SYSTEM AND METHOD TO FACILITATE COMPLIANCE WITH COPPA FOR WEBSITE REGISTRATION

• US 20130152171A1
• Filed: 12/12/2012
• Published: 06/13/2013
• Est. Priority Date: 12/12/2011
• Status: Active Grant

• Current Assignee: Gen Digital Inc.
• Original Assignee: CleanPort BV (Avira GmbH & Co. KG)
• Inventors: KINDLER, Noah, DEAN, Gregory, SEDIGHIAN, Saman, SAVVATEEV, Valeri, BENNETT, Michael
• Granted Patent: US 8,904,494 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0846 using time-dependent-passwords, e.g. periodically changing passwords
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

Embodiments of the present invention provide a third-party system that allows parents or authorized guardians to continually grant permissions to several websites and online services and provides a one-time-authentication process of the parent-child relationship. Through this system, the need to re-authenticate the parent-child relationship or for each online company to build their own authentication system and COPPA record keeping mechanisms can be reduced or eliminated. In addition, the embodiments provided herein may afford a service for managing COPPA compliance that is relatively easy for online companies to integrate into their online services and websites.

Claims

1. A method, comprising:

receiving from a site coupled to a network a request sent via the network to authorize a user seeking access to the site, the request being received at a service coupled to the network and remote from the site and the user;

determining whether the user has previously registered with the service;

if the user is determined to have been previously registered with the service, the service identifying an authorizing agent associated with the user from a database coupled to the service; and

sending a message to the identified authorizing agent that requests that the authorizing agent authorize the user to access the site;

if the user is determined not to have been previously registered with the service, the service checking the database to determine whether at least one authorizing agent is associated with the user in the database;

displaying, via the network, to the user a list of one or more authorizing agents that are determined to be associated with the user;

permitting the user to select one of the authorizing agents from the list; and

sending a message to the selected authorizing agent that requests that the authorizing agent authorize the user to access the site;

if the user does not select any authorizing agent from the list, the service querying the user, via the network for a name of the user, address information associated with an authorizing agent that is authorized to authorize the user to access the site, and for an answer to a security question;

querying the authorizing agent to confirm that the user is associated with the authorizing agent and to provide an answer to the security question;

obtaining credit card information of the authorizing agent;

determining whether the answer provided by the authorizing agent matches the answer provided by the user; and

determining whether the credit card information corresponds to at least a portion of the address information provided by the user;

receiving an authorizing message from the authorizing agent indicating whether the authorizing agent authorizes the user to access the site;

storing a record in the database indicating whether the authorizing agent authorized the user to access the site; and

sending the site, via the network, a message indicating whether the authorizing agent authorized the user to access the site.

2. The method of claim 1, wherein the authorizing agent is a parent or legal guardian of the user.

3. The method of claim 1, wherein the user is a child less than thirteen-years old.

4. The method of claim 1, wherein the security question is selected from a set of predetermined security questions obtaining from a plurality of security questions stored in the database, wherein each security question has a unique identifier associated therewith in the database.

5. The method of claim 1, further comprising assigning a unique identifier to the user;

assigning a unique identifier to the security question;

generating a one-way hash from the unique identifier of the user, the unique identifier of the security question and the answer provided by the user;

generating a one-way hash from the unique identifier of the user, the unique identifier of the security question, and the answer provided by the authorizing agent;

comparing the generated one-way hashes to determine they match; and

if the one-way hashes are determined to match, authenticating the relationship between the user and the authorizing agent.

6. The method of claim 1, further comprising receiving a message from the authorizing agent revoking the user'"'"'s authorization to access to the site;

notifying the site that the user'"'"'s access has been revoked.

7. The method of claim 1, wherein information about the user is not stored by the service until a relationship has been confirmed between the authorizing agent and the user.

8. The method of claim 7, wherein the relationship is a parent-child relationship.

9. The method of claim 1, further comprising receiving a request to register the site with the service;

determining whether the site meets predefined criteria;

if the site meets the predefined criteria, creating a record for the site in the database; and

sending a token to the site for use in subsequent communications with the service.

10. The method of claim 1, further comprising receiving a reply from the site confirming that that site has performed an action corresponding to the indication as to whether the authorizing agent has authorized the user to access the site.

20. The system of claim 1, further comprising the service having an interface adapted for receiving a request to register the site with the service;

determining whether the site meets predefined criteria;

if the site meets the predefined criteria, creating a record for the site in the database; and

sending a token to the site for use in subsequent communications with the service.

11. A computer program product embodied on a computer readable medium for causing a computer to perform a method, comprising:

computer code for receiving from a site coupled to a network a request sent via the network to authorize a user seeking access to the site, the request being received at a service coupled to the network and remote from the site;

computer code for determining whether the user has previously registered with the service;

if the user is determined to have been previously registered with the service, computer code for identifying an authorizing agent associated with the user from a database coupled to the service; and

sending a message to the identified authorizing agent that requests that the authorizing agent authorize the user to access the site;

if the user is determined not to have been previously registered with the service, computer code for checking the database to determine whether at least one authorizing agent is associated with the user in the database;

displaying, via the network, to the user a list of one or more authorizing agents that are determined to be associated with the user;

permitting the user to select one of the authorizing agents from the list; and

sending a message to the selected authorizing agent that requests that the authorizing agent authorize the user to access the site;

if the user does not select any authorizing agent from the list, computer code for querying the user, via the network for a name of the user, address information associated with an authorizing agent that is authorized to authorize the user to access the site, and for an answer to a security question;

computer code for querying the authorizing agent to confirm that the user is associated with the authorizing agent and to provide an answer to the security question;

obtaining credit card information of the authorizing agent;

determining whether the answer provided by the authorizing agent matches the answer provided by the user; and

determining whether the credit card information corresponds to at least a portion of the address information provided by the user;

computer code for receiving an authorizing message from the authorizing agent indicating whether the authorizing agent authorizes the user to access the site;

computer code for storing a record in the database indicating whether the authorizing agent authorized the user to access the site; and

computer code for sending the site, via the network, a message indicating whether the authorizing agent authorized the user to access the site.

12. A system, comprising:

a service coupled to the network;

the service having an interface for receiving from a site coupled to a network a request sent via the network to authorize a user seeking access to the site, wherein the service is remote from the site and the user;

the service having a database, wherein the service querying the database to determine whether the user has previously registered with the service;

if the user is determined to have been previously registered with the service, the service having logic for identifying an authorizing agent associated with the user from a database coupled to the service; and

sending a message to the identified authorizing agent that requests that the authorizing agent authorize the user to access the site;

if the user is determined not to have been previously registered with the service, the service having logic for checking the database to determine whether at least one authorizing agent is associated with the user in the database;

displaying, via the network, to the user a list of one or more authorizing agents that are determined to be associated with the user;

permitting the user to select one of the authorizing agents from the list; and

sending a message to the selected authorizing agent that requests that the authorizing agent authorize the user to access the site;

if the user does not select any authorizing agent from the list, the service having logic for querying the user, via the network for a name of the user, address information associated with an authorizing agent that is authorized to authorize the user to access the site, and for an answer to a security question;

the service having logic for querying the authorizing agent to confirm that the user is associated with the authorizing agent and to provide an answer to the security question;

obtaining credit card information of the authorizing agent;

determining whether the answer provided by the authorizing agent matches the answer provided by the user; and

determining whether the credit card information corresponds to at least a portion of the address information provided by the user;

the interface of the service being adapted to receive an authorizing message from the authorizing agent indicating whether the authorizing agent authorizes the user to access the site;

the service having logic for storing a record in the database indicating whether the authorizing agent authorized the user to access the site; and

the service having logic for sending the site, via the network, a message indicating whether the authorizing agent authorized the user to access the site.

13. The system of claim 12, wherein the authorizing agent is a parent or legal guardian of the user.

14. The system of claim 12, wherein the user is a child less than thirteen-years old.

15. The system of claim 12, wherein the security question is selected from a set of predetermined security questions obtaining from a plurality of security questions stored in the database, wherein each security question has a unique identifier associated therewith in the database.

16. The system of claim 12, wherein the service has logic for assigning a unique identifier to the user;

assigning a unique identifier to the security question;

generating a one-way hash from the unique identifier of the user, the unique identifier of the security question and the answer provided by the user;

generating a one-way hash from the unique identifier of the user, the unique identifier of the security question, and the answer provided by the authorizing agent;

the service having logic for comparing the generated one-way hashes to determine they match; and

if the one-way hashes are determined to match, the service having logic authenticating the relationship between the user and the authorizing agent.

17. The system of claim 12, further comprising the service having an interface for receiving a message from the authorizing agent revoking the user'"'"'s authorization to access to the site;

and logic for notifying the site that the user'"'"'s access has been revoked.

18. The system of claim 12, wherein information about the user is not stored by the service until a relationship has been confirmed between the authorizing agent and the user.

19. The system of claim 18, wherein the relationship is a parent-child relationship.