Authentication Token Mechanism for Secure Third-Party Account Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large organizations, such as financial institutions, face challenges in providing secure and convenient access to customer account information while managing third-party account information aggregators, which pose security and usability risks due to the sharing of login credentials and lack of control over access permissions.
Innovation Solution
Implementing authentication tokens that allow customers to authorize third-party aggregators to access their account information, enabling read-only access and maintaining credentials within the financial institution's domain, with revocation controls to manage access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If customers share login credentials with third-party aggregators, then aggregators can access account information, but security risks increase and control over access is lost
Solution Approach 1:
The patent segments the authentication process into distinct components: initial customer authentication with the financial institution, generation of a time-limited access token, and separate aggregator authentication using that token. This segmentation allows the credentials to remain secure at the financial institution while enabling aggregator access through a controlled token mechanism.
Solution Approach 2:
The patent introduces an access token as an intermediary between the customer's credentials and the aggregator's access requests. The token acts as a mediator that carries authorization information without exposing the actual login credentials, allowing secure third-party access while maintaining credential security at the financial institution.
2Productivity
If aggregators perform screen scraping to collect account information, then they can compile financial data, but they gain full account access including ability to transfer funds and perform transactions
Solution Approach 1:
The patent applies local quality by granting the aggregator token with specific, limited permissions rather than full account access. The token is configured to allow only read-only access to account information while explicitly preventing transactional operations such as fund transfers, creating a localized permission set that matches the aggregator's informational needs without exposing harmful capabilities.
Solution Approach 2:
The patent changes the authorization parameter from full account access to restricted read-only access through the token mechanism. By modifying the scope and permissions embedded in the access token, the system transforms the aggregator's capability from potentially harmful full access to safe, limited information retrieval only.
3Reliability
If customers must update passwords with both financial institution and aggregator, then account security is maintained, but usability and convenience decrease
Solution Approach 1:
The patent extracts the password update requirement from the aggregator interaction and isolates it to only the financial institution. By removing the need for customers to propagate password changes to third-party aggregators, the system maintains security through centralized credential management while eliminating the inconvenience of multi-system password synchronization.
Solution Approach 2:
The patent implements self-service by having the financial institution automatically handle credential validation and token reissuance when customers change their passwords. The system automatically invalidates old tokens and generates new ones without requiring customer intervention at the aggregator level, making the security maintenance transparent and convenient for users.
4Adaptability or versatility
If financial institutions allow aggregator access through traditional authentication, then aggregators can access account data, but the institution cannot effectively regulate or restrict aggregator traffic
Solution Approach 1:
The patent introduces dynamic control through time-limited access tokens that can be revoked or renewed by the financial institution at any time. The token mechanism allows the institution to dynamically adjust aggregator access based on changing security requirements, customer preferences, or detected anomalies, transforming static credential sharing into a flexible, controllable authorization system.
Solution Approach 2:
The patent establishes a feedback loop where the financial institution receives and processes aggregator access requests with tokens, validates them against current customer authorization preferences, and can revoke or modify tokens based on ongoing monitoring. This continuous feedback mechanism enables the institution to maintain control over aggregator traffic patterns and respond to security events in real-time.
Data Source
AI summary
Methods, systems, and computer-readable media for providing access to account information using authentication tokens are presented. In some embodiments, a customer of a financial institution may visit an account information aggregator site and request to add an account maintained by the financial institution to a collection of accounts for which the aggregator may collect account information on behalf of the customer. Rather than providing their username, password, and/or other bank login credentials to the aggregator, the customer may be redirected to a page provided by the financial institution where the customer can enter their credentials and authenticate with the financial institution. After authenticating the customer, the financial institution may generate a token and provide the token to the aggregator. Subsequently, the aggregator may use the token to obtain read-only access to financial account information for one or more financial accounts that are maintained by the financial institution for the customer.