Method and system for securely controlling access to data

Patent metadata

Field	Value
Publication number	US-10896263-B2
Application number	US-201816168481-A
Country	US
Kind code	B2
Filing date	Oct 23, 2018
Priority date	Oct 24, 2017
Publication date	Jan 19, 2021
Grant date	Jan 19, 2021

Abstract

A computer-implemented method of securely controlling access to data, the method including a consolidation server creating and securely storing a consolidated file labelled by a user device ID, including a first record including a first app ID and a first account ID, and a second record including a second app ID and a second account ID, transmitting encrypted data, including the consolidated file, to the user device, receiving encrypted data indicating a request to modify the first record from the user device, and responsive thereto, modifying the first record according to the request to modify the first record and securely storing a resulting modified first record, and transmitting to the first issuer server encrypted data, including the first app ID and the first account ID, indicating an instruction to modify the first app's access rights to data relating to the first account according to the request.

First claim

What is claimed is:

1. A computer-implemented method of securely controlling access to data, the method performed using a consolidation server, the method comprising:
receiving, from a first issuer server, first encrypted data comprising a user device identifier (ID), a first application (app) ID for a first app stored on a user device, and a first account ID for a first account issued by a first issuer, indicating authorization for the first app to access data relating to the first account;
receiving, from a second issuer server, second encrypted data comprising the user device ID, a second app ID for a second app stored on the user device, and a second account ID for a second account issued by a second issuer, indicating authorization for the second app to access data relating to the second account;
creating and securely storing a consolidated file labelled by the user device ID, the consolidated file comprising:
a first record comprising the first app ID and the first account ID; and
a second record comprising the second app ID and the second account ID;

transmitting third encrypted data, comprising the consolidated file, to the user device; and
receiving fourth encrypted data, comprising the user device ID, the first app ID, and the first account ID, indicating a request to modify the first record from the user device.

2. The method according to claim 1 , further comprising, before receiving the fourth encrypted data, receiving sixth encrypted data, comprising the user device ID, indicating a request to register with an access rights consolidation service, from the user device.

3. The method according to claim 2 , wherein the fourth and sixth encrypted data originates from an app provided by an operator of the consolidation server on the user device.

4. The method according to claim 1 , wherein one or more of the first encrypted data, the second encrypted data, the third encrypted data, and the fourth encrypted data are transmitted by means of an application programming interface (API) call.

5. The method according to claim 1 , wherein the first issuer and the second issuer are the same issuer.

6. The method according to claim 5 , wherein the first account and the second account are the same account.

7. The method according to claim 1 , wherein response to receiving the fourth encrypted data, the method further comprising:
modifying the first record according to the request to modify the first record and securely storing a resulting modified first record; and
transmitting to the first issuer server fifth encrypted data, comprising the first app ID and the first account ID, indicating an instruction to modify access rights for the first app to data relating to the first account according to the request.

8. The method according to claim 7 , further comprising:
receiving, by the first issuer server, the fifth encrypted data; and responsive thereto, transmitting, by the first issuer server, seventh encrypted data, comprising the first account ID, indicating a modification notification to a server of a provider of the first app.

9. The method according to claim 8 , further comprising:
prior to the consolidation server receiving the first encrypted data, receiving, by the first issuer server, eighth encrypted data, comprising the first account ID and the first app ID, indicating authorization for the first app to access data relating to the first account, from the user device; and
responsive thereto, transmitting, by the first issuer server, the first encrypted data to the consolidation server.

10. The method according to claim 9 , further comprising:
between receiving the eighth encrypted data and receiving the fifth encrypted data, transmitting, by the first issuer server, ninth encrypted data, comprising data related to the first account, to the server of the provider of the first app.

11. The method according to claim 9 , further comprising:
prior to receiving the eighth encrypted data, transmitting, by the first issuer server, tenth encrypted data, comprising the first account ID and the first app ID, indicating a request for the eighth encrypted data, to the user device.

12. The method according to claim 11 , further comprising:
prior to transmitting the tenth encrypted data, receiving, by the first issuer server, eleventh encrypted data, comprising the user device ID, the first account ID and the first app ID, indicating an account-related data access request from the server of the provider of the first app.

13. A consolidation server comprising:
a processor;
a transmitter communicatively coupled to the processor;
a receiver communicatively coupled to the processor, and a memory communicatively coupled to the processor and storing instructions which, when executed by the processor, cause the consolidation server to
receive, from a first issuer server, first encrypted data comprising a user device identifier (ID), a first application (app) ID for a first app stored on a user device, and a first account ID for a first account issued by a first issuer, indicating authorization for the first app to access data relating to the first account;
receive, from a second issuer server, second encrypted data comprising the user device ID, a second app ID for a second app stored on the user device, and a second account ID for a second account issued by a second issuer, indicating authorization for the second app to access data relating to the second account;
create and securely store a consolidated file labelled by the user device ID, the consolidated file comprising:
a first record comprising the first app ID and the first account ID; and
a second record comprising the second app ID and the second account ID;

transmit third encrypted data, comprising the consolidated file, to the user device; and
receive fourth encrypted data, comprising the user device ID, the first app ID, and the first account ID, indicating a request to modify the first record from the user device.

14. The consolidation server according to claim 13 , wherein the memory stores further instructions which, in response to receiving the fourth encrypted data, cause the consolidation server to
modify the first record according to the request to modify the first record and securely storing a resulting modified first record; and
transmit to the first issuer server fifth encrypted data, comprising the first app ID and the first account ID, indicating an instruction to modify access rights for the first app to data relating to the first account according to the request.

15. A non-transitory computer-readable storage medium having instructions stored thereon for securely controlling access to data in a consolidation server, which when executed by one or more processors, cause the one or more processors to:
receive, from a first issuer server, first encrypted data comprising a user device identifier (ID), a first application (app) ID for a first app stored on a user device, and a first account ID for a first account issued by a first issuer, indicating authorization for the first app to access data relating to the first account;
receive, from a second issuer server, second encrypted data comprising the user device ID, a second app ID for a second app stored on the user device, and a second account ID for a second account issued by a second issuer, indicating authorization for the second app to access data relating to the second account;
create and securely store a consolidated file labelled by the user device ID, the consolidated file comprising:
a first record comprising the first app ID and the first account ID; and
a seco

Assignees

• Mastercard International Inc

Inventors

• Sinha Advait
• Ahmad Syed Aamir
• Malik Raghav

Classifications

• G06F21/604 Primary

  Tools and structures for managing or administering access control systems · CPC title

• G06F21/6245

  Protecting personal data, e.g. for financial or medical purposes · CPC title

• H04L67/06

  specially adapted for file transfer, e.g. file transfer protocol [FTP] · CPC title

• H04L63/102

  Entity profiles · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title