# US 11,451,396 B2 · False positive reduction in electronic token forgery detection

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,451,396 B2
- Document ID: US11451396B2
- Status: Granted
- Kind: B2
- Application number: 16/674,699
- Filed: 2019-11-05
- Published: 2021-05-06
- Granted: 2022-09-20
- Earliest claimed: 2019-11-05
- Assignees: Microsoft Technology Licensing, LLC
- Applicants: Microsoft Technology Licensing, LLC
- Inventors: Bryan R. Jeffrey; Craig Gordon Lockwood; Reeves Hoppe Briggs
- Web page: https://patentgrep.com/patent/US11451396B2

## CPC

- H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)}
- H04L 63/105: {Multiple levels of security}
- H04L 9/002: {Countermeasures against attacks on cryptographic mechanisms (network architectures or network communication protocols for protection against malicious traffic H04L63/1441)}
- H04L 9/3247: {involving digital signatures}
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04L 63/126: {the source of the received data}
- H04L 63/0815: {providing single-sign-on or federations}
- H04L 63/1483: {service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Disclosed embodiments provide for detection of fraudulent electronic security tokens. A compromised private key allows forgery of electronic security tokens, which then allow access to computer resources. Some embodiments track sequence numbers issued by a token issuing authority and are then able to predict sequence numbers issued by the token issuing authority going forward. Some embodiments also determine validity of a token based, at least in part, on a service or client attempting to access resources using the token. For example, some of the disclosed embodiments maintain reputation data for clients or services utilizing electronic tokens, and make determinations on whether a token is likely valid based on the client or services reputation.

## Claims

### Claim 1

A method performed by hardware processing circuitry, comprising:
receiving a plurality of notifications, each notification indicating issuance of a security token, wherein an issuer of each security token is a first token issuing authority;
decoding, from the plurality of notifications, a corresponding plurality of token sequence numbers;
determining, from the plurality of notifications, a rate of change of the plurality of token sequence numbers, the rate of change indicating a number of increments or decrements of a baseline sequence number that occur per unit time, the increments or decrements increase or decrease the baseline sequence number by a determinable amount;
receiving a first security token at a first time;
determining an issuer of the first security token is the first token issuing authority;
determining a digital signature of the first security token is valid;
determining the first token issuing authority is offline;
responsive to determining the first token issuing authority is offline, determining, based on the first time and the rate of change, a token sequence number confidence interval of the first security token issuing authority;
determining a token sequence number included in the first security token is within the token sequence number confidence interval; and
validating the first security token based on determining the token sequence number included in the first security token is within the token sequence number confidence interval.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
determining a second security token issuing authority is offline during a first time period;
receiving a second security token during a second time period;
determining an issuer of the second security token is the second security token issuing authority; and
validating the second security token.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
receiving a third security token from a first service;
determining a validation rate of tokens received from the first service meets a criterion; and
validating the third security token based on the determining the validation rate of tokens received from the first service meets the criterion.

### Claim 4 (depends on 3)

The method of claim 3, wherein the first security token is received from a second service, the method further comprising:
storing an indication of an association between the validation of the first security token and the second service;
determining, based on the stored indication, a validation rate of tokens received from the second service; and
validating a fourth security token based on the validation rate of tokens received from the second service.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
receiving a second security token at a second time;
validating a second digital signature of the second security token;
determining a second token sequence number of the second security token;
determining, based on the second time and the rate of change, a second range of token sequence numbers;
determining the second token sequence number is outside the determined second range; and
generating, based on the determining the second token sequence number is outside the determined second range, a notification indicating the first token issuing authority's private key is compromised.

### Claim 6 (depends on 5)

The method of claim 5, further comprising:
receiving a third security token from a service;
determining a validation rate of tokens received from the service meets a criterion;
determining an issuer of the third security token is a second security token issuing authority; and
generating, based on the determining the issuer of the third security token is a second security token issuing authority, a notification indicating the second security token issuing authority's private key is compromised.

### Claim 7 (depends on 1)

The method of claim 1, further comprising determining a percentage of valid tokens indicating an issuer of the respective valid token is the first token issuing authority, wherein the determining of the token sequence number confidence interval is in response to the percentage meeting a criterion.

### Claim 8

A system, comprising:
hardware processing circuitry;
one or more hardware memories comprising instructions that when executed configure the hardware processing circuitry to perform operations comprising:
receiving a plurality of notifications, each notification indicating issuance of a token, wherein an issuer of each security token is a first security token issuing authority;
decoding, from the plurality of notifications, a corresponding plurality of token sequence numbers;
determining, from the plurality of notifications, a rate of change of the plurality of token sequence numbers, the rate of change indicating a number of increments or decrements of a baseline sequence number that occur per unit time, the increments or decrements increase or decrease the baseline sequence number by a determinable amount;
receiving a first security token at a first time;
determining an issuer of the first security token is the first security token issuing authority;
determining a digital signature of the first security token is valid;
determining the first security token issuing authority is offline;
responsive to determining the first security token issuing authority is offline, determining, based on the first time and the rate of change, a token sequence number confidence interval of the first security token issuing authority;
determining a token sequence number included in the first security token is within the token sequence number confidence interval; and
validating the first security token based on determining the token sequence number included in the first security token is within the token sequence number confidence interval.

### Claim 9 (depends on 8)

The system of claim 8, the operations further comprising:
determining a second security token issuing authority is offline during a first time period;
receiving a second security token during a second time period,
determining an issuer of the second security token is the second security token issuing authority; and
validating the second security token.

### Claim 10 (depends on 8)

The system of claim 8, the operations further comprising:
receiving a third security token from a first service;
determining a validation rate of tokens received from the first service meets a criterion; and
validating the third security token based on the determining the validation rate of tokens received from the first service meets the criterion.

### Claim 11 (depends on 10)

The system of claim 10, wherein the first security token is received from a second service, the operations further comprising:
storing an indication of an association between the validation of the first security token and the second service;
determining, based on the stored indication, a validation rate of tokens received from the second service; and
validating a fourth security token based on the validation rate of tokens received from the second service.

### Claim 12 (depends on 8)

The system of claim 8, the operations further comprising:
receiving a second security token at a second time;
validating a second digital signature of the second security token;
determining a second token sequence number of the second security token;
determining, based on the second time and the rate of change, a second range of token sequence numbers;
determining the second token sequence number is outside the determined second range; and
generating, based on the determining the second token sequence number is outside the determined second range, a notification indicating the first security token issuing authority's private key is compromised.

### Claim 13 (depends on 12)

The system of claim 12, the operations further comprising:
receiving a third security token from a service;
determining a validation rate of tokens received from the service meets a criterion;
determining an issuer of the third security token is a second token issuing authority; and
generating, based on the determining the issuer of the third security token is a second token issuing authority, a notification indicating the second token issuing authority's private key is compromised.

### Claim 14 (depends on 8)

The system of claim 8, the operations further comprising determining a percentage of valid tokens indicating an issuer of the respective valid token is the first security token issuing authority, wherein the determining of the token sequence number confidence interval is in response to the percentage meeting a criterion.

### Claim 15

A non-transitory computer readable storage medium comprising instructions that when executed configure hardware processing circuitry to perform operations comprising:
receiving a plurality of notifications, each notification indicating issuance of a token, wherein an issuer of each security token is a first security token issuing authority;
decoding, from the plurality of notifications, a corresponding plurality of token sequence numbers;
determining, from the plurality of notifications, a rate of change of the plurality of token sequence numbers, the rate of change indicating a number of increments or decrements of a baseline sequence number that occur per unit time, the increments or decrements increase or decrease the baseline sequence number by a determinable amount;
receiving a first security token at a first time;
determining the first security token is issued by the first security token issuing authority;
determining a digital signature of the first security token is valid;
determining the first security token issuing authority is offline;
responsive to determining the first security token issuing authority is offline, determining, based on the first time and the rate of change, a token sequence number confidence interval of the first security token issuing authority;
determining a token sequence number included in the first security token is within the token sequence number confidence interval; and
validating the first security token based on determining the token sequence number included in the first security token is within the token sequence number confidence interval.

### Claim 16 (depends on 15)

The non-transitory computer readable storage medium of claim 15, further comprising:
determining a second security token issuing authority is offline during a first time period;
receiving a second security token during a second time period;
determining an issuer of the second security token is the second security token issuing authority; and
validating the second security token.

### Claim 17 (depends on 15)

The non-transitory computer readable storage medium of claim 15, further comprising:
receiving a third security token from a first service;
determining a validation rate of tokens received from the first service meets a criterion; and
validating the third security token based on the determining the validation rate of tokens received from the first service meets a criterion.

### Claim 18 (depends on 17)

The non-transitory computer readable storage medium of claim 17, wherein the first security token is received from a second service, the operations further comprising:
storing an indication of an association between the validation of the first security token and the second service;
determining, based on the stored indication, a validation rate of tokens received from the second service; and
validating a fourth security token based on the validation rate of tokens received from the second service.