False positive reduction in electronic token forgery detection

A system, comprising:

• hardware processing circuitry;
• one or more hardware memories comprising instructions that when executed configure the hardware processing circuitry to perform operations comprising:
• receiving a plurality of notifications, each notification indicating issuance of a token, wherein an issuer of each security token is a first security token issuing authority;
• decoding, from the plurality of notifications, a corresponding plurality of token sequence numbers;
• determining, from the plurality of notifications, a rate of change of the plurality of token sequence numbers, the rate of change indicating a number of increments or decrements of a baseline sequence number that occur per unit time, the increments or decrements increase or decrease the baseline sequence number by a determinable amount;
• receiving a first security token at a first time;
• determining an issuer of the first security token is the first security token issuing authority;
• determining a digital signature of the first security token is valid;
• determining the first security token issuing authority is offline;
• responsive to determining the first security token issuing authority is offline, determining, based on the first time and the rate of change, a token sequence number confidence interval of the first security token issuing authority;
• determining a token sequence number included in the first security token is within the token sequence number confidence interval;
• and
• validating the first security token based on determining the token sequence number included in the first security token is within the token sequence number confidence interval.

A non-transitory computer readable storage medium comprising instructions that when executed configure hardware processing circuitry to perform operations comprising:

• receiving a plurality of notifications, each notification indicating issuance of a token, wherein an issuer of each security token is a first security token issuing authority;
• decoding, from the plurality of notifications, a corresponding plurality of token sequence numbers;
• determining, from the plurality of notifications, a rate of change of the plurality of token sequence numbers, the rate of change indicating a number of increments or decrements of a baseline sequence number that occur per unit time, the increments or decrements increase or decrease the baseline sequence number by a determinable amount;
• receiving a first security token at a first time;
• determining the first security token is issued by the first security token issuing authority;
• determining a digital signature of the first security token is valid;
• determining the first security token issuing authority is offline;
• responsive to determining the first security token issuing authority is offline, determining, based on the first time and the rate of change, a token sequence number confidence interval of the first security token issuing authority;
• determining a token sequence number included in the first security token is within the token sequence number confidence interval;
• and
• validating the first security token based on determining the token sequence number included in the first security token is within the token sequence number confidence interval.