# US 10,372,938 B2 · Resource protection using tokenized information > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,372,938 B2 - Document ID: US10372938B2 - Status: Granted - Kind: B2 - Application number: 15/182,899 - Filed: 2016-06-15 - Published: 2016-10-06 - Granted: 2019-08-06 - Earliest claimed: 2015-06-15 - Assignees: Token Corporation - Applicants: Cointrust, Inc. - Inventors: Steve Kirsch - Web page: https://patentgrep.com/patent/US10372938B2 ## CPC - G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/102: {Entity profiles} - H04W 12/084: using delegated authorisation, e.g. open authorisation [OAuth] protocol - H04L 63/068: {using time-dependent keys, e.g. periodically changing keys (cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088)} - H04L 63/126: {the source of the received data} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A method of using tokens to securely process actions for protected resources may include receiving a request to activate a token associated with a resource with rules governing an action associated with the resource and a signature by a first computer system. The method may also include verifying the signature by the first computer system, and assigning a token identifier to the resource. The method may additionally include receiving the token identifier from a second computer system and a request to perform the action associated with the resource, and determining whether the rules governing the action have been met. The method may further include performing, based on a determination that the one or more rules governing the action have been met, the action associated with the resource. ## Claims ### Claim 1 A method of using tokens to securely process actions for protected resources, the method comprising: receiving, by a hardware processor at a server, a request to activate a token associated with a resource, wherein the request comprises: one or more rules governing an action associated with the resource, the one or more rules comprising: an indication of a computer system that is authorized to request that an action associated with a resource be performed; and characteristics that are specific to a transaction involving a first computer system and a second computer system; and a signature by the first computer system; verifying, at the server, the signature by the first computer system; assigning, at the server, a token identifier to the resource; receiving, at the server, and from the second computer system: the token identifier; and a request to perform the action associated with the resource; determining, by the hardware processor at the server, whether the one or more rules governing the action have been met, including verifying that the second computer system comprises the computer system that is authorized to request that the action associated with a resource be performed and verifying that the request to perform the action conforms with the characteristics that are specific to the transaction; and performing, by the hardware processor at the server, and based on a determination that the one or more rules governing the action have been met, the action associated with the resource. ### Claim 2 (depends on 1) The method of claim 1, wherein the request to activate the token further comprises the token identifier. ### Claim 3 (depends on 1) The method of claim 1, wherein the token comprises an output numerical string. ### Claim 4 (depends on 1) The method of claim 1, wherein the request to activate the token further comprises one or more actions that may be performed using the resource. ### Claim 5 (depends on 1) The method of claim 1, wherein the request to activate the token further comprises a public signature associated with the second computer system. ### Claim 6 (depends on 1) The method of claim 1, further comprising generating, by the server, the token identifier in response to receiving the request to activate the token. ### Claim 7 (depends on 1) The method of claim 1, further comprising storing, at the server, the token identifier, a reference to the resource, and the one or more rules governing the action associated with the resource as an entry in a data structure. ### Claim 8 A non-transitory, computer-readable medium comprising instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising: receiving, at a server, a request to activate a token associated with a resource, wherein the request comprises: one or more rules governing an action associated with the resource, the one or more rules comprising; an indication of a computer system that is authorized to request that an action associated with a resource be performed; and characteristics that are specific to a transaction involving a first computer system and a second computer system; and a signature by the first computer system; verifying, at the server, the signature by the first computer system; assigning, at the server, a token identifier to the resource; receiving, at the server, and from the second computer system: the token identifier; and a request to perform the action associated with the resource; determining whether the one or more rules governing the action have been met, including verifying that the second computer system comprises the computer system that is authorized to request that the action associated with a resource be performed and verifying that the request to perform the action conforms with the characteristics that are specific to the transaction; and performing, by the server, and based on a determination that the one or more rules governing the action have been met, the action associated with the resource. ### Claim 9 (depends on 8) The non-transitory, computer-readable medium according to claim 8, comprising additional instructions that cause the one or more processors to perform additional operations comprising: sending, by the server, the token identifier to the first computer system and not the second computer system. ### Claim 10 (depends on 8) The non-transitory, computer-readable medium according to claim 8, comprising additional instructions that cause the one or more processors to perform additional operations comprising: sending, by the server, the token identifier to the second computer system and not the first computer system. ### Claim 11 (depends on 8) The non-transitory, computer-readable medium according to claim 8, comprising additional instructions that cause the one or more processors to perform additional operations comprising: receiving, at the server, and from a second computer system, a signature by the second computer system; and verifying, at the server, the signature by the second computer system. ### Claim 12 (depends on 8) The non-transitory, computer-readable medium according to claim 8, wherein the resource comprises personal information of a user of the first computer system. ### Claim 13 (depends on 8) The non-transitory, computer-readable medium according to claim 8, wherein the resource comprises a physical asset owned by a user of the first computer system. ### Claim 14 (depends on 8) The non-transitory, computer-readable medium according to claim 8, wherein the one or more rules comprises a limitation on the an amount of the resource that may be affected by the action. ### Claim 15 A system comprising: one or more processors; and one or more memory devices comprising instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising: receiving, at a server, a request to activate a token associated with a resource, wherein the request comprises: one or more rules governing an action associated with the resource, the one or more rules comprising: an indication of a computer system that is authorized to request that an action associated with a resource be performed; and characteristics that are specific to a transaction involving a first computer system and a second computer system; and a signature by the first computer system; verifying, at the server, the signature by the first computer system; assigning, at the server, a token identifier to the resource; receiving, at the server, and from the second computer system: the token identifier; and a request to perform the action associated with the resource; determining whether the one or more rules governing the action have been met, including verifying that the second computer system comprises the computer system that is authorized to request that the action associated with a resource be performed and verifying that the request to perform the action conforms with the characteristics that are specific to the transaction; and performing, by the server, and based on a determination that the one or more rules governing the action have been met, the action associated with the resource. ### Claim 16 (depends on 15) The system of claim 15 wherein the one or more rules comprises a time window during which the action may be performed. ### Claim 17 (depends on 15) The system of claim 15 wherein the action associated with the resource comprises verifying that information provided by the second computer system about the resource is correct. ### Claim 18 (depends on 15) The system of claim 15 wherein the action associated with the resource comprises transferring at least a portion of the resource to a third computer system. ### Claim 19 (depends on 15) The system of claim 15 wherein the action associated with the resource comprises transmitting at least a portion of the resource to the second computer system. ### Claim 20 (depends on 15) The system of claim 15, wherein the one or more memory devices further comprise additional instructions that cause the one or more processors to perform additional operations comprising: determining that at least one of the one or more rules comprises a callout function with a web address; sending the callout function to the web address; and receiving a determination of whether the action can be performed from the web address.