Delegated Payment Access Using Temporary Authorization Credentials

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing payment services do not support services like direct debit, deposit, or credit due to unpredictable account balances and lack of trust among users, and they require users to share sensitive authentication data with third parties for transactions.

Innovation Solution

A method and device for managing access authorization to a payment service that generates temporary data, such as a public identifier and confidential code, for delegated users, ensuring secure transactions without sharing the owner's authentication data, and allowing controlled access rights with parameters like authorized amount and validity period.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If users share authentication data with third parties to enable transactions, then transaction capability is improved, but security deteriorates

Engineering Contradiction:

Improvetransaction capabilityVSAvoidsecurity risk

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The authentication system is segmented into multiple components: the owner user's device generates a shared secret, which is then used to create separate authentication credentials for the delegated user. This segmentation allows the delegated user to perform transactions without accessing the owner's actual authentication data, thus maintaining security while enabling transaction capability.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

A server acts as an intermediary between the owner user and the delegated user. The server receives the shared secret from the owner user, generates the delegated user's authentication credentials, and manages the delegation process. This intermediary prevents direct exposure of sensitive authentication data while still enabling the delegated user to access payment services.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Adaptability or versatility

If payment services support direct debit, deposit, or credit services, then service versatility is improved, but reliability deteriorates due to unpredictable account balances

Engineering Contradiction:

Improveservice varietyVSAvoidtrust among users

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The system performs preliminary actions by obtaining user consent and generating delegation credentials before any financial transactions occur. The owner user explicitly authorizes the delegated user through a consent flow, and the system pre-generates authentication credentials that will be valid for future transactions. This preliminary authorization establishes trust before the actual financial operations take place.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements feedback mechanisms where the owner user is notified and can review delegated access permissions. The consent flow provides feedback to the owner user about who is being granted access and to what extent. This feedback loop maintains trust by keeping the account holder informed about ongoing delegations.

Inventive Principle:

Principle #23Feedback

3Object-affected harmful factors

If temporary access data is generated for delegated users, then security is improved, but device complexity increases

Engineering Contradiction:

Improvesecurity levelVSAvoidsystem complexity

Core Design Contradiction:

Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The system enables self-service by allowing the owner user to independently generate shared secrets and authorize delegated users through a straightforward consent flow on their own device. The server automatically handles the complex tasks of generating credentials and managing delegations based on simple user inputs. This self-service approach maintains security without requiring complex manual configuration by the user.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS12481973B2Method and device for managing access authorization to a payment service provided to a user

Publication Date: 2025.11.25 ORANGE SA

AI summary

A method and a device for managing access authorization to a payment service provided to a user is disclosed. A request to initialize at least one access authorization is received from a terminal of the owner user. Such an access authorization is intended to allow at least one delegated user to access the account of the owner user, the request comprising at least one identifier of the delegated user and one identifier of the owner user. Temporary data for accessing an account associated with the delegated user is generated, the temporary data comprising a public identifier associated with the delegated user, and a confidential code associated with the public identifier. The temporary data is transmitted to at least one terminal of the delegated user or of another user.