Method and apparatus for token-based tamper detection

A method for validating tokens comprising:

• storing a first set of a plurality of tokens, the first set of the plurality of token comprising:
• a hard token representing identification information of a device,
• a network token representing the status of a network that facilitates communication from the device, and
• a resource token representing information associated with a resource;
• storing a second set of a plurality of tokens, the second set comprising secured copies of the hard token, network token, and resource token, the second set generated when the hard token, network token, and resource token of the first set were first generated;
• receiving, based on network jitter, a suspect token indicating a risk that at least one of the device, the network, and the resource has been tampered;
• in response to receiving the suspect token, applying, by a processor, one or more token tampering rules that specify which of the at least one of the hard token, network token, and resource token may have been affected as result of the risk indicated in the suspect token;
• comparing the at least one of the hard token, network token, and resource token of the first set that is identified by the one or more token tampering rules as being associated with the suspect token with its corresponding secured copy of the second set;
• in response to determining that the at least one of the hard token, network token, and resource token of the first set does not match the corresponding secured copy of the second set, communicating a revalidation token indicating the at least one token has been tampered;
• computing, based upon the revalidation token, a risk token representing an increased level of risk associated with the at least one of the device, the network, and the resource;
• and
• determining, based on the risk token, an access decision associated with the at least one of the device, the network, and the resource.

One or more computer-readable non-transitory storage media embodying software that is operable when executed to:

• store a first set of a plurality of tokens, the first set of the plurality of token comprising:
• a hard token representing identification information of the device,
• a network token representing the status of a network that facilitates communication from a device, and
• a resource token representing information associated with a resource;
• store a second set of a plurality of tokens, the second set comprising secured copies of the hard token, network token, and resource token, the second set generated when the hard token, network token, and resource token of the first set were first generated;
• receive, based on network jitter, a suspect token indicating a risk that at least one of the device, the network, and the resource has been tampered;
• in response to receiving the suspect token, apply one or more token tampering rules that specify which of the at least one of the hard token, network token, and resource token may have been affected as result of the risk indicated in the suspect token;
• compare the at least one of the hard token, network token, and resource token of the first set that is identified by the one or more token tampering rules as being associated with the suspect token with its corresponding secured copy of the second set;
• in response to determining that the at least one of the hard token, network token, and resource token of the first set does not match the corresponding secured copy of the second set, communicate a revalidation token indicating the at least one token has been tampered;
• compute, based upon the revalidation token, a risk token representing an increased level of risk associated with the at least one of the device, the network, and the resource;
• and
• determine, based on the risk token, an access decision associated with the at least one of the device, the network, and the resource.