# US 8,572,724 B2 · Method and apparatus for network session validation

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,572,724 B2
- Document ID: US8572724B2
- Status: Granted
- Kind: B2
- Application number: 13/479,554
- Filed: 2012-05-24
- Published: 2013-02-21
- Granted: 2013-10-29
- Earliest claimed: 2011-08-15
- Assignees: Bank of America Corporation
- Applicants: Rakesh Radhakrishnan
- Inventors: Rakesh Radhakrishnan
- Web page: https://patentgrep.com/patent/US8572724B2

## CPC

- G06F 21/335: {for accessing specific resources, e.g. using Kerberos tickets}
- G06Q 20/4016: {involving fraud or risk level assessment in transaction processing}
- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04L 63/105: {Multiple levels of security}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

According to one embodiment, an apparatus may store a plurality of token-based rules. A token-based rule facilitates access to a resource. The apparatus may further store a plurality of tokens. The apparatus may receive a first token indicating that access to the resource has been requested and determine at least one token-based rule based at least in part upon the first token. The at least one token-based rule may condition access to the resource upon a second token. The second token may indicate that the resource is associated with a virtual private network of the link layer of the open systems interconnection model. The apparatus may determine that the plurality of tokens includes the second token associated with the at least one token-based rule and generate a session token based at least in part upon the first token and the second token.

## Claims

### Claim 1

An apparatus comprising:
a memory operable to:
store a plurality of token-based rules, wherein each token-based rule facilitates access to a resource; and
store a plurality of tokens; and
a processor communicatively coupled to the memory and operable to:
receive a first token indicating that access to the resource has been requested;
determine at least one token-based rule based at least in part upon the first token, wherein:
the at least one token-based rule conditions access to the resource upon a second token; and
the second token indicates that the resource is associated with a virtual private network of the link layer of the open systems interconnection model;
determine that the plurality of tokens includes the second token associated with the at least one token-based rule; and
generate a session token based at least in part upon the first token and the second token in response to the determination that the plurality of tokens includes the second token.

### Claim 2 (depends on 1)

The apparatus of claim 1, wherein the processor is further operable to:
receive a third token indicating an event affecting the risk associated with granting access to the resource;
determine, based at least in part upon the at least one token-based rule, that access to the resource should be terminated in response to receiving the third token; and
terminate the session token in response to the determination that access to the resource should be terminated.

### Claim 3 (depends on 2)

The apparatus of claim 2, wherein the event is at least one of that the resource has been exposed to a virus and that a connection associated with the virtual private has experienced a security breach.

### Claim 4 (depends on 2)

The apparatus of claim 2, wherein the processor is further operable to:
generate a decision token indicating that access to the resource should be terminated in response to the determination that access to the resource should be terminated; and
transmit the decision token.

### Claim 5 (depends on 2)

The apparatus of claim 2, wherein the processor is further operable to:
determine, prior to terminating the session token, an incomplete transaction associated with the resource; and
complete the transaction before terminating the session token.

### Claim 6 (depends on 2)

The apparatus of claim 2, wherein the processor is further operable to:
receive a fourth token indicating that the event has been resolved; and
determine, based at least in part upon the fourth token and the at least one token-based rule, that access to the resource should be reestablished.

### Claim 7 (depends on 6)

The apparatus of claim 6, wherein the processor is further operable to:
determine, prior to terminating the session token, an incomplete transaction associated with the resource;
halt the transaction prior to terminating the session token; and
continue the transaction after access to the resource has been reestablished.

### Claim 8 (depends on 1)

The apparatus of claim 1, wherein generating the session token comprises a hash using the first and second tokens.

### Claim 9 (depends on 1)

The apparatus of claim 1, wherein the processor is further operable to:
generate a decision token indicating that access to the resource should be granted in response to the determination that the plurality of tokens includes the second token; and
transmit the decision token.

### Claim 10 (depends on 1)

The apparatus of claim 1, wherein the first token is a resource token.

### Claim 11 (depends on 1)

The apparatus of claim 1, wherein the second token further indicates at least one of a connection strength associated with the virtual private network and a connection speed associated with the virtual private network.

### Claim 12 (depends on 1)

The apparatus of claim 1, wherein the second token further indicates at least one of an IP address associated with a network forming the virtual private network, an IP address associated with a device associated with the virtual private network, and an IP address associated with the resource.

### Claim 13

A method comprising:
storing, by a memory, a plurality of token-based rules, wherein each token-based rule facilitates access to a resource;
storing, by the memory, a plurality of tokens;
receiving, by a processor communicatively coupled to the memory, a first token indicating that access to the resource has been requested;
determining, by the processor, at least one token-based rule based at least in part upon the first token, wherein:
the at least one token-based rule conditions access to the resource upon a second token; and
the second token indicates that the resource is associated with a virtual private network of the link layer of the open systems interconnection model;
determining, by the processor, that the plurality of tokens includes the second token associated with the at least one token-based rule; and
generating, by the processor, a session token based at least in part upon the first token and the second token in response to the determination that the plurality of tokens includes the second token.

### Claim 14 (depends on 13)

The method of claim 13, wherein the processor is further operable to:
receiving, by the processor, a third token indicating an event affecting the risk associated with granting access to the resource;
determining, by the processor, based at least in part upon the at least one token-based rule, that access to the resource should be terminated in response to receiving the third token; and
terminating, by the processor, the session token in response to the determination that access to the resource should be terminated.

### Claim 15 (depends on 14)

The method of claim 14, wherein the event is at least one of that the resource has been exposed to a virus and that a connection associated with the virtual private has experienced a security breach.

### Claim 16 (depends on 14)

The method of claim 14, wherein the processor is further operable to:
generating, by the processor, a decision token indicating that access to the resource should be terminated in response to the determination that access to the resource should be terminated; and
transmitting, by the processor, the decision token.

### Claim 17 (depends on 14)

The method of claim 14, wherein the processor is further operable to:
determining, by the processor, prior to terminating the session token, an incomplete transaction associated with the resource; and
completing, by the processor, the transaction before terminating the session token.

### Claim 18 (depends on 14)

The method of claim 14, wherein the processor is further operable to:
receiving, by the processor, a fourth token indicating that the event has been resolved; and
determining, by the processor, based at least in part upon the fourth token and the at least one token-based rule, that access to the resource should be reestablished.

### Claim 19 (depends on 18)

The method of claim 18, wherein the processor is further operable to:
determining, by the processor, prior to terminating the session token, an incomplete transaction associated with the resource;
halting, by the processor, the transaction prior to terminating the session token; and
continuing, by the processor, the transaction after access to the resource has been reestablished.

### Claim 20 (depends on 13)

The method of claim 13, wherein generating the session token comprises a hash using the first and second tokens.

### Claim 21 (depends on 13)

The method of claim 13, wherein the processor is further operable to:
generating, by the processor, a decision token indicating that access to the resource should be granted in response to the determination that the plurality of tokens includes the second token; and
transmitting, by the processor, the decision token.

### Claim 22 (depends on 13)

The method of claim 13, wherein the first token is a resource token.

### Claim 23 (depends on 13)

The method of claim 13, wherein the second token further indicates at least one of a connection strength associated with the virtual private network and a connection speed associated with the virtual private network.

### Claim 24 (depends on 13)

The method of claim 13, wherein the second token further indicates at least one of an 1P address associated with a network forming the virtual private network, an IP address associated with a device associated with the virtual private network, and an IP address associated with the resource.

### Claim 25

One or more computer-readable non-transitory storage media embodying software that is operable when executed to:
store a plurality of token-based rules, wherein each token-based rule facilitates access to a resource;
store a plurality of tokens;
receive a first token indicating that access to the resource has been requested;
determine at least one token-based rule based at least in part upon the first token, wherein:
the at least one token-based rule conditions access to the resource upon a second token; and
the second token indicates that the resource is associated with a virtual private network of the link layer of the open systems interconnection model;
determine that the plurality of tokens includes the second token associated with the at least one token-based rule; and
generate a session token based at least in part upon the first token and the second token in response to the determination that the plurality of tokens includes the second token.

### Claim 26 (depends on 25)

The media of claim 25, wherein the processor is further operable to:
receive a third token indicating an event affecting the risk associated with granting access to the resource;
determine, based at least in part upon the at least one token-based rule, that access to the resource should be terminated in response to receiving the third token; and
terminate the session token in response to the determination that access to the resource should be terminated.

### Claim 27 (depends on 26)

The media of claim 26, wherein the event is at least one of that the resource has been exposed to a virus and that a connection associated with the virtual private has experienced a security breach.

### Claim 28 (depends on 26)

The media of claim 26, wherein the processor is further operable to:
generate a decision token indicating that access to the resource should be terminated in response to the determination that access to the resource should be terminated; and
transmit the decision token.

### Claim 29 (depends on 26)

The media of claim 26, wherein the processor is further operable to:
determine, prior to terminating the session token, an incomplete transaction associated with the resource; and
complete the transaction before terminating the session token.

### Claim 30 (depends on 26)

The media of claim 26, wherein the processor is further operable to:
receive a fourth token indicating that the event has been resolved; and
determine, based at least in part upon the fourth token and the at least one token-based rule, that access to the resource should be reestablished.

### Claim 31 (depends on 30)

The media of claim 30, wherein the processor is further operable to:
determine, prior to terminating the session token, an incomplete transaction associated with the resource;
halt the transaction prior to terminating the session token; and
continue the transaction after access to the resource has been reestablished.

### Claim 32 (depends on 25)

The media of claim 25, wherein generating the session token comprises a hash using the first and second tokens.

### Claim 33 (depends on 25)

The media of claim 25, wherein the processor is further operable to:
generate a decision token indicating that access to the resource should be granted in response to the determination that the plurality of tokens includes the second token; and
transmit the decision token.

### Claim 34 (depends on 25)

The media of claim 25, wherein the first token is a resource token.

### Claim 35 (depends on 25)

The media of claim 25, wherein the second token further indicates at least one of a connection strength associated with the virtual private network and a connection speed associated with the virtual private network.

### Claim 36 (depends on 25)

The media of claim 25, wherein the second token further indicates at least one of an IP address associated with a network forming the virtual private network, an IP address associated with a device associated with the virtual private network, and an IP address associated with the resource.