System and method enabling multiparty and multi level authorizations for accessing confidential information

Patent metadata

Field	Value
Publication number	US-9536107-B2
Application number	US-201514720168-A
Country	US
Kind code	B2
Filing date	May 22, 2015
Priority date	Mar 24, 2015
Publication date	Jan 3, 2017
Grant date	Jan 3, 2017

Abstract

Disclosed is a method and system for enabling multi-party and multi level authorizations for accessing confidential information. A first set of access privilege levels, a first set of credentials, a second set of access privilege levels and a second set of credentials are configured corresponding to a plurality of services. A service consumer may be identified using an identifier and thereafter authorized to issue a request for a service based upon authentication of the service consumer using an access privilege level of the first set of access privilege levels and a credential of the first set of credentials. After the authentication, an OTAT is generated. A service provider may be authenticated using the OTAT, an access privilege level of the second set of access privilege levels and a credential of the second set of credentials. The service provider is then authorized to access the confidential information of the service consumer.

First claim

We claim:

1. A method enabling multi-party and multi-level authorizations for accessing confidential information, the method comprising:
configuring, by a processor, a plurality of services, a first set of access privilege levels, a first set of credentials corresponding to the first set of access privilege levels, a second set of access privilege levels and a second set of credentials corresponding to the second set of access privilege levels, wherein the first set of access privilege levels and the second set of privilege levels are associated with the plurality of services, and wherein at least one access privilege level of the first set of access privilege levels and at least one credential of the first set of credentials are provided to one or more service consumers for requesting one or more services of the plurality of services, and wherein at least one access privilege level of the second set of access privilege levels and at least one credential of the second set of credentials are provided to a service provider to serve the one or more services requested by the one or more service consumers;
identifying, by the processor, the one or more service consumers based upon a unique identifier associated with the one or more service consumers;
receiving, by the processor, a service request from the one or more service consumers, after the identification, for facilitating one or more services of the plurality of services;
authenticating, by the processor, the one or more service consumers based upon an access privilege level, of the first set of access privilege levels, configured for the service and a credential, of the first set of credentials, corresponding to the access privilege level of the first set of access privilege levels;
generating, by the processor, a One Time Authorization Token (OTAT) corresponding to the one or more services requested by the one more service consumers after the authorization of the one or more service consumers;
authenticating, by the processor, the service provider based on the OTAT, an access privilege level of the second set of access privilege levels and a credential, of the second set of credentials, corresponding to the access privilege level of the second set of access privilege levels; and
authorizing, by the processor, the service provider to access confidential information, associated with the one or more service consumers, required for serving the service request from the one or more service consumers, wherein the access is provided to the service provider until the service request is served or a validity time associated with the OTAT is expired.

2. The method of claim 1 , wherein the first set of credentials and the second set of credentials comprises at least one of a credential, a biometric signature, a secret question and a combination thereof, and wherein the biometric signature comprises at one of a fingerprint, iris, face, palm-vein, voice and a combination thereof, and wherein the first set of access privilege levels and the second set of access privilege levels are configured based on each service and a level of confidentiality associated with the confidential information.

3. The method of claim 1 , wherein the unique identifier is one of a credential like username and password, Radio-frequency identification (RFID), a personal identification number (PIN), a credential used to access a social media platform, an internet id, an account number, a onetime password (OTP) and a combination thereof.

4. The method of claim 1 , wherein service request is received from a service consumer device associated with the one or more service consumers, and wherein the service consumer device is one of a mobile phone, a kiosk, an interactive voice response (IVR) enabled device, internet enabled device, POS Terminal and a computing terminal present within the premises of the service provider, wherein the device is pre-registered to issue the service request.

5. The method of claim 4 , further comprising displaying, on the service consumer device, a service catalogue comprising one or more services, from the plurality of services applicable for the one or more service consumers, and wherein the service catalogue is displayed after the identification of the one or more service consumers.

6. The method of claim 1 , wherein the OTAT further comprises token details associated with the OTAT, wherein the token details comprises a token type, Unique ID for Token, Host Identifier, role and access privilege level of the service provider for whom the token is issued, identifier of the one or more service consumers issuing the token, consumer ID, list of one or more accounts along with account identifiers, service endpoint reference, list of services for the one or more accounts, access privilege level for each service, data sensitivity instructions, token issue timestamp, and token expiry timestamp.

7. The method of claim 6 , further comprising generating a unique key based upon the authentication of the one or more consumers, wherein the unique key is generated when the service request is received from one of the mobile phone, the kiosk, the interactive voice response (IVR) enabled device, or the internet enabled device, and wherein the unique key is one of an alphanumeric key, a numeric key, or a hash code or a combination thereof, and wherein the generation of the unique key is further notified to the one or more service consumers by transmitting a text message or a multimedia message on the service consumer device to the registered notification means.

8. The method of claim 7 , wherein the key comprises an authorization details, service details, information of the one or more service consumers, the validity time and a wait time, and wherein the key is further translated into the OTAT.

9. The method of claim 4 , wherein the service provider is authorized to access the confidential information via a service provider device, and wherein the service provider device is a computing terminal present within the premises of the service provider, and wherein the service provider device is further pre-registered to serve the service request from the one or more service consumers.

10. The method of claim 9 , wherein the confidential information is classified into at least one of predefined categories based upon the level of confidentiality associated with the confidential information, and wherein the confidential information is displayed, on the service provider device, based upon the classification of the confidential information into a predefined category.

11. The method of claim 10 , wherein the predefined category comprises highly secret, secret, confidential and restrictive, and wherein the confidential information is masked or partially masked based upon the classification.

12. The method of claim 5 , wherein the service request is received in order to facilitate one or more services of the plurality of services, and wherein the one or more service consumers are authenticated based upon a highest access privilege level amongst the access privilege levels configured for the multiple services and a credential corresponding to the highest access privilege level.

13. The method of claim 1 , further comprising authorizing the service provider to serve another service request, associated with one or more additional service, received from the one or more service consumers within the validity time associated with the OTAT, and wherein the another service request is served by
authenticating the service provider based on the OTAT, an access privilege level, of the second set of access privilege levels, configured for enabling display of the service catalogue

Assignees

• Tata Consultancy Services Ltd

Inventors

• Soman Anushka
• Garg Shalin
• Vallat Sathish
• Agrawal Sachin Kumar
• Thomas Annie

Classifications

• G06Q40/02

  Banking, e.g. interest calculation or account maintenance (credit or loans G06Q40/03) · CPC title

• H04L9/3213

  using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807) · CPC title

• G06F21/62

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title

• G06F21/6245 Primary

  Protecting personal data, e.g. for financial or medical purposes · CPC title

• H04L63/0861

  using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231) · CPC title