System Providing Methodology for Access Control with Cooperative Enforcement

A system for authenticating and assigning access privileges to a client device for access to a service, the system comprising:

• a policy specifying access privileges to be assigned to a client device based on attributes of the client device;
• a primary authentication module for receiving a request from a client device for access to the service and determining whether to authenticate the client device for access to the service;
• and
• a supplemental authentication module for examining attributes of a client device authenticated by said primary authentication module and assigning access privileges to the client device based on the policy.

A method for assigning privileges to a client to use a service based on an access policy, the method comprising:

• specifying an access policy for assigning privileges to a client to use the service based on attributes of the client;
• detecting a request for use of the service from a client;
• attempting authentication of the client based on user identity information provided by the client;
• if the client is authenticated based on user identity, collecting attribute information from the client;
• and
• assigning privileges to the client to use the service based on the collected attribute information and the access policy.

In a system comprising a client computer connecting to a service through a network, a method for regulating access to the service based on a specified access policy, the method comprising:

• transmitting a challenge from the service to the client computer connecting to the service for determining whether the client computer is in compliance with said specified access policy, wherein said access policy includes attributes of the client device that are acceptable for permitting access to the service;
• transmitting a response from the client computer back to the service, for responding to the challenge issued by the service;
• and
• blocking access to the service by the client computer if the client computer does not respond appropriately to the challenge issued by the service.