# US 10,454,923 B2 · System and method for providing limited access to data > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,454,923 B2 - Document ID: US10454923B2 - Status: Granted - Kind: B2 - Application number: 15/710,978 - Filed: 2017-09-21 - Published: 2018-01-11 - Granted: 2019-10-22 - Earliest claimed: 2010-05-12 - Assignees: Capital One Services, LLC - Applicants: Capital One Financial Corporation - Inventors: Jeffrey Michael Chapman - Web page: https://patentgrep.com/patent/US10454923B2 ## CPC - G06Q 30/06: Buying, selling or leasing transactions - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G07F 7/1025: {Identification of user by a PIN code} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04W 12/069: using certificates or pre-shared keys - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G07F: COIN-FREED OR LIKE APPARATUS (coin sorting G07D3/00; coin testing G07D5/00; {handling coins or paper currencies apart from payment activated apparatus G07D; payment architectures, schemes or protocols G06Q20/00}) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A system and computer-implemented method for providing access to data of a first party including receiving information for identifying the first party, authenticating the first party using the received information for identifying the first party and generating a first read-only personal identification number (PIN). The first read-only PIN is associated with a first set of access rights for the data of the first party and provided to a second party. The first read-only PIN is stored with the first set of access rights in a computer database. A third party receives the first read-only PIN from the second party, authenticates the received first read-only PIN using the stored first read-only PIN and provides the second party with access to at least a portion of the data of the first party using the first set of access rights associated with the first read-only PIN if the received first read-only PIN is authenticated. ## Claims ### Claim 1 A system for providing access to data of a first party, comprising: a database that stores at least one virtual authentication credential, at least one access rights, and at least one party identifier; a computer processor associated with the database having a computer readable storage medium, the computer readable storage medium comprising computer-executable instructions stored therein causing the processor to: receive a first party identifier from a first party device; authenticate the first party using the first party identifier; generate, upon receipt of a request from the first party device, a virtual authentication credential using a random or pseudo-random generator; store, in the database, the virtual authentication credential; receive a selection from the first party device of a second party and a third party for receiving the virtual authentication credential; associate the virtual authentication credential with a second party identifier stored in the database and second party limited access rights for the data of the first party, wherein the second party limited access rights are based on second party data and stored in the database; associate the virtual authentication credential with a third party identifier stored in the database and third party limited access rights for the data of the first party, wherein the third party limited access rights are based on third party data and stored in the database; receive at least a portion of the second party identifier from a device associated with the second party; receive at least a portion of the third party identifier from a device associated with the third party; authenticate the second party and the third party using the at least a portion of the second party identifier, the at least a portion of the third party identifier, the second party identifier stored in the database, and the third party identifier stored in the database; receive the virtual authentication credential from the second party device; receive the virtual authentication credential from the third party device; authenticate the virtual authentication credential for the second party device and the third party device by comparing the virtual authentication credential received from the second party device and the third party device with the virtual authentication credential stored in the database; receive a payment from the second party device; process the payment from the second party device, and: when the payment is successfully processed: provide the second party device with limited access to the data of the first party as defined in the second party limited access rights; when the payment is not successfully processed: transmit an alert to the second party device that the payment could not be processed; provide the third party device with limited access to the data of the first party as defined in the third party limited access rights; determine usage information for the virtual authentication credential; and provide the first party with the usage information. ### Claim 2 (depends on 1) The system of claim 1, wherein the computer readable storage medium further comprises computer-executable instructions stored therein for causing said computer processor to: cancel the virtual authentication credential to prevent any access by the second party device to the data of the first party. ### Claim 3 (depends on 2) The system of claim 2, wherein the computer readable storage medium further comprises computer-executable instructions stored therein for causing said computer processor to: generate a new virtual authentication credential after the virtual authentication credential has been cancelled; associate the new virtual authentication credential with the third party limited access rights for the data of the first party; provide the new virtual authentication credential to the third party device; store the new virtual authentication credential with the third party limited access rights in the database; receive the new virtual authentication credential from the third party device; authenticate the new virtual authentication credential by comparing the new virtual authentication credential with the new virtual authentication credential stored in the database; and provide the third party device with limited access to first party data as defined in the third party limited access rights. ### Claim 4 (depends on 1) The system of claim 1, wherein the second party limited access rights to data of the first party comprises at least one of: rights to read the data, rights to view the data, rights to modify the data, rights to manipulate the data, rights to download the data, rights to upload the data, rights to transfer the data, rights to share the data, rights to aggregate the data, rights to mine the data, rights to analyze the data, access rights to a subset of the data, duration of access rights to the data, time of access rights to the data, payment requirements for receiving access rights to the data, terms and conditions for the data, and combinations thereof. ### Claim 5 (depends on 1) The system of claim 1, wherein the second party limited access rights comprise rights to view data and rights to modify a subset of data. ### Claim 6 (depends on 3) The system of claim 3, wherein the third party limited access rights comprise rights to view data and rights to modify a subset of data. ### Claim 7 (depends on 5) The system of claim 5, the computer readable storage medium further comprising computer-executable instructions stored therein for causing said computer processor to: store the data of the first party in a first computer file of the database; and store the subset of the data of the first party in a second computer file of the database. ### Claim 8 (depends on 1) The system of claim 1, wherein the second party limited access rights comprise payment requirements for receiving additional access rights to data. ### Claim 9 (depends on 3) The system of claim 3, wherein the third party limited access rights comprise payment requirements for receiving additional access rights to data. ### Claim 10 A non-transitory computer readable storage medium comprising instructions for causing a processor to execute a computer-implemented method for providing access to data of a first party, comprising: receiving a first party identifier from a first party device; authenticating the first party using the first party identifier; generating, upon receipt of a request from the first party device, a virtual authentication credential using a random or pseudo-random generator; storing, in a database, the virtual authentication credential; receiving a selection from the first party device of a second party for receiving the virtual authentication credential; associating the virtual authentication credential with a second party identifier stored in the database and second party limited access rights for the data of the first party, wherein the second party limited access rights are based on second party data and stored in the database; transmitting a request for payment to the second party for use of the virtual authentication credential; receiving at least a portion of the second party identifier from a device associated with the second party; authenticating the second party using the at least a portion of the second party identifier and the second party identifier stored in the database; receiving the virtual authentication credential from the second party device; authenticating the virtual authentication credential by comparing the virtual authentication credential received from the second party device with the virtual authentication credential stored in the database; receiving a payment from the second party device; processing the payment from the second party device, and when the payment is successfully processed: providing the second party device with limited access to the data of the first party as defined in the second party limited access rights; when the payment is not successfully processed: transmitting an alert to the second party device that the payment could not be processed; determine usage information for the virtual authentication credential; and provide the first party with the usage information. ### Claim 11 (depends on 10) The non-transitory computer readable storage medium of claim 10, wherein the non-transitory computer readable storage medium further comprises computer-executable instructions stored therein for causing said computer processor to: cancel the virtual authentication credential to prevent any access by the second party device to the data of the first party. ### Claim 12 (depends on 11) The non-transitory computer readable storage medium of claim 11, wherein the non-transitory computer readable storage medium further comprises computer-executable instructions stored therein for causing said computer processor to: generate a new virtual authentication credential after the virtual authentication credential has been cancelled; associate the new virtual authentication credential with third party limited access rights for the data of the first party, wherein the third party limited access rights are based on third party data; provide the new virtual authentication credential to a third party device; store the new virtual authentication credential with the third party limited access rights in the database; receive the new virtual authentication credential from the third party device; authenticate the new virtual authentication credential by comparing the new virtual authentication credential from the third party device with the new virtual authentication credential stored in the database; and provide the third party device with limited access to first party data as defined in the third party limited access rights. ### Claim 13 (depends on 10) The non-transitory computer readable storage medium of claim 10, wherein the second party limited access rights to data of the first party comprises at least one of: rights to read the data, rights to view the data, rights to modify the data, rights to manipulate the data, rights to download the data, rights to upload the data, rights to transfer the data, rights to share the data, rights to aggregate the data, rights to mine the data, rights to analyze the data, access rights to a subset of the data, duration of access rights to the data, time of access rights to the data, payment requirements for receiving access rights to the data, terms and conditions for the data, and combinations thereof. ### Claim 14 (depends on 10) The non-transitory computer readable storage medium of claim 10, wherein the second party limited access rights comprise rights to view data and rights to modify a subset of data. ### Claim 15 (depends on 12) The non-transitory computer readable storage medium of claim 12, wherein the third party limited access rights comprise rights to view data and rights to modify a subset of data. ### Claim 16 (depends on 14) The non-transitory computer readable storage medium of claim 14, the computer readable storage medium further comprising computer-executable instructions stored therein for causing said computer processor to: store the data of the first party in a first computer file of the database; and store the subset of the data of the first party in a second computer file of the database. ### Claim 17 (depends on 10) The non-transitory computer readable storage medium of claim 10, wherein the second party limited access rights comprise payment requirements for receiving additional access rights to data. ### Claim 18 (depends on 12) The non-transitory computer readable storage medium of claim 12, wherein the third party limited access rights comprise payment requirements for receiving additional access rights to data.