# US 2016/0366188 A1 · System, apparatus and method for access control list processing in a constrained environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2016/0366188 A1 - Document ID: US20160366188A1 - Status: Published application - Kind: A1 - Application number: 14/856,857 - Filed: 2015-09-17 - Published: 2016-12-15 - Earliest claimed: 2015-06-09 - Assignees: Intel Corporation - Applicants: Intel Corporation - Inventors: Ned M. Smith; Mats G. Agerstam; Nathan Heldt-Sheller - Web page: https://patentgrep.com/patent/US20160366188A1 ## CPC - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - H04L 63/101: {Access control lists [ACL]} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 12/084: using delegated authorisation, e.g. open authorisation [OAuth] protocol - H04W 12/088: using filters or firewalls - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract In one embodiment, a method includes receiving a first request from a first device to access a first resource of the system and determining whether to grant access to the first resource based on a first access control list stored in the system, the first access control list associated with the first device, the first device having a first relevance value, and based on the determination, granting the access to the first resource; and receiving a second request from a second device to access a second resource of the system and forwarding the second request to an access manager service coupled to the system to determine whether to grant access to the second resource based on a second access control list stored in the access manager service associated with the second device, the second device having a second relevance value, receive an access grant from the access manager service and based thereon, granting the access to the second resource. ## Claims ### Claim 1 An apparatus comprising: a processor; a sensor to sense at least one parameter; a first storage to store the at least one parameter; and a second storage to store a first access control list associated with a first device, wherein the processor is to determine whether to grant an access request received from the first device to access a first resource of the apparatus based on the first access control list, the apparatus and the first device coupled in a distributed network having a distributed access control policy in which the apparatus is to locally host access control policy for a first subset of devices and at least one access manager service is to remotely host access control policy for a second subset of devices. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the apparatus is to receive a second request from a second device to access a second resource of the apparatus and forward the second request to the access manager service, wherein the second device is of the second subset of devices. ### Claim 3 (depends on 1) The apparatus of claim 1, wherein the apparatus is, responsive to a third request received from a third device, to send a redirection message to the third device to cause the third device to send the third request to the access manager service, to cause a third access control list associated with the third device to be dynamically provisioned to the second storage. ### Claim 4 (depends on 1) The apparatus of claim 1, wherein the first subset of devices comprises safety-related devices and the second subset of devices comprises non-safety-related devices. ### Claim 5 (depends on 4) The apparatus of claim 4, wherein the first device is of the first subset of devices, the first resource and the first device having a common safety label, wherein an intermediary device is to enable the access request to be sent to the apparatus based at least in part on a subject credential including the common safety label. ### Claim 6 (depends on 1) The apparatus of claim 1, wherein the first access control list comprises a subject field to store an identifier of the first device, a resource field to store a resource identifier of the first resource, and a permission field to store one or more access types to be granted to the first device. ### Claim 7 (depends on 1) The apparatus of claim 1, wherein the second storage is to store a third access control list comprising a subject field to store an identifier of a third device, a resource field to store a resource identifier of a third resource of the apparatus, and a distribution field to identify a distributed entity that is to perform an access decision for the third device. ### Claim 8 (depends on 1) The apparatus of claim 1, wherein the apparatus is to be dynamically provisioned with the first access control list based at least in part on a relevance value associated with the first device. ### Claim 9 (depends on 8) The apparatus of claim 8, wherein the apparatus is to thereafter delete the first access control list from the second storage based on request activity of the first device. ### Claim 10 (depends on 1) The apparatus of claim 1, wherein the apparatus comprises a sensor device. ### Claim 11 (depends on 1) The apparatus of claim 1, further comprising a networking device coupled between the first device and the apparatus, the network device to enable a first communication from the first device to be delivered to the apparatus, wherein the first device and the apparatus have a common safety label, the first communication having a first credential associated with the common safety device. ### Claim 12 At least one computer readable storage medium comprising instructions that when executed enable a system to: receive a first request from a first device to access a first resource of the system and determine whether to grant access to the first resource based on a first access control list stored in the system, the first access control list associated with the first device, the first device having a first relevance value, and based on the determination, grant the access to the first resource; and receive a second request from a second device to access a second resource of the system and forward the second request to an access manager service coupled to the system to determine whether to grant access to the second resource based on a second access control list stored in the access manager service, the second access control list associated with the second device, the second device having a second relevance value, receive an access grant from the access manager service and based thereon, grant the access to the second resource. ### Claim 13 (depends on 12) The at least one computer readable storage medium of claim 12, further comprising instructions that when executed enable the system to: receive a third request from a third device to access a third resource of the system, wherein at a time of receipt of the third request, the system does not store a third access control list associated with the third device; send a redirection message to the third device, to cause the third device to send the third request to the access manager service; receive the third access control list from the third device, the third access control list obtained in the third device from the access manager service; and receive a fourth request from the third device to access the third resource and determine whether to grant access to the third resource based on the third access control list stored in the system. ### Claim 14 (depends on 13) The at least one computer readable storage medium of claim 13, wherein the third access control list comprises a signed access control list, and further comprising instructions that when executed enable the system to receive a fifth request from the third device to access the third resource and prevent the access if a signature of the signed access control list is invalid. ### Claim 15 (depends on 12) The at least one computer readable storage medium of claim 12, further comprising instructions that when executed enable the system to store the first access control list in the system based on the first relevance value and not store the second access control list in the system based on the second relevance value. ### Claim 16 (depends on 12) The at least one computer readable storage medium of claim 12, further comprising instructions that when executed enable the system to cause the second access control list to be stored in a controller located in a common network portion with the system. ### Claim 17 (depends on 12) The at least one computer readable storage medium of claim 12, wherein the system comprises a sensor device, the sensor device including a storage to store the first access control list, and wherein the sensor device is located in a first network portion and is coupled to a controller located in the first network portion, the controller comprising the access manager service to store the second access control list. ### Claim 18 (depends on 12) The at least one computer readable storage medium of claim 12, wherein the access grant to the first resource comprises one of a create, read, update, delete, notify and publish access. ### Claim 19 (depends on 12) The at least one computer readable storage medium of claim 12, further comprising instructions that when executed enable the system to dynamically provision the first access control list into the system and to thereafter delete the first access control list from the system based on request activity of the first device. ### Claim 20 (depends on 12) The at least one computer readable storage medium of claim 12, further comprising instructions that when executed enable the system to receive an authorization token from the access manager service, validate the authorization token, and responsive to validation of the authorization token, enable a fourth device to access a fourth resource of the system. ### Claim 21 (depends on 12) The at least one computer readable storage medium of claim 12, further comprising instructions that when executed enable the system to receive a resource access request from a requester device to access a requested resource of the system, redirect the resource access request to the access manager service, and thereafter receive a token generated by the access manager service, and grant the access to the requested resource. ### Claim 22 A system comprising: at least one sensor device including a processor and a storage to store a first access control list associated with a first device, wherein the processor is to determine whether to grant an access request received from the first device to access a first resource of the at least one sensor device based on the first access control list, the at least one sensor device and the first device coupled in a distributed network having a distributed access control policy in which the at least one sensor device is to locally host access control policy for a first subset of devices and at least one access manager service is to remotely host access control policy for a second subset of devices, the at least one sensor device to be located in a first portion of a network; and a first controller coupled to the at least one sensor device, the first controller to control the at least one sensor device, the first controller including a second storage to store a second access control list and to determine whether to allow a second device to access the at least one sensor device based on the second access control list, the first controller located in a second portion of the network. ### Claim 23 (depends on 22) The system of claim 22, wherein the first network portion comprises an autonomous network portion and the second network portion comprises a semi-autonomous network portion. ### Claim 24 (depends on 22) The system of claim 22, further comprising a server coupled to the first controller, the server comprising an access manager service and a storage to store a third access control list, the access manager service to determine whether to allow a third device to access the at least one sensor device based on the third access control list, the server located in a third portion of the network. ### Claim 25 (depends on 24) The system of claim 24, wherein the access manager service is to dynamically provision the third access control list to the at least one sensor device as a temporal access control list, to enable the at least one sensor device to perform access control decisions with regard to the third device within a temporal window.