Providing one party access to an account of another party

A first party is provided with access to an account of a second party by inputting identification information for the account of the second party, and receiving account information for the account of the second party based on the identification information. The account of the second party is accessed based on the account information.

BACKGROUND OF THE INVENTION

This invention relates to providing one party with access to an account of another party.

Investment firms provide their customers (including plan sponsors and participants) with on-line access to accounts, such as retirement accounts and investment accounts. To access an account via the Internet, for example, the owner or manager of the account enters a user identifier (“ID”) and a password on a Web page provided by the investment firm. Once inside the account, the owner or manager can view account information, such as balances, or change account parameters, such as fund allocations.

SUMMARY OF THE INVENTION

In general, in one aspect of the invention, an account of a second party is accessed by inputting identification information for the account (such as a user ID), and receiving account information for the account based on the identification information. The account is accessed based on this account information.

Among the advantages of the invention may be one or more of the following. The first party can access the account without knowing the second party's password. This is particularly advantageous if the first party is an employee of an investment firm that maintains the account. For example, the employee is able to view the same information as the account owner, thus making it easier for the employee to address any problems that the account owner is having with the account or with accessing information in the account. Another benefit is that changes to the account can be made by the employee, if the owner so desires.

The foregoing aspect may include one or more of the following features/functions. The account information may define a right of a first party to access computer programs associated with the account. The account information may be stored in a text file. The first party may access the account information by requesting access to the account, receiving an interrogation into the text file from software that controls access to the account, and receiving access to the account if the software determines, based on the interrogation, that the first party is entitled to access the account. The first party may input the identification information on a Web page accessed by a Web browser. The text file may comprise an Internet cookie.

The above aspect may also include the first party inputting identifying information, and receiving access information that corresponds to the identifying information. The access information may define a right of the first party to access a program which includes the account of the second party. The program may be accessed based on the access information. The inputting, receiving, and accessing noted above may be performed from the program. Access to the program by the first party may be governed by the access information. Information from the account may be displayed. A parameter of the account may be changed.

In general, in another aspect, to access an account of a second party, a first party receives identification information for the account. It is then verified that the first party is entitled to access the account based on the identification information. Account information is provided to the first party for use in accessing the account.

This aspect may include one or more of the following features/functions. It may include receiving a request from the first party to access the account of the second party, obtaining account information from the first party, and determining whether the first party is entitled to access the account based on the account information. The aspect may include receiving information identifying the first party, verifying that the first party is entitled to access a program that includes the account of the second party based on the identification information, and providing, to the first party, access information for use in accessing the program. The aspect may include receiving a request from the first party to access the program that includes the account of the second party, obtaining the access information from the first party, and determining whether the first party is entitled to access the program based on the access information.

Other features and advantages will become apparent from the following description, claims and drawings.

DESCRIPTION

In some embodiments, one party (the “pretender”) can access an account of another party without knowing the other party's password. For example, an employee of an investment firm can access a retirement or investment plan of a company, an individual account in such a plan, or an independent account of a private investor. Once the account is accessed, the information that would be displayed to its owner or manager is displayed to the pretender. “Owner” refers to the person that owns funds in an account, and “manager” refers to the person that makes investment decisions for the account, but does not necessarily own the funds in the account (though he may).

A network system10for implementing this embodiment is shown inFIG. 1. Network system10includes computers11and12, network13, server14, and intermediary network15.

Intermediary network15may be the Internet, a wide area network (“WAN”), or any other IP (Internet Protocol) or non-IP network capable of transmitting HTML (HyperText Markup Language) (or “Web”) pages. Connected to network15are server14and computer11. Computer11is a personal computer (“PC”), or other processing device, which includes a memory16for storing computer programs17and a processor19for executing those programs to perform various functions (see view20). Among the programs stored in memory16are an operating system (“OS”)17a, such as Microsoft® Windows98®, and a Web browser17b, such as Netscape® Navigator®, for accessing from server14.

Server14is a World Wide Web (“WWW”) server that can be implemented on one or more computers (only one computer is shown). Server14includes a memory21which stores computer programs22and a processor24which executes instructions in those computer programs to perform various functions (see view23). The computer programs stored in memory21include code22aand applications22b.

Applications22benable remote users at computers11and12to access information25on accounts that are accessible to server14. Commercial embodiments of such applications include Plan Sponsor Webstation® (“PSW”) and NetBenefits®, both from Fidelity® Investments. PSW provides a plan sponsor, such as an employer, with information about an investment plan. For example, using PSW, an employer can obtain information about its employees' retirement plan. NetBenefits® provides an individual with information about investment accounts and other financial services available to the individual. The term “account” will be used to denote any type of investment account, such as an individual investment account or a company investment plan.

Code22areceives identification information from a pretender, and authenticates the pretender based on information in database26. Database26includes user IDs, passwords, and other information for permitting a pretender to access the accounts of another party. Once the pretender is authenticated, code22aretrieves information from database26and provides that information to the pretender. This information identifies which of applications22bare accessible to the pretender, and which computer programs within each of those applications are accessible to the pretender. A detailed description of these functions of code22ais provided below. Commercial embodiments of code22ainclude the Pretender and Profiler software from Fidelity® Investments.

Server14is connected to network13. Network13is a local area network (“LAN”) that supports an intranet running HTTP (Hyper Text Transport Protocol), over which Web pages are transmitted from server14to a pretender logged onto computer12. Computer12is a PC, or the like, which includes a memory27for storing computer programs29and a processor30for executing instructions in those programs to perform various functions (see view31).

Stored in memory27are OS29a, such as Microsoft® Windows98®, and a Web browser29b, such as Netscape® Navigator®. Web browser29bis used to access Web pages generated by code22ain server14. Web browser29bincludes a text file32(such as an Internet “cookie”) which contains information relating to a pretender on computer12.

Text file32contains the following fields: LB$T, LB$A, LB$I, LB$R, LB$D, SP$T, and SP$I. LB$T is a ticket associated with a pretender “session” and is used to track the activities of a pretender during that session. LB$A identifies programs in an application (see LB$D) that the pretender is allowed to access. LB$I is the user ID of the pretender. LB$R indicates a realm in which the pretender is operating. For example, LB$R may indicate that the pretender is viewing the contents of another party's account or that the pretender is performing tests on applications. LB$D indicates which applications a pretender is allowed to access. SP$T is used by code29cto exit a session after a predetermined time of inactivity. SP$I is the user ID of the account owner or the pretender.

Code29c, which is also stored in memory27, interacts with browser29band code22ain server14to enable a pretender at computer12to access others' accounts. InFIGS. 2 and 3, a pretender at computer12inputs (201) identification information via a Web page34(FIG. 4) provided by server14. The identification information includes the user ID35and password36assigned to the pretender. Clicking on “Continue” button37causes code29cto transmit the identification information to server14.

At server14, code22areceives (301) the identification information of the pretender from computer12. Code22averifies (302) the password and user ID of the pretender by comparing them to passwords and user IDs stored in database26. If code22adetermines that the pretender's user ID and password match those stored in database26, code22alocates access information in database26corresponding to the user ID and password of the pretender. The access information is stored in association with the user ID and password, and specifies which of applications22bthe pretender may access.

Code22aretrieves the access information for the pretender and provides (303) it to computer12. Code22aalso outputs a Web page39(FIG. 5) to computer12. Web page39includes selection buttons40for selecting which of applications22bto access, and pull-down bar41which can also be used to select an application22b. Web page39also includes entry box42for entering a user ID to access a user's account. This user ID may be the social security number of the account owner, the actual user ID of the account owner, or any other account identifier.

Returning toFIG. 2, code29cin computer12receives (202) the access information from server14, and stores (203) the access information in text file32, in particular, in the LB$D field. Web page39(FIG. 5) is also displayed on computer12. Using this Web page, the pretender selects (204) an application22band inputs a user ID in entry box42that corresponds to an account the pretender wants to access from the selected application. This information is transmitted to server14, where it is received (304) by code22a.

Code22averifies (305) that the pretender is entitled to access the account based on the identification information for the pretender and the user ID from Web page39. In particular, code22asearches through database26to determine if the pretender has the right to access the account associated with the input user ID. If information in database26indicates that the pretender is permitted to access the account, code22aretrieves information from database26that specifies the scope and content of the pretender's right of access to the account.

An account may provide access to one or more computer programs and/or databases. For example, a user's investment account may be served by programs for transmitting money between funds and determining fund performance, as described below. Database26contains information specifying which programs (and/or databases) a pretender may access in each account and/or restrictions on the pretender's rights of access. Code22aprovides (306) this information (called “account information”) to computer12.

Code29cin computer12receives (205) the account information from server14, and stores (206) the account information in text file32, in particular, in the LB$A field. The access information and account information in text file32are used in gaining access to accounts and applications. For example, if a pretender selects applications44or45from Web page39(FIG. 5), and inputs an account number in entry box42, code22aprovides Web page46(FIG. 6) to computer12. Web page46includes the same information that is displayed to the user specified in entry box42when the user accesses the account. Web page46also includes an indication47that the pretender is “pretending” to be the user whose ID is specified in entry box42, and identification information49for the user.

The rights of the pretender to view data, execute programs, and change parameters of the account of Web page46are specified in the account information (LB$A) in text file32. For example, Web page46displays icons50for executing programs that are available in the account. These icons include “Balances” icon50afor executing a program to obtain account balances; “Quotes” icon50bfor executing a program to obtain stock quotes and the like; “Market Indices” icon50cfor executing a program to obtain market indices; “Fund Performance” icon50dfor executing a program to determine the performance of funds in the account; “Fund Exchanges” icon50efor executing a program to move money between funds; “Contribution Elections” icon50ffor executing a program to contribute money to funds; “Payroll Deductions” icon50gfor executing a program to specify payroll deductions; “Loans” icon50hfor executing a program to inquire about loans; “Withdrawal” icon50ifor executing a program to withdraw money from the account; “Transaction History” icon50jfor executing a program to obtain a transaction history for the account; “Plan Literature” icon50kfor executing a program to obtain literature about an investment plan; “Plan Information” icon50lfor executing a program to obtain information about an investment plan; and “Calculator” icon50mfor executing a calculator program.

Which of the programs the pretender has a right to access is specified in the account information in the LB$A field of text file32. Upon execution, code (not shown) in a program interrogates text file32to determine if the pretender can access the program. Referring toFIGS. 7 and 8, the pretender requests (701) access to a program by clicking on one of icons50. Code22ain server14receives (801) the request and obtains (802) account information from text file32in browser29b. Specifically, code22ainterrogates the LB$A field of the text file. Code22areceives (702) the interrogation request and allows the text file to be probed. Code22athen determines (803) if the pretender is permitted to access the program based on the account information in the LB$A field.

If the pretender is permitted to access the program, the pretender receives access in703; otherwise access is denied. The account information in LB$A may permit the pretender to execute programs for viewing/accessing information relating to an account (e.g., fund performance), but not to change parameters of the account (e.g., to move money from one fund to another). Alternatively, the access information may permit the pretender to change account parameters. Access to the account may be provided to a pretender from an application22bregardless of whether the owner of the account can access that application.

FIG. 9shows a Web page52that is accessed via application54(FIG. 5). As in Web page46ofFIG. 6, web page52includes various programs that can be accessed therefrom. These programs55include “News”55a(shown) for executing a program to obtain news about an account (plan), “Plan”55bfor executing a program to access information on a specific plan (see below); “Participant”55cfor executing a program to obtain information on a plan participant; “Admin”55dfor executing a program to obtain information regarding plan administration; “Reports”55efor executing a program to obtain plan reports; “Communication”55ffor executing a program relating to communication; and “Invest”55gfor executing a program to invest in a plan.

As above, which of the foregoing programs the pretender has a right to access is specified in account information in the LB$A field of text file32. Upon execution, code in a program interrogates the text file to determine if the pretender can access the program. This is done in accordance with the processes ofFIGS. 7 and 8. Also, as above, the view and information provided by Web page52is the same view and information that the plan sponsor specified in entry box42(FIG. 5) would see.

As an alternative to the view of the plan sponsor provided inFIG. 9, the pretender can obtain information about a specific plan (such as content, templates, and the like) that is not associated with a particular plan sponsor's view. Clicking on “Plan”55a(FIG. 9) produces Web page60shown inFIG. 10. From Web page60, the pretender is prompted to enter a plan number in entry box61. Clicking on “Continue” button62retrieves Web page64(FIG. 11), which includes information65on the plan number entered in entry box61. As above, the pretender will be able to do this if it is permitted by the account information in text file32.

Returning toFIG. 5, each time a pretender enters a new application22bin a current pretender session, code in that application interrogates the access information (LB$D) in the text file32to determine if the pretender has the right to enter that application. Once in the application, accessing programs in the application is performed in accordance withFIGS. 7 and 8above.

Other embodiments are also within the scope of the following claims. For example, programs50in an application44might themselves include embedded programs. Rights of access to such embedded programs may also be specified in a text file that is interrogated by such embedded programs prior to their execution. The pretender can obtain access to accounts while the owner is accessing the account (at the same time) or while the owner is not accessing the account.