Person-based authorization for shared account systems

Patent metadata

Field	Value
Publication number	US-12380450-B1
Application number	US-202016918764-A
Country	US
Kind code	B1
Filing date	Jul 1, 2020
Priority date	May 26, 2020
Publication date	Aug 5, 2025
Grant date	Aug 5, 2025

Abstract

Disclosed are various embodiments for person-based authorization for shared account systems. In one embodiment, a service receives a user request from a client device associated with an account to perform an action using an application. The service then identifies a user originating the user request. The service generates a token that includes an account identifier corresponding to the account and a person identifier corresponding to the user. The service sends the user request and the token to a provider of the application.

First claim

Therefore, the following is claimed:

1. A non-transitory computer-readable medium embodying a program executable in at least one computing device, wherein when executed the program causes the at least one computing device to at least:
receive a voice command from a client device associated with a shared account to perform an action using a third-party application, wherein the shared account is associated with a plurality of users, and the client device is authenticated for access to the shared account using a registration credential;
identify a user originating the voice command based at least in part on performing a voice recognition on the voice command;
generate a request, with an application programming interface (API), to determine that the third-party application uses personal data, wherein the personal data is stored in a data store;
communicate the request to an application provider of the third-party application;
obtain, in response to the request, application requirements regarding the personal data;
determine that the application requires specific profile information about the user;
verify that the application provider has permission to access the personal data for a person profile associated with the shared account based at least in part on a person identifier of a token being associated with the person profile;
render, using a speaker on the client device, a question via speech synthesis, wherein the question requests consent from the user to share the personal data with the third-party application;

receive the consent from the user by a voice confirmation;
generate the token that includes an account identifier and the person identifier in response to receiving the consent, the account identifier corresponding to the shared account of the plurality of users, the person identifier corresponding to a person profile for the user in the shared account, the person identifier of the token being configured for a provider of the application to use the person identifier to access the person profile associated with the shared account;
anonymize the account identifier and the person identifier;

encrypt the anonymized account identifier and the anonymized person identifier within the token;
send the token and an indication of the action to the provider of the third-party application for authorizing the provider to perform the action based at least in part on receiving the consent, the token comprising the anonymized account identifier and the anonymized person identifier; and
personalize a service provided by the third-party application by providing the token having the anonymized account identifier and the anonymized person identifier, wherein the personalizing comprises correlating actions with the anonymized account identifier and the anonymized person identifier.

2. The non-transitory computer-readable medium of claim 1 , wherein when executed the program further causes the at least one computing device to at least:
receive a request for the personal data of the user from the provider of the third-party application, the request including the token; and
send the personal data to the provider of the third-party application.

3. A system, comprising:
at least one computing device; and
at least one service executable in the at least one computing device, wherein when executed the at least one service causes the at least one computing device to at least:
receive a user request from a client device associated with a shared account to perform an action using an application, the shared account being associated with a plurality of users;
identify a user originating the user request;
generate a request, with an application programming interface (API), to determine that the application uses personal data, wherein the personal data is stored in a data store;
communicate the request to an application provider of the application;
obtain, in response to the request, application requirements regarding the personal data;
determine that the application requires specific profile information about the user;
verify that the application provider has permission to access the personal data for a person profile associated with the shared account based at least in part on a person identifier of a token being associated with the person profile;
render, using a speaker on the client device, a question via speech synthesis, wherein the question requests consent from the user to share the personal data with the application;
generate the token that includes an account identifier and the person identifier, the account identifier corresponding to the shared account of the plurality of users, the person identifier corresponding to a person profile for the user in the shared account, the person identifier of the token being configured for a provider of the application to use the person identifier to access the person profile associated with the shared account;
anonymize the account identifier and the person identifier;
encrypt the anonymized account identifier and the anonymized person identifier within the token;
send the user request and the token to the provider of the application for authorizing the provider to perform the action, the token comprising the anonymized account identifier and the anonymized person identifier; and
personalize a service provided by the application by providing the token having the anonymized account identifier and the anonymized person identifier, wherein the personalizing comprises correlating actions with the anonymized account identifier and the anonymized person identifier.

4. The system of claim 3 , wherein when executed the at least one service further causes the at least one computing device to at least:
receive a request for personal data of the user from the provider of the application, the request presenting the token; and
send the personal data of the user to the provider of the application.

5. The system of claim 4 , wherein the token encodes at least one permission relative to the personal data of the user.

6. The system of claim 4 , wherein the personal data comprises at least one of: a name of the user or an email address of the user.

7. The system of claim 4 , wherein when executed the at least one service further causes the at least one computing device to at least:
receive a result of the action being performed by the application from the provider of the application; and
send data to the client device encoding the result for presentation by the client device.

8. The system of claim 3 , wherein the token is associated with a person profile permission for indicating an item in the person profile that is accessible to the provider.

9. The system of claim 3 , wherein when executed the at least one service further causes the at least one computing device to at least:
determine that the application uses personal data of the user;
request a consent from the user via the client device to share the personal data with the provider of the application;
receive the consent from the user; and
wherein the person identifier is included in the token based at least in part on receiving the consent from the user.

10. The system of claim 9 , wherein the consent is requested via synthesized speech rendered by the client device.

11. The system of claim 3 , wherein the user request comprises a voice command captured via a microphone of the client device, and the user is identified based at least in part on a voice recognition of the voice command.

12. A method, comprising:
receiving, via at least one of one or more computing devices, a user request from a client device associated with a shared account to perform an

Assignees

• Amazon Tech Inc

Inventors

• Dadheech Nibha
• Sharma Anurag
• Zhang Long
• Nguyen Natalie Thuy-Tien
• Chaurasia Sharad
• Kumar Bharath Bhimanaik
• Rathod Chetan Kishor

Classifications

• G06Q20/42

  Confirmation, e.g. check or permission by the legal debtor of payment · CPC title

• G06Q20/383

  Anonymous user system · CPC title

• G06Q20/40145 Primary

  Biometric identity checks · CPC title

• G10L13/00

  Speech synthesis; Text to speech systems · CPC title

• G10L17/22

  Interactive procedures; Man-machine interfaces · CPC title