# US 2021/0243024 A1 · User Security Token Invalidation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243024 A1 - Document ID: US20210243024A1 - Status: Published application - Kind: A1 - Application number: 17/234,631 - Filed: 2021-04-19 - Published: 2021-08-05 - Earliest claimed: 2018-06-25 - Assignees: Elasticsearch B.V. - Applicants: Elasticsearch B.V. - Inventors: Jayesh Modi - Web page: https://patentgrep.com/patent/US20210243024A1 ## CPC - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 9/001: {using chaotic signals} - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/14: using a plurality of keys or algorithms - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Provided are methods and systems for invalidating user security tokens. An example method may include providing, by one or more nodes in a cluster, a list of revoked security tokens. The method may include receiving, by the one or more nodes, an indication of invalidating a user security token associated with a user device. The indication may include a request from the user to invalidate the user security token. The method may further include, in response to the receiving, adding, by the one or more nodes, the user security token to the list of revoked security tokens. The user security token can be added to the list of revoked security tokens prior to the expiration time of the user security token. The method may further include replicating, by the one or more nodes, the list of revoked security tokens between further nodes of the cluster. ## Claims ### Claim 1 A method for invalidating user security tokens, the method comprising: providing, by one or more nodes in a cluster, a list of revoked security tokens; receiving, by the one or more nodes, an indication of invalidating a user security token associated with a user; in response to the receiving, adding, by the one or more nodes, the user security token to the list of revoked security tokens, the user security token to the list of revoked security tokens, the user security token being encrypted using an authenticated encryption; and generating, by the one or more nodes, a key to be used for the authenticated encryption, the key being generated based on a shared secret between the one or more nodes of the cluster. ### Claim 2 (depends on 1) The method of claim 1, further comprising replicating, by the one or more nodes, the list of revoked security tokens between further nodes of the cluster. ### Claim 3 (depends on 1) The method of claim 1, wherein the indication of invalidating of the user security token includes a request from the user to invalidate the user security token. ### Claim 4 (depends on 1) The method of claim 1, wherein the user security token includes information regarding the user, an issue time of the user security token, and an expiration time of the user security token. ### Claim 5 (depends on 4) The method of claim 4, wherein the user security token is added to the list of revoked security tokens prior to the expiration time of the user security token. ### Claim 6 (depends on 4) The method of claim 4, further comprising: determining, by the one or more nodes, that the issue time precedes a predetermined time; and in response to the determination, adding, by the one or more nodes, the user security token to the list of revoked security tokens. ### Claim 7 (depends on 1) The method of claim 1, wherein generating, by the one or more nodes, a key to be used for the authenticated encryption occurs upon a restart of the cluster. ### Claim 8 (depends on 1) The method of claim 1, wherein the indication of invalidating of the user security token includes a request from an administrator of the cluster to invalidate the user security token. ### Claim 9 (depends on 1) The method of claim 1, wherein the indication of invalidating of the user security token is issued by one or more applications running on the cluster. ### Claim 10 (depends on 7) The method of claim 7, further comprising upon the restart of the cluster, invalidating, by the one or more nodes, previously issued user security tokens. ### Claim 11 A system for invalidating user security tokens, the system comprising a cluster including one or more nodes configured to: provide a list of revoked security tokens; receive an indication of invalidating a user security token associated with a user; in response to the receiving the indication, add, by the one or more nodes, the user security token to the list of revoked security tokens, the user security token to the list of revoked security tokens, the user security token being encrypted using an authenticated encryption; and generate, by the one or more nodes, a key to be used for the authenticated encryption, the key being generated based on a shared secret between the one or more nodes of the cluster. ### Claim 12 (depends on 11) The system of claim 11, wherein the one or more nodes are further configured to replicate the list of revoked security tokens between further nodes of the cluster. ### Claim 13 (depends on 11) The system of claim 11, wherein the indication of invalidating of the user security token includes a request from an administrator of the cluster to invalidate the user security token. ### Claim 14 (depends on 11) The system of claim 11, wherein the user security token includes information regarding the user, an issue time of the user security token, and expiration time of the user security token. ### Claim 15 (depends on 14) The system of claim 14, wherein the user security token is added to the list of revoked security tokens prior to the expiration time of the user security token. ### Claim 16 (depends on 14) The system of claim 14, wherein the one or more nodes is further configured to: determine that the issue time of the user security token precedes a predetermined time; and in response to the determination, add the user security token to the list of revoked security tokens. ### Claim 17 (depends on 11) The system of claim 11, wherein the generation, by the one or more nodes, of the key to be used for the authenticated encryption occurs upon a restart of the cluster. ### Claim 18 (depends on 11) The system of claim 11, wherein the indication of invalidating of the user security token is issued by one or more applications running on the cluster. ### Claim 19 (depends on 17) The system of claim 17, wherein, upon the restart of the cluster, the one or more nodes are further configured to invalidate previously issued security tokens. ### Claim 20 A non-transitory computer-readable storage medium having embodied thereon instructions, which when executed by at least one processor, perform steps of a method, the method comprising: providing, by one or more nodes in a cluster, a list of revoked security tokens; receiving, by the one or more nodes, an indication of invalidating a user security token associated with a user device; in response to the receiving the indication, adding, by the one or more nodes, the user security token to the list of revoked security tokens, by the one or more nodes, the user security token to the list of revoked security tokens, the user security token being encrypted using an authenticated encryption; and generating, by the one or more nodes, a key to be used for the authenticated encryption, the key being generated based on a shared secret between the one or more nodes of the cluster.