# US 2008/0189776 A1 · Method and System for Dynamically Controlling Access to a Network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2008/0189776 A1 - Document ID: US20080189776A1 - Status: Published application - Kind: A1 - Application number: 12/024,905 - Filed: 2008-02-01 - Published: 2008-08-07 - Earliest claimed: 2007-02-01 - Assignees: Credit Suisse Securities (USA) LLC - Inventors: Colin Constable - Web page: https://patentgrep.com/patent/US20080189776A1 ## CPC - H04L 63/10: {for controlling access to devices or network resources} - G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints - H04L 12/1822: {Conducting the conference, e.g. admission, detection, selection or grouping of participants, correlating users to one or more conference sessions, prioritising transmission} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04W 12/06: Authentication - H04W 12/065: Continuous authentication - G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - H04L 63/102: {Entity profiles} - H04L 2463/082: applying multi-factor authentication - H04W 12/08: Access security - H04W 12/40: Security arrangements using identity modules - H04W 12/63: Location-dependent; Proximity-dependent - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract The dynamic access evaluation system receives a service request from a device seeking access to a network. The system receives information about the requester, the device from which the request is made and/or the location of the requester and the device. The system analyzes rule sets for the application being requested on the network to determine whether authentication is necessary. The system authenticates the requester based on a comparison of authorization information to information about the requester received in the request. The system authenticates the device by comparing device information in the request to historical device information. Furthermore, the system receives location information for the device and the requester and compares them to determine whether the locations are the same or similar. After granting access, the system continues to monitor information about the requester, device, or location and can terminate device access based on a change in the monitored information. ## Claims ### Claim 1 A computer-implemented method for dynamically evaluating access by a requester to a computer network, comprising the steps of: receiving a request for access to the network from a requester at a device; receiving authentication information for the requester; accepting authorization information for the requester; comparing the authentication information to authorization information to determine whether the requester is authentic; generating an authentication score based on the comparison of the authentication information to the authorization information; and determining network access based on the authentication score. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising the steps of: granting the requester access to the network at the device; providing the requester access to the network at the device; receiving additional authentication information for the requester; identifying a change in the authentication information for the requester, wherein at least a portion of the additional authentication information is different than the authentication information; and determining whether to terminate access to the network for the requester at the device based on said change. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the authentication information comprises two-factor authentication information. ### Claim 4 (depends on 3) The computer-implemented method of claim 3, wherein the two-factor authentication information comprises a security identification and a personal identification number. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the authentication information comprises biometric data of the requester. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein comparing the authentication information to the authorization information comprises: determining whether the authentication information is substantially similar to the authorization information; and generating the authentication score based on the similarity of the authentication information to the authorization information. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein comparing the authentication information to the authorization information comprises: determining the identity of the requester based on the authentication information; determining a service requested by the requester in the network; and determining whether the requester is authorized to access the service on the network by comparing the identity of the requester to a listing of users permitted to access the service. ### Claim 8 (depends on 7) The computer-implemented method of claim 7, wherein the service comprises an application on the network. ### Claim 9 A computer-implemented method for dynamically evaluating access by a device to a computer network, comprising the steps of: receiving a request for access to the network from a device; receiving information about the device making the request; comparing the device information to historical device information; determining whether the device is authentic based on the comparison of the device information to the historical device information; generating an authentication score based on the comparison of the device information to historical device information; and determining whether to grant network access to the device based on the authentication score. ### Claim 10 (depends on 9) The computer-implemented method of claim 9, wherein determining whether to grant network access to the device based on the authentication score comprises: evaluating the authentication score; evaluating at least a portion of the comparison of the device information to the historical device information; and determining whether to grant network access to the device based on the authentication score and the portion of the comparison of device information to the historical device information. ### Claim 11 (depends on 9) The computer-implemented method of claim 9, further comprising the steps of: granting the device access to the network; providing the device access to the network; receiving additional device information for the device while the device is accessing the network; identifying a change in the device information, wherein at least a portion of the additional device information is different than the device information; and determining whether to terminate access to the network for the device based on the change. ### Claim 12 (depends on 9) The computer-implemented method of claim 9, wherein the information about the device comprises fingerprint data of the device. ### Claim 13 (depends on 9) The computer-implemented method of claim 9, wherein determining whether the device is authentic comprises the steps of determining whether the device information is substantially similar to the historical device information; and generating the authentication score based on the amount of similarity between the device information and the historical device information. ### Claim 14 (depends on 9) The computer-implemented method of claim 9, further comprising the steps of: determining a service requested by the device in the network; evaluating a set of rules related to the requested service to determine whether authentication of the device is required for the requested service; and granting access to the service on the network without evaluating the authentication score if it is determined that authentication of the device is not required for the requested service. ### Claim 15 (depends on 14) The computer-implemented method of claim 14, further comprising the step of: evaluating the authentication score to determine whether to grant network access if it is determined that authentication is required for the requested service. ### Claim 16 (depends on 14) the computer-implemented method of claim 14, wherein the service comprises an application on the network. ### Claim 17 A computer-implemented method for dynamically evaluating access by a device to a computer network, comprising the steps of: receiving a request for access to the network from a requester at a device; receiving a device location; receiving a requester location; comparing the location of the device to the location of the requester to determine whether they are substantially similar; and granting access to the network at the device based on a positive determination that the device location and the requester location are substantially similar. ### Claim 18 (depends on 17) The computer-implemented method of claim 17, further comprising the steps of: determining a service requested by the device in the network; evaluating a set of rules related to the requested service to determine whether determining the location of the device or the requester is required for access to the service; and granting access to the service on the network without regard to the comparison of the location of the device to the location of the requester based on a determination that determining the location of the device or the requester is not required for access to the service. ### Claim 19 (depends on 17) The computer-implemented method of claim 17, further comprising the steps of: determining a service requested by the device in the network; evaluating a set of rules related to the requested service to determine a location where the service can be accessed; determining whether the location of the device is within the location where the service is allowed to be accessed; and providing the device access to the service on the network based on a positive determination that the location of the device is within the location where the service is allowed to be accessed. ### Claim 20 (depends on 19) The computer-implemented method of claim 19, further comprising the steps of: receiving additional device location information while the device is accessing the service on the network; identifying a change in the location of the device based on a difference between the device location and the additional device location information; determining whether the location of the device is within the location where the service is allowed to be accessed based on the additional device location information; and determining whether to terminate access to the service based on the additional device location information. ### Claim 21 (depends on 17) The computer-implemented method of claim 17, further comprising the steps of: determining a service requested by the device in the network; evaluating a set of rules related to the requested service to determine a location where the service can be accessed; determining whether the location of the requester is within the location where the service is allowed to be accessed; and providing the device access to the service on the network based on a positive determination that the location of the requester is within the location where the service is allowed to be accessed. ### Claim 22 (depends on 21) The computer-implemented method of claim 21, further comprising the steps of: receiving additional requester location information while the device is accessing the service on the network; identifying a change in the location of the requester based on the additional device location information; determining whether the location of the requester is within the location where the service is allowed to be accessed based on the additional requester location information; and determining whether to terminate access to the service based on the additional requester location information. ### Claim 23 (depends on 17) The computer-implemented method of claim 17, wherein the requester location is determined from presence feeds. ### Claim 24 (depends on 17) The computer-implemented method of claim 17, wherein the device location is determined from a global positioning system signal. ### Claim 25 (depends on 17) The computer-implemented method of claim 17, wherein receiving the device location comprises: accepting an internet protocol address for the request; evaluating the internet protocol address to determine a location of the internet protocol address; assigning the location of the internet protocol address as the device location. ### Claim 26 (depends on 17) The computer-implemented method of claim 17, further comprising the steps of: determining the identity of the requester comprising the steps of: receiving authentication information for the requester; accepting authorization information for the requester; comparing the authentication information to the authorization information to determine whether the requester is authentic; identifying the requester based on a positive determination that the requester is authentic. ### Claim 27 (depends on 17) The computer-implemented method of claim 17, wherein receiving the requester location comprises the steps of: receiving the device location, wherein the device comprises a webcam; receiving a video feed of at least a portion of the requester from the webcam; determining the identity of the requester based on the video feed; and setting the location of the requester as equal to the device location. ### Claim 28 (depends on 17) The computer-implemented method of claim 17, wherein receiving the requester location comprises the steps of: receiving the device location; receiving a biometric data of the requester at the device; evaluating the biometric data to determine the identity of the requester; and setting the location of the requester as equal to the device location. ### Claim 29 (depends on 17) The computer-implemented method of claim 17, further comprising the steps of: generating a location score based on the similarity in location information for the device and the requester; and determining whether to grant network access to the device based on the location score. ### Claim 30 (depends on 29) The computer-implemented method of claim 29, wherein the location score improves based on increase in the number of location source providers that identify that the requester and the device are in a substantially similar location. ### Claim 31 A system for dynamically evaluating access by a device to a computer network comprising a first logic component for receiving information about a requester using the device and determining the authenticity of the requester; a second logic component for receiving information about the device making a request to access the network and determine whether the device is authentic; and a third logic component for receiving information about a location of the device and a location of the requester and determining whether the locations of the device and the requester are substantially similar. ### Claim 32 (depends on 31) The system of claim 31, further comprising a policy engine for receiving the determinations of the first, second, and third logic components and determining whether to grant the device access to the network based on those determinations. ### Claim 33 (depends on 32) The system of claim 32, wherein the policy engine further receives at least a portion of the information about the location of the device and the location of the requester and determining whether to grant the device access to the network further comprises an evaluation of the received portion of the information about the location of the device and the location of the requester. ### Claim 34 (depends on 32) The system of claim 32, wherein the policy engine receives updated information from at least one of the first, second, and third logic components while the device is accessing the network, wherein the updated information is analyzed by the policy engine to identify differences between the updated information and the information from the first, second, and third logic components. ### Claim 35 (depends on 34) The system of claim 34, further comprising a plurality of applications, at least a portion of the applications comprising access rules, wherein the policy engine evaluates the access rules for an application requested by the device and terminates the connection between the device and the network if the difference between the updated information and the information from the first, second, and third logic components violates at least one of the access rules for the requested application. ### Claim 36 (depends on 31) The system of claim 31, further comprising presence feeds communicably connected to the third logic component, wherein the presence feeds comprise information about the location of the requester. ### Claim 37 (depends on 31) The system of claim 31, further comprising an authorization repository communicably connected to the first logic component, wherein the authorization database comprises user permission information for a plurality of services on the network. ### Claim 38 (depends on 31) The system of claim 31, further comprising a repository of device assets communicably connected to the second logic component, wherein the repository comprises information about a plurality of devices having access to the network. ### Claim 39 (depends on 31) The system of claim 31, wherein the first, second, and third logic components are comprised in a single logic component. ### Claim 40 A computer-implemented method for dynamically evaluating access by a requester to a computer network, comprising the steps of: determining a first authentication information for the requester at a first period in time; determining a second authentication information for the requester at a second period in time while the requester is accessing the network; comparing the first authentication information to the second authentication information; identifying a change between the first and second authentication information for the requester; and determining whether to terminate the requester's access to the network at the device based on the change. ### Claim 41 (depends on 40) The computer-implemented method of claim 40, wherein determining whether to terminate the requester's access to the network at the device is based on an evaluation of the second authentication information. ### Claim 42 (depends on 40) The computer-implemented method of claim 40, further comprising the step of granting the requester access to the network at the device based on the first authentication information. ### Claim 43 A computer-implemented method for dynamically evaluating access by a device to a computer network, comprising the steps of: receiving a first set of information about the device making the request at a first period of time; receiving a second set of information about the device at a second period of time, while the device is accessing the network; comparing the first set of information about the device to the second set of information about the device; identifying a change between the first and second set of information; and determining whether to terminate the device's access to the network based on the change. ### Claim 44 (depends on 43) The computer-implemented method of claim 43, wherein determining whether to terminate the device's access to the network is based on an evaluation of the second set of information about the device. ### Claim 45 (depends on 43) The computer-implemented method of claim 43, further comprising the step of granting the device access to the network based on the first set of information about the device. ### Claim 46 A computer-implemented method for dynamically evaluating access by a device to a computer network, comprising the steps of: receiving a first location for the device at a first period of time; receiving a second location for the device at a second period of time, while the device is accessing the network; comparing the first location to the second location; identifying a change between the first and second location of the device; and determining whether to terminate the device's access to the network based on the change. ### Claim 47 (depends on 46) The computer-implemented method of claim 46, wherein determining whether to terminate the device's access to the network is based on an evaluation of the second location for the device. ### Claim 48 (depends on 46) The computer-implemented method of claim 46, further comprising the step of granting the device access to the network based on the first location for the device. ### Claim 49 A computer-implemented method for dynamically evaluating access by a requester at a device to a computer network, comprising the steps of: receiving a first location for the requester at a first period of time; receiving a second location for the requester at a second period of time, while the device is accessing the network; comparing the first location to the second location of the requester; identifying a change between the first and second location of the requester; and determining whether to terminate access to the network based on the change. ### Claim 50 (depends on 49) The computer-implemented method of claim 49, wherein determining whether to terminate access to the network is based on an evaluation of the second location for the requester. ### Claim 51 (depends on 49) The computer-implemented method of claim 49, further comprising the step of granting the requester access to the network at the device based on the first location for the requester. ### Claim 52 A system for dynamically evaluating access by a device to a computer network comprising: a first logic component for receiving information about a requester using the device and determining the authenticity of the requester; a second logic component for receiving information about the device making a request to access the network and determine whether the device is authentic; a third logic component for receiving information about a location of the device and a location of the requester and determining whether the locations of the device and the requester are substantially similar; a policy engine for receiving information from at least one of the first, second, and third logic components at a first period of time and updated information from at least one of the first, second, and third logic components at a second period of time, while the device is accessing the network, wherein the information and the updated information are compared to identify a change and a determination is made whether to terminate access by the device to the network based on the change.