Granted Patent B2

US 12,726,475 · App. 19/009,132 · Granted Sep 1, 2026

Inventors: Jemlin Lucas (Coppell, TX); Suryanarayana Adivi (Hyderabad, IN); Pushkar Taneja (Hyderabad, IN)

Assignee: Bank of America Corporation

H04L63/0838H04L63/0846H04L63/0861

Abstract

Claims (86)

1 . A method for secure inter-cloud authentication with time-sync verification to control access to data stored across multiple cloud providers, comprising:

initiating, by a user device, an access request to a primary cloud service, wherein the access request is associated with user authentication credentials and specifies data located across at least two cloud providers;

transmitting, by the user device, the authentication credentials to an identity provider (IdP), which is responsible for managing inter-cloud authentication across the multiple cloud providers, wherein the authentication credentials include a biometric identifier, a password, and a time-based one-time password (TOTP) that is dynamically generated for the user;

generating, by the identity provider (IdP), an authentication token that incorporates a timestamp synchronized with a Network Time Protocol (NTP) server, wherein the timestamp serves as a temporal marker to validate the freshness of the authentication request and prevent replay attacks;

verifying, by the identity provider (IdP), the accuracy of the timestamp by comparing the system time with the NTP server time, ensuring that the authentication token is generated within a predefined time window that aligns with the current server time;

embedding, by the identity provider (IdP), the TOTP and timestamp within the authentication token, wherein the TOTP is generated using a secret key unique to the user and refreshed at predefined intervals to provide a time-sensitive component to the authentication token;

issuing, by the identity provider (IdP), the authentication token to the primary cloud provider, wherein the token includes the user's credentials, the synchronized timestamp, and TOTP, and is valid only within a specific time window;

forwarding, by the primary cloud provider, the authentication token to a secondary cloud provider specified in the access request, wherein the secondary cloud provider is configured to independently validate the authentication token's timestamp and TOTP components;

validating, by the secondary cloud provider, the authentication token by checking the timestamp and ensuring it falls within an acceptable range relative to the secondary cloud provider's synchronized system time, as verified by the NTP server, thereby confirming that the request is recent and legitimate;

verifying, by the secondary cloud provider, the TOTP embedded in the authentication token to ensure it matches the expected TOTP based on the user's secret key, confirming the identity of the requesting user and the integrity of the request;

granting, by the secondary cloud provider, access to the requested data upon successful validation of the timestamp and TOTP within the authentication token, wherein access is restricted if the token is expired, tampered with, or otherwise invalid;

implementing, by an inter-cloud communication module, secure communication channels between the primary cloud provider, the secondary cloud provider, and the identity provider, wherein each channel is protected by a protocol selected from the group consisting of TLS and HTTPS, ensuring data integrity and confidentiality during inter-cloud transmission;

logging, by a monitoring and audit module, each instance of authentication token generation, validation, and access request in a secure, immutable ledger, wherein each log entry records user identity, timestamp, token validity, and outcome of the authentication process for compliance with data security standards;

enforcing, by a token expiration module, a time-based expiration on each authentication token, ensuring that tokens are valid only within a limited time window and are discarded after expiration to prevent unauthorized reuse;

reissuing, by the identity provider (IdP), an updated authentication token upon detection of a time discrepancy or authentication failure due to minor network delays, wherein the reissued token includes an adjusted timestamp and refreshed TOTP to synchronize with the cloud providers' system times and prevent legitimate access denials;

requiring, by a multi-factor authentication (MFA) module, additional user verification factors in the authentication token generation process, including at least two of the following: biometric data, a user password, and a device-based verification, to strengthen identity validation before token issuance; and

initiating, by a threat detection module within the identity provider, an automated response if suspicious patterns or anomalies in access requests are detected, wherein the response includes temporarily locking access to the affected cloud providers, notifying administrators, and requiring reauthentication to mitigate potential security threats.

2 . The method of claim 1 , wherein the identity provider (IdP) further comprises a biometric processing module configured to convert the biometric identifier into a cryptographic hash before embedding it within the authentication token, ensuring that sensitive biometric data is securely processed and protected from direct exposure.

3 . The method of claim 2 , wherein the timestamp included in the authentication token is periodically recalibrated by the identity provider (IdP) based on data from a plurality of NTP servers, ensuring accurate synchronization and reducing the risk of discrepancies due to network delays.

4 . The method of claim 3 , wherein the identity provider (IdP) is configured to apply a tolerance range to the timestamp comparison with the NTP server, accounting for minor time variations across the primary and secondary cloud providers to prevent legitimate access denial.

5 . The method of claim 4 , wherein the authentication token is embedded with metadata specifying the expiration time, the identity of the requesting user, and the originating cloud provider, allowing the secondary cloud provider to verify the origin and intended purpose of the access request.

6 . The method of claim 5 , further comprising a token validation module within the secondary cloud provider, configured to check for token duplication or replay by comparing each received token with a stored list of recently validated tokens, rejecting any token that matches a previously accepted token.

7 . The method of claim 6 , wherein the TOTP included in the authentication token is refreshed at intervals shorter than the typical NTP synchronization period, providing an additional layer of time-sensitive security to prevent attackers from intercepting and reusing tokens.

8 . The method of claim 7 , wherein the TOTP generation is based on both the user's secret key and real-time environmental data specific to the user's device, such as geographic location, IP address, or device identifier, to create a unique and context-aware authentication factor.

9 . The method of claim 8 , further comprising configuring the multi-factor authentication (MFA) module to prioritize the use of biometric authentication as a primary factor, wherein the user's biometric data is required before generating the authentication token to enhance security for sensitive data access.

10 . The method of claim 9 , wherein the inter-cloud communication module encrypts each data transmission between the identity provider, primary cloud provider, and secondary cloud provider using an end-to-end encryption protocol, selected from the group consisting of AES-256 and RSA-2048, to ensure the confidentiality of the authentication token.

11 . The method of claim 10 , wherein the monitoring and audit module records additional data, including the user's device details, IP address, and session duration, to create a comprehensive audit trail for post-event analysis and regulatory compliance.

12 . The method of claim 11 , wherein the token expiration module is configured to adjust the expiration period based on risk levels associated with the requested data, providing shorter expiration times for higher-risk access requests to enhance security.

13 . The method of claim 12 , further comprising the reissuing module automatically notifying the user device in cases where an updated token is generated due to detected time discrepancies, prompting the user to reinitiate the authentication process with the reissued token.

14 . The method of claim 13 , wherein the multi-factor authentication (MFA) module is configured to incorporate device-based authentication by verifying the device's unique hardware identifier and matching it with previously registered devices to ensure the request is made from an authorized device.

15 . The method of claim 14 , further comprising a behavioral analysis module within the identity provider that monitors access patterns, wherein anomalies in access frequency, location, or device usage trigger additional authentication steps or alerts to prevent unauthorized access.

16 . The method of claim 15 , wherein the threat detection module employs machine learning algorithms to detect patterns consistent with security threats, enabling real-time adjustments to authentication protocols based on detected risk factors.

17 . The method of claim 16 , further comprising an emergency response module that, upon detection of a significant security threat, disables token issuance for affected user accounts and notifies administrators for immediate review and intervention.

18 . The method of claim 17 , wherein the identity provider (IdP) is further configured to limit a number of authentication token requests per user within a specified time frame, reducing a likelihood of brute-force attacks on the inter-cloud authentication system.

19 . A method for secure inter-cloud authentication with time-sync verification to control access to data stored across multiple cloud providers, comprising:

initiating, by a user device, an access request to a primary cloud service, wherein the access request includes authentication credentials associated with the user, specifying data located across at least two cloud providers;

transmitting, by the user device, the authentication credentials to an identity provider (IdP) responsible for managing inter-cloud authentication, wherein the authentication credentials include a biometric identifier, a password, and a time-based one-time password (TOTP) dynamically generated for the user;

converting, by a biometric processing module within the IdP, the biometric identifier into a cryptographic hash, wherein the cryptographic hash is embedded within the authentication token to enhance the security of biometric data and protect it from direct exposure;

generating, by the identity provider (IdP), an authentication token that incorporates a synchronized timestamp verified with a Network Time Protocol (NTP) server, wherein the timestamp provides a temporal marker to validate the freshness of the authentication request and prevent replay attacks;

verifying, by the identity provider (IdP), the accuracy of the timestamp by comparing it with the NTP server time, and applying a predefined tolerance range to accommodate minor discrepancies between the primary and secondary cloud providers' system times;

embedding, by the identity provider (IdP), the TOTP and synchronized timestamp within the authentication token, wherein the TOTP is generated using a unique user secret key and refreshed at predefined intervals, providing a time-sensitive component to the authentication token;

associating, by the identity provider (IdP), metadata with the authentication token, including an expiration time, user identity, originating cloud provider, and the validity period of the TOTP, ensuring that the token is uniquely identifiable and restricted in scope;

issuing, by the identity provider (IdP), the authentication token to the primary cloud provider, wherein the authentication token is valid only within a specific time window and is protected by time-based expiration;

forwarding, by the primary cloud provider, the authentication token to a secondary cloud provider specified in the access request, wherein the secondary cloud provider is configured to validate the authentication token independently;

validating, by a token validation module within the secondary cloud provider, the authentication token by verifying the timestamp and ensuring it falls within an acceptable range relative to the secondary cloud provider's synchronized system time, thereby confirming the recency and legitimacy of the request;

comparing, by the secondary cloud provider, the TOTP embedded in the authentication token with the expected TOTP generated using the user's unique secret key, ensuring that the token originates from the authenticated user and has not been tampered with;

performing, by the token validation module, a duplication check on the authentication token by cross-referencing it with recently validated tokens, rejecting the token if it matches a previously accepted token to prevent replay attacks;

granting, by the secondary cloud provider, access to the requested data upon successful validation of the timestamp, TOTP, and duplication check, wherein access is denied if any element fails verification;

establishing, by an inter-cloud communication module, secure communication channels between the primary cloud provider, secondary cloud provider, and identity provider, wherein each channel is protected by a secure transmission protocol selected from the group consisting of TLS and HTTPS, ensuring data integrity and confidentiality during inter-cloud transmission;

recording, by a monitoring and audit module, each instance of authentication token generation, validation, and access request in a secure, immutable ledger, wherein each log entry includes the timestamp, user identity, device details, IP address, token validity, and outcome of the authentication process to provide an audit trail for regulatory compliance;

applying, by a token expiration module within the identity provider, a time-based expiration on each authentication token, configured to adjust the expiration period based on the risk level of the requested data, with shorter expiration times applied to higher-risk data requests;

reissuing, by a reissuing module within the identity provider, an updated authentication token with an adjusted timestamp and refreshed TOTP if a time discrepancy or minor network delay is detected, ensuring that legitimate access requests are not denied due to transient synchronization issues;

requiring, by a multi-factor authentication (MFA) module within the identity provider, additional verification factors in the authentication process, including at least two of the following: biometric data, password, and device-based verification, to ensure robust user identity verification;

verifying, by a device-based authentication module within the identity provider, the user's device-specific identifiers, including a unique hardware identifier, and matching them against previously registered devices to restrict access to authorized devices;

analyzing, by a behavioral analysis module within the identity provider, access patterns and detecting anomalies in user location, frequency, or device usage, wherein anomalies trigger additional verification steps or alerts to prevent unauthorized access;

detecting, by a threat detection module within the identity provider, patterns indicative of security threats using machine learning algorithms, wherein the threat detection module dynamically adjusts authentication protocols based on detected risks;

initiating, by an emergency response module within the identity provider, a security lockdown upon detection of a significant threat, temporarily disabling token issuance for affected accounts and notifying system administrators to prevent unauthorized access;

limiting, by a rate-limiting module within the identity provider, a number of authentication token requests per user within a specified time frame, thereby reducing a likelihood of brute-force or token enumeration attacks on the inter-cloud authentication system; and

notifying, by the reissuing module, the user device when an updated authentication token is issued, prompting the user to reinitiate the authentication process using the reissued token to ensure seamless access in cases of transient timing discrepancies.

20 . A system for secure inter-cloud authentication with time-sync verification to control access to data distributed across multiple cloud storage providers, comprising:

a user device configured to initiate an access request for data stored across a plurality of cloud storage providers, wherein the access request includes user authentication credentials consisting of a biometric identifier, a password, and a time-based one-time password (TOTP) for generating a unique, session-specific authentication token;

an identity provider (IdP) operatively connected to the user device and responsible for managing inter-cloud authentication, wherein the IdP:

receives the authentication credentials from the user device,

processes the biometric identifier into a cryptographic hash to prevent direct exposure of the user's biometric data,

generates the TOTP using a user-specific secret key synchronized with a Network Time Protocol (NTP) server, and

produces an authentication token that integrates the cryptographic hash, TOTP, and a timestamp verified against the NTP server;

a timestamp validation module within the IdP, configured to compare the timestamp in the authentication token with the synchronized NTP server time, applying a predefined tolerance range to account for minor time discrepancies across cloud providers, ensuring that the authentication token is generated within a valid time window;

a token embedding module within the IdP, configured to embed the TOTP, cryptographic hash, and timestamp within the authentication token, ensuring that the token is unique to the session and prevents replay attacks by setting a limited validity period;

a primary cloud provider configured to receive the authentication token from the IdP and forward it to a secondary cloud provider specified in the access request, wherein the primary cloud provider acts as an intermediary to validate the inter-cloud access attempt;

a token validation module within the secondary cloud provider, configured to:

validate the authentication token by checking that the timestamp falls within an acceptable range relative to the secondary cloud provider's synchronized NTP server time,

verify the TOTP within the authentication token using the user's secret key to confirm the authenticity of the request, and

cross-check the token against a stored list of recently validated tokens to prevent token duplication or replay attacks;

an access control module within the secondary cloud provider, configured to grant or deny access to the requested data based on the successful validation of the timestamp, TOTP, and uniqueness of the authentication token, wherein access is restricted if any component of the token fails verification;

an inter-cloud communication module operatively connecting the IdP, primary cloud provider, and secondary cloud provider, configured to establish secure communication channels protected by a transmission protocol selected from the group consisting of TLS and HTTPS, ensuring data integrity and confidentiality during the inter-cloud authentication process;

a monitoring and audit module within the IdP, configured to record each instance of authentication token generation, validation, and access request in a secure, immutable ledger, wherein each log entry includes the timestamp, user identity, token validity, access outcome, and device details, providing a verifiable audit trail for regulatory compliance;

a token expiration module within the IdP, configured to enforce a time-based expiration on each authentication token, wherein tokens are set to expire within a preconfigured window relative to the session start time and are invalidated after expiration to prevent unauthorized reuse;

a reissuing module within the IdP, configured to generate an updated authentication token if minor synchronization discrepancies are detected, wherein the reissued token includes an adjusted timestamp and refreshed TOTP to ensure that legitimate access requests are not disrupted by transient network delays;

a multi-factor authentication (MFA) module within the IdP, configured to require multiple verification factors before generating the authentication token, including a combination of biometric data, a user password, and a device-specific identifier, enhancing security by ensuring that access is restricted to verified users;

a device-based authentication module within the MFA module, configured to verify the unique hardware identifier of the user's device against registered identifiers, ensuring that the access request originates from an authorized device before allowing token generation;

a behavioral analysis module within the IdP, configured to monitor access patterns and identify anomalies in user behavior, wherein detected anomalies, such as unusual access frequency, location discrepancies, or device changes, trigger additional authentication steps or alerts to mitigate a risk of unauthorized access;

a threat detection module within the IdP, configured to apply machine learning algorithms to identify patterns indicative of security threats, wherein the threat detection module dynamically adjusts authentication protocols, including modifying token expiration periods and requiring additional security factors in response to detected risk;

an emergency response module within the IdP, configured to disable token issuance and notify administrators upon detection of significant security threats, such as recurring access anomalies or attempted replay attacks, enabling immediate intervention and review of security settings;

a rate-limiting module within the IdP, configured to restrict a number of authentication token requests per user within a predefined time frame, thereby reducing a likelihood of brute-force or token enumeration attacks on the inter-cloud authentication system;

a token notification module within the reissuing module, configured to notify the user device if an updated authentication token is issued due to synchronization adjustments, prompting the user to reinitiate the authentication process with the refreshed token; and

a compliance and monitoring module within the IdP, configured to continuously oversee access patterns, token issuance frequency, and token validation events across cloud providers, generating real-time alerts for system administrators upon detecting unauthorized access attempts, ensuring ongoing system compliance with data security regulations and best practices.

Assignments (1)

Continuity (1)

References Cited (40)