Application-Specific Credentials for Third-Party Data Access

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing token-based authorization and consent processes, such as OAuth, do not ensure that third-party applications manage and distribute confidential data in accordance with the granted level of access and imposed limitations, and they decouple user authorization from the subsequent use of the data.

Innovation Solution

A computing system associated with a centralized authority generates an application-specific credential that indicates the likelihood of a third-party application managing confidential data in accordance with the granted access level and imposed limitations, and this credential is provisioned to the third-party application and recorded in a distributed ledger.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If traditional token-based authorization (OAuth) is used to enable third-party application access to confidential data, then ease of operation and accessibility are improved, but reliability and compliance assurance deteriorate because the system cannot ensure that third-party applications manage data in accordance with granted access levels

Engineering Contradiction:

ImproveThird-party application accessVSAvoidCompliance assurance

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The system performs preliminary actions by generating application-specific credentials before data access occurs. These credentials are created based on pre-defined access policies and are validated before any confidential data is transmitted, ensuring compliance is established in advance rather than retroactively

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary credential validation mechanism that sits between the third-party application and the confidential data. The system validates application-specific credentials against stored credential data, acting as a mediator that ensures compliance without requiring direct trust between the application and data holder

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If user authorization is decoupled from subsequent data use to enable flexible third-party access, then adaptability and versatility are improved, but reliability and control deteriorate because the system loses ability to enforce access limitations

Engineering Contradiction:

ImproveAccess flexibilityVSAvoidAccess control

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The system implements dynamic credential validation where application-specific credentials are checked against stored credential data at the time of each data access request. This allows the system to adaptively enforce access controls based on current authorization status rather than relying on static, pre-established trust relationships

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The patent establishes a feedback mechanism where the system validates credentials and can revoke access based on observed application behavior. The credential validation process provides continuous feedback about whether the application is acting within its authorized scope, enabling the system to maintain control while allowing flexible access

Inventive Principle:

Principle #23Feedback

3Reliability

If application-specific credentials are generated and validated to ensure compliance, then reliability and compliance assurance are improved, but device complexity and processing overhead increase

Engineering Contradiction:

ImproveCompliance assuranceVSAvoidCredential validation system

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent segments the authorization system into distinct components: credential generation, credential storage, and credential validation. This segmentation allows each component to be optimized independently and enables modular implementation where the validation logic can be integrated at appropriate system boundaries without requiring complete system redesign

Inventive Principle:

Principle #1Segmentation

4Reliability

If credential validation is performed for each data access request, then reliability and compliance monitoring are improved, but productivity and response time deteriorate

Engineering Contradiction:

ImproveCompliance monitoringVSAvoidData access speed

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system performs preliminary credential validation before data access is granted. By validating application-specific credentials in advance and caching the validation results, the system reduces the overhead for subsequent data access operations while maintaining compliance assurance

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS20250030675A1Managing third-party access to confidential data using dynamically generated application-specific credentials

Publication Date: 2025.01.23 THE TORONTO DOMINION BANK

AI summary

The disclosed exemplary embodiments include computer-implemented systems, apparatuses, and processes that dynamically manage consent, permissioning, and trust between computing systems and unrelated, third-party applications operating within a computing environment. By way of example, the apparatus may receive a request for an element of data that includes an access token and first credential data associated with an application program. When the first credential data corresponds to second credential data associated with the application program, may determine that the requested data element is accessible to the application program and perform operations that validate the access token. Further, and based on the validation of the access token, that apparatus may obtain and encrypt the requested data element, and may transmit the encrypted data element to a device via the communications interface.