# US 2019/0318115 A1 · System for efficient management of invalid access tokens > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0318115 A1 - Document ID: US20190318115A1 - Status: Published application - Kind: A1 - Application number: 16/382,157 - Filed: 2019-04-11 - Published: 2019-10-17 - Earliest claimed: 2018-04-11 - Assignees: Barclays Services Limited - Applicants: Obligated Services Limited - Inventors: Dickon Holt; Michael Forrest - Web page: https://patentgrep.com/patent/US20190318115A1 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06Q 20/40: Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists - G06F 21/45: Structures or tools for the administration of authentication - G06Q 20/3821: {Electronic credentials} - H04L 63/10: {for controlling access to devices or network resources} - G06F 21/1014: {to tokens} - G06F 2221/2129: Authenticate client device independently of the user - G06F 2221/2137: Time limited access, e.g. to a computer or data - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - H04L 63/123: {received data contents, e.g. message integrity} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A client system comprises processing circuitry configured to receive, from a user device, a first access request comprising a first instruction to access a protected resource; transmit a token request for an access token to be used for accessing the protected resource; and receive an access token in response to the token request, the access token having a corresponding time to expire. The client system comprises a token storage unit configured to store the access token. The processing circuitry is further configured to receive a rejection message indicating that the access token is not valid for receiving the protected resource; and store, at the token storage unit, an invalidation flag associated with the stored access token, in response to receiving the rejection message. ## Claims ### Claim 1 A computer-implemented method comprising: receiving, at a client system from a user device, a first access request comprising a first instruction to access a protected resource stored at a resource system; transmitting, from the client system to an authorisation system, a token request for an access token to be used for accessing the protected resource, in response to the first access request; receiving, at the client system, an access token in response to the token request, the access token having a corresponding time to expire indicative of a time at which the access token will not be valid for obtaining the protected resource from the resource system; storing the access token at a token storage unit of the client system; receiving a rejection message, at the client system, indicating that the access token is not valid for receiving the protected resource; and storing, at the token storage unit, an invalidation flag associated with the stored access token, in response to receiving the rejection message. ### Claim 2 (depends on 1) The computer-implemented method of claim 1 further comprising: transmitting the stored access token from the client system to the resource system and, in response, receiving the rejection message. ### Claim 3 (depends on 1) The computer-implemented method of claim 1 further comprising: determining that the stored access token is associated with the invalidation flag and, in response, preventing the stored access token from being transmitted to the resource system. ### Claim 4 (depends on 1) The computer-implemented method of claim 1 further comprising: in response to the token request, receiving and storing an expiry time indicator in association with the access token at token storage unit; wherein the expiry time indicator is indicative of a time at which the corresponding access token will not be valid. ### Claim 5 (depends on 4) The computer-implemented method of claim 4 wherein storing the invalidation flag comprises: setting the stored expiry time indicator associated with the access token to indicate a time that is before a current time. ### Claim 6 (depends on 4) The computer-implemented method according to claims 4 further comprising token storage maintenance steps performed at the client system comprising: comparing the time indicated by the stored expiry time indicator with a current time; deleting the access token corresponding with the stored access token, if the time indicated by the stored expiry time indicator is after the current time. ### Claim 7 (depends on 6) The computer-implemented method of claim 6 wherein the token storage maintenance steps are executed intermittently or according to a predetermined schedule. ### Claim 8 (depends on 7) The computer-implemented method of claim 7 wherein the predetermined scheduled defines a time interval between adjacent executions of the token storage maintenance steps. ### Claim 9 (depends on 1) The computer-implemented method of claim 1 further comprising: receiving, at the client system, a refresh token corresponding to the access token, wherein the refresh token is for use in obtaining a valid access token at the client system; and storing the refresh token at the token storage unit. ### Claim 10 (depends on 9) The computer-implemented method of claim 9 further comprising, receiving a rejection message, at the client system, indicating that the refresh token is not valid for obtaining a valid access token; and storing, at the token storage unit, an invalidation flag associated with the stored refresh token. ### Claim 11 (depends on 10) The computer-implemented method of claim 10 further comprising: determining that the stored refresh token is associated with the invalidation flag and, in response, preventing the stored refresh token from being transmitted to the authorisation system. ### Claim 12 (depends on 11) The computer-implemented method of claim 11 wherein storing the invalidation flag comprises: setting the stored expiry time indicator associated with the refresh token to indicate a time that is before a current time. ### Claim 13 (depends on 11) The computer-implemented method of claim 11 further comprising token storage maintenance steps performed at the client system comprising: comparing the time indicated by the stored expiry time indicator with a current time; deleting the refresh token corresponding with the stored if the time indicated by the stored expiry time indicator is after the current time ### Claim 14 (depends on 13) The computer-implemented method of claim 13 wherein the token storage maintenance steps are executed intermittently or according to a predetermined schedule. ### Claim 15 (depends on 14) The computer-implemented method of claim 14 wherein the predetermined scheduled defines a time interval between adjacent executions of the token storage maintenance steps. ### Claim 16 A computer program comprising instructions which, when the program is executed by a computer, cause the computer to carry out the method of: receiving, at a client system from a user device, a first access request comprising a first instruction to access a protected resource stored at a resource system; transmitting, from the client system to an authorisation system, a token request for an access token to be used for accessing the protected resource, in response to the first access request; receiving, at the client system, an access token in response to the token request, the access token having a corresponding time to expire indicative of a time at which the access token will not be valid for obtaining the protected resource from the resource system; storing the access token at a token storage unit of the client system; receiving a rejection message, at the client system, indicating that the access token is not valid for receiving the protected resource; and storing, at the token storage unit, an invalidation flag associated with the stored access token, in response to receiving the rejection message. ### Claim 17 (depends on 16) A data carrier signal carrying the computer program of claim 16. ### Claim 18 A computer readable medium comprising instructions which, when executed by a computer, cause the computer to carry out the method of: receiving, at a client system from a user device, a first access request comprising a first instruction to access a protected resource stored at a resource system; transmitting, from the client system to an authorisation system, a token request for an access token to be used for accessing the protected resource, in response to the first access request; receiving, at the client system, an access token in response to the token request, the access token having a corresponding time to expire indicative of a time at which the access token will not be valid for obtaining the protected resource from the resource system; storing the access token at a token storage unit of the client system; receiving a rejection message, at the client system, indicating that the access token is not valid for receiving the protected resource; and storing, at the token storage unit, an invalidation flag associated with the stored access token, in response to receiving the rejection message. ### Claim 19 A client system comprising processing circuitry configured to: receive, from a user device, a first access request comprising a first instruction to access a protected resource stored at a resource system; transmit, to an authorisation system, a token request for an access token to be used for accessing the protected resource, in response to the first access request; and receive, at the client system, an access token in response to the token request, the access token having a corresponding time to expire indicative of a time at which the access token will not be valid for obtaining the protected resource from the resource system; wherein the client system comprises a token storage unit configured to store the access token; and the processing circuitry is further configured to: receive a rejection message, at the client system, indicating that the access token is not valid for receiving the protected resource; and store, at the token storage unit, an invalidation flag associated with the stored access token, in response to receiving the rejection message. ### Claim 20 A client system comprising: a receiver configured to receive, from a user device, a first access request comprising a first instruction to access a protected resource stored at a resource system; a transmitter configured to transmit, to an authorisation system, a token request for an access token to be used for accessing the protected resource, in response to the first access request; wherein the receiver is configured to receive an access token in response to the token request, the access token having a corresponding time to expire indicative of a time at which the access token will not be valid for obtaining the protected resource from the resource system; wherein the client system further comprises a token storage unit configured to store the access token; the receiver configured to receive a rejection message, at the client system, indicating that the access token is not valid for receiving the protected resource; and the token storage unit configured to store an invalidation flag associated with the stored access token, in response to receiving the rejection message.