Methods and apparatus for authorizing access to data

• US 8,438,622 B2
• Filed: 07/10/2008
• Issued: 05/07/2013
• Est. Priority Date: 07/10/2008
• Status: Active Grant

• Current Assignee: Esther Ezra, Mark Ezra
• Original Assignee: Honesty Online, LLC
• Inventors: CYNKIN, Laurence H., ROBERTS, Jay B.
• Primary Examiner(s): LEMMA, SAMSON B
• Application Number:
  US12/170,804
• Publication Number:
  US 20100011431A1
• Time in Patent Office: 1,762 Days
• Field of Search: 726/9, 713/159, 713/168, 713/172
• US Class Current: 726/9
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

In one embodiment, a method comprises receiving a request from a first party for access to controlled data, and providing access to the controlled data to a second party. The first party requests access to the controlled data and a token is provided to the first party. The token includes data associated with authorized access to the controlled data. A request for access to the controlled data including the token is later received from the second party, and access to the controlled data is provided to the second party.

Claims

1. A method, comprising:

receiving by a computer processor from a first party, a request for access to controlled data;

sending from the computer processor to the first party a token at a first time, the token including a first data set associated with authorized access to the controlled data;

receiving at the computer processor from a second party and not from the first party a request for the controlled data at a second time, the request from the second party including the token, the second time being no earlier than the first time; and

sending from the computer processor a signal such that the second party and not to the first party is provided access to the controlled data based on the token.

2. The method of claim 1, further comprising:

encrypting the token before the first time such that the first data is inaccessible to the first party and the second party; and

decrypting the token after the second time.

3. The method of claim 1, further comprising providing to the first party an identifier associated with a resource and including the token, the resource being configured to provide access to the controlled data based on the token.

4. The method of claim 1, wherein the first data set is authentication data for an application at the first party, the token includes a second data set different from the first data set, the second data set is application data for the application at the first party.

5. The method of claim 1, further comprising determining whether the first party is authorized to request access to the controlled data based on a predetermined identifier associated with first party.

6. The method of claim 1, wherein the first data set is associated with authorized access to the controlled data by a plurality of parties.

7. The method of claim 1, wherein the request includes a request for a token associated with the controlled data when the first party does not have access to the controlled data.

8. The method of claim 1, wherein the first data set includes data associated with an indication of a valid token at the first time.

9. The method of claim 1, wherein:

the first party is a web site providing access to an indication of availability of controlled data;

the second party is a user terminal accessing the first party; and

the controlled data is data associated with a third party different from the first party and the second party.

10. An apparatus, comprising:

an interface configured to be operatively coupled to a communication network;

a memory, the memory being configured to store controlled data; and

a computer processor operatively coupled to the interface and the memory, the computer processor having a token module configured to receive from a first party over the communication network a request for a token associated with the controlled data, the token module configured to provide to the first party over the communication network the token at a first time,

the computer processor having a data access module configured to receive from a second party and not from the first party over the communication network the token at a second time, the second time being no earlier than the first time, the data access module configured to provide to the second party and not to the first party access to the controlled data over the communication network based on the token.

11. The apparatus of claim 10, wherein the token module is further configured to generate and encrypt the token before the first time, the data access module is further configured to decrypt the token after the second time.

12. The apparatus of claim 10, wherein the token module is further configured to determine whether the first party is authorized to request a token based on a predetermined identifier associated with the first party.

13. The apparatus of claim 10, wherein the token module is further configured to send to the first party an identifier associated with a resource, the resource being configured to provide access to the controlled data based on the token.

14. The apparatus of claim 10, wherein the token module is further configured to include a first data set and a second data set in the token, the first data set being authentication data for an application at the first party, the second data set being different from the first data set, the second data set being application data for the application at the first party.

15. The apparatus of claim 10, wherein the data access module is further configured to determine whether the token received from the second party is valid based on data associated with authorized access to the controlled data included in the token.

16. A method, comprising:

receiving at a first party from a second party a request for access to controlled data at a first time;

sending from the first party to a computer processor a request for access to the controlled data at a second time, the second time being no earlier than the first time;

receiving at the first party by the computer processor a token after the second time, the token including a first data set associated with authorized access to the controlled data; and

sending from the first party to the second party the token and an identifier associated with a resource such that the second party is directed to the resource without being directed through the first party and the second party provides the token to the resource to access the controlled data without the token being provided to the first party, the token configured such that the resource provides to the second party access to the controlled data based on the token.

17. The method of claim 16, further comprising sending from the first party to the computer processor (1) authentication data associated with the second party, and (2) application data for an application at the first party such that the authentication data associated with the second party and the application data associated with the application at the first party is included in the token.

18. The method of claim 16, wherein the token is included in the identifier associated with the resource.

19. The method of claim 16, further comprising authenticating the second party before the first time.

20. The method of claim 16, further comprising:

providing to the second party uncontrolled data associated with an individual before the first time; and

providing to the second party an indication associated with availability of controlled data associated with the individual before the first time.

21. The method of claim 16, wherein:

the second party is a user terminal accessing a web site, the web site including an indication of availability of the controlled data;

the computer processor is included in a computer server storing the controlled data and providing the resource for access to the controlled data; and

the controlled data is data associated with the first party different from the second party and the processor.