Method and apparatus for token-based tamper detection

• US 9,069,943 B2
• Filed: 08/15/2011
• Issued: 06/30/2015
• Est. Priority Date: 08/15/2011
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Radhakrishnan, Rakesh, Frick, Cynthia Ann, Marian, Radu, Barbir, Abdulkader Omar, Badhwar, Rajat P.
• Primary Examiner(s): ZAIDI, SYED A
• Application Number:
  US13/210,220
• Publication Number:
  US 20130047225A1
• Time in Patent Office: 1,415 Days
• Field of Search: 726/6, 726/1, 705/59, 713/201, 709/250
• US Class Current: 1/1
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

According to one embodiment, an apparatus may store: a hard token representing identification information of the device, a network token representing the status of a network, and a resource token representing information associated with a resource. The apparatus may further store secured copies of the hard token, network token, and resource token. The apparatus may receive a suspect token indicating a risk that at least one of the device, the network, and the resource has been tampered, and in response, determine to inspect at least one of the hard token, network token, and resource token. The apparatus may then compare the at least one of the hard token, network token, and resource token with its corresponding secured copy. If at least one of those tokens does not match its corresponding secured copy, the apparatus may communicate a revalidation token indicating at least one token has been tampered.

Claims

1. An apparatus comprising:

a memory storing;

a first set of a plurality of tokens, the first set of the plurality of tokens comprising;

a hard token representing identification information of a device,

a network token representing the status of a network that facilitates communication from the device, and

a resource token representing information associated with a resource; and

a second set of a plurality of tokens, the second set comprising secured copies of the hard token, network token, and resource token, the second set generated when the hard token, network token, and resource token of the first set were first generated; and

a processor;

receiving, based on network jitter, a suspect token indicating a risk that at least one of the device, the network, and the resource has been tampered;

in response to receiving the suspect token, applying one or more token tampering rules that specify which of the at least one of the hard token, network token, and resource token may have been affected as result of the risk indicated in the suspect token;

comparing the at least one of the hard token, network token, and resource token of the first set that is identified by the one or more token tampering rules as being associated with the suspect token with its corresponding secured copy of the second set;

in response to determining that the at least one of the hard token, network token, and resource token of the first set does not match the corresponding secured copy of the second set, communicating a revalidation token indicating the at least one token has been tampered;

computing, based upon the revalidation token, a risk token representing an increased level of risk associated with the at least one of the device, the network, and the resource; and

determining, based on the risk token, an access decision associated with the at least one of the device, the network, and the resource.

2. The apparatus of claim 1, the processor further:

terminating the at least one of the hard token, network token, and resource token; and

terminating a new token that matches the corresponding secured copy of the at least one of the hard token, network token, and resource token.

3. The apparatus of claim 2, the processor further replacing the at least one of the hard token, network token, and resource token with the new token.

4. The apparatus of claim 1, the processor further verifying the integrity of a ticket associated with the at least one of the hard token, network token, and resource token indicated by the suspect token.

5. The apparatus of claim 4, wherein the integrity of the ticket indicates whether the at least one of the hard token, network token, and resource token has been tampered.

6. The apparatus of claim 1, the memory further storing a plurality of token-based rules, wherein a token-based rule facilitates determining to inspect at least one of the hard token, network token, and resource token.

7. The apparatus of claim 1, wherein the determination to inspect is based on a token-based rule.

8. The apparatus of claim 1, wherein

each token of the first set of the plurality of tokens and the second set of the plurality of tokens comprise a plurality of attributes;

and

comparing the at least one of the hard token, network token and resource token of the first set with its corresponding secured copy of the second set comprises performing token-based analysis rather than attribute based analysis.

9. A method for validating tokens comprising:

storing a first set of a plurality of tokens, the first set of the plurality of token comprising;

a hard token representing identification information of a device,

a network token representing the status of a network that facilitates communication from the device, and

a resource token representing information associated with a resource;

storing a second set of a plurality of tokens, the second set comprising secured copies of the hard token, network token, and resource token, the second set generated when the hard token, network token, and resource token of the first set were first generated;

receiving, based on network jitter, a suspect token indicating a risk that at least one of the device, the network, and the resource has been tampered;

in response to receiving the suspect token, applying, by a processor, one or more token tampering rules that specify which of the at least one of the hard token, network token, and resource token may have been affected as result of the risk indicated in the suspect token;

comparing the at least one of the hard token, network token, and resource token of the first set that is identified by the one or more token tampering rules as being associated with the suspect token with its corresponding secured copy of the second set;

in response to determining that the at least one of the hard token, network token, and resource token of the first set does not match the corresponding secured copy of the second set, communicating a revalidation token indicating the at least one token has been tampered;

computing, based upon the revalidation token, a risk token representing an increased level of risk associated with the at least one of the device, the network, and the resource; and

determining, based on the risk token, an access decision associated with the at least one of the device, the network, and the resource.

10. The method of claim 9, further comprising:

terminating the at least one of the hard token, network token, and resource token; and

generating a new token that matches the corresponding secured copy of the at least one of the hard token, network token, and resource token.

11. The method of claim 10, further comprising replacing the at least one of the hard token, network token, and resource token with the new token.

12. The method of claim 9, further comprising verifying the integrity of a ticket associated with the at least one of the hard token, network token, and resource token indicated by the suspect token.

13. The method of claim 12, wherein the integrity of the ticket indicates whether the at least one of the hard token, network token, and resource token has been tampered.

14. The method of claim 9, further comprising storing a plurality of token-based rules, wherein a token-based rule facilitates determining to inspect at least one of the hard token, network token, and resource token.

15. The method of claim 9, wherein the determination to inspect is based on a token-based rule.

16. The method of claim 9, wherein

each token of the first set of the plurality of tokens and the second set of the plurality of tokens comprise a plurality of attributes;

and

comparing the at least one of the hard token, network token and resource token of the first set with its corresponding secured copy of the second set comprises performing token-based analysis rather than attribute based analysis.

17. One or more computer-readable non-transitory storage media embodying software that is operable when executed to:

store a first set of a plurality of tokens, the first set of the plurality of token comprising;

a hard token representing identification information of the device,

a network token representing the status of a network that facilitates communication from a device, and

a resource token representing information associated with a resource;

store a second set of a plurality of tokens, the second set comprising secured copies of the hard token, network token, and resource token, the second set generated when the hard token, network token, and resource token of the first set were first generated;

receive, based on network jitter, a suspect token indicating a risk that at least one of the device, the network, and the resource has been tampered;

in response to receiving the suspect token, apply one or more token tampering rules that specify which of the at least one of the hard token, network token, and resource token may have been affected as result of the risk indicated in the suspect token;

compare the at least one of the hard token, network token, and resource token of the first set that is identified by the one or more token tampering rules as being associated with the suspect token with its corresponding secured copy of the second set;

in response to determining that the at least one of the hard token, network token, and resource token of the first set does not match the corresponding secured copy of the second set, communicate a revalidation token indicating the at least one token has been tampered;

compute, based upon the revalidation token, a risk token representing an increased level of risk associated with the at least one of the device, the network, and the resource; and

determine, based on the risk token, an access decision associated with the at least one of the device, the network, and the resource.

18. The media of claim 17 embodying software further operable when executed to:

terminate the at least one of the hard token, network token, and resource token; and

generate a new token that matches the corresponding secured copy of the at least one of the hard token, network token, and resource token.

19. The media of claim 18 embodying software further operable when executed to replace the at least one of the hard token, network token, and resource token with the new token.

20. The media of claim 17 embodying software further operable when executed to verify the integrity of a ticket associated with the at least one of the hard token, network token, and resource token indicated by the suspect token.

21. The media of claim 20, wherein the integrity of the ticket indicates whether the at least one of the hard token, network token, and resource token has been tampered.

22. The media of claim 17 embodying software further operable when executed to store a plurality of token-based rules, wherein a token-based rule facilitates determining to inspect at least one of the hard token, network token, and resource token.

23. The media of claim 17, wherein the determination to inspect is based on a token-based rule.

24. The media of claim 17, wherein

each token of the first set of the plurality of tokens and the second set of the plurality of tokens comprise a plurality of attributes;

and

comparing the at least one of the hard token, network token and resource token of the first set with its corresponding secured copy of the second set comprises performing token-based analysis rather than attribute based analysis.