Systems and methods of authenticating and controlling access over customer data

• US 9,699,656 B2
• Filed: 03/02/2016
• Issued: 07/04/2017
• Est. Priority Date: 07/20/2015
• Status: Active Grant

• Current Assignee: TATA Consultancy Services Limited (Tata Sons Pvt Ltd.)
• Original Assignee: TATA Consultancy Services Limited (Tata Sons Pvt Ltd.)
• Inventors: Singh, Harbhajan Mohan, Mani, Jayasekar, Ponnan, Sureshbabu, Vadivel, Padmanaban
• Primary Examiner(s): Ly, Nghi H
• Application Number:
  US15/058,930
• Publication Number:
  US 20170026830A1
• Time in Patent Office: 489 Days
• Field of Search: 455 10, 455411, 4554141, 4554221, 4554561
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/43 wireless channels
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06Q 10/105 Human resources
• CPC Class Codes: H04L 2463/082 applying multi-factor authentication cryptographic mechanisms or cryptographic arrangements including means for verifying the identity or authority of a user of the system or for message authentication H04L9/32
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 4/021 Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
• CPC Class Codes: H04W 4/029 Location-based management or tracking services

Abstract

Method and system for authenticating and controlling access to customer data is disclosed. Initially, a mobile agent raises a login request and a customer raises an authentication request through a pre-installed mobile application available on agent device and customer device. The unique identification details of customer device and agent device are stored on the system. The system performs a location match between the customer device and agent device thereafter a session key is generated. The session key is sent in parts to the customer device and mobile devices wherein at the time of authentication of agent device, the system performs a location match, session key match and identification detail match.

Claims

1. A computer implemented method executed at least in part on a system, for authenticating and controlling access to customer data by a mobile agent comprising:

receiving by a mobile application management module, mobile agent login request from an agent device and a customer authentication request from a customer device using a pre-installed mobile application wherein unique identification data of agent device and customer device is pre-stored;

receiving by a location match module, geo-spatial location of the agent device and the customer device and performing geo-spatial location match for the agent device and the customer device;

generating by a session key generator module, a session key which is valid for pre-determined duration of a meeting session and dividing the session key into two parts wherein one part is sent to the agent device and other part to the customer device wherein the session key is generated and sent only if location match is found between the agent device and customer device;

entering the received parts of session key into agent device and customer device by mobile agent and customer respectively and comparing by a session key verification module, the entered session key with the generated session key by the session key generator module;

comparing by an ID match module, the unique identification data of agent device and customer device stored with identification data of agent device and customer device used for entering the session key; and

granting access by an access module to mobile agent through agent device only if the location match, session key match and identification data match for the agent device and customer device is found.

2. The method of claim-1, wherein the session key is valid for the meeting session scheduled for a pre-determined duration between the mobile agent and the customer.

3. The method of claim-1, wherein the generated session key is alphanumeric or alphabetical string.

4. The method of claim-1, wherein the generated session key is an even numbered string or an odd numbered string.

5. The method of claim-1, wherein the generated session key is divided into two equal halves.

6. The method of claim-1, wherein the generated session key is divided into two unequal halves.

7. The method of claim-1, wherein the identification data registered on remote server includes IMEI (international mobile equipment identity) number, SIM number and IMSI number for the agent device and customer device.

8. The method of claim-1, wherein failure of location match between agent device and the customer device leads to denial of access of mobile agent to customer data.

9. The method of claim-1, wherein failure of identification data match of agent device stored on remote server with the agent device used for entering part of session key leads to denial of access of mobile agent to customer data.

10. The method of claim-4, wherein failure of identification data match of customer device stored on remote server with the customer device used for entering part of session key leads to denial of access of mobile agent to customer data.

11. The method of claim-1, additional comprising:

receiving by the location match module, geo-spatial location of agent device and customer device during pendency of meeting session;

in response to receiving, conducting geo-spatial location match of agent device and customer device by location match module during pendency of meeting session; and

continuing the access of mobile agent to customer data by the access module only if the location match is found.

12. The method of claim-11, wherein the location match during pendency of meeting session is conducted over pre-determined intervals of time.

13. The method of claim-11, wherein the access of mobile agent to customer data is revoked if the location match is not found.

14. The method of claim-1, additionally comprising:

receiving, a prompt on the customer device, an indication of meeting session nearing expiration of duration;

receiving an extension request by the access module sent through the customer device;

receiving in response an acceptance of extension request on the access module by the mobile agent through agent device;

receiving over a the location match module, geospatial location of the agent device and the customer device and conducting a geo-spatial location match for the agent device and customer device; and

granting continued access during extended meeting session by access module to the mobile agent only if the location match is found.

15. The method of claim-14, wherein the access of mobile agent to customer data is revoked after expiration of meeting session.

16. The method of claim-14, wherein the access of mobile agent to customer data is revoked if location match is not found during extended meeting session.

17. A system for authenticating and controlling access to customer data by a mobile agent comprising:

a memory storing instructions;

a processor coupled to the memory to;

receive by a mobile application management module, mobile agent login request from an agent device and a customer authentication request from a customer device using a pre-installed mobile application wherein unique identification data of agent device and customer device is pre-stored;

receive by a location match module, geo-spatial location of the agent device and the customer device and performing geo-spatial location match for the agent device and the customer device;

generating by a session key generator module, a session key which is valid for pre-determined duration of a meeting session and dividing the session key into two parts wherein one part is sent to the agent device and other part to the customer device wherein the session key is generated and sent only if location match is found between the agent device and customer device;

entering the received parts of session key into agent device and customer device by mobile agent and customer respectively and comparing by a session key verification module, the entered session key with the generated session key by the session key generator module;

comparing by an ID match module, the unique identification data of agent device and customer device stored with identification data of agent device and customer device used for entering the session key; and

granting access by an access module to mobile agent through agent device only if the location match, session key match and identification data match for the agent device and customer device is found.

18. A computer program product for authenticating and controlling access of mobile agent to customer data, the computer program product comprising a non-transitory computer-readable storage medium having computer-readable program code portions stored therein, the computer-readable program code portions comprising:

a first executable portion for receiving mobile agent login request and customer authentication request;

a second executable portion for receiving gee-spatial location of agent device and customer device and performing a location match between agent device and customer device;

a third executable portion for generating a session key and dividing the session key into two parts and sending the parts to agent device and customer device only if the location match is found;

a fourth executable portion for comparing the entered session key with the generated session key;

a fifth executable portion for comparing pre-stored unique identification data with the identification data of agent device and customer device; and

a sixth executable portion for granting access to mobile agent only if the location match, session key match and identification data match is found for agent device and customer device.