Secure permissioning of access to user accounts, including secure deauthorization of access to user accounts
A permissions management system is disclosed for enabling a user to securely authorize a third-party system to access user account data and initiate transactions related to a user account, without disclosing to the third-party system account credentials. The system enables the user to also securely de-authorize the third-party system. For example, records may be automatically generated that securely store account information, including one or more permissions related to the account and/or the third-party. A token associated with a record may be shared with the third-party system, but neither the record itself, nor the user account credentials, may be shared with the third-party. Accordingly, the third-party may request user account data and/or initiate transactions by providing the token, but does not itself know, e.g., the user account credentials. Further, the user may set various permissions related to the token, and may also revoke the token (e.g., de-authorize the third-party), thus providing increased security to the user's account.
1. A system comprising:
a first computing device associated with an institution; and
a second computing device associated with a permissions manager,
wherein:
the first computing device and second computing device are configured to communicate with a third computing device associated with a user;
the second computing device is configured to communicate with a fourth computing device associated with an external application;
the first computing device is further configured to:
receive an authorization request via software executing on the third computing device, the authorization request including at least: account credentials associated with an account of the user held by the institution, wherein the software is configured to provide the account credentials to the first computing device without storing the account credentials on the third computing device;
verify, using the account credentials, authorization to access the account by the user;
in response to verifying the authorization, generate at least a token associated with the authorization; and
provide the token to the second computing device;
the second computing device is further configured to:
receive the token and associate the token with at least the institution and the account of the user;
receive, from the fourth computing device, a request for account data associated with the account of the user; and
in response to receiving the request for account data from the fourth computing device, communicate, to the first computing device associated with the institution, the token and the request for account data;
the first computing device is further configured to:
receive, from the second computing device, the token and the request for account data;
verify, using the token, authorization to provide the account data;
access the account data from the account of the user; and
communicate, to the second computing device, the account data associated with the account of the user; and
the second computing device is further configured to:
receive, from the first computing device, the account data; and
communicate the account data to the fourth computing device,
wherein neither the account credentials nor the token is communicated to the fourth computing device associated with the external application.
2. The system of claim 1 , wherein the second computing device is further configured to:
receive, from the third computing device or another computing device associated with the user, a request to deauthorize access to the account data by the external application; and
in response to the request to deauthorize access, revoke the token or revoke access to the account data.
3. The system of claim 2 , wherein the second computing device is further configured to:
receive one or more permissions that indicate constraints on authorization of the external application to access the account data;
store the one or more permissions; and
determine, based on the one or more permissions, whether the request for account data exceeds the constraints on the authorization of the external application to access the account data.
4. The system of claim 3 , wherein the second computing device is further configured to:
communicate the account data to the fourth computing device in response to determining the external application is authorized to access the account data.
5. The system of claim 4 , wherein the second computing device is further configured to:
provide a unique identifier associated with the token, but not the token, to the fourth computing device, wherein the request for user account data includes the unique identifier.
6. A system comprising:
a second computing device associated with a permissions manager, the second computing device in communication with a first computing device associated an institution, a third computing device associated with a user, and a fourth computing device associated with an external application, the second computing device configured to:
receive from the first computing device a token associated with an authorization to access an account of a user held by the institution, the token generated by the first computing device after the first computing device has verified account credentials provided by the user of the third computing device via software executing on the third computing device, wherein the software is configured to provide the account credentials to the first computing device without storing the account credentials on the third computing device;
associate the token with at least the institution and the account of the user;
receive, from the fourth computing device, a request for account data associated with the account of the user;
in response to receiving the request for account data from the fourth computing device, communicate to the first computing device associated with the institution, the token and the request for account data;
receive, from the first computing device, the account data after the first computing device has verified authorization to provide the account data using the token and accessed the account data from the account of the user at the institution; and
communicate the account data to the fourth computing device,
wherein neither the account credentials nor the token is communicated to the fourth computing device associated with the external application.
7. The system of claim 6 , wherein the second computing device is further configured to:
receive, from the third computing device or another computing device associated with the user, a request to deauthorize access to the account data by the external application; and
in response to the request to deauthorize access, revoke the token or revoke access to the account data.
8. The system of claim 7 , wherein the second computing device is further configured to:
receive one or more permissions that indicate constraints on authorization of the external application to access the account data;
store the one or more permissions; and
determine, based on the one or more permissions, whether the request for account data exceeds the constraints on the authorization of the external application to access the account data.
9. The system of claim 8 , wherein the second computing device is further configured to:
communicate the account data to the fourth computing device after determining the external application is authorized to access the account data.
10. The system of claim 9 , wherein the second computing device is further configured to:
provide a unique identifier associated with the token, but not the token, to the fourth computing device, wherein the request for user account data includes the unique identifier.
11. A computer-implemented method comprising:
by a first computing device comprising one or more processors executing program instructions, the first computing device associated with an institution:
receiving an authorization request via software executing on a third computing device associated with a user, the authorization request including at least: account credentials associated with an account of the user held by the institution, wherein the plug-in is configured to provide the account credentials to the first computing device without storing the account credentials on the third computing device;
verifying, using the account credentials, authorization to access the account by the user;
in response to verifying the authorization, generating at least a token associated with the authorization; and
providing the token to a second computing device;
by the second computing device comprising one or more processors executing program instructions, the second computing device associated with a permissions manager:
receiving the token and associate the token with at least the institution and the account of the user;
receiving, from a fourth computing device associated with the external application, a request for account data associated with the account of the user; and
in response to receiving the request for account data from the fourth computing device, communicating, to the first computing device associated with the institution, the token and the request for account data;
the first computing device is further configured to:
receiving, from the second computing device, the token and the request for account data;
verifying, using the token, authorization to provide the account data;
accessing the account data from the account of the user; and
communicating, to the second computing device, the account data associated with the account of the user; and
the second computing device is further configured to:
receiving, from the first computing device, the account data; and
communicating the account data to the fourth computing device,
wherein neither the account credentials nor the token is communicated to the fourth computing device associated with the external application.
12. The computer-implemented method of claim 11 further comprising:
further by the second computing device:
receiving, from the third computing device or another computing device associated with the user, a request to deauthorize access to the account data by the external application; and
in response to the request to deauthorize access, revoking the token or revoke access to the account data.
13. The computer-implemented method of claim 12 further comprising:
further by the second computing device:
receiving one or more permissions that indicate constraints on authorization of the external application to access the account data;
storing the one or more permissions; and
determining, based on the one or more permissions, whether the request for account data exceeds the constraints on the authorization of the external application to access the account data.
14. The computer-implemented method of claim 13 further comprising:
further by the second computing device:
communicating the account data to the fourth computing device in response to determining the external application is authorized to access the account data.
15. The computer-implemented method of claim 14 further comprising:
further by the second computing device:
providing a unique identifier associated with the token, but not the token, to the fourth computing device, wherein the request for user account data includes the unique identifier.
16. A computer-implemented method comprising:
by a second computing device comprising one or more processors executing program instructions, the second computing device associated with a permissions manager, the second computing device in communication with a first computing device associated an institution, a third computing device associated with a user, and a fourth computing device associated with an external application:
receiving from the first computing device a token associated with an authorization to access an account of a user held by the institution, the token generated by the first computing device after the first computing device has verified account credentials provided by the user of the third computing device via software executing on the third computing device, wherein the software is configured to provide the account credentials to the first computing device without storing the account credentials on the third computing device;
associating the token with at least the institution and the account of the user;
receiving, from the fourth computing device, a request for account data associated with the account of the user;
in response to receiving the request for account data from the fourth computing device, communicating to the first computing device associated with the institution, the token and the request for account data;
receiving, from the first computing device, the account data after the first computing device has verified authorization to provide the account data using the token and accessed the account data from the account of the user at the institution; and
communicating the account data to the fourth computing device,
wherein neither the account credentials nor the token is communicated to the fourth computing device associated with the external application.
17. The computer-implemented method of claim 16 further comprising:
further by the second computing device:
receiving, from the third computing device or another computing device associated with the user, a request to deauthorize access to the account data by the external application; and
in response to the request to deauthorize access, revoking the token or revoke access to the account data.
18. The computer-implemented method of claim 17 further comprising:
further by the second computing device:
receiving one or more permissions that indicate constraints on authorization of the external application to access the account data;
storing the one or more permissions; and
determining, based on the one or more permissions, whether the request for account data exceeds the constraints on the authorization of the external application to access the account data.
19. The computer-implemented method of claim 18 further comprising:
further by the second computing device:
communicating the account data to the fourth computing device after determining the external application is authorized to access the account data.
20. The computer-implemented method of claim 19 further comprising:
further by the second computing device:
providing a unique identifier associated with the token, but not the token, to the fourth computing device, wherein the request for user account data includes the unique identifier.