SECURE PERMISSIONING OF ACCESS TO USER ACCOUNTS, INCLUDING SECURE DEAUTHORIZATION OF ACCESS TO USER ACCOUNTS
A permissions management system is disclosed for enabling a user to securely authorize a third-party system to access user account data and initiate transactions related to a user account, without disclosing to the third-party system account credentials. The system enables the user to also securely de-authorize the third-party system. For example, records may be automatically generated that securely store account information, including one or more permissions related to the account and/or the third-party. A token associated with a record may be shared with the third-party system, but neither the record itself, nor the user account credentials, may be shared with the third-party. Accordingly, the third-party may request user account data and/or initiate transactions by providing the token, but does not itself know, e.g., the user account credentials. Further, the user may set various permissions related to the token, and may also revoke the token (e.g., de-authorize the third-party), thus providing increased security to the user's account.
1 . A computer-implemented method comprising:
receiving, from a first computing device associated with an institution and at a second computing device associated with a permissions manager, a unique identifier associated with an account of a user held by the institution, wherein the second computing device is further in communication with a third computing device associated with the user and a fourth computing device associated with an external application;
associating the unique identifier with the institution and the account of the user;
receiving, from the fourth computing device, a request for account data associated with the account of the user;
in response to receiving the request for the account data from the fourth computing device, communicating, to the first computing device associated with the institution, the unique identifier and the request for the account data;
receiving, from the first computing device and based on the unique identifier, the account data
2 . The computer-implemented method of claim 1 , further comprising:
receiving one or more permissions that indicate constraints on authorization of the external application to access the account data;
storing the one or more permissions; and
determining, based on the one or more permissions, whether the request for the account data exceeds the constraints on the authorization of the external application to access the account data.
3 . The computer-implemented method of claim 1 , wherein the request is a first request and wherein access to the account data is based on one or more permissions, the computer-implemented method further comprising:
receiving, by the second computing device and from the third computing device, a second request to modify the one or more permissions limiting use of the account data, wherein the second request revokes authorization of an entity to use the account data; and
updating, by the second computing device, the one or more permissions based on the second request.
4 . The computer-implemented method of claim 1 , wherein the unique identifier is based on at least one of:
encrypted data of one or more elements of the account data; or
a user identifier and an identifier of the external application.
5 . The computer-implemented method of claim 1 , wherein the unique identifier is not communicated to the fourth computing device associated with the external application.
6 . The computer-implemented method of claim 1 , wherein the request for the account data includes an indication of a type of account data requested, the indication comprising at least one of: transaction-level data, balance data, historical account data, or metadata associated with the account.
7 . The computer-implemented method of claim 1 , wherein communicating the unique identifier and the request for the account data to the first computing device comprises transmitting, via an application proxy instance, a message formatted according to a protocol associated with the institution.
8 . The computer-implemented method of claim 1 , wherein receiving the account data from the first computing device comprises receiving a financial statement from the institution.
9 . A system comprising:
one or more processors; and
one or more non-transitory computer-readable media storing computer executable instructions that, when executed, cause the one or more processors to perform operations comprising:
receiving, from a first computing device associated with an institution and at a second computing device associated with a permissions manager, a unique identifier associated with an account of a user held by the institution, wherein the second computing device is further in communication with a third computing device associated with the user and a fourth computing device associated with an external application;
associating the unique identifier with the institution and the account of the user;
receiving, from the fourth computing device, a request for account data associated with the account of the user;
in response to receiving the request for the account data from the fourth computing device, communicating, to the first computing device associated with the institution, the unique identifier and the request for the account data;
receiving, from the first computing device and based on the unique identifier, the account data
10 . The system of claim 9 , the operations further comprising:
receiving one or more permissions that indicate constraints on authorization of the external application to access the account data;
storing the one or more permissions; and
determining, based on the one or more permissions, whether the request for the account data exceeds the constraints on the authorization of the external application to access the account data.
11 . The system of claim 9 , wherein the request is a first request and wherein access to the account data is based on one or more permissions, the operations further comprising:
receiving, by the second computing device and from the third computing device, a second request to modify the one or more permissions limiting use of the account data, wherein the second request revokes authorization of an entity to use the account data; and
updating, by the second computing device, the one or more permissions based on the second request.
12 . The system of claim 9 , wherein the unique identifier is based on at least one of:
encrypted data of one or more elements of the account data; or
a user identifier and an identifier of the external application.
13 . The system of claim 9 , wherein the unique identifier is not communicated to the fourth computing device associated with the external application.
14 . The system of claim 9 , wherein the request for the account data includes an indication of a type of account data requested, the indication comprising at least one of: transaction-level data, balance data, historical account data, or metadata associated with the account.
15 . The system of claim 9 , wherein communicating the unique identifier and the request for the account data to the first computing device comprises transmitting, via an application proxy instance, a message formatted according to a protocol associated with the institution.
16 . The system of claim 9 , wherein receiving the account data from the first computing device comprises receiving a financial statement from the institution.
17 . One or more non-transitory computer-readable media storing computer executable instructions that, when executed, cause one or more processors to perform operations comprising:
receiving, from a first computing device associated with an institution and at a second computing device associated with a permissions manager, a unique identifier associated with an account of a user held by the institution, wherein the second computing device is further in communication with a third computing device associated with the user and a fourth computing device associated with an external application;
associating the unique identifier with the institution and the account of the user;
receiving, from the fourth computing device, a request for account data associated with the account of the user;
in response to receiving the request for the account data from the fourth computing device, communicating, to the first computing device associated with the institution, the unique identifier and the request for the account data;
receiving, from the first computing device and based on the unique identifier, the account data
18 . The one or more non-transitory computer-readable media of claim 17 , the operations further comprising:
receiving one or more permissions that indicate constraints on authorization of the external application to access the account data;
storing the one or more permissions; and
determining, based on the one or more permissions, whether the request for the account data exceeds the constraints on the authorization of the external application to access the account data.
19 . The one or more non-transitory computer-readable media of claim 17 , wherein the request is a first request and wherein access to the account data is based on one or more permissions, the operations further comprising:
receiving, by the second computing device and from the third computing device, a second request to modify the one or more permissions limiting use of the account data, wherein the second request revokes authorization of an entity to use the account data; and
updating, by the second computing device, the one or more permissions based on the second request.
20 . The one or more non-transitory computer-readable media of claim 17 , wherein the unique identifier is based on at least one of:
encrypted data of one or more elements of the account data; or
a user identifier and an identifier of the external application.