Migrating sessions using a private cloud-cloud technology

• US 10,462,230 B2
• Filed: 05/23/2017
• Issued: 10/29/2019
• Est. Priority Date: 05/23/2017
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Mishra, Amit
• Primary Examiner(s): Homayounmehr, Farid
• Assistant Examiner(s): Salman, Raied A
• Application Number:
  US15/602,190
• Publication Number:
  US 20180343309A1
• Time in Patent Office: 889 Days
• Field of Search: 726 7, 726 5, 707 1, 709206
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04L 67/148 Migration or transfer of sessions

Abstract

The migration of a communication session from one device to another device may include registering at least two devices, receiving a request to transfer the session from one device to another, determining whether transfer of the session is authorized, storing session information associated with the session, authenticating user credentials at the second device, transmitting the stored session information to the second device, and receiving a request that incorporates the transmitted session information to restore the communication session on the second device. In addition, access to the system may be prohibited from the first device for a predefined period of time.

Claims

1. An apparatus, comprising:

a user interface operable to receive;

a request to transfer an active communication session between the apparatus and a first device such that the active communication session is between the apparatus and a second device, wherein the first device and the second device are coupled to a network, and

one or more credentials from a user;

a memory operable to store the request, the credentials from the user, an identifier of the first device, an identifier of the second device, and session information associated with the first active communication session;

a network interface operable to communicate with the network; and

a processor communicatively coupled to the user interface, the memory, and the network interface, the processor operable to;

register the first device and the second device;

detect the active communication session between the apparatus and the first device;

receive, after detecting the active communication session, a first request to transfer the active communication session between the apparatus and the first device such that the active communication session is between the apparatus and the second device;

determine, using the identifier of the first device and the identifier of the second device, whether the first device and the second device are registered and whether transfer of the active communication session is authorized;

if the first device and the second device are registered and transfer of the active communication session is authorized;

store, in the memory, the session information associated with the communication session from a header of the first request to transfer the active communication session;

receive and authenticate credentials of the user provided at the second device;

transmit the stored session information associated with the active communication session to the second device;

receive a second request associated with the active communication session that includes the transmitted session information to restore the active communication session on the second device based on the received second request and the session information; and

prohibit, after receiving the second request, access to the active communication session by the first device for a predefined period of time.

2. The apparatus of claim 1, wherein the credentials of the user at the second device comprise at least one biometric credential.

3. The apparatus of claim 1, wherein the identifier of the first device or the identifier of the second device comprises at least one identifier selected from the group of an Internet Protocol (IP) address, a media access control (MAC) address, a geographic location, and a security token, associated with the first device or the second device respectively.

4. The apparatus of claim 1, wherein the session information comprises a session identifier of the active communication session.

5. The apparatus of claim 1, wherein registering the first device and the second device comprises:

receiving a first request by the user to remember the first device;

generating and transmitting a first security token to the first device for storage on the first device;

receiving a second request by the user to remember the second device; and

generating and transmitting a second security token to the second device for storage on the second device.

6. The apparatus of claim 1, wherein the processor is further operable to compare the identifier of the first device or the identifier of the second device against fraud rules to determine whether transfer of the communication session is authorized.

7. The apparatus of claim 1, wherein the identifier of the first device comprises a geographic location of the first device and the identifier of the second device comprises a geographic location of the second device, and the processor is further operable to:

receive the geographic location of the first device;

receive the geographic location of the second device; and

authorize transfer of the active communication session from the first device to the second device if the geographic location of the first device and the geographic location of the second device are within a predefined value of each other.

8. A method, comprising:

registering a first device and a second device coupled to a communication network in response to a user request;

detecting, by a server, an active communication session between the server and the first device;

receiving, by the server, after detecting the active communication session, a first request to transfer the active communication session such that the active communication session is between the apparatus and the second device;

determining, by the server, using an identifier of the first device and an identifier of the second device, whether the first device and the second device are registered and whether transfer of the active communication session is authorized;

if the first device and the second device are registered and transfer of the active communication session is authorized;

storing, by the server in a memory, session information associated with the active communication session from a header of the first request to transfer the active communication session;

receiving and authenticating, by the server, credentials of the user provided at the second device;

transmitting, by the server, the stored session information associated with the active communication session to the second device;

receiving, by the server, a second request associated with the active communication session that includes the transmitted session information to restore the active communication session on the second device based on the received second request and the session information; and

prohibiting, by the server after receiving the second request, access to the active communication session by the first device for a predefined period of time.

9. The method of claim 8, wherein the credentials of the user at the second device comprise at least one biometric credential.

10. The method of claim 8, wherein the identifier of the first device or the identifier of the second device comprises at least one identifier selected from the group of an Internet Protocol (IP) address, a media access control (MAC) address, a geographic location, and a security token, associated with the first device or the second device respectively.

11. The method of claim 8, wherein the session information comprises a session identifier of the active communication session.

12. The method of claim 8, wherein registering the first device and the second device comprises:

receiving a first request by the user to remember the first device;

storing, in the memory, the identifier of the first device and generating a first security token;

transmitting the first security token to the first device for storage on the first device;

receiving a second request by the user to remember the second device;

storing, in the memory, the identifier of the second device and generating a second security token;

transmitting a second security token to the second device for storage on the second device.

13. The method of claim 8 further comprising comparing the identifier of the first device or the identifier of the second device against fraud rules to determine whether transfer of the communication session is authorized.

14. The method of claim 8, wherein the identifier of the first device comprises a geographic location of the first device and the identifier of the second device comprises a geographic location of the second device, and the method further comprises

receiving the geographic location of the first device;

receiving the geographic location of the second device; and

authorizing transfer of the active communication session from the first device to the second device if the geographic location of the first device and the geographic location of the second device are within a predefined value of each other.

15. A system, comprising:

a first device and a second device associated with a user and coupled to a network, wherein the first device is operable to generate a request to transfer an active communication session between a data server and the first device such that the active communication session is between the apparatus and the second device;

the data server comprising a processor operable to;

register the first device and the second device;

detect the active communication session between the data server and the first device;

receive, after detecting the active communication session, a first request to transfer the active communication session between the data server and the first device to the second device such that the active communication session is between the apparatus and the second device, the request including session information associated with the active communication session;

determine, using an identifier of the first device and an identifier of the second device, whether the first device and the second device are registered and whether transfer of the active communication session is authorized;

if the first device and the second device are registered and transfer of the active communication session is authorized;

store the session information associated with the active communication session from a header of the first request to transfer the active communication session;

receive and authenticate credentials of the user provided at the second device;

transmit the stored session information associated with the active communication session to the second device;

receive a second request associated with the active communication session that includes the transmitted session information to restore the active communication session on the second device based on the received second request and the session information; and

prohibit, after receiving the second request, access to the active communication session by the first device for a predefined period of time.

16. The system of claim 15, wherein the credentials of the user at the second device comprise at least one biometric credential.

17. The system of claim 15, wherein the identifier of the first device or the identifier of the second device comprises at least one identifier selected from the group of an Internet Protocol (IP) address, a media access control (MAC) address, a geographic location, and a security token, associated with the first device or the second device respectively.

18. The system of claim 15, wherein the session information comprises a session identifier of the active communication session.

19. The system of claim 15, wherein registering the first device and the second device comprises:

receiving a first request by the user to remember the first device;

generating and transmitting a first security token to the first device for storage on the first device;

receiving a second request by the user to remember the second device; and

generating and transmitting a second security token to the second device for storage on the second device.

20. The system of claim 15, wherein the identifier of the first device comprises a geographic location of the first device and the identifier of the second device comprises a geographic location of the second device, and the processor is further operable to:

receive the geographic location of the first device;

receive the geographic location of the second device; and

authorize transfer of the active communication session from the first device to the second device if the geographic location of the first device and the geographic location of the second device are within a predefined value of each other.