Secure authorization of access to user accounts by one or more authorization mechanisms

Patent metadata

Field	Value
Publication number	US-12074880-B2
Application number	US-202217656528-A
Country	US
Kind code	B2
Filing date	Mar 25, 2022
Priority date	Sep 14, 2018
Publication date	Aug 27, 2024
Grant date	Aug 27, 2024

Abstract

A permissions management system is disclosed for enabling a user to securely authorize access to user accounts and/or securely authorize execution of transactions related to user accounts via one or more application programming interfaces (“APIs”) and/or one or more authorization mechanisms.

First claim

What is claimed is:

1. A computer system comprising:
a computer readable storage medium having program instructions embodied therewith; and
one or more hardware processors configured to execute the program instructions to cause the computer system to:
provide permissions code to a computing device operated by a user, wherein the permissions code is configured to generate one or more user interfaces configured to receive, from the user, at least a first account identifier associated with a user account;
receive, from the computing device operated by the user, at least the first account identifier and account credentials associated with the user account;
access a second account identifier associated with the user account through at least an application programming interface (“API”) associated with an institution and using the account credentials;
in response to determining that the first account identifier and the second account identifier match, generate a token usable to authorize access to user account data associated with the user account or initiate transactions related to the user account,
wherein the permissions code is configured provide secure communications, to the computer system, of the first account identifier and the account credentials, and
wherein the first account identifier and the account credentials are not stored by the computing device operated by the user;

in response to determining that at least one of: the institution does not support a first fallback authorization mechanism, or the first fallback authorization mechanism failed:
initiate a second fallback authorization mechanism;
initiate one or more authorization transactions to the user account using the first account identifier and an institution identifier associated with the institution; and
verify the one or more authorization transactions; and

in response to verifying the one or more authorization transactions, generate a token usable to authorize access to the user account data associated with the user account or initiate transactions related to the user account.

2. The computer system of claim 1 , wherein the one or more processors are configured to execute the program instructions to further cause the computer system to:
receive, from the computing device operated by the user, a first institution identifier associated with the institution; and
access a second institution identifier associated with the institution through at least one of: the API associated with the institution, or a database of institution identifiers,
wherein generating the token is performed further in response to determining that the first institution identifier and the second institution identifier match.

3. The computer system of claim 1 , wherein the one or more processors are configured to execute the program instructions to further cause the computer system to:
further in response to determining that the first account identifier and the second account identifier match, access user account information associated with the user account through at least the API associated with the institution.

4. The computer system of claim 1 , wherein the one or more user interfaces are further configured to receive, from the user, at least:
an indication of the institution, and
the account credentials associated with the user account.

5. The computer system of claim 1 , wherein the one or more processors are configured to execute the program instructions to further cause the computer system to:
instantiate a simulated instance of a software application associated with the institution and configured to communicate with a computing device associated with the institution through the API associated with the institution, wherein accessing the second account identifier is performed through the simulated instance of the software application and the API associated with the institution and using the account credentials.

6. The computer system of claim 1 , wherein the second account identifier is accessed through extraction of the second account identifier from a document accessed through the API associated with the institution.

7. The computer system of claim 1 , wherein the one or more processors are configured to execute the program instructions to further cause the computer system to:
receive the institution identifier associated with the institution from at least one of: the computing device operated by the user, or a database of institution identifiers.

8. The computer system of claim 7 , wherein the one or more user interfaces are further configured to receive, from the user, at least: the institution identifier.

9. The computer system of claim 8 , wherein the one or more processors are configured to execute the program instructions to further cause the computer system to:
verify the one or more authorization transactions based on one or more authorization parameters associated with the one or more authorization transactions,
wherein the one or more authorization parameters include at least one of: transaction type, transaction description, transaction amount, transaction identifier, datestamps, timestamps, source, or other transaction metadata.

10. The computer system of claim 9 , wherein the one or more processors are configured to execute the program instructions to further cause the computer system to:
automatically verify the one or more authorization transactions without additional user input, wherein automatically verifying the one or more authorization transactions comprises:
accessing, from the user account data associated with the user account, a first one or more authorization parameters associated with the one or more authorization transactions through the at least an API associated with the institution and using the account credentials; and
comparing the first one or more authorization parameters with a second one or more authorization parameters associated with the one or more authorization transactions to determine that the first one or more authorization parameters and the second one or more authorization parameters match, wherein the second one or more authorization parameters are stored by the computer system upon initiating the one or more authorization transactions.

11. The computer system of claim 10 , wherein the one or more processors are configured to execute the program instructions to further cause the computer system to:
in response to initiating the one or more authorization transactions, and before verifying the one or more authorization transactions, generate an interim token.

12. The computer system of claim 1 , wherein the one or more processors are configured to execute the program instructions to further cause the computer system to:
in response to determining that at least one of: the institution does not support the second fallback authorization mechanism, or the second fallback authorization mechanism failed:
initiate a third fallback authorization mechanism;
if not already initiated, initiate one or more authorization transactions to the user account using the first account identifier and the institution identifier associated with the institution;
receive a first one or more authorization parameters from the computing device operated by the user; and
verify the one or more authorization transactions based at least in part on the first one or more authorization parameters; and

in response to verifying the one or more authorization transactions, generate a token usable to authorize access to user account data associated with the user account or initiate transactions related to the user account.

13. The computer system of claim 12 , wh

Assignees

• Plaid Inc

Inventors

• Pate Jason
• Bernasconi Paolo
• Dudek Jan
• Avron Riley
• Johnson Maxwell
• Kansal Sattvik
• Hockey William
• Hidebrandt Alexis

Classifications

• G06F9/455

  Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines · CPC title

• G06F21/44

  Program or device authentication · CPC title

• H04L63/0853

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title

• G06F21/45

  Structures or tools for the administration of authentication · CPC title

• H04L63/102 Primary

  Entity profiles · CPC title