NFC Token Transfer for Secure Third-Party Data Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users face challenges in authorizing access to their web service accounts from third-party devices without disclosing their credentials, as existing methods risk storing credentials on unfamiliar devices and exposing sensitive data.
Innovation Solution
A method utilizing NFC-enabled devices to transfer a request token from a third-party device to a user device for authorization, where the user device authenticates and returns an authorized token to the third-party device, allowing the service provider to generate an access token for secure data access without revealing user credentials.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If user credentials are entered on a third-party device to access web services, then access to the web service is enabled, but the credentials may be stored on the device and expose the user account to security risks
Solution Approach 1:
The patent introduces an intermediary authorization mechanism where a request token is transferred via NFC from the third-party device to the user device. The user then authorizes this token through their own device, which communicates with the service provider to obtain an access token. This intermediary process eliminates the need to input credentials on the third-party device, thus preventing credential exposure while maintaining access functionality.
2Device complexity
If user credentials are disclosed to a third-party device, then access authorization is simplified, but the user loses control over which data is accessed
Solution Approach 1:
The patent segments the authorization process into distinct phases: request token generation, NFC transfer to user device, user authorization of specific data scopes, and access token generation. This segmentation allows the user to review and control exactly which data the third-party device can access, rather than granting blanket access through credential disclosure. The user interface presents specific data access requests for user approval.
3Ease of operation
If credentials are stored on a third-party device for continued access, then convenience is improved, but security and privacy are compromised
Solution Approach 1:
Instead of storing credentials on the third-party device, the system creates a copied authorization mechanism using tokens. The request token is copied via NFC to the user device for authorization, and the resulting access token is used by the third-party device to access services. This token-based copying approach eliminates credential storage on external devices while maintaining continued access capability.
Data Source
AI summary
A third party device is authorized to access data associated with a user account at a service provider, wherein the third party device and a user device are in data communication with the service provider, and are both NFC-enabled. The method comprises obtaining a request token generated by the service provider, transmitting the request token from the third party device to the user device via NFC, authorizing the request token at the user device, transmitting the authorized request token from the user device to the third party device via NFC, and obtaining an access token generated by the service provider, corresponding to the authorized request token, wherein the access token allows the third party device to access data associated with the user account at the service provider.