Granular Consent Access Token for Third-Party Data Security

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing access control systems for protected data resources lack a comprehensive and secure method to manage granular consent for third-party applications, leading to potential security risks and inefficiencies in handling various types of access requests.

Innovation Solution

A computing system and method that generate an access token for one-time authorization based on user-defined granular consent, allowing third-party applications to access protected data resources while enforcing user-defined rules and permissions, ensuring secure and controlled access.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Device complexity

If a simple access permissions system is used, then the system complexity is reduced, but the ability to handle various types of third-party access requests is limited

Engineering Contradiction:
Improveaccess permissions system complexityVSAvoidability to handle third-party access requests
Core Design Contradiction:
Device complexityVSAdaptability or versatility

Solution Approach 1:

The access control system segments permissions into granular scopes (e.g., read, write, delete operations on specific data types) and organizes third-party applications into categories. This segmentation allows the system to manage complex access requests through modular permission structures without requiring complete customization for each application, thereby reducing overall system complexity while maintaining versatility.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The system implements dynamic permission assignment where access rights are not fixed but can be adjusted based on the specific needs of each third-party application. Users can grant, revoke, or modify permissions in real-time, and the system adapts to different access patterns through configurable policy rules. This dynamic approach enables the system to handle diverse access requests flexibly without requiring complex hard-coded permissions for each scenario.

Inventive Principle:
Principle #15Dynamics

2Reliability

If granular consent management is implemented, then data security and user control are enhanced, but the complexity of access control operations increases

Engineering Contradiction:
Improvedata securityVSAvoidaccess control operations complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The system performs preliminary actions by pre-defining permission templates and access policies that outline security requirements and user controls. These pre-configured structures establish security frameworks in advance, allowing the system to enforce granular consent management through standardized procedures rather than requiring complex ad-hoc security configurations for each access request, thus reducing operational complexity while maintaining high security standards.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The system introduces intermediary components such as policy engines and permission brokers that mediate between users and third-party applications. These intermediaries handle the complex logic of granular consent validation, permission verification, and access control enforcement, shielding users from the complexity of security operations while maintaining strong security controls. The intermediaries translate high-level user preferences into detailed access control decisions automatically.

Inventive Principle:
Principle #24Intermediary (Mediator)

Data Source

PatentUS11882126B2Systems and methods for controlling third-party access of a protected data resource
Publication Date: 2024.01.23 THE TORONTO DOMINION BANK
  • US11882126B2 patent drawing
  • US11882126B2 patent drawing
  • US11882126B2 patent drawing

AI summary

A computer-implemented method is disclosed. The method includes: receiving, via an application server associated with a first application, a request for the first application to perform a first access operation in connection with a user account at a protected resource; determining that the first access operation is not among permitted user account operations for the first application in connection with the user account; and in response to determining that the first access operation is not among the permitted user account operations: generating a request for a one-time authorization for the first application to perform the first access operation; sending, to a client device, the request for the one-time authorization; receiving, via the client device, an indication of the requested one-time authorization; generating an access token for a one-time access of the user account based on the indication of one-time authorization; and transmitting the access token to the application server associated with the first application to grant, to the first application, one-time access to the user account.