Authentication Token Mechanism for Secure Third-Party Data Access

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Large organizations, such as financial institutions, face challenges in providing secure and convenient access to customer account information while managing third-party account information aggregators, which pose security risks due to the storage of login credentials and potential unauthorized access to financial accounts.

Innovation Solution

Implementing authentication tokens that allow customers to authenticate with their financial institution directly, generating a token for authorized access by third-party aggregators, thereby limiting access to read-only permissions and maintaining credentials within the financial institution's domain, enabling easy revocation of access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If customers share login credentials with third-party account information aggregators, then the aggregators can access account information, but security risks increase due to credential storage outside the financial institution's control

Engineering Contradiction:

Improveaccess to account informationVSAvoidsecurity

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent introduces an intermediary authentication token mechanism between customers and third-party aggregators. The financial institution issues authentication tokens to customers who authorize access, and these tokens serve as intermediaries that allow aggregators to access account information without storing or handling actual login credentials. This resolves the contradiction by enabling information access while maintaining security through the intermediary token system that never exposes real credentials.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If third-party aggregators perform screen scrapes to collect account information, then they can compile financial data from multiple institutions, but unauthorized access and potential fund transfers become possible

Engineering Contradiction:

Improvedata collection capabilityVSAvoidunauthorized transactions

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The authentication token system implements local quality by providing different levels of access control. The tokens are configured to grant specific permissions (such as read-only access to account information) rather than full access. This allows aggregators to perform legitimate data collection functions while preventing harmful actions like unauthorized fund transfers, as the token permissions locally control what operations are permitted.

Inventive Principle:

Principle #3Local quality

3Reliability

If customers change their account passwords with the financial institution, then security is improved, but they must also update password information with the account information aggregator

Engineering Contradiction:

ImprovesecurityVSAvoiduser convenience

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The system segments the authentication mechanism into two independent parts: the customer's permanent login credentials with the financial institution, and the time-limited authentication tokens issued to aggregators. When customers change their permanent passwords, only their financial institution credentials are updated, not the aggregator access tokens. This segmentation allows security improvements at the financial institution level without requiring aggregator password updates, as tokens are separate authentication artifacts.

Inventive Principle:

Principle #1Segmentation

4Adaptability or versatility

If financial institutions add more functionality to customer portals, then service quality improves, but security of customer account information becomes more difficult to maintain

Engineering Contradiction:

ImprovefunctionalityVSAvoidinformation security

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The patent extracts the authentication and authorization logic from the customer portal functionality. By using authentication tokens issued independently of the portal's functional features, the system separates security mechanisms from the evolving functionality of the customer portal. This allows the portal to add new features and capabilities while maintaining security through the token-based authentication system that operates independently of portal-specific functionality.

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentUS9830591B2Providing access to account information using authentication tokens

Publication Date: 2017.11.28 BANK OF AMERICA CORP

AI summary

Methods, systems, and computer-readable media for providing access to account information using authentication tokens are presented. In some embodiments, a customer of a financial institution may visit an account information aggregator site and request to add an account maintained by the financial institution to a collection of accounts for which the aggregator collects account information on behalf of the customer. Rather than providing their username, password, or other bank login credentials to the aggregator, the customer may be redirected to a page provided by the financial institution where the customer can enter the customer's credentials and authenticate with the financial institution. After authenticating the customer, the financial institution may generate a token and provide the token to the aggregator. Subsequently, the aggregator may use the token to obtain read-only access to financial account information for one or more financial accounts that are maintained by the financial institution for the customer.