Stateless token replay protection
AssigneeVisa International Service Association
InventorEric Le Saint
Life of this patent
Estimating the term…
Abstract
An authorization data can be captured and reused for an unauthorized purpose or context during the validity period by an adversity. Current anti-replay solutions are complex and unpractical. For example, conditional access anti-replay solution requires supplementary context or behavior control services to protect against replay. However, any authorization data can be issued with an authentication timecode, which is valid during a period of short time and is non-predictable, i.e., it can be stolen but not replayed. Therefore, a timecode can be issued with the authorization data to protect against a replay attack.
Claims23
A method of accessing a resource, the method comprising performing, by a user device:
- transmitting, to an authentication server, authentication data and an access request for the resource, wherein an access to the resource is obtained using an authorization token, wherein the authorization token has a specified time;
- receiving, from the authentication server, a first timecode model, wherein the first timecode model is generated using a first base seed;
- determining a first elapsed time using a current time of the user device and the specified time;
- determining a first timecode using the first elapsed time and the first timecode model;
- transmitting the first timecode and the authorization token to a verification server;
- and
- receiving the access to the resource based on the first timecode matching a second timecode generated by the verification server, wherein the second timecode is generated using a second timecode model and a second elapsed time, wherein the second timecode model is generated using a second base seed, and wherein the second elapsed time is determined using the specified time and a current time of the verification server.
(canceled)
8-10. (canceled)
(canceled)
A user device comprising:
- a processor;
- a network interface;
- and
- a non-transitory computer-readable medium comprising code for instructing the processor to implement a method of accessing a resource, the method comprising performing:
- transmitting, to an authentication server, authentication data and an access request for the resource, wherein an access to the resource is obtained using an authorization token, wherein the authorization token has a specified time;
- receiving, from the authentication server, a first timecode model, wherein the first timecode model is generated using a first base seed;
- determining a first elapsed time using a current time of the user device and the specified time;
- determining a first timecode using the first elapsed time and the first timecode model;
- transmitting the first timecode and the authorization token to a verification server;
- and
- receiving the access to the resource based on the first timecode matching a second timecode generated by the verification server, wherein the second timecode is generated using a second timecode model and a second elapsed time, wherein the second timecode model is generated using a second base seed, and wherein the second elapsed time is determined using the specified time and a current time of the verification server.
Dependencies are inferred from the claim text.