# US 8,572,683 B2 · Method and apparatus for token-based re-authentication

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,572,683 B2
- Document ID: US8572683B2
- Status: Granted
- Kind: B2
- Application number: 13/210,289
- Filed: 2011-08-15
- Published: 2013-02-21
- Granted: 2013-10-29
- Earliest claimed: 2011-08-15
- Assignees: Bank of America Corporation
- Applicants: Rakesh Radhakrishnan; Cynthia Ann Frick; Radu Marian; Abdulkader Omar Barbir; Rajat P. Badhwar
- Inventors: Rakesh Radhakrishnan; Cynthia Ann Frick; Radu Marian; Abdulkader Omar Barbir; Rajat P. Badhwar
- Web page: https://patentgrep.com/patent/US8572683B2

## CPC

- G06F 21/33: using certificates
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

According to one embodiment, an apparatus may store a plurality of tokens that indicate a user is using a device to access a resource over a network. The apparatus may detect at least one token indicating a change associated with at least one of the device, the network, or the resource. The apparatus may then determine to re-authenticate the user in response to the change. The apparatus may then request a password generated using personal information of the user, and receive a re-authentication token comprising the password generated using personal information of the user. The apparatus may then request, from the user, a second password. The request for the second password may include instructions on how to form the second password. The apparatus may receive a response comprising the second password and determine that the second password matches the password. The apparatus may then re-authenticate the user.

## Claims

### Claim 1

An apparatus comprising:
a memory operable to store a plurality of tokens that indicate a user is using a device to access a resource over a network; and
a processor operable to:
detect at least one token indicating a change associated with at least one of the device, the network, or the resource, wherein the change poses a risk to a current authentication of the user;
block the user from accessing the resource in response to the change;
determine whether to re-authenticate the user in response to the change and in response to the determination to re-authenticate the user;
request generation of a first password, wherein the first password is generated using a combination of personal information associated with the user;
receive a re-authentication token comprising the first password;
request, from the user, a second password, the request for the second password comprising a message instructing the user how to for the second password to match the first password;
receive a response comprising the second password;
determine that the second password matches the first password; and
re-authenticate the user in response to the determination that the second password matches the password.

### Claim 2 (depends on 1)

The apparatus of claim 1, wherein the change is jitter in the network.

### Claim 3 (depends on 1)

The apparatus of claim 1, wherein the change is a change in the access requirements of the resource.

### Claim 4 (depends on 1)

The apparatus of claim 1, wherein the personal information comprises at least one of the user's age, number of children, and spouse's age.

### Claim 5 (depends on 1)

The apparatus of claim 1, wherein a subsequently generated re-authentication token is different from a previously generated re-authentication token.

### Claim 6 (depends on 1)

The apparatus of claim 1, wherein a subsequent generation of the password uses a different combination of personal information of the user than a previous generation of the password.

### Claim 7 (depends on 1)

The apparatus of claim 1, the processor further operable to store a plurality of token-based rules, wherein a token-based rule facilitates the generation of a re-authentication token.

### Claim 8 (depends on 1)

The apparatus of claim 1, wherein the determination to re-authenticate the user is based on a token-based rule and the plurality of tokens.

### Claim 9

A method for re-authenticating a user comprising:
storing a plurality of tokens that indicate a user is using a device to access a resource over a network;
detecting, by a processor, at least one token indicating a change associated with at least one of the device, the network, or the resource, wherein the change poses a risk to a current authentication of the user;
blocking, by the processor, the user from accessing the resource in response to the change;
determining, by the processor, whether to re-authenticate the user in response to the change and in response to the determination to re-authenticate the user:
requesting generation of a first password, wherein the first password is generated using a combination of personal information associated with the user;
receiving a re-authentication token comprising the first password;
requesting, from the user, a second password, the request for the second password comprising a message instructing the user how to form the second password to match the first password;
receiving a response comprising the second password;
determining, by the processor, that the second password matches the first password; and
re-authenticating the user in response to the determination that the second password matches the password.

### Claim 10 (depends on 9)

The method of claim 9, wherein the change is jitter in the network.

### Claim 11 (depends on 9)

The method of claim 9, wherein the change is a change in the access requirements of the resource.

### Claim 12 (depends on 9)

The method of claim 9, wherein the personal information comprises at least one of the user's age, number of children, and spouse's age.

### Claim 13 (depends on 9)

The method of claim 9, wherein a subsequently generated re-authentication token is different from a previously generated re-authentication token.

### Claim 14 (depends on 9)

The method of claim 9, wherein a subsequent generation of the password uses a different combination of personal information of the user than a previous generation of the password.

### Claim 15 (depends on 9)

The method of claim 9, further comprising storing a plurality of token-based rules, wherein a token-based rule facilitates the generation of a re-authentication token.

### Claim 16 (depends on 9)

The method of claim 9, wherein the determination to re-authenticate the user is based on a token-based rule and the plurality of tokens.

### Claim 17

One or more computer-readable non-transitory storage media embodying software that is operable when executed to:
store a plurality of tokens that indicate a user is using a device to access a resource over a network;
detect at least one token indicating a change associated with at least one of the device, the network, or the resource, wherein the change poses a risk to a current authentication of the user;
block the user from accessing the resource in response to the change;
determine to re-authenticate the user in response to the change and in response to the determination to re-authenticate the user:
request generation of a first password, wherein the first password is generated using a combination of personal information associated with the user;
receive a re-authentication token comprising the first password;
request, from the user, a second password, the request for the second password comprising a message instructing the user how to form the second password to match the first password;
receive a response comprising the second password;
determine that the second password matches the first password; and
re-authenticate the user in response to the determination that the second password matches the password.

### Claim 18 (depends on 17)

The media of claim 17, wherein the change is jitter in the network.

### Claim 19 (depends on 17)

The media of claim 17, wherein the change is a change in the access requirements of the resource.

### Claim 20 (depends on 17)

The media of claim 17, wherein the personal information comprises at least one of the user's age, number of children, and spouse's age.

### Claim 21 (depends on 17)

The media of claim 17, wherein a subsequently generated re-authentication token is different from a previously generated re-authentication token.

### Claim 22 (depends on 17)

The media of claim 17, wherein a subsequent generation of the password uses a different combination of personal information of the user than a previous generation of the password.

### Claim 23 (depends on 17)

The media of claim 17 embodying software further operable to store a plurality of token-based rules, wherein a token-based rule facilitates the generation of a re-authentication token.

### Claim 24 (depends on 17)

The media of claim 17, wherein the determination to re-authenticate the user is based on a token-based rule and the plurality of tokens.