Patent ID: 11962596
Assignee: BANK OF AMERICA CORPORATION
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. An access control device, comprising:
a memory operable to store:
device profiles identifying approved user devices for accessing a network, wherein each user device is associated with device authentication credentials; and
user profiles identifying approved users for accessing the network, wherein each user is associated with user credentials; and

a processor operably coupled to the memory, configured to:
receive a connection request from a user device, wherein the connection request comprises device authentication credentials for the user device;
identify a device profile for the user device that corresponds with the device authentication credentials;
determine that the user device passes authentication in response to identifying the device profile;
receive user credentials for a first user of the user device;
identify a first user identity of the first user using the user credentials for the first user;
establish a first network connection with the user device, wherein the first network restricts access to network resources;
send a token request to the user device via the first network connection, wherein the token request is sent by executing code to redirect a browser on the user device to a webpage;
receive a token from the webpage and via the first network connection in response to sending the token request to the user device, wherein the token is a unique value that is associated with the first user;
identify a second user identity of the first user obtained using the token;
determine that the first user identity of the first user matches the second user identity of the first user; and
establish a second network connection for the user device, wherein the second network connection enables the user device to access the network resources that were restricted by the first network connection, wherein identifying the second user identity of the first user obtained using the token includes:
sending the token to an identity provider device that is configured to validate the token; and
receiving the second user identity from the identity provider device after validating the token.