NFC-based authorization of access to data from a third party device
A third party device is authorized to access data associated with a user account at a service provider, wherein the third party device and a user device are in data communication with the service provider, and are both NFC-enabled. The method comprises obtaining a request token generated by the service provider, transmitting the request token from the third party device to the user device via NFC, authorizing the request token at the user device, transmitting the authorized request token from the user device to the third party device via NFC, and obtaining an access token generated by the service provider, corresponding to the authorized request token, wherein the access token allows the third party device to access data associated with the user account at the service provider.
1. A method of authorizing a third party device to access data associated with a user account at a service provider, wherein the third party device and a separate user device are in data communication with the service provider and are both NFC-enabled, the method comprising:
obtaining, at the third party device, a request token generated by the service provider, wherein the request token can only be used by a requesting third party device;
transmitting the request token from the third party device to the separate user device via NFC;
receiving, at the third party device, a signed request token from the separate user device via NFC, wherein the signed request token was signed by the service provider after user authorization; and
obtaining, at the third party device via HTTP, an access token generated by the service provider, the access token corresponding to the signed request token, wherein the access token allows the third party device to remotely access a user-defined subset of data associated with the user account at the service provider during a user-defined period of validity.
2. The method according to claim 1 , wherein the step of obtaining the request token further comprises:
transmitting a request for the request token from the third party device to the service provider;
receiving a generated request token from the service provider at the third party device.
3. The method according to claim 1 , wherein the request for the request token comprises a device ID corresponding to the third party device.
4. The method according to claim 2 , wherein the request for the request token comprises a user ID corresponding to the user account.
5. The method according to claim 1 , wherein the step of obtaining the access token further comprises:
generating, at the third party device, a request for the access token based on the authorized request token;
transmitting the request for the access token from the third party device to the service provider; and
receiving, at the third party device, a generated access token from the service provider.
6. The method according to claim 1 , wherein the signed request token is signed with a user specific key.
7. The method according to claim 1 , further comprising:
selecting a set of user data stored at the service provider for authorization.
8. The method according to claim 7 , wherein the selected set of user data correspond to the user account.
9. The method according to claim 1 , wherein the request token is an OAuth request token and wherein the access token is an OAuth access token.
10. The method according to claim 1 , wherein the access token is encoded into a Uniform Resource Locator (URL).
11. The method according to claim 10 , further comprising:
opening, with the NFC enabled third party device, the URL in a browser.
12. The method according to claim 10 , further comprising:
opening, with the NFC enabled third party device, the URL in a dedicated application.
13. The method according to claim 12 , wherein the dedicated application is installed on the NFC enabled third party device.
14. A system comprising:
a service provider;
an NFC enabled user device belonging to a user having a user account at the service provider; and
an NFC enabled third party device, the third party device and the NFC enabled user device being in network communication with the service provider, wherein the NFC enabled third party device is configured to obtain a request token issued by the service provider, the request token can only be used by a requesting third party device, and transmit the request token to the NFC enabled user device via NFC, obtain an access token generated by the service provider based upon a signed request token via HTTP, wherein the signed request token was signed by the service provider after user authorization and based on the access token, remotely access a user-defined subset of data associated with the user account at the service provider during a user-defined period of validity.