Privilege-Constrained Authentication via Single-Use Authorization Codes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional authentication techniques for applications accessing client accounts are insecure, requiring users to fully trust the application with their credentials, leading to potential risks and loss of control over the actions performed by the application.
Innovation Solution
A privilege-constrained authentication system that uses single-use authorization codes conveyed over multiple channels to authenticate applications, limiting their privileges through permitted action tokens, ensuring secure and controlled access to client accounts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If conventional authentication techniques are used where users provide username and password to applications, then applications can perform actions on behalf of users, but users lose control over application actions and credentials are exposed to security risks
Solution Approach 1:
The patent segments the authentication process into multiple independent components: application credentials verification, user authorization code generation, and action permissioning. Instead of giving applications direct access to user credentials, the system creates separate authorization codes for each desired action, allowing users to control and review each permission individually while maintaining application functionality.
Solution Approach 2:
The patent introduces an intermediary authorization service that mediates between applications and user accounts. This service verifies application credentials, generates time-limited authorization codes, and enforces action permissions without exposing user credentials to applications. The intermediary layer protects user security while enabling application access through the permitted actions mechanism.
2Ease of operation
If users provide full credentials to applications for secure access, then applications can perform any action on user accounts, but users cannot monitor or control specific actions taken
Solution Approach 1:
The patent implements feedback mechanisms where users receive notifications about application authorization requests and can review permitted actions before granting access. The system provides users with visibility into what actions their applications can perform, allowing informed consent and ongoing monitoring of application behavior through the action permissioning system.
Solution Approach 2:
The patent makes authorization dynamic and reversible. Instead of static credential sharing, the system generates time-limited authorization codes that can be revoked or modified. Users can control and adjust application permissions over time, with the ability to revoke access or modify permitted actions as needed, providing ongoing control rather than one-time authentication.
3Ease of manufacture
If conventional authentication is used, then application development is simple, but security risks increase and user trust is compromised
Solution Approach 1:
The patent enables applications to self-verify their credentials through the authorization service without requiring direct user credential sharing. Applications can independently obtain authorization codes by presenting their credentials to the authorization service, which automatically verifies and issues appropriate permissions. This self-service mechanism simplifies application development while maintaining security through automated credential verification and permission enforcement.
Data Source
AI summary
Methods and systems are provided for managing access to a client account related (CAR) resource. When a privilege-constrained (PC) application requests access to an individual client account, a single use authorization (SUA) code is created that is associated with the individual client account. The SUA code is routed to, and returned from, the privilege-constrained (PC) application to authenticate the PC application. The PC application, once authenticated, receives a permitted action token that identifies a limited set of privileges that the PC application is authorized to perform in connection with the CAR resource. The PC application provides the permitted action token to an access service. The access service limits access, by the PC application, to the CAR resource based on the permitted action token.