Protecting user information
AssigneeInternational Business Machines Corporation
InventorsZhi Guo Gao, He Yuan Huang, Li Li, Rui Xiong Tian
Life of this patent
Estimating the term…
Abstract
A method and apparatus for protecting user information. The method includes receiving a request for accessing the user information from an application. When the request does not include an authorized token, the user is requested to temporally confirm the request for access. In response to the confirmation, a token is generated and the user on a mobile service platform is associated with the request for access by the token. The application is then allowed to access the user information based on the token associating the user with the request for accessing the user information from the application.
Claims17
A method for protecting user information in a communication system, the method comprising the steps of:
- receiving, from an application, a first request to access the user information;
- determining that the first request does not include an authorized token;
- responsive to the determination that the first request does not include an authorized token, generating and transmitting a first token to the application;
- associating the first token with the first request;
- receiving, from the user, an authentication request that includes the first token obtained from the application by the user;
- authenticating the user in response to receiving the authentication request;
- requesting the user to confirm the first request;
- generating a second token in response to a user-initiated confirmation of the first request;
- transmitting the second token to the user;
- associating the second token with the user, wherein the second token is also associated with a user identifier;
- receiving a second request for accessing the user information from the application, the second request including the second token obtained from the user by the application;
- and
- allowing the application to access the user information in response to receiving the second request.
A computer implemented apparatus for protecting user information, comprising:
- computer means;
- and
- instructions executable by the computer means to perform a method, the method including:
- receiving, from an application, a first request for accessing the user information;
- determining that the first request does not include an authorized token;
- responsive to the determination that the first request does not include an authorized token, generating and transmitting a first token to the application, and associating the first token with the first request;
- authenticating the user in response to receiving an authentication request from the user, said authentication request including the first token obtained from the application by the user;
- in response to authentication of the user, requesting the user to confirm the first request according to the association of the first token with the first request;
- in response to receipt of a user-initiated confirmation of the first request for generating a second token, transmitting the second token to the user, and associating the second token with the user;
- receiving a second request for accessing the user information from the application, said second request including the second token obtained from the user by the application, wherein the second token is also associated with a user identifier;
- allowing the application to access the user information according to the association of the second token with the user, in response to receiving said second request.
Dependencies are inferred from the claim text.