METHOD AND SYSTEM FOR PROVIDING PERMISSION-BASED ACCESS TO SENSITIVE INFORMATION

• US 20120185921A1
• Filed: 01/18/2011
• Published: 07/19/2012
• Est. Priority Date: 01/18/2011
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: CHESWICK, William Roberts, WECHSLER, Chesla Catherine, MAZIARSKI, Gerald, WEST, Earle H., MILLER, Amy Susan, FEAVER, John Arthur, CHEN, David, NARAYANAN, Shankaran, KARNALKAR, Anup D., SHEIKH, Amir Mehmood, MUELLER, David G.
• Granted Patent: US 8,769,621 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/104 Grouping of entities

Abstract

A method provides for permission-based access to personal information over a communication network. The method includes entering specified owner personal information in an owner terminal, by an owner, to establish a secure owner profile, which is stored in an owner database. The method also includes entering specified user personal information in a user terminal, by a user, to establish a secure user profile, which is stored in a user database. The method further includes entering a user request in the user terminal requesting permission to receive a designated piece of the owner personal information from the secure owner profile. A server determines whether to approve the user request; and provides permission to use the designated piece of the owner personal information to the user over the communication network after the user request is approved by the server.

Claims

1. A method for providing permission-based access to personal information over a communication network, the method comprising:

entering specified owner personal information in an owner terminal, by an owner, to establish a secure owner profile;

storing the secure owner profile in an owner database;

entering specified user personal information in a user terminal, by a user, to establish a secure user profile;

storing the secure user profile in a user database;

entering a user request in the user terminal requesting permission to use a designated piece of the owner personal information from the secure owner profile;

determining, by a server, whether to approve the user request; and

providing permission to use the designated piece of the owner personal information to the user over the communication network after the user request is approved by the server.

2. The method as described in claim 1,

wherein the secure owner profile includes the owner'"'"'s name, owner profile identifier, sensitive personal information, a list of trusted users, and an alert configuration.

3. The method as described in claim 2,

wherein the list of trusted users includes a global list of trusted users whose user requests are automatically approved, and a specific list of trusted users whose user requests are approved only for selected pieces of the owner'"'"'s personal information, designated by the owner.

4. The method as described in claim 1,

wherein the owner can update the specified owner personal information stored in the secure owner profile over the communication network using the user terminal.

5. The method as described in claim 1,

wherein the secure user profile includes the user'"'"'s name and user profile identifier.

6. The method as described in claim 1,

wherein all user requests and related approval determinations are stored in an historical database establishing an historical record.

7. The method as described in claim 1,

wherein the user request includes a piece of owner personal information that is used by the server to determine whether to approve the user request, such that the server provides (1) a response indicating that the owner is not a subscriber when the piece of owner personal information does not match any owner stored in any owner database, (2) a response automatically approving the user request when the user is included in a global list of trusted users, and (3) a response conditionally approving the user request when the user is included in a specific list of trusted users, dependent upon the user and the designated portion of owner personal information requested.

8. The method as described in claim 1,

wherein the determining whether to approve the user request by the server includes sending an alert notification to the owner that a user request has been received, and receiving from the owner an owner response indicating whether the user request should be approved.

9. The method as described in claim 8,

wherein the alert notification includes specific information designated by the owner in the secure owner profile.

10. The method as described in claim 9,

wherein the server waits a designated amount of time for the owner response to the alert notification, the designated amount of time being specified in the secure owner profile, and the server provides an owner default response to the user request when the owner response is not received within the designated amount of time.

11. The method as described in claim 8, wherein the owner may access all pending user requests, and selectively determine whether to approve each pending request.

12. The method as described in claim 11, wherein the owner must enter both a permanent owner identifier and a transitory security identifier to access the pending user requests.

13. The method as described in claim 1, wherein when the owner selects a special lockdown provision, the server continues to receive user requests from a designated user, but is prevented from approving any user requests from the designated user, and when the owner selects a global lockdown provision, the server continues to receive user requests from all users, but is prevented from approving user requests from any user.

14. The method as described in claim 1,

wherein the processor provides a special warning message to the owner when at least one designated user request attribute exceeds an owner-established user request threshold.

15. The method as described in claim 14,

wherein the at least one designated user request attribute exceeds a total number of user requests within a timeframe established by the owner.

16. The method as described in claim 15,

wherein the at least one designated user request attribute further exceeds a total number of user requests for a same piece designated portion of owner personal information.

17. The method as described in claim 1, wherein the server accessed a source of truth when a permission request is made, in order to receive a System ID and a Profile ID of a person who owns the requested piece of owner personal information.

18. The method describe in claim 1, wherein the user may query the personal data access system using the user terminal to check the status of user requests.

19. A non-transitory computer-readable storage medium, encoded with a computer-executable program for providing permission-based access to personal information, comprising:

an owner entering segment for entering specified owner personal information in an owner terminal, by an owner, to establish a secure owner profile;

an owner storing segment for storing the secure owner profile in an owner database;

a user entering segment for entering specified user personal information in a user terminal, by a user, to establish a secure user profile;

a user storing segment for storing the secure user profile in a user database;

a user entering segment for entering a user request in the user terminal requesting permission to, receive a designated piece of the owner personal information from the secure owner profile;

a determining segment for determining, by a server, whether to approve the user request; and

a providing segment for providing access to the designated piece of the owner personal information to the user over the communication network after the user request is approved by the server.

20. A system for providing permission-based access to personal information over a communication network, comprising:

an electronic owner database that stores at least one secure owner profile, the at least one secure owner profile including specified owner personal information, which was entered into the system by an owner terminal;

an electronic user database that stores at least one secure user profile, the at least one secure user profile including specified user personal information, which was entered into the system by a user terminal; and

a server that receives at least one user request entered into the system by the user terminal, the at least one user request requesting permission to use a designated piece of owner personal information from the secure owner profile,

wherein the server provides access to the designated piece of the owner personal information to the user over the communication network after the user request has been approved by the server.