# US 12,135,806 B2 · Token generation and management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,135,806 B2 - Document ID: US12135806B2 - Status: Granted - Kind: B2 - Application number: 18/184,340 - Filed: 2023-03-15 - Published: 2023-09-21 - Granted: 2024-11-05 - Earliest claimed: 2022-03-16 - Assignees: UserClouds, Inc. - Applicants: UserClouds, Inc. - Inventors: Vladimir Fedorov; Stephen Garrity; Ramanujan Srinivasan - Web page: https://patentgrep.com/patent/US12135806B2 ## CPC - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - H04L 63/105: {Multiple levels of security} - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Token generation and management are disclosed, including: generating a token corresponding to a set of user data based at least in part on a token generation policy; storing a mapping between the token and the set of user data; and determining whether to grant a token resolution request associated with the token based at least in part on a token access policy associated with the token and a context parameter associated with the token resolution request. ## Claims ### Claim 1 A system, comprising: a memory; and a processor coupled to the memory and configured to: generate a token corresponding to a set of user data based at least in part on a token generation policy, wherein to generate the token comprises to add a predetermined value within the token; store a mapping between the token and the set of user data; determine whether to grant a token resolution request associated with the token based at least in part on a token access policy associated with the token and a context parameter associated with the token resolution request, wherein the context parameter is not included as an argument in the token resolution request, wherein to determine whether to grant the token resolution request comprises to: in response to receiving the token resolution request, dynamically determine the context parameter by querying a third-party server using a request parameter that is included in the token resolution request to determine a relationship between a requestor associated with the token resolution request and a principal associated with the set of user data; and determine whether the determined relationship matches a specified relationship for which the token is permitted to be resolved in accordance with the token access policy; receive a token deletion request comprising the predetermined value; and in response to a determination that the token comprises the predetermined value, cause the mapping to be associated with a post deletion access policy, wherein the post deletion access policy comprises an expiration date to be associated with the mapping. ### Claim 2 (depends on 1) The system of claim 1, wherein to generate the token comprises to preserve at least a portion of the set of user data in the token. ### Claim 3 (depends on 1) The system of claim 1, wherein to generate the token comprises to preserve a data format of the set of user data in the token. ### Claim 4 (depends on 1) The system of claim 1, wherein the mapping further comprises one or more of the following: a set of attributes associated with the set of user data, identifying information associated with the token generation policy, and identifying information associated with the token access policy. ### Claim 5 (depends on 1) The system of claim 1, wherein to store the mapping between the token and the set of user data comprises to: select a selected token store from a plurality of token stores located in a plurality of geographic locations; and store the mapping at the selected token store. ### Claim 6 (depends on 1) The system of claim 1, wherein the processor is further configured to: determine to grant the token resolution request; transform the set of user data based at least in part on the token access policy; and return the transformed set of user data. ### Claim 7 (depends on 1) The system of claim 1, wherein the processor is further configured to: receive a token lookup request comprising the set of user data; locate the mapping between the token and the set of user data in a token store; and return the token from the mapping. ### Claim 8 (depends on 1) The system of claim 1, wherein the processor is further configured to: determine that the expiration date has passed; and delete the mapping. ### Claim 9 (depends on 1) The system of claim 1, wherein the processor is further configured to: determine, from a token store, a set of mappings between tokens and sets of user data that have expired; and delete the set of mappings from the token store. ### Claim 10 A method, comprising: generating a token corresponding to a set of user data based at least in part on a token generation policy, wherein generating the token comprises adding a predetermined value within the token; storing a mapping between the token and the set of user data; determining whether to grant a token resolution request associated with the token based at least in part on a token access policy associated with the token and a context parameter associated with the token resolution request, wherein the context parameter is not included as an argument in the token resolution request, wherein determining whether to grant the token resolution request comprises: in response to receiving the token resolution request, dynamically determining the context parameter by querying a third-party server using a request parameter that is included in the token resolution request to determine a relationship between a requestor associated with the token resolution request and a principal associated with the set of user data; and determining whether the determined relationship matches a specified relationship for which the token is permitted to be resolved in accordance with the token access policy: receiving a token deletion request comprising the predetermined value; and in response to a determination that the token comprises the predetermined value, causing the mapping to be associated with a post deletion access policy, wherein the post deletion access policy comprises an expiration date to be associated with the mapping. ### Claim 11 (depends on 10) The method of claim 10, wherein generating the token comprises preserving at least a portion of the set of user data in the token. ### Claim 12 (depends on 10) The method of claim 10, wherein generating the token comprises preserving a data format of the set of user data in the token. ### Claim 13 (depends on 10) The method of claim 10, wherein the mapping further comprises one or more of the following: a set of attributes associated with the set of user data, identifying information associated with the token generation policy, and identifying information associated with the token access policy. ### Claim 14 (depends on 10) The method of claim 10, wherein storing the mapping between the token and the set of user data comprises: selecting a selected token store from a plurality of token stores located in a plurality of geographic locations; and storing the mapping at the selected token store. ### Claim 15 (depends on 10) The method of claim 10, further comprising: determining that the expiration date has passed; and deleting the mapping. ### Claim 16 A computer program product, the computer program product being embodied in a non-transitory computer readable medium and comprising computer instructions for: generating a token corresponding to a set of user data based at least in part on a token generation policy, wherein generating the token comprises adding a predetermined value within the token; storing a mapping between the token and the set of user data; determining whether to grant a token resolution request associated with the token based at least in part on a token access policy associated with the token and a context parameter associated with the token resolution request, wherein the context parameter is not included as an argument in the token resolution request, wherein determining whether to grant the token resolution request comprises: in response to receiving the token resolution request, dynamically determining the context parameter by querying a third-party server using a request parameter that is included in the token resolution request to determine a relationship between a requestor associated with the token resolution request and a principal associated with the set of user data; and determining whether the determined relationship matches a specified relationship for which the token is permitted to be resolved in accordance with the token access policy; receiving a token deletion request comprising the predetermined value; and in response to a determination that the token comprises the predetermined value, causing the mapping to be associated with a post deletion access policy, wherein the post deletion access policy comprises an expiration date to be associated with the mapping.