Secure permissioning of access to user accounts, including secure deauthorization of access to user accounts
A permissions management system is disclosed for enabling a user to securely authorize a third-party system to access user account data and initiate transactions related to a user account, without disclosing to the third-party system account credentials. The system enables the user to also securely de-authorize the third-party system. For example, records may be automatically generated that securely store account information, including one or more permissions related to the account and/or the third-party. A token associated with a record may be shared with the third-party system, but neither the record itself, nor the user account credentials, may be shared with the third-party. Accordingly, the third-party may request user account data and/or initiate transactions by providing the token, but does not itself know, e.g., the user account credentials. Further, the user may set various permissions related to the token, and may also revoke the token (e.g., de-authorize the third-party), thus providing increased security to the user's account.
1. A computer-implemented method comprising:
by a first computing device comprising one or more processors executing program instructions:
receiving, from a third computing device associated with an external application, an authorization request including an indication of a user account;
retrieving, from a fourth computing device associated with an institution, information associated with the user account held by the institution;
generating at least:
an electronic record of the information, and
a token associated with the electronic record;
causing at least one of a unique identifier associated with the token or the token to be provided to the third computing device; and
providing, to a second computing device, at least:
the electronic record of the information, and
the token associated with the electronic record; and
by the second computing device comprising one or more processors executing program instructions, the second computing device separate from the first computing device:
receiving, from the first computing device, at least:
the electronic record of the information, and
the token associated with the electronic record;
receiving, from the third computing device, at least:
the at least one of the unique identifier associated with the token or the token, and
a request to cause a transaction related to the user account to be executed;
verifying, based at least in part on the at least one of the unique identifier associated with the token or the token, authorization of the third computing device to cause the transaction to be executed;
initiating the transaction via communication with the fourth computing device or another institution or transaction processor,
whereby the third computing device is enabled to cause transactions related to the user account to be executed without sharing the information with the third computing device.
2. The computer-implemented method of claim 1 further comprising:
further by the second computing device:
receiving a request to deauthorize the third computing device from causing execution of transactions related to the user account; and
in response to the request to deauthorize the third computing device, revoking the at least one of the unique identifier associated with the token or the token,
whereby deauthorization of the third computing device from causing transactions to be executed is efficiently enabled by revocation of the at least one of the unique identifier associated with the token or the token.
3. The computer-implemented method of claim 1 , wherein:
further by the first computing device:
providing, to the second computing device, one or more permissions along with the electronic record of the information; and
further by the second computing device:
in response to receiving the request to cause the transaction related to the user account to be executed, determining, based on the one or more permissions, an authorization of the external application to cause the transaction related to the user account to be executed.
4. The computer-implemented method of claim 3 further comprising:
further by the second computing device:
providing an indication to the third computing device whether or not there is an authorization of the external application to cause the transaction related to the user account to be executed.
5. The computer-implemented method of claim 1 , wherein the information associated with the user account includes at least one of: an indication of the external application, an indication of the institution, an account number, or a routing number.
6. The computer-implemented method of claim 1 further comprising:
further by the second computing device:
providing an indication to the third computing device whether or not execution of the transaction is successful.
7. The computer-implemented method of claim 1 , wherein the generating is performed in response to a request received from a computing device associated with the external application.
8. The computer-implemented method of claim 1 , wherein the third and fourth computing devices do not directly communicate with one another.
9. A computer-implemented method comprising:
by a first computing device comprising one or more processors executing program instructions, the first computing device in communication with a second computing device separate from the first computing device, a third computing device associated with an external application, and a fourth computing device associated with an institution:
receiving, from the third computing device, an authorization request including an indication of a user account;
retrieving, from the fourth computing device associated with the institution, information associated with the user account held by the institution;
generating at least:
an electronic record of the information, and
a token associated with the electronic record;
causing at least one of a unique identifier associated with the token or the token to be provided to the third computing device; and
providing, to the second computing device, at least:
the electronic record of the information, and
the token associated with the electronic record,
wherein the token is useable by the second computing device to verify an authorization of the third computing device to request to cause a transaction related to the user account to be executed,
whereby the third computing device is enabled to cause transactions related to the user account to be executed without sharing the information with the third computing device.
10. The computer-implemented method of claim 9 , wherein the transaction is to be executed via communication between the second computing device and the fourth computing device or another institution or transaction processor.
11. The computer-implemented method of claim 9 further comprising:
further by the first computing device:
providing, to the second computing device, one or more permissions along with the electronic record of the information, wherein the one or more permissions are usable by the second computing device to further determine an authorization of the third computing device to cause the transaction related to the user account to be executed.
12. The computer-implemented method of claim 9 , wherein the information associated with the user account includes at least one of: an indication of the external application, an indication of the institution, an account number, or a routing number.
13. The computer-implemented method of claim 9 , wherein the generating is performed in response to a request received from a computing device associated with the external application.
14. A computer-implemented method comprising:
by a second computing device comprising one or more processors executing program instructions, the second computing device in communication with a first computing device separate from the second computing device, a third computing device associated with an external application, and a fourth computing device associated with an institution:
receiving, from the first computing device, at least:
an electronic record of information associated with a user account held by the institution, the information retrieved from the fourth computing device via the first computing device, and
a token associated with the electronic record, the token generated by the first computing device;
receiving, from the third computing device, at least:
at least one of a unique identifier associated with the token or the token, and
a request to cause a transaction related to the user account to be executed;
verifying, based at least in part on the at least one of the unique identifier associated with the token or the token, authorization of the third computing device to cause the transaction to be executed;
initiating the transaction via communication with the fourth computing device or another institution or transaction processor,
whereby the third computing device is enabled to cause transactions related to the user account to be executed without sharing the information with the third computing device.
15. The computer-implemented method of claim 14 further comprising:
further by the second computing device:
receiving a request to deauthorize the third computing device from causing execution of transactions related to the user account; and
in response to the request to deauthorize the third computing device, revoking the at least one of the unique identifier associated with the token or the token,
whereby deauthorization of the third computing device from causing transactions to be executed is efficiently enabled by revocation of the at least one of the unique identifier associated with the token or the token.
16. The computer-implemented method of claim 14 further comprising:
further by the second computing device:
in response to receiving the request to cause the transaction related to the user account to be executed, determining, based on one or more permissions provided by the first computing device, an authorization of the external application to cause the transaction related to the user account to be executed.
17. The computer-implemented method of claim 16 further comprising:
further by the second computing device:
providing an indication to the third computing device whether or not there is an authorization of the external application to cause the transaction related to the user account to be executed.
18. The computer-implemented method of claim 14 , wherein the information associated with the user account includes at least one of: an indication of the external application, an indication of the institution, an account number, or a routing number.
19. The computer-implemented method of claim 14 further comprising:
further by the second computing device:
providing an indication to the third computing device whether or not execution of the transaction is successful.
20. The computer-implemented method of claim 14 , wherein the third and fourth computing devices do not directly communicate with one another.