# US 11,451,555 B2 · Resource-driven dynamic authorization framework > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,555 B2 - Document ID: US11451555B2 - Status: Granted - Kind: B2 - Application number: 17/102,494 - Filed: 2020-11-24 - Published: 2021-03-18 - Granted: 2022-09-20 - Earliest claimed: 2015-07-02 - Assignees: Convida Wireless, LLC - Applicants: Convida Wireless, LLC - Inventors: Vinod Kumar Choyi; Chonggang Wang; Shamim Akbar Rahman; Quang Ly; Xu Li; Zhuo Chen; Rocco Di Girolamo - Web page: https://patentgrep.com/patent/US11451555B2 ## CPC - H04L 63/105: {Multiple levels of security} - G06Q 20/383: {Anonymous user system} - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04L 63/101: {Access control lists [ACL]} - H04L 63/102: {Entity profiles} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Embodiments concern a dynamic authorization framework. Security Classification Process (SCP) is the process of classifying raw data, information extracted from raw data, content or code from security-value perspective. Security Achievability Determination Process (SADP) is a process based on a SV/SC that has been assigned, the RHE may determine the Security Requirements and how the security requirements may be achieved. During the Security Achievability Listing Process (SALP), the RHE uploads onto the Resource Listing Entity (RLE) the URI of the resource, the SAM associated with the resource and optionally a digital certificate associated with the resource. During the SAM Assessment Process (SAMAP) process, a Client evaluates the security mechanisms that must be carried out in order to meet the SAM that was provided as part of the Discovery Process (DP). Based on the SAM obtained from the RLE, the Client may initiate a Security Achievability Enabling Process (SAEP). The Client may be required to initiate an Authentication, Authorization, Payment and obtain an assertion of secure behavior from a Security-Achievability Enabler Function (SAEF), which may be a trusted third-party Function or Entity. ## Claims ### Claim 1 An apparatus, comprising a processor, a memory, and computer-executable instructions stored in the memory which, when executed by the processor, cause the apparatus to: send, to a Resource Listing Entity (RLE), a query pertaining to a resource; receive, from the RLE, a response to the query, the response comprising a location of the resource and a Security Achievability Mechanism (SAM) associated with the resource; determine, based on the SAM, a security level required for accessing the resource; determine, based on the security level and needs of the apparatus, an authorization model for accessing the resource, the authorization model being a push model, a pull model, an agent model, a push confirm model, or an indirect push model; and apply the authorization model in communications required for compliance with the SAM in accessing the resource. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the needs of the apparatus comprise one or more of a constraint on available battery, memory, computational bandwidth, and certificate. ### Claim 3 (depends on 1) The apparatus of claim 1, wherein the instructions further cause the apparatus to: identify an Authorization Server (AS), the AS being trustable by the apparatus and the RLE; and contact the AS server to obtain access to the resource. ### Claim 4 (depends on 1) The apparatus of claim 1, wherein the instructions further cause the apparatus to determine to perform, based on the SAM and the needs of the apparatus, a proxy-authentication operation. ### Claim 5 (depends on 1) The apparatus of claim 1, wherein the instructions further cause the apparatus to determine to perform, based on the SAM and the needs of the apparatus, a proxy-retrieval operation. ### Claim 6 (depends on 1) The apparatus of claim 1, wherein the instructions further cause the apparatus to: initiate an authentication, authorization, and/or payment operation; in response to the authentication, authorization, and/or payment operation, obtain an assertion of secure behavior from a Security-Achievability Enabler Function (SAEF). ### Claim 7 (depends on 6) The apparatus of claim 6, wherein the SAEF is a trusted third-party function. ### Claim 8 (depends on 1) The apparatus of claim 1, wherein the instructions further cause the apparatus to: identify a protocol associated the authorization model; download the protocol; use the protocol in applying the model in communications required for compliance with the SAM in accessing the resource. ### Claim 9 (depends on 7) The apparatus of claim 7, in which the protocol is Datagram Transport Layer Security (DTLS).