IVR Sensitive Data Masking for Call Center Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional call centers face breaches of sensitive information as agents can access personally identifiable information before it is masked, violating security standards like PCI and HIPAA.
Innovation Solution
Implementing an automated voice response system that transfers callers to an IVR during sensitive information provision, ensuring the agent cannot hear or access this information, and using single-use encryption keys for secure storage and retrieval.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If agents manually collect and enter sensitive information from callers, then the call center can process customer information and provide service, but the sensitive information is exposed to unauthorized access by agents before masking
Solution Approach 1:
The patent extracts the sensitive information collection function from the agent's manual process and transfers it to an automated IVR system. The IVR automatically collects sensitive information through automated voice prompts, eliminating the agent's direct involvement in handling sensitive data while maintaining service delivery capabilities
Solution Approach 2:
The patent introduces an IVR system as an intermediary between the caller and the agent. The IVR acts as a mediator that collects sensitive information on behalf of the agent, then transfers only masked or encrypted data to the agent, preventing unauthorized access while preserving the information collection function
2Reliability
If sensitive information is masked or obfuscated in the database after collection, then unauthorized access is prevented, but the information remains vulnerable during the collection and entry phase
Solution Approach 1:
The patent applies preliminary action by masking or encrypting sensitive information at the point of collection through the IVR system, before the data is stored in the database or transmitted to agents. This upfront security measure eliminates the vulnerability window that exists in conventional systems during collection and entry phases
3Reliability
If an automated IVR system collects sensitive information, then agent access is prevented, but the system complexity increases
Solution Approach 1:
The patent makes the IVR system multi-functional by combining sensitive information collection, automatic masking/encryption, and secure data transmission capabilities within a single automated platform. This consolidates multiple functions that would otherwise require separate systems, reducing overall system complexity while maintaining security
Data Source
AI summary
A computer-implemented system and method for storing and retrieving sensitive information is provided. Segments of sensitive data each encrypted via a single use encryption key and associated with a reference code are maintained. The reference code is received for at least one of the segments of encrypted sensitive data and the encryption key is recreated based on the received reference code. The encrypted sensitive data segment is decrypted using the recreated encryption key and the decrypted sensitive data segment populates a field in a display.