# US 12,182,247 B1 · Systems and methods for authentication of physical access tokens at access terminals > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,182,247 B1 - Document ID: US12182247B1 - Status: Granted - Kind: B1 - Application number: 18/585,011 - Filed: 2024-02-22 - Granted: 2024-12-31 - Earliest claimed: 2024-02-22 - Applicants: Stanley Kevin Miles - Inventors: Stanley Kevin Miles - Web page: https://patentgrep.com/patent/US12182247B1 ## CPC - G06F 21/34: involving the use of external additional devices, e.g. dongles or smart cards - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract In certain embodiments, a physical network access token at a network access terminal may be authenticated for modification of records at a remote server system. In some embodiments, a set of records and counterpart records having the same record identifiers and resource amounts may be stored independently on a physical token or user device and the remote server system. When a connection is established between an access terminal and the physical token (e.g., for authenticating a modification of record(s)), the access terminal may transmit input data to the token, which may use the input data with the records stored on the token to generate authentication data, which may be used by the remote server to authenticate a network action requested via the token. ## Claims ### Claim 1 A stored value card for facilitating authentication at a network access terminal for modification of network records at a remote server system to prevent malicious or unauthorized access to associated resources, the stored value card comprising: one or more processors and non-transitory computer-readable media comprising instructions that, when executed by the one or more processors, cause operations comprising: responsive to establishing a connection with the network access terminal, accessing a set of records stored at the stored value card, the set of records being associated with a user and including a first record comprising (a) a record identifier identifying the first record of the user and (b) a resource amount balance of the first record of the user, wherein the record identifier and resource amount balance of the first record are a same record identifier and resource amount balance of a first counterpart record of a set of counterpart records stored at the remote server system; receiving, from the network access terminal, input data comprising a random seed value and a requested resource amount; responsive to receiving the input data, transmitting authentication data to the network access terminal, wherein the authentication data is generated based on (i) the random seed value, (ii) the requested resource amount, and (iii) the resource amount balance of the first record and other data of the set of records stored at the stored value card; and updating the set of records to reflect a transfer corresponding to the requested resource amount by generating and storing, at the stored value card, a new record that (i) is a modified version of the first record and (ii) comprises a resource amount balance and a record identifier different from the record identifier of the first counterpart record. ### Claim 2 (depends on 1) The stored value card of claim 1, wherein generating the authentication data comprises: hashing a combination of respective record identifiers and resource amount balances of two or more records of the set of records stored at the stored value card, the random seed value, and the requested resource amount to obtain a hash value; and encrypting the hash value using a private key associated with the user. ### Claim 3 (depends on 1) The stored value card of claim 1, wherein the record identifier of the new record is based on an output generated by inputting a combination of (i) a secret key stored at the remote server system and the stored value card, (ii) a time associated with an establishment of connection to the stored value card, and (iii) the record identifier of the first record into a hash-based message authentication code (HMAC) algorithm. ### Claim 4 (depends on 1) The stored value card of claim 1, wherein, in connection to verification of the authentication data, the remote server system is configured to update the set of counterpart records to reflect a transfer corresponding to the requested resource amount by generating a new counterpart record that (i) is a modified version of the first counterpart record and (ii) comprises a resource amount balance and a record identifier (a) different from the record identifier of the first counterpart record and (b) the same as the record identifier of the new record stored at the stored value card. ### Claim 5 A method comprising: storing, at a stored value card, a set of records associated with a user including a first record comprising (a) a record identifier identifying the first record of the user and (b) a resource amount balance of the first record of the user, wherein the record identifier and resource amount balance of the first record are a same record identifier and resource amount balance of a first counterpart record of a set of counterpart records stored at a remote server system; receiving, by the stored value card, from an access terminal, input data comprising a random seed value and a requested resource amount; transmitting, by the stored value card, based on the input data, authentication data to the access terminal, wherein the authentication data is generated based on (i) the random seed value, (ii) the requested resource amount, and (iii) the resource amount balance of the first record and other data of the set of records stored at the stored value card; and updating, by the stored value card, the set of records to reflect a transfer corresponding to the requested resource amount by generating a new record that (i) is a modified instance of the first record and (ii) comprises a resource amount balance and a record identifier different from the record identifier of the first counterpart record. ### Claim 6 (depends on 5) The method of claim 5, further comprising storing, at the stored value card, a hash-based value generated based on a combination of inputs including data from the new record. ### Claim 7 (depends on 5) The method of claim 5, wherein generating the authentication data comprises: hashing a combination of (i) respective record identifiers and resource amounts of two or more records of the set of records stored at the stored value card, (ii) the random seed value, and (iii) the requested resource amount to obtain a hash value; and encrypting the hash value using a private key associated with the user. ### Claim 8 (depends on 5) The method of claim 5, wherein the record identifier of the new record is based on an output generated by inputting a combination of (i) a secret key stored at the remote server system and the stored value card, (ii) a time associated with an establishment of connection to the stored value card, or (iii) the record identifier of the first record into a hash-based message authentication code (HMAC) algorithm. ### Claim 9 (depends on 5) The method of claim 5, wherein, in connection to verification of the authentication data, the remote server system is configured to update the set of counterpart records to reflect a transfer corresponding to the requested resource amount by generating a new counterpart record that (i) is a modified instance of the first counterpart record and (ii) comprises a resource amount and a record identifier different from the record identifier of the first counterpart record. ### Claim 10 (depends on 9) The method of claim 9, further comprising mapping, to a primary identifier associated with the user, the record identifier of the first record as a previous state and mapping, to the primary identifier associated with the user, the record identifier of the new record as a current-state record. ### Claim 11 (depends on 10) The method of claim 10, further comprising: receiving a return request from the access terminal for returning resources associated with the first record, wherein the return request comprises the record identifier of the first record and the requested resource amount; identifying, based on the primary identifier, the new record as the current-state record; updating the set of records to reflect a return corresponding to the requested resource amount by generating a second new record that (i) is a modified instance of the new record and (ii) comprises a resource amount and a record identifier different from the record identifier of the new record; and mapping, to the primary identifier associated with the user, the record identifier of the new record as another previous state and mapping, to the primary identifier associated with the user, the record identifier of the second new record as a current-state record. ### Claim 12 (depends on 11) The method of claim 11, wherein, in connection with the return request, the remote server system generates a second new counterpart record that (i) is a modified instance of a new counterpart record and (ii) comprises a resource amount and a record identifier different from the record identifier of the new counterpart record. ### Claim 13 One or more non-transitory, computer-readable media comprising instructions that, when executed by one or more processors, cause operations comprising: accessing a set of records stored at a card, the set of records being associated with a user and including a first record comprising (a) a record identifier identifying the first record of the user and (b) a resource amount balance of the first record of the user, wherein the record identifier and resource amount balance of the first record are a same record identifier and resource amount balance of a first counterpart record of a set of counterpart records stored at a remote server system; receiving, from an access terminal, input data comprising a random seed value and a requested resource amount; transmitting, based on the input data, authentication data to the access terminal, wherein the authentication data is generated based on (i) the requested resource amount and (ii) the resource amount balance of the first record and other data of the set of records stored at the card; and updating the set of records to reflect a transfer corresponding to the requested resource amount by generating a new record that (i) is a modified instance of the first record and (ii) comprises a resource amount balance and a record identifier different from the record identifier of the first counterpart record. ### Claim 14 (depends on 13) The one or more non-transitory, computer-readable media of claim 13, wherein the instructions further cause operations comprising storing, at the card, a hash-based value generated based on a combination of inputs including data from the new record. ### Claim 15 (depends on 13) The one or more non-transitory, computer-readable media of claim 13, wherein generating the authentication data comprises: hashing a combination of (i) respective record identifiers and resource amounts of two or more records of the set of records stored at the card, (ii) the random seed value, and (iii) the requested resource amount to obtain a hash value; and encrypting the hash value using a private key associated with the user. ### Claim 16 (depends on 13) The one or more non-transitory, computer-readable media of claim 13, wherein the record identifier of the new record is based on an output generated by inputting a combination of (i) a secret key stored at the remote server system and the card, (ii) a time associated with an establishment of connection to the card, and (iii) the record identifier of the first record into a hash-based message authentication code (HMAC) algorithm. ### Claim 17 (depends on 13) The one or more non-transitory, computer-readable media of claim 13, wherein, in connection to verification of the authentication data, the remote server system is configured to update the set of counterpart records to reflect a transfer corresponding to the requested resource amount by generating a new counterpart record that (i) is a modified instance of the first counterpart record and (ii) comprises a resource amount and a record identifier different from the record identifier of the first counterpart record. ### Claim 18 (depends on 17) The one or more non-transitory, computer-readable media of claim 17, wherein the instructions further cause operations comprising mapping, to a primary identifier associated with the user, the record identifier of the first record as a previous state and mapping, to the primary identifier associated with the user, the record identifier of the new record as a current-state record. ### Claim 19 (depends on 18) The one or more non-transitory, computer-readable media of claim 18, wherein the instructions further cause operations comprising: receiving a return request from the access terminal for returning resources associated with the first record, wherein the return request comprises the record identifier of the first record and the requested resource amount; identifying, based on the primary identifier, the new record as the current-state record; updating the set of records to reflect a return corresponding to the requested resource amount by generating a second new record that (i) is a modified instance of the new record and (ii) comprises a resource amount and a record identifier different from the record identifier of the new record; and mapping, to the primary identifier associated with the user, the record identifier of the new record as another previous state and mapping, to the primary identifier associated with the user, the record identifier of the second new record as a current-state record. ### Claim 20 (depends on 19) The one or more non-transitory, computer-readable media of claim 19, wherein, in connection with the return request, the remote server system generates a second new counterpart record that (i) is a modified instance of a new counterpart record and (ii) comprises a resource amount and a record identifier different from the record identifier of the new counterpart record.