Method and Apparatus for Object Security Session Validation

• US 20130047262A1
• Filed: 05/24/2012
• Published: 02/21/2013
• Est. Priority Date: 08/15/2011
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Radhakrishnan, Rakesh
• Granted Patent: US 9,159,065 B2
• Time in Patent Office: Days
• US Class Current: 726/27
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06Q 20/4016 involving fraud or risk level assessment in transaction processing

Abstract

According to one embodiment, an apparatus may store a plurality of token-based rules. A token-based rule may facilitate access to a resource. The apparatus may further store a plurality of tokens. The plurality of tokens may include a session token associated with access to the resource by a device. The apparatus may receive a first token indicating that an alarm associated with the device has been triggered. The apparatus may determine, based at least in part upon at least one token-based rule from the plurality of token-based rules, that access to the resource should be terminated in response to receiving the first token and terminate the session token in response to the determination that access to the resource should be terminated.

Claims

1. An apparatus comprising:

a memory operable to;

store a plurality of token-based rules, wherein a token-based rule facilitates access to a resource; and

store a plurality of tokens, wherein the plurality of tokens includes a session token associated with access to the resource by a device; and

a processor communicatively coupled to the memory and operable to;

receive a first token indicating that an alarm associated with the device has been triggered;

determine, based at least in part upon at least one token-based rule from the plurality of token-based rules, that access to the resource should be terminated in response to receiving the first token; and

terminate the session token in response to the determination that access to the resource should be terminated.

2. The apparatus of claim 1, wherein the processor is further operable to:

receive a resource token indicating that access to the resource has been requested by the device;

determine at least one token-based rule based at least in part upon the first token, wherein the at least one token-based rule conditions access to the resource upon a second token;

determine that the plurality of tokens includes the second token specified by the at least one token-based rule; and

generate a session token based at least in part upon the resource token and the second token in response to the determination that the plurality of tokens includes the second token.

3. The apparatus of claim 2, wherein generating the session token comprises a hash using the resource token and second token.

4. The apparatus of claim 2, wherein the processor is further operable to:

generate a decision token indicating that access to the resource should be granted in response to the determination that access to the resource should be granted; and

transmit the decision token.

5. The apparatus of claim 1, wherein the processor is further operable to:

determine, prior to terminating the session token, an incomplete transaction associated with the resource; and

complete the transaction before terminating access to the resource.

6. The apparatus of claim 1, wherein the processor is further operable to:

receive a second token indicating that the alarm has been resolved; and

determine, based at least in part upon the second token and the at least one token-based rule, that access to the resource should be reestablished.

7. The apparatus of claim 6, wherein the processor is further operable to:

determine, prior to terminating access to the resource, an incomplete transaction associated with the resource;

halt the transaction prior to terminating access to the resource; and

continue the transaction after access to the resource has been reestablished.

8. The apparatus of claim 6, wherein the second token further indicates at least one of that the alarm was a false alarm and that the alarm has been silenced.

9. The apparatus of claim 1, wherein the processor is further operable to:

generate a decision token indicating that access to the resource should be terminated in response to the determination that access to the resource should be terminated; and

transmit the decision token.

10. The apparatus of claim 1, wherein the device is at least one of a house, an automobile, and a boat.

11. The apparatus of claim 1, wherein the at least one token-based rule indicates that access to resource should be terminated if the alarm associated with the device triggers.

12. A method comprising:

storing, by a memory, a plurality of token-based rules, wherein a token-based rule facilitates access to a resource;

storing, by the memory, a plurality of tokens, wherein the plurality of tokens includes a session token associated with access to the resource by a device;

receiving, by a processor communicatively coupled to the memory, a first token indicating that an alarm associated with the device has been triggered;

determining, by the processor, based at least in part upon at least one token-based rule from the plurality of token-based rules, that access to the resource should be terminated in response to receiving the first token; and

terminating, by the processor, the session token in response to the determination that access to the resource should be terminated.

13. The method of claim 12, wherein the processor is further operable to:

receiving, by the processor, a resource token indicating that access to the resource has been requested by the device;

determining, by the processor, at least one token-based rule based at least in part upon the first token, wherein the at least one token-based rule conditions access to the resource upon a second token;

determining, by the processor, that the plurality of tokens includes the second token specified by the at least one token-based rule; and

generating, by the processor, a session token based at least in part upon the resource token and the second token in response to the determination that the plurality of tokens includes the second token.

14. The method of claim 13, wherein generating the session token comprises a hash using the resource token and second token.

15. The method of claim 13, wherein the processor is further operable to:

generating, by the processor, a decision token indicating that access to the resource should be granted in response to the determination that access to the resource should be granted; and

transmitting, by the processor, the decision token.

16. The method of claim 12, wherein the processor is further operable to:

determining, by the processor, prior to terminating the session token, an incomplete transaction associated with the resource; and

completing, by the processor, the transaction before terminating access to the resource.

17. The method of claim 12, wherein the processor is further operable to:

receiving, by the processor, a second token indicating that the alarm has been resolved; and

determining, by the processor, based at least in part upon the second token and the at least one token-based rule, that access to the resource should be reestablished.

18. The method of claim 17, wherein the processor is further operable to:

determining, by the processor, prior to terminating access to the resource, an incomplete transaction associated with the resource;

halting, by the processor, the transaction prior to terminating access to the resource; and

continuing, by the processor, the transaction after access to the resource has been reestablished.

19. The method of claim 17, wherein the second token further indicates at least one of that the alarm was a false alarm and that the alarm has been silenced.

20. The method of claim 12, wherein the processor is further operable to:

generating, by the processor, a decision token indicating that access to the resource should be terminated in response to the determination that access to the resource should be terminated; and

transmitting, by the processor, the decision token.

21. The method of claim 12, wherein the device is at least one of a house, an automobile, and a boat.

22. The method of claim 12, wherein the at least one token-based rule indicates that access to resource should be terminated if the alarm associated with the device triggers.

23. One or more computer-readable non-transitory storage media embodying software that is operable when executed to:

store a plurality of token-based rules, wherein a token-based rule facilitates access to a resource;

store a plurality of tokens, wherein the plurality of tokens includes a session token associated with access to the resource by a device;

receive a first token indicating that an alarm associated with the device has been triggered;

determine, based at least in part upon at least one token-based rule from the plurality of token-based rules, that access to the resource should be terminated in response to receiving the first token; and

terminate the session token in response to the determination that access to the resource should be terminated.

24. The media of claim 23 embodying software further operable when executed to:

receive a resource token indicating that access to the resource has been requested by the device;

determine at least one token-based rule based at least in part upon the first token, wherein the at least one token-based rule conditions access to the resource upon a second token;

determine that the plurality of tokens includes the second token specified by the at least one token-based rule; and

generate a session token based at least in part upon the resource token and the second token in response to the determination that the plurality of tokens includes the second token.

25. The media of claim 24, wherein generating the session token comprises a hash using the resource token and second token.

26. The media of claim 24 embodying software further operable when executed to:

generate a decision token indicating that access to the resource should be granted in response to the determination that access to the resource should be granted; and

transmit the decision token.

27. The media of claim 23 embodying software further operable when executed to:

determine, prior to terminating the session token, an incomplete transaction associated with the resource; and

complete the transaction before terminating access to the resource.

28. The media of claim 23 embodying software further operable when executed to:

receive a second token indicating that the alarm has been resolved; and

determine, based at least in part upon the second token and the at least one token-based rule, that access to the resource should be reestablished.

29. The media of claim 28 embodying software further operable when executed to:

determine, prior to terminating access to the resource, an incomplete transaction associated with the resource;

halt the transaction prior to terminating access to the resource; and

continue the transaction after access to the resource has been reestablished.

30. The media of claim 28, wherein the second token further indicates at least one of that the alarm was a false alarm and that the alarm has been silenced.

31. The media of claim 23 embodying software further operable when executed to:

generate a decision token indicating that access to the resource should be terminated in response to the determination that access to the resource should be terminated; and

transmit the decision token.

32. The media of claim 23, wherein the device is at least one of a house, an automobile, and a boat.

33. The media of claim 23, wherein the at least one token-based rule indicates that access to resource should be terminated if the alarm associated with the device triggers.