# US 8,752,124 B2 · Apparatus and method for performing real-time authentication using subject token combinations > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,752,124 B2 - Document ID: US8752124B2 - Status: Granted - Kind: B2 - Application number: 13/479,482 - Filed: 2012-05-24 - Published: 2013-02-21 - Granted: 2014-06-10 - Earliest claimed: 2011-08-15 - Assignees: Bank of America Corporation - Applicants: Rakesh Radhakrishnan - Inventors: Rakesh Radhakrishnan - Web page: https://patentgrep.com/patent/US8752124B2 ## CPC - G06F 21/00: Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity - H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)} - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)} - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/102: {Entity profiles} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract According to one embodiment, an apparatus may receive a resource token associated with a resource indicating that access to the resource has been requested. The apparatus may determine at least one token-based rule based at least in part upon the resource token, wherein the at least one token-based rule may be associated with at least one subject token. The apparatus may then determine that the at least one subject token is not in the plurality of first subject tokens and the plurality of second subject tokens based at least in part upon the at least one token-based rule, and deny access to the resource. ## Claims ### Claim 1 An apparatus comprising: a memory configured to: store a plurality of token-based rules, wherein a token-based rule facilitates access to a first resource and a second resource; store a plurality of first subject tokens associated with a user, wherein the plurality of first subject tokens indicates at least one form of user authentication that has been performed; store a plurality of second subject tokens associated with a device, wherein the plurality of second subject tokens indicates at least one form of device authentication that has been performed; and store a session token associated with a session, wherein: access to the first resource has been granted during the session; and the at least one form of user authentication and the at least one form of device authentication must be performed in order for access to the first resource to be granted; and a processor communicatively coupled to the memory and configured to: receive a resource token indicating that access to the second resource has been requested; determine at least one token-based rule based at least in part upon the resource token, wherein the at least one token-based rule is associated with at least one subject token, the at least one subject token indicating a form of authentication that must be performed in order for access to the second resource to be granted; determine that the at least one subject token is not in the plurality of first subject tokens and the plurality of second subject tokens, wherein the determination that the at least one subject token is not in the plurality of first subject tokens and the plurality of second subject tokens indicates that the form of authentication has not been performed during the session; determine that access to the second resource should be denied based at least in part upon the determination that the at least one subject token is not in the plurality of first subject tokens and the plurality of second subject tokens; generate a message indicating the determination that access to the second resource should be denied, wherein the message further indicates the form of authentication; and transmit the message to the device. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the at least one subject token is associated with a missing form of user authentication. ### Claim 3 (depends on 1) The apparatus of claim 1, wherein the at least one subject token is associated with a missing form of device authentication. ### Claim 4 (depends on 1) The apparatus of claim 1, wherein the processor is further configured to: receive the at least one subject token; and determine that access to the second resource should be granted based at least in part upon the at least one subject token. ### Claim 5 (depends on 4) The apparatus of claim 4, wherein receiving the at least one subject token indicates that a missing form of user authentication has been performed. ### Claim 6 (depends on 5) The apparatus of claim 5, wherein the missing form of user authentication is biometric authentication. ### Claim 7 (depends on 4) The apparatus of claim 4, wherein receiving the at least one subject token indicates that a missing form of device authentication has been performed. ### Claim 8 A method comprising: storing, by a memory, a plurality of token-based rules, wherein a token-based rule facilitates access to a first resource and a second resource; storing, by the memory, a plurality of first subject tokens associated with a user, wherein the plurality of first subject tokens indicates at least one form of user authentication that has been performed; storing, by the memory, a plurality of second subject tokens associated with a device, wherein the plurality of second subject tokens indicates at least one form of device authentication that has been performed; storing, by the memory, a session token associated with a session, wherein: access to the first resource has been granted during the session; and the at least one form of user authentication and the at least one form of device authentication must be performed in order for access to the first resource to be granted; receiving, by a processor communicatively coupled to the memory, a resource token indicating that access to the second resource has been requested; determining, by the processor, at least one token-based rule based at least in part upon the resource token, wherein the at least one token-based rule is associated with at least one subject token, the at least one subject token indicating a form of authentication that must be performed in order for access to the second resource to be granted; determining, by the processor, that the at least one subject token is not in the plurality of first subject tokens and the plurality of second subject tokens, wherein the determination that the at least one subject token is not in the plurality of first subject tokens and the plurality of second subject tokens indicates that the form of authentication has not been performed during the session; determining, by the processor, that access to the second resource should be denied based at least in part upon the determination that the at least one subject token is not in the plurality of first subject tokens and the plurality of second subject tokens; generating, by the processor, a message indicating the determination that access to the second resource should be denied, wherein the message further indicates the form of authentication; and transmitting, by the processor, the message to the device. ### Claim 9 (depends on 8) The method of claim 8, wherein the at least one subject token is associated with a missing form of user authentication. ### Claim 10 (depends on 8) The method of claim 8, wherein the at least one subject token is associated with a missing form of device authentication. ### Claim 11 (depends on 9) The method of claim 9, further comprising: receiving, by the processor, the at least one subject token; and determining, by the processor, that access to the second resource should be granted based at least in part upon the at least one subject token. ### Claim 12 (depends on 11) The method of claim 11, wherein receiving the at least one subject token indicates that a missing form of user authentication has been performed. ### Claim 13 (depends on 12) The method of claim 12, wherein the missing form of user authentication is biometric authentication. ### Claim 14 (depends on 11) The method of claim 11, wherein receiving the at least one subject token indicates that a missing form of device authentication has been performed. ### Claim 15 One or more computer-readable non-transitory storage media embodying software that, when executed, is configured to: store a plurality of token-based rules, wherein a token-based rule facilitates access to a first resource and a second resource; store a plurality of first subject tokens associated with a user, wherein the plurality of first subject tokens indicates at least one form of user authentication that has been performed; store a plurality of second subject tokens associated with a device, wherein the plurality of second subject tokens indicates at least one form of device authentication that has been performed; store a session token associated with a session, wherein: access to the first resource has been granted during the session; and the at least one form of user authentication and the at least one form of device authentication must be performed in order for access to the first resource to be granted; receive a resource token indicating that access to the second resource has been requested; determine at least one token-based rule based at least in part upon the resource token, wherein the at least one token-based rule is associated with at least one subject token, the at least one subject token indicating a form of authentication that must be performed in order for access to the second resource to be granted; determine that the at least one subject token is not in the plurality of first subject tokens and the plurality of second subject tokens, wherein the determination that the at least one subject token is not in the plurality of first subject tokens and the plurality of second subject tokens indicates that the form of authentication has not been performed during the session; determine that access to the second resource should be denied based at least in part upon the determination that the at least one subject token is not in the plurality of first subject tokens and the plurality of second subject tokens; generate a message indicating the determination that access to the second resource should be denied, wherein the message further indicates the form of authentication; and transmit the message to the device. ### Claim 16 (depends on 15) The media of claim 15, wherein the at least one subject token is associated with a missing form of user authentication. ### Claim 17 (depends on 15) The media of claim 15, wherein the at least one subject token is associated with a missing form of device. ### Claim 18 (depends on 15) The media of claim 15 embodying software that, when executed, is further configured to: receive the at least one subject token; and determine that access to the second resource should be granted based at least in part upon the at least one subject token. ### Claim 19 (depends on 18) The media of claim 18, wherein receiving the at least one subject token indicates that a missing form of user authentication has been performed. ### Claim 20 (depends on 19) The media of claim 19, wherein the missing form of user authentication is biometric authentication. ### Claim 21 (depends on 18) The media of claim 18, wherein receiving the at least one subject token indicates that a missing form of device authentication has been performed.