# US 12,113,789 B2 · Multifactor authentication for information security within a metaverse

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,113,789 B2
- Document ID: US12113789B2
- Status: Granted
- Kind: B2
- Application number: 17/729,641
- Filed: 2022-04-26
- Published: 2023-10-26
- Granted: 2024-10-08
- Earliest claimed: 2022-04-26
- Assignees: Bank of America Corporation
- Applicants: Bank of America Corporation
- Inventors: Vinesh Premji Patel; Manu J. Kurian; Michael Robert Young
- Web page: https://patentgrep.com/patent/US12113789B2

## CPC

- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- G06F 3/011: {Arrangements for interaction with the human body, e.g. for user immersion in virtual reality (blind teaching G09B21/00)}
- G06F 3/017: {Gesture based interaction, e.g. based on a set of recognized hand gestures (interaction based on gestures traced on a digitiser G06F3/04883)}
- G06T 11/00: Two-dimensional [2D] image generation
- G06V 20/20: in augmented reality scenes
- G06V 40/11: {Hand-related biometrics; Hand pose recognition}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06T: IMAGE DATA PROCESSING OR GENERATION, IN GENERAL
- G06V: IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING

## Abstract

A device is configured to identify a physical location within a virtual environment for an avatar that is associated with a user and to obtain a first token from a token map based on the physical location within the virtual environment for the avatar that is associated with the user. The device is further configured to receive physical attribute information for the user in the real world and to obtain a second token from the token map based on the physical attribute information for the user in the real world. The device is further configured to generate an authentication token by combining the first token and the second token and to verify an identify of the user based on the authentication token.

## Claims

### Claim 1

An information security device, comprising:
a memory operable to store a token map, wherein:
the token map is configured to:
map physical locations within a virtual environment to tokens; and
map physical attributes and actions of users to tokens; and
each token is a unique alphanumeric value; and
a processor operably coupled to the memory, configured to:
identify a physical location within the virtual environment for an avatar that is associated with a first user;
obtain a first token from the token map based on the physical location within the virtual environment for the avatar that is associated with the first user;
receive physical attribute information for the first user in the real world;
obtain a second token from the token map based on the physical attribute information for the first user in the real world;
obtain a third token from the token map, wherein the third token is based at least in part upon a gesture that is an action performed by the first user in the real world;
generate an authentication token by combining the first token, the second token, and the third token; and
verify an identity of the first user based on the authentication token.

### Claim 2 (depends on 1)

The device of claim 1, wherein the physical attribute information comprises a biometric signal for the first user.

### Claim 3 (depends on 1)

The device of claim 1, wherein:
the token map is further configured to map gestures performed by avatars in the virtual environment with tokens;
the processor is further configured to:
identify a gesture performed by the avatar that is associated with the first user in the virtual environment; and
obtain a fourth token from the token map based on the gesture performed by the avatar associated with the first user in the virtual environment; and
generating the authentication token further comprises combining the fourth token with the first token, the second token, and the third token.

### Claim 4 (depends on 1)

The device of claim 1, wherein:
the processor is further configured to:
receive a user input indicating the gesture performed by the first user in the real world; and
obtain the third token from the token map based on the gesture performed by the first user in the real world.

### Claim 5 (depends on 1)

The device of claim 1, wherein verifying the identity of the first user based on the authentication token comprises:
sending the authentication token to a user device that is associated with the first user, wherein the user device is configured to generate a graphical representation of the authentication token.

### Claim 6 (depends on 1)

The device of claim 1, wherein verifying the identity of the first user based on the authentication token comprises:
sending the authentication token to a user device that is associated with a second user, wherein the user device is configured to verify the identity of the first user in response to determining that the authentication token matches an expected authentication token for the first user.

### Claim 7 (depends on 1)

The device of claim 1, wherein the processor is further configured to:
compare the authentication token to an expected authentication token for the first user;
verify the identity of the first user in response to determining that the authentication token matches the expected authentication token for the first user; and
output a message indicating the identity of the first user has been verified.

### Claim 8

An authentication method, comprising:
identifying a physical location within a virtual environment for an avatar that is associated with a first user;
obtaining a first token from a token map based on the physical location within the virtual environment for the avatar that is associated with the first user, wherein the token map is configured to:
map physical locations within the virtual environment to tokens; and
map physical attributes and actions of users to tokens; and
each token is a unique alphanumeric value;
receiving physical attribute information for the first user in the real world;
obtaining a second token from the token map based on the physical attribute information for the first user in the real world;
obtaining a third token from the token map, wherein the third token is based at least in part upon a gesture that is an action performed by the first user in the real world;
generating an authentication token by combining the first token, the second token, and the third token; and
verifying an identity of the first user based on the authentication token.

### Claim 9 (depends on 8)

The method of claim 8, wherein the physical attribute information comprises a biometric signal for the first user.

### Claim 10 (depends on 8)

The method of claim 8, further comprising:
identifying a gesture performed by the avatar that is associated with the first user in the virtual environment; and
obtaining a fourth token from the token map based on the gesture performed by the avatar associated with the first user in the virtual environment; and
wherein generating the authentication token further comprises combining the fourth token with the first token, the second token, and the third token.

### Claim 11 (depends on 8)

The method of claim 8, further comprising:
receiving a user input indicating the gesture performed by the first user in the real world; and
obtaining the third token from the token map based on the gesture performed by the first user in the real world.

### Claim 12 (depends on 8)

The method of claim 8, wherein verifying the identity of the first user based on the authentication token comprises:
sending the authentication token to a user device that is associated with the first user, wherein the user device is configured to generate a graphical representation of the authentication token.

### Claim 13 (depends on 8)

The method of claim 8, wherein verifying the identity of the first user based on the authentication token comprises:
sending the authentication token to a user device that is associated with a second user, wherein the user device is configured to verify the identity of the first user in response to determining that the authentication token matches an expected authentication token for the first user.

### Claim 14 (depends on 8)

The method of claim 8, further comprising:
comparing the authentication token to an expected authentication token for the first user;
verifying an identify of the first user in response to determining that the authentication token matches the expected authentication token for the first user; and
outputting a message indicating that the identity of the first user has been verified.

### Claim 15

A non-transitory computer-readable medium storing instructions that when executed by a processor cause the processor to:
identify a physical location within a virtual environment for an avatar that is associated with a first user;
obtain a first token from a token map based on the physical location within the virtual environment for the avatar that is associated with the first user, wherein the token map is configured to:
map physical locations within the virtual environment to tokens; and
map physical attributes and actions of users to tokens; and
each token is a unique alphanumeric value;
receive physical attribute information for the first user in the real world, wherein the physical attribute information comprises a biometric signal for the first user;
obtain a second token from the token map based on the physical attribute information for the first user in the real world;
obtain a third token from the token map, wherein the third token is based at least in part upon a gesture that is an action performed by the first user in the real world;
generate an authentication token by combining the first token, the second token, and the third token; and
verify an identity of the first user based on the authentication token.

### Claim 16 (depends on 15)

The non-transitory computer-readable medium of claim 15, further comprising instructions that when executed by the processor cause the processor to:
identify a gesture performed by the avatar that is associated with the first user in the virtual environment; and
obtain a fourth token from the token map based on the gesture performed by the avatar associated with the first user in the virtual environment; and
wherein generating the authentication token further comprises combining the fourth token with the first token, the second token, and the third token.

### Claim 17 (depends on 15)

The non-transitory computer-readable medium of claim 15, further comprising instructions that when executed by the processor cause the processor to:
receive a user input indicating the gesture performed by the first user in the real world;
obtain the third token from the token map based on the gesture performed by the first user in the real world.

### Claim 18 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein verifying the identity of the first user based on the authentication token comprises:
sending the authentication token to a user device that is associated with the first user, wherein the user device is configured to generate a graphical representation of the authentication token.

### Claim 19 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein verifying the identity of the first user based on the authentication token comprises:
sending the authentication token to a user device that is associated with a second user, wherein the user device is configured to verify the identity of the first user in response to determining that the authentication token matches an expected authentication token for the first user.

### Claim 20 (depends on 15)

The non-transitory computer-readable medium of claim 15, further comprising instructions that when executed by the processor cause the processor to:
compare the authentication token to an expected authentication token for the first user;
verify an identity of the first user in response to determining that the authentication token matches the expected authentication token for the first user; and
output a message indicating the identity of the first user has been verified.