Financial Account Authentication via Public Key Encryption

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Storing user login credentials in an aggregation server system for financial account aggregation poses a risk to user financial data security, as it compromises the security of the system if compromised.

Innovation Solution

Implementing a public-key infrastructure (PKI) configuration where each financial institution generates public and private keys, with the aggregation server system using the public key to encrypt user login information, which can only be decrypted by the financial institution's private key, thereby restricting access and enhancing security.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If user login credentials are stored in the aggregation server system, then the system can access and aggregate financial data from multiple institutions, but the security risk increases if the aggregation server is compromised

Engineering Contradiction:

Improveability to aggregate financial dataVSAvoidsecurity of user credentials

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The patent extracts the sensitive credential storage function from the aggregation server by implementing a dedicated secure credential vault. The vault is a separate security domain that stores encrypted credentials, isolating them from the main aggregation server. This extraction reduces the security risk to the aggregation server while maintaining the ability to access credentials when needed for data aggregation.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent introduces a credential vault as an intermediary component between the aggregation server and financial institutions. The vault acts as a secure mediator that holds encrypted credentials and releases them through controlled authentication processes. This intermediary layer protects the aggregation server from direct exposure to sensitive credentials while enabling necessary access for legitimate operations.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If public keys are distributed to user devices for encrypting login information, then security is enhanced, but the system complexity increases due to key management requirements

Engineering Contradiction:

Improvesecurity of credential transmissionVSAvoidkey management infrastructure

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent implements a universal key management system where the credential vault serves multiple functions: storing encrypted credentials, managing public key distribution, handling authentication, and coordinating with multiple financial institutions. This multi-functional approach consolidates key management complexity into a centralized secure component rather than distributing it across multiple systems.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The system implements self-service key management where user devices automatically obtain and use public keys for encryption without requiring manual configuration. The credential vault automatically manages key distribution, rotation, and expiration, reducing the operational burden on users and administrators while maintaining strong security.

Inventive Principle:

Principle #25Self-service

3Reliability

If encrypted credentials are stored instead of plaintext, then security is improved, but the ease of operation decreases due to decryption requirements

Engineering Contradiction:

Improveprotection of user login informationVSAvoidaccess to financial data

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent implements preliminary authentication where the credential vault decrypts and validates credentials before the aggregation server needs to access financial data. This preliminary action ensures that decryption occurs only when properly authenticated, maintaining security while enabling efficient subsequent data access operations without repeated decryption overhead.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent replaces manual credential management with automated cryptographic operations. The credential vault automatically handles encryption, decryption, and authentication using cryptographic protocols, eliminating the need for manual intervention while maintaining strong security. This substitution makes the system both more secure and easier to operate through automation.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS11551209B2Financial account authentication

Publication Date: 2023.01.10 YODLEE INC

AI summary

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for receiving, from a user device, a request to include financial data describing a financial account in an interface, the financial account being associated with a particular financial institution; identifying one or more metadata attributes for accessing the financial account associated with the particular financial institution; obtaining a public digital key associated with the financial institution; providing, to the user device, data describing the one or more metadata attributes and the public digital key associated with the financial institution; receiving, from the user device, respective values for the one or more metadata attributes, the corresponding values having been encrypted by the user device using the public digital key; and storing the encrypted values for the one or more metadata attributes for use in accessing and aggregating financial data describing the financial account.