# US 8,752,157 B2 · Method and apparatus for third party session validation

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,752,157 B2
- Document ID: US8752157B2
- Status: Granted
- Kind: B2
- Application number: 13/479,533
- Filed: 2012-05-24
- Published: 2013-02-21
- Granted: 2014-06-10
- Earliest claimed: 2011-08-15
- Assignees: Bank of America Corporation
- Applicants: Rakesh Radhakrishnan
- Inventors: Rakesh Radhakrishnan
- Web page: https://patentgrep.com/patent/US8752157B2

## CPC

- G06F 21/335: {for accessing specific resources, e.g. using Kerberos tickets}
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04L 63/10: {for controlling access to devices or network resources}
- G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints
- G06F 21/41: where a single sign-on provides access to a plurality of computers
- G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS
- G06F 2221/2115: Third party
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

According to one embodiment, an apparatus may store a plurality of tokens. The apparatus may receive a first token indicating that access to a resource has been requested by a device. The apparatus may determine at least one token-based rule based at least in part upon the first token. The at least one token-based rule may condition access to the resource upon a second token. The apparatus may determine the geographic location of the device based on a token in the plurality of tokens. The apparatus may determine, based on the geographic location of the device, that the second token should be requested from an entity and transmit a request to the entity for the second token. The apparatus may receive the second token from the entity and generate a session token based at least in part upon the first token and the second token.

## Claims

### Claim 1

An apparatus comprising:
a processor;
a memory communicatively coupled to the processor;
a plurality of token-based rules stored in the memory, wherein a token-based rule facilitates access to a resource; and
a plurality of tokens stored in the memory; and
computer instructions stored within the memory;
wherein the processor, when executing the computer instructions stored in the memory:
receives a first token indicating that access to the resource has been requested by a device;
determines at least one token-based rule based at least in part upon the first token, wherein the at least one token-based rule conditions access to the resource upon a second token;
determines the geographic location of the device based on a token in the plurality of tokens;
determines, based on the geographic location of the device, that the second token should be requested from an entity;
transmits a request to the entity for the second token;
receives the second token from the entity; and
generates a session token based at least in part upon the first token and the second token in response to receiving the second token;
receives a third token indicating an event affecting the risk associated with granting access to the resource, wherein the event is at least one of a security breach associated with the entity and the geographic location of the device changing so that the device cannot communicate with the entity;
determines, based at least in part upon the at least one token-based rule, that access to the resource should be terminated in response to receiving the third token;
terminates the session token in response to the determination that access to the resource should be terminated;
determines, prior to terminating the session token, an incomplete transaction associated with the resource, and
completes the transaction before terminating the session token.

### Claim 2 (depends on 1)

The apparatus of claim 1, wherein the processor, when executing the computer instructions stored in the memory further:
generates a decision token indicating that access to the resource should be terminated in response to the determination that access to the resource should be terminated; and
transmits the decision token.

### Claim 3 (depends on 1)

The apparatus of claim 1, wherein the processor, when executing the computer instructions stored in the memory further:
receives a fourth token indicating that the event has been resolved;
determines, based at least in part upon the fourth token and the at least one token-based rule, that access to the resource should be reestablished.

### Claim 4 (depends on 3)

The apparatus of claim 3, wherein the processor, when executing the computer instructions stored in the memory further:
determines, prior to terminating the session token, an incomplete transaction associated with the resource;
halts the transaction prior to terminating the resource token; and
continues the transaction after access to the resource has been reestablished.

### Claim 5 (depends on 1)

The apparatus of claim 1, wherein generating the session token comprises a hash using the first and second tokens.

### Claim 6 (depends on 1)

The apparatus of claim 1, wherein the processor, when executing the computer instructions stored in the memory further:
generates a decision token indicating that access to the resource should be granted in response to receiving the second token; and
transmits the decision token.

### Claim 7 (depends on 1)

The apparatus of claim 1 wherein the processor, when executing the computer instructions stored in the memory further determines that the device is in a different country than the apparatus.

### Claim 8

A method comprising:
storing, by a memory, a plurality of token-based rules, wherein a token-based rule facilitates access to a resource;
storing, by the memory, a plurality of tokens;
receiving, by a processor communicatively coupled to the memory, a first token indicating that access to the resource has been requested by a device;
determining, by the processor, at least one token-based rule based at least in part upon the first token, wherein the at least one token-based rule conditions access to the resource upon a second token;
determining, by the processor, the geographic location of the device based on a token in the plurality of tokens;
determining, by the processor, based on the geographic location of the device, that the second token should be requested from an entity;
transmitting, by the processor, a request to the entity for the second token;
receiving, by the processor, the second token from the entity; and
generating, by the processor, a session token based at least in part upon the first token and the second token in response to receiving the second token;
receiving, by the processor, a third token indicating an event affecting the risk associated with granting access to the resource, wherein the event is at least one of a security breach associated with the entity and the geographic location of the device changing so that the device cannot communicate with the entity;
determining, by the processor, based at least in part upon the at least one token-based rule, that access to the resource should be terminated in response to receiving the third token;
terminating, by the processor, the session token in response to the determination that access to the resource should be terminated;
determining, by the processor, prior to terminating the session token, an incomplete transaction associated with the resource; and
completing, by the processor, the transaction before terminating the session token.

### Claim 9 (depends on 8)

The method of claim 8, further comprising:
generating, by the processor, a decision token indicating that access to the resource should be terminated in response to the determination that access to the resource should be terminated; and
transmitting, by the processor, the decision token.

### Claim 10 (depends on 8)

The method of claim 8, further comprising:
receiving, by the processor, a fourth token indicating that the event has been resolved;
determining, by the processor, based at least in part upon the fourth token and the at least one token-based rule, that access to the resource should be reestablished.

### Claim 11 (depends on 10)

The method of claim 10, further comprising:
determining, by the processor, prior to terminating the session token, an incomplete transaction associated with the resource;
halting, by the processor, the transaction prior to terminating the resource token; and
continuing, by the processor, the transaction after access to the resource has been reestablished.

### Claim 12 (depends on 8)

The method of claim 8, wherein generating the session token comprises a hash using the first and second tokens.

### Claim 13 (depends on 8)

The method of claim 8, further comprising:
generating, by the processor, a decision token indicating that access to the resource should be granted in response to receiving the second token; and
transmitting, by the processor, the decision token.

### Claim 14 (depends on 8)

The method of claim 8, further comprising determining, by the processor, that the device is in a different country than the method.

### Claim 15

One or more computer-readable non-transitory storage media embodying software that when executed by a processor causes the processor to execute operations comprising:
storing a plurality of token-based rules, wherein a token-based rule facilitates access to a resource;
storing a plurality of tokens;
receiving a first token indicating that access to the resource has been requested by a device;
determining at least one token-based rule based at least in part upon the first token,
wherein the at least one token-based rule conditions access to the resource upon a second token;
determining the geographic location of the device based on a token in the plurality of tokens,
determining, based on the geographic location of the device, that the second token should be requested from an entity;
transmitting a request to the entity for the second token;
receiving the second token from the entity; and
generating a session token based at least in part upon the first token and the second token in response to receiving the second token;
receiving a third token indicating an event affecting the risk associated with granting access to the resource, wherein the event is at least one of a security breach associated with the entity and the geographic location of the device changing so that the device cannot communicate with the entity;
determining, based at least in part upon the at least one token-based rule, that access to the resource should be terminated in response to receiving the third token;
terminating the session token in response to the determination that access to the resource should be terminated;
determining, prior to terminating the session token, an incomplete transaction associated with the resource; and
completing the transaction before terminating the session token.

### Claim 16 (depends on 15)

The media of claim 15 embodying software that when executed by the processor further causes the processor to execute operations comprising:
generating a decision token indicating that access to the resource should be terminated in response to the determination that access to the resource should be terminated; and
transmitting the decision token.

### Claim 17 (depends on 15)

The media of claim 15 embodying software that when executed by the processor further causes the processor to execute operations comprising:
receiving a fourth token indicating that the event has been resolved,
determining, based at least in part upon the fourth token and the at least one token-based rule, that access to the resource should be reestablished.

### Claim 18 (depends on 17)

The media of claim 17 embodying software that when executed by the processor further causes the processor to execute operations comprising:
determining, prior to terminating the session token, an incomplete transaction associated with the resource,
halting the transaction prior to terminating the resource token; and
continuing the transaction after access to the resource has been reestablished.

### Claim 19 (depends on 15)

The media of claim 15, wherein generating the session token comprises a hash using the first and second tokens.

### Claim 20 (depends on 15)

The media of claim 15 embodying software that when executed by the processor further causes the processor to execute operations comprising:
generating a decision token indicating that access to the resource should be granted in response to receiving the second token; and
transmitting the decision token.

### Claim 21 (depends on 15)

The media of claim 15 embodying software that when executed by the processor further causes the processor to determine that the device is in a different country than the apparatus.