# US 2018/0026960 A1 · Preventing Unauthorized Access to Secured Information Systems Using Tokenized Authentication Techniques

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2018/0026960 A1
- Document ID: US20180026960A1
- Status: Published application
- Kind: A1
- Application number: 15/214,972
- Filed: 2016-07-20
- Published: 2018-01-25
- Earliest claimed: 2016-07-20
- Assignees: Bank of America Corporation
- Applicants: Bank of America Corporation
- Inventors: Elizabeth S. Votaw; Andrew T. Keys; Ashish Arora
- Web page: https://patentgrep.com/patent/US20180026960A1

## CPC

- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 63/0815: {providing single-sign-on or federations}
- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity}
- H04L 63/102: {Entity profiles}
- H04L 2463/082: applying multi-factor authentication
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A computing platform may receive, from a client portal server, a request to authenticate a user to a user account associated with a client portal provided by the client portal server. Based on receiving the request to authenticate, the computing platform may send, to a social messaging server, an authentication token request message. Subsequently, the computing platform may receive, from the social messaging server, an authentication token. Thereafter, the computing platform may validate the authentication token received from the social messaging server. Based on validating the authentication token received from the social messaging server, the computing platform may generate a validation message directing the client portal server to provide the user with access to the user account. Subsequently, the computing platform may send, to the client portal server, the validation message directing the client portal server to provide the user with access to the user account.

## Claims

### Claim 1

A computing platform, comprising:
at least one processor;
a communication interface communicatively coupled to the at least one processor; and
memory storing computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
receive, via the communication interface, and from a client portal server, a request to authenticate a first user to a first user account associated with a client portal provided by the client portal server;
based on receiving the request to authenticate the first user to the first user account associated with the client portal provided by the client portal server, send, via the communication interface, and to a social messaging server, a first authentication token request message;
receive, via the communication interface, and from the social messaging server, a first authentication token;
validate the first authentication token received from the social messaging server;
based on validating the first authentication token received from the social messaging server, generate a first validation message directing the client portal server to provide the first user with access to the first user account; and
send, via the communication interface, and to the client portal server, the first validation message directing the client portal server to provide the first user with access to the first user account.

### Claim 2 (depends on 1)

The computing platform of claim 1, wherein the request to authenticate the first user to the first user account associated with the client portal provided by the client portal server comprises information indicating that a first tokenized link included in a notification generated by the client portal server and sent via a social messaging service provided by the social messaging server has been selected.

### Claim 3 (depends on 2)

The computing platform of claim 2, wherein the first tokenized link comprises a unique identifier linked to the first user account associated with the client portal provided by the client portal server and a first interface of the client portal provided by the client portal server.

### Claim 4 (depends on 2)

The computing platform of claim 2, wherein the first authentication token request message comprises information identifying a first social messaging service account associated with the social messaging service provided by the social messaging server.

### Claim 5 (depends on 4)

The computing platform of claim 4, wherein the first authentication token received from the social messaging server comprises information indicating that the first user is authenticated to the first social messaging service account associated with the social messaging service provided by the social messaging server.

### Claim 6 (depends on 5)

The computing platform of claim 5, wherein the first validation message directing the client portal server to provide the first user with access to the first user account comprises information indicating that the first user has been authenticated to the first user account based on the first authentication token received from the social messaging server.

### Claim 7 (depends on 5)

The computing platform of claim 5, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
prior to generating the first validation message directing the client portal server to provide the first user with access to the first user account:
generate a first step-up authentication prompt for a first registered client computing device linked to the first user account;
send, via the communication interface, and to the first registered client computing device linked to the first user account, the first step-up authentication prompt generated for the first registered client computing device linked to the first user account; and
validate a first response to the first step-up authentication prompt generated for the first registered client computing device linked to the first user account,
wherein the first validation message directing the client portal server to provide the first user with access to the first user account is generated based on validating the first response to the first step-up authentication prompt generated for the first registered client computing device linked to the first user account.

### Claim 8 (depends on 5)

The computing platform of claim 5, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
receive, via the communication interface, and from the client portal server, a request to authenticate a second user to a second user account associated with the client portal provided by the client portal server;
based on receiving the request to authenticate the second user to the second user account associated with the client portal provided by the client portal server, send, via the communication interface, and to the social messaging server, a second authentication token request message;
receive, via the communication interface, and from the social messaging server, a second authentication token;
validate the second authentication token received from the social messaging server;
based on validating the second authentication token received from the social messaging server, generate a second validation message directing the client portal server to provide the second user with access to the second user account; and
send, via the communication interface, and to the client portal server, the second validation message directing the client portal server to provide the second user with access to the second user account.

### Claim 9 (depends on 8)

The computing platform of claim 8, wherein the request to authenticate the second user to the second user account associated with the client portal provided by the client portal server comprises information indicating that a second tokenized link included in a notification generated by the client portal server and sent via the social messaging service provided by the social messaging server has been selected.

### Claim 10 (depends on 9)

The computing platform of claim 9, wherein the second tokenized link comprises a unique identifier linked to the second user account associated with the client portal provided by the client portal server and a second interface of the client portal provided by the client portal server.

### Claim 11 (depends on 9)

The computing platform of claim 9, wherein the second authentication token request message comprises information identifying a second social messaging service account associated with the social messaging service provided by the social messaging server.

### Claim 12 (depends on 11)

The computing platform of claim 11, wherein the second authentication token received from the social messaging server comprises information indicating that the second user is authenticated to the second social messaging service account associated with the social messaging service provided by the social messaging server.

### Claim 13 (depends on 12)

The computing platform of claim 12, wherein the second validation message directing the client portal server to provide the second user with access to the second user account comprises information indicating that the second user has been authenticated to the second user account based on the second authentication token received from the social messaging server.

### Claim 14 (depends on 12)

The computing platform of claim 12, wherein the memory stores additional computer-readable instructions that, when executed by the at least one processor, cause the computing platform to:
prior to generating the second validation message directing the client portal server to provide the second user with access to the second user account:
generate a second step-up authentication prompt for a second registered client computing device linked to the second user account;
send, via the communication interface, and to the second registered client computing device linked to the second user account, the second step-up authentication prompt generated for the second registered client computing device linked to the second user account; and
validate a second response to the second step-up authentication prompt generated for the second registered client computing device linked to the second user account,
wherein the second validation message directing the client portal server to provide the second user with access to the second user account is generated based on validating the second response to the second step-up authentication prompt generated for the second registered client computing device linked to the second user account.

### Claim 15

A method, comprising:
at a computing platform comprising at least one processor, memory, and a communication interface:
receiving, by the at least one processor, via the communication interface, and from a client portal server, a request to authenticate a first user to a first user account associated with a client portal provided by the client portal server;
based on receiving the request to authenticate the first user to the first user account associated with the client portal provided by the client portal server, sending, by the at least one processor, via the communication interface, and to a social messaging server, a first authentication token request message;
receiving, by the at least one processor, via the communication interface, and from the social messaging server, a first authentication token;
validating, by the at least one processor, the first authentication token received from the social messaging server;
based on validating the first authentication token received from the social messaging server, generating, by the at least one processor, a first validation message directing the client portal server to provide the first user with access to the first user account; and
sending, by the at least one processor, via the communication interface, and to the client portal server, the first validation message directing the client portal server to provide the first user with access to the first user account.

### Claim 16 (depends on 15)

The method of claim 15, wherein the request to authenticate the first user to the first user account associated with the client portal provided by the client portal server comprises information indicating that a first tokenized link included in a notification generated by the client portal server and sent via a social messaging service provided by the social messaging server has been selected.

### Claim 17 (depends on 16)

The method of claim 16, wherein the first tokenized link comprises a unique identifier linked to the first user account associated with the client portal provided by the client portal server and a first interface of the client portal provided by the client portal server.

### Claim 18 (depends on 16)

The method of claim 16, wherein the first authentication token request message comprises information identifying a first social messaging service account associated with the social messaging service provided by the social messaging server.

### Claim 19 (depends on 18)

The method of claim 18, wherein the first authentication token received from the social messaging server comprises information indicating that the first user is authenticated to the first social messaging service account associated with the social messaging service provided by the social messaging server.

### Claim 20

One or more non-transitory computer-readable media storing instructions that, when executed by a computing platform comprising at least one processor, memory, and a communication interface, cause the computing platform to:
receive, via the communication interface, and from a client portal server, a request to authenticate a first user to a first user account associated with a client portal provided by the client portal server;
based on receiving the request to authenticate the first user to the first user account associated with the client portal provided by the client portal server, send, via the communication interface, and to a social messaging server, a first authentication token request message;
receive, via the communication interface, and from the social messaging server, a first authentication token;
validate the first authentication token received from the social messaging server;
based on validating the first authentication token received from the social messaging server, generate a first validation message directing the client portal server to provide the first user with access to the first user account; and
send, via the communication interface, and to the client portal server, the first validation message directing the client portal server to provide the first user with access to the first user account.