFIC

SERVICE

The present invention relates to a method for gathering and providing aggregated information on a group of users of a specific service.

Nowadays there is a strong interest on the part of e.g. multimedia providers to obtain certain information concerning the consumer behaviour of the users of their services. For example, a television service provider might be interested in the viewing habits of his customers and might in particular want to know e.g. the age group of a number of individuals watching his television shows. Such information can be very valuable for a provider since it allows him to schedule the best program during prime time to thereby increase the number of viewers. Moreover, such information is extremely valuable to decide which advertisements should be played during a given program.

From a more general point of view, there are various other scenarios in which a provider of some kind of service might have an interest to learn something about the usage of his offered service. By obtaining statistical and demographic information regarding the usage of his services the provider is enabled to further improve them. For instance, such an interest may exist in connection with web browsing, telephone services, shopping, tele voting, to name just a few examples. The list could be continued nearly endlessly.

Currently, information of the above mentioned kind, for instance about user viewed TV-programs, is obtained by querying a group of randomly selected service user what is usually done over the telephone. This approach is time and cost consuming since a rather large amount of single telephone calls has to be performed in order to obtain significant results. Furthermore, such telephone calls constitute an invasion of the called people's privacy and might cause some anonymity problems. Alternatively, it is known from practise in the world of television to install specific monitoring devices in a selected group of users. However, in the future, and in particular with IPTV, it would be possible to link the channel being watched with the device and, possibly, with the identity of the respective user. Insofar, it is very likely, that in the context of such a mechanism the person's right to privacy may be severely endangered.

It is therefore an object of the present invention to improve and further develop a method of the initially described type for gathering and providing aggregated information on a group of users of a specific service in such a way that by employing mechanisms that are readily to implement information on users is obtainable in a cost and time efficient manner thereby maintaining and ensuring the users' anonymity.

In accordance with the invention, the aforementioned object is accomplished by a method comprising the features of claim 1. According to this claim, such a method is characterized in that information related to the users' service usage behaviour is transmitted from the users' service use devices to a collector entity, wherein the users' identity is referred to under pseudonyms, the pseudonyms being registered at an identity provider, that the collected information is relayed to a third party, wherein the third party performs an internal analysis of the received information thereby filtering out a set of pseudonyms, that the third party contacts the identity provider with a query comprising said filtered set of pseudonyms and at least one query parameter, and that the query is analysed and answered with a reply by the identity provider on the basis of pre-configurable policies.

According to the invention it has been recognised that privacy concerns can be confronted by employing pseudonyms under which the user's identity is referred to. To this end an identity provider is implemented in which the pseudonyms are registered and which gives one or several pseudonyms to each of its users and links them to the users' identity. Thus, anonymized information can be collected under the user's pseudonyms and can be relayed in a controlled manner to a third party, which is enabled to perform an internal analysis of the received information based on its needs to filter out a set of pseudonyms. After the filtering the third party contacts the identity provider with a query wherein the query is based on said filtered set of pseudonyms and at least one generic query parameter. According to the invention the query is analysed by the identity provider and answered with a reply on the basis of pre-configurable policies. By means of such pre-configurable policies the third party is bound to certain rules which serve to minimize the risk of linking information about the queried user thereby ensuring anonymity in the pseudonym set.

It is to be noted that during the whole process user identities are never disclosed as insofar the invention applies the concepts of virtual identity. The method according to the invention combines an "Identity Management" and "Federated Identity" system, such as one supported by Liberty Alliance protocols, in which the user's identity is referred to under pseudonyms, with a collection mechanism in order to collect information in an anonymous way.

The employment of the identity provider in a manner according the invention has the further advantage that the third party, which will generally be a content provider, does not have to reveal his queries to the collector entity - these are competitors and this information is also privileged. Moreover, as mentioned above the filtering is performed by the third party itself according to its needs and requirements. Thus, the query directed to the identity provider only has to include the filtered set of pseudonyms and a query parameter. Consequently, the third party does not have to reveal its real interests behind the query to the identity provider. In other words, the identity provider does not receive which event (e.g. the watching of a specific program or the access to a certain web page) the query refers to. It is to be noted that the query parameter is only a generic parameter related to, for instance, gender, age (e.g. younger than 18 years), etc., or combinations thereof (e.g. women over 50 years old). From such generic query parameters the identity provider can not draw any conclusions regarding the underlying third party's interests. - A -

In an advantageous embodiment the information related to the user's service usage behaviour may include service specific information. For instance, in the case of a shopping service the information related to the user's service usage behaviour may include information regarding the products the user has bought, in the case of a tele voting information on the users' votes (e.g., yes or no), in the case of web browsing information on the URLs of visited sites, etc.

In a specific embodiment the information related to the user's service usage behaviour includes the time the service was active. Alternatively or additionally, the information related to the user's service usage behaviour includes the time the user utilised the service, which may be, for instance, the time the user's service use device was active. The time information is especially advantageous, for example, in the context of TV services. The time information may be transmitted to the collector entity in addition to the service specific information mentioned before. However, there may be scenarios in which the time information already constitutes the service specific information.

Furthermore, the information related to the user's service usage behaviour may include service content information. In the context of TV services, especially IPTV services, the service content information may, in particular, include information regarding the channel or program the user is watching. According to a specific embodiment, the information related to the user's service usage behaviour could be generated at a content provider and could then be transferred to the collector entity or entities.

As regards an effective collection of local information it may be provided that the multiple households of a house are connected to the collector entity via a home gateway. Thus, the collector entity does not have to contact single service use devices (e.g. IPTV devices), but only the home gateways to which the single service use devices of the respective household are registered.

With respect to the transmission of collected information from the home gateways to the collector entity it may be provided that the collector entity contacts all the home gateways which are registered under him and poll their databases in a progressive manner. After the information being polled it is no longer required at the home gateway and may be erased. Alternatively, it is possible to keep the information stored for a certain time period. This might be useful in situations in which multiple collector entities poll for the same information at the home gateways. In this context it is to be understood that the service described is not necessarily linked to one service provider exclusively.

According to another scenario it is also possible that the home gateways are configured in such a way that they push collected information in an anonymous way to the collector entity or entities, for instance in fixed pre-set time intervals. The deletion of collected information may be handled in the same way as described above in the case of polling.

Advantageously, the information related to the user's service usage behaviour is transmitted to the collector entity by means of SNMP (Simple Network Management Protocol). This protocol supports both pull and push mechanisms. In general, the information may be transmitted over any proprietary protocol which may be, for example, over a web service.

Regarding the identification of the user of an IPTV device or any other service use device, it may be checked by means of an authentication, by means of a wireless interface or by means of a transponder (e.g. RFIDs) which user is accessing the service. As wireless interface, e.g. Bluetooth or infrared technology could be used. In an especially advantageous embodiment the authentication of a user of a service use device is performed via the user's cell phone to ensure that the owner is actually present in front of the device. For instance the authentication could be performed by the user being asked to introduce a pin number in his mobile phone or in any other suitable device. The authentication may be performed locally, i.e. between the home gateway and the e.g. mobile phone of the user. Alternatively, the authentication may be performed by the identity provider via the home gateway or directly with the service provider without the use of the home gateway.

As regards a particularly strong privacy keeping each pseudonym may be used only once instead of several times. In particular, the pseudonyms may be changed (renewed or reused) in certain time intervals. The time intervals may have a fixed pre-configured length or, alternatively, may be chosen on a randomized basis. Moreover, the pseudonyms may have a time tag to them so that their instances can be distinguished. In this context it proves to be advantageous that the third party's query directed to the identity provider includes additional information on the pseudonyms contained in said filtered set of pseudonyms. This additional information may for example include information regarding the date and time when each pseudonym was used. Based on this information the identity provider is enabled to resolve the pseudonyms against the real users (in case the same pseudonym has been reused at a different day or time).

The pseudonyms, which are registered at the identity provider, may be provided in large numbers whereupon, in general, several pseudonyms identify the same user. However, the opposite may also be realized, i.e. the identity provider may assign one or more pseudonyms to two users to represent them both. This might be the case when the identity provider notices that the two users always have actions together. Consequently the identity provider employs these common pseudonyms when both users simultaneously use the same service in the same way, for example in the case of a TV service when they are watching the same channel simultaneously (which the identity provider is aware of by respective authentications). Instead of two users this scheme may be applied also for a group, e.g. for a family. Assigning the same pseudonym to more than one user helps to throw eavesdroppers out of balance.

Regarding the reply of the identity provider to a query from the part of a third party it may be provided that the identity provider enforces certain restrictions on the query. Specifically the identity provider may be configured in such a way that queries upon a set of pseudonyms are restricted in case the number of pseudonyms of the set of pseudonyms is below a configurable minimum threshold. In other words, the set of pseudonyms on which the query is based must contain a number of pseudonyms which is sufficiently large in order to ensure single user's privacy. As a further parameter the computational effort associated with answering a query can be taken into consideration. Basically, this effort is higher the larger the number of pseudonyms contained in a query. In general, it is possible to choose a configuration in which a balance performance between anonymity and concealment of users' private data on the one hand and passable computational effort on the other hand is realized.

According to a further policy the identity provider may be configured in such way that only a configurable maximum number of queries within a given time period is considered admissible. By this means it is avoided that a third party obtains information by a multitude of queries which may, by combining the information in an appropriate way, reveal a user's identity. According to an especially secure embodiment the maximum number of queries which is considered admissible by the identity provider is specified by taking into account the period of renewal of the pseudonyms. The less the pseudonyms are renewed the lower may be the maximum number of admissible queries.

To summarize, in general the policies of the identity provider serve to control and, as the case may be, restrict the amount of information which is divulged to the third party. The query of the third party must abide to the identity provider's privacy rules in terms of the query type, the minimum number of pseudonyms contained in the query and/or the number of queries per time interval. It may be provided that the policies of the identity provider are defined individually for each user or group of users. By this means users are enabled to get a better service at the expense of reducing their privacy.

In the context of a business model it may be provided that the aggregated information collected by the collector entity is sold to a third party. Furthermore it may be provided that the answering of queries directed to the identity provider from third parties is implemented as a service liable to pay costs.

There are several ways how to design and further develop the teaching of the present invention in an advantageous way. To this end, it is to be referred to the patent claims subordinate to patent claim 1 on the one hand and to the following explanation of preferred embodiments of the invention by way of example, illustrated by the figure on the other hand. In connection with the explanation of the preferred embodiments of the invention by the aid of the figure, generally preferred embodiments and further developments of the teaching will we explained.

In the drawings:

Fig. 1 is a schematic view of a specific application scenario of the method according to the invention related to an IPTV service illustrating the process of gathering local information on individual IPTV users,

Fig. 2 is a table illustrating the registration of pseudonyms at the identity provider,

Fig. 3 is a schematic view illustrating the process of collecting information at a collector entity,

Fig. 4 is a schematic view illustrating the process of providing the information to a third party,

Fig. 5 is a schematic view illustrating the process of the third party querying the identity provider, and

Fig. 6 is a schematic view of another specific application scenario of the method according to the invention related to a user televoting.

Fig. 1 illustrates a specific application scenario of the method according to the invention related to gathering and providing aggregated information on a group of users of an IPTV service. More specifically, Fig. 1 is a schematic view of a building with several households in which several IPTV devices are operated. In the concrete scenario shown, users A and B are watching television via their IPTV device which comprises a set top box denominated as STB1. The set top box STB1 functions on the one hand as digital broadcast receiver, and is on the other hand connected to a home gateway GW. The same holds true for the set top box STB2 of user C. Between the IPTV device of user D and the home gateway GW a wireless connection is established.

In the illustrated example the user's cell phones serve as an authenticated way of checking who is in front of the IPTV device (e.g. by using Bluetooth or infrared technology). However, other technologies could be used, e.g. RFIDs which may be integrated into the user's watches. A local authentication happens between the home gateway GW and the mobile phone of each user. To ensure that the owner is actually present in front of the monitor of his IPTV device the user might be asked to introduce a pin number in his mobile phone.

Once the authentication occurred the mobile phone or the home gateway GW will choose one of the pseudonyms which are registered at the identity provider IdP for that user together with personal data. The pseudonyms will exist in large numbers which is schematically illustrated in the table of Fig. 2. The first column of the table comprises the virtual identity VID of the registered users. The second column comprises the pseudonyms assigned to the users by the identity provider IdP. As it can be seen in the case of users A and B several pseudonyms identify the same user. On the other hand pseudonym PS3 represents both user A as well as user B. This pseudonym can be used when both users are watching the same channel simultaneously. In the following columns user specific information is stored which may be interesting from a demographic point of view. In the specific embodiment shown in Fig. 2, column 3 contains the age of the user and column 4 contains the gender of the user. It is to be understood that the database, as the case may be, may comprise further columns comprising more user specific information, for example whether the user lives in a rural area or in a city, information regarding the user's job, information whether the user lives alone or together with other people, etc.

Fig. 3 shows the process of collecting the information brought together at the home gateways GW at a collector entity. In the illustrated embodiment the collector entity is implemented as a part of the IPTV platform (which in other application scenarios might be a subcontractor linked to the IPTV operator, a NGN provider, a third party, etc.). However, in other scenarios the collector entity may be outside the IPTV service provider in which case the service provider, which owns the collector entity, should have an agreement with the network provider which provides him with the necessary credentials to pull the home gateways. This mechanism is well known to cable operators which frequently poll information on traffic in their cable modems.

According to the embodiment of Fig. 3 the collector entity will contact all the home gateways which are registered under him and poll their databases in a progressive manner. The information on time and pseudonyms are then stored and mixed at the collector entity. For the purpose of clarity only three houses with corresponding home gateways GW are shown. The house and the respective home gateway GW on the left side of Fig. 2 corresponds with the house and the home gateway GW shown in Fig. 1. As mentioned already the information which is transferred from the home gateways GW to the collector entity comprises at least information on time and on pseudonyms. In the concrete case additional information regarding the channel that has been watched is transmitted (e.g. the user referred to under pseudonym PS1 watched channel 05 from 16:00 to 17:00). The same pseudonym and time lists are collected at the collector entity from other home gateways, which in Fig. 3 is indicated by PSX and PSY.

Fig. 4 is a schematic illustration of the process of providing the information collected at the collector entity to a third party which, in general, will be a content provider CP. At determinate instances the collector entity will provide the pseudonym list with times and, as the case may be, other additional information associated to each entry to the third party. It may be provided that only the relevant information is passed on. The corresponding filtering may be based on time or on the additional information which is associated with the entry and is content relevant. For example, only the entries which are relevant to the XY network (in terms of TV channels, time or shows) will be passed on to the XY party. Although not explicitly shown in the figures, it is to be understood that the third party may gather information over different collector entities (such as different IPTV operators, cable operators, satellite operators, etc.). Fig. 5 is a schematic illustration of the process of checking the information the third party has received from the collector entity against the identity provider IdP. To this end the third party CP issues a query to the IdP based on a bulk piece of data. The piece of data must abide to the IdP's privacy rules in terms of the query type, the minimum number of pseudonyms in it contained and the number of queries within a certain time interval, for instance per day.

In a concrete application scenario, for example, the third party CP wants to know, from the bulk of pseudonyms it selected, i.e. from all users watching a specific channel in a certain time interval, how many of them refer to users that are between the ages of 15 and 20 years old. The identity provider IdP first checks whether the query is admissible in terms of its privacy rules. If the query has successfully passed this check the identity provider IdP will determine the result to the query and will forward the result back to the third party CP. The answer from the IdP will simply contain a count on the number of users which fulfil the criteria specified in the third party's query. The identity provider IdP is configured in such a way as to check for duplicate pseudonyms which will once be ignored in order to ensure that the result is not falsified. Pseudonyms which match more than one user though, will be checked against the specified criteria individually.

Fig. 6 illustrates schematically another specific application scenario of the method according to the invention wherein demographic characteristics related to a televoting is collected and provided to a third party. In the specific case the IPTV operator offers a particular TV show which is interactive, and users can respond to certain questions or vote from their IPTV devices at home. Consequently, in a first step individual IPTV users (three of which are shown in Fig. 6) send their votes in an anonymised manner by using pseudonyms to the IPTV operator which at the same time functions as collector entity. However, it is to be understood that the collector entity might not be the IPTV provider, but a third party that is offering this service to the IPTV provider.

In the case shown in Fig. 6 the user on the left side of Fig. 6 sends vote 1 by using pseudonym PS1 , the user in the middle also sends vote 1 by using pseudonym PS2 and the user on the right side sends vote 2 by using pseudonym PS3. These votes are collected at the IPTV operator. Third parties that are interested to know how people voted can ask for these votes. Upon a respected request and after having performed an admissibility check of the query the respective data is forwarded (in general sold) to the requesting third party. In Fig. 6 this process is indicated as step 2.

In step 3 the third party sends a request to the identity provider IdP wherein the request is based on a set of pseudonyms and a generic query parameter. The set of pseudonyms may comprise those pseudonyms which are assigned to users which voted by vote 1. The generic query parameter may refer to a histogram on age, gender, etc. When the identity provider IdP receives the request, the identity provider IdP analyses the query based on its set of policies. If the query satisfies the policies the IdP sends an answer to the third party (step 4) wherein the answer is a number indicating the number of users that satisfy the criteria specified in the query. For example, the third party may ask how many men between 18 and 26 years old are comprised in the list of pseudonyms and the IdP answers by informing the third party that a number N of users is falling in the specified segment.

Many modifications and other embodiments of the invention set forth herein will come to mind the one skilled in the art to which the invention pertains having the benefit of the teachings presented in the foregoing description and the associated drawings. Therefore, it is to be understood that the invention is not to be limited to the specific embodiments disclosed and that modifications and other embodiments are intended to be included within the scope of the appended claims. Although specific terms are employed herein, they are used in a generic and descriptive sense only and not for purposes of limitation.

Claims

C l a i m s

1. Method for gathering and providing aggregated information on a group of users of a specific service, c h a r a c t e r i z e d i n that information related to the users' service usage behaviour is transmitted from the users' service use devices to a collector entity, wherein the users' identity is referred to under pseudonyms, the pseudonyms being registered at an identity provider, that the collected information is relayed to a third party, wherein the third party performs an internal analysis of the received information thereby filtering out a set of pseudonyms, that the third party contacts the identity provider with a query comprising said filtered set of pseudonyms and at least one query parameter, and that the query is analysed and answered with a reply by the identity provider on the basis of pre-configurable policies.

2. Method according to claim 1 , wherein the information related to the users' service usage behaviour includes a service specific information.

3. Method according to claim 1 or 2, wherein the information related to the users' service usage behaviour includes the time the service was active and/or the user utilised the service.

4. Method according to any of claims 1 or 3, wherein the information related to the users' service usage behaviour includes information related to the content of the service.

5. Method according to any of claims 1 to 4, wherein the information related to the content of the service is generated at the content provider and then transferred to the collector entity.

6. Method according to any of claims 1 to 5, wherein the multiple households of a house are connected to the collector entity via a home gateway.

7. Method according to claim 6, wherein the collector entity is configured to poll the databases of the home gateways.

8. Method according to claim 6, wherein information is pushed from the home gateway to the collector entity.

9. Method according to any of claims 6 to 8, wherein information stored at the home gateway is deleted after it has been polled from and/or pushed to the collector entity.

10. Method according to any of claims 1 to 9, wherein the information related to the users' service usage behaviour is transmitted to the collector entity by means of SNMP (Simple Network Management Protocol).

11. Method according to any of claims 1 to 10, wherein the information related to the users' service usage behaviour is transmitted to the collector entity over a web service and/or via a proprietary or standard data transfer mechanism.

12. Method according to any of claims 1 to 11 , wherein the user of a service use device is identified by means of an authentication, by means of a wireless interface, or by means of a transponder.

13. Method according to claim 12, wherein the authentication of a user of a service use device is performed via the user's cell-phone.

14. Method according to claim 13, wherein the user is requested to introduce a pin number.

15. Method according to any of claims 12 to 14, wherein the authentication is performed at the identity provider via the home gateway.

16. Method according to any of claims 12 or 14, wherein the authentication is performed directly without the use of the home gateway.

17. Method according to any of claims 1 to 16, wherein the pseudonyms are changed in certain time intervals.

18. Method according to any of claims 1 to 17, wherein a time tag is associated to each pseudonym.

19. Method according to any of claims 1 to 18, wherein the third party's query directed to the identity provider includes additional information on the pseudonyms contained in said filtered set of pseudonyms, in particular information related to the time when the pseudonyms were used.

20. Method according to any of claims 1 to 19, wherein the identity provider is configured in such a way that queries upon a set of pseudonyms are restricted in case the number of pseudonyms of the set of pseudonyms is below a configurable minimum threshold.

21. Method according to any of claims 1 to 20, wherein the identity provider is configured in such a way that only a configurable maximum number of queries within a given time period is considered admissible.

22. Method according to any of claims 1 to 21 , wherein the policies of the identity provider are defined individually for each user or group of users.

23. Method according to any of claims 1 to 22, wherein the aggregated information collected by the collector entity is sold to a third party.

24. Method according to any of claims 1 to 23, wherein the answering of queries directed to the identity provider from third parties is implemented as a service liable to pay costs.