# US 7,614,078 B1 · Threshold access based upon stored credentials > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 7,614,078 B1 - Document ID: US7614078B1 - Status: Granted - Kind: B1 - Application number: 10/406,342 - Filed: 2003-04-02 - Granted: 2009-11-03 - Earliest claimed: 2003-04-02 - Assignees: Cisco Technology, Inc. - Inventors: Jeremy Stieglitz - Web page: https://patentgrep.com/patent/US7614078B1 ## CPC - H04L 9/321: {involving a third party or a trusted authority} - H04L 2209/043: of tables, e.g. lookup, substitution or mapping - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method and apparatus for authorizing an access requester to access a data communication network is provided. A determination is made that a threshold access control server cannot process an access request associated with the access requester. Access requester history data, or data that describes the access history for an access requester, is analyzed to obtain a threshold access level. A threshold access level is an expression of how likely that a particular access requester is a legitimate access requester. A session profile is selected for the access requester based on the threshold access level. The session profile indicates one or more actions the access requester is authorized to perform in the network. The session profile may subsequently be transmitted to the access requester to allow the access requester access to the network to the extent appropriate in view of the access requester history data. ## Claims ### Claim 1 A method, comprising: receiving, from an access requester that does not have access to a data communication network, a request to access the data communication network; the access control server attempting to obtain assistance from an external validation server that normally handles one or more credentials used for authentication to process the request; storing and maintaining, separate from the external validation server, access requester history data for the access requester, wherein the access requester history data comprises one or more of a location of validation of one or more prior access requests, a length of time since a last successful access request from the access requester, a length of time that an account associated with the access requester has existed, a type of credential associated with the access request, a group membership associated with the access requester, a MAC address or other unique identifier associated with the access request, or a status credential that represents a security configuration of a device associated with the assess requester; determining that an access control server cannot process the access request associated with the access requester, wherein said determining that the access control server cannot process the access request includes failing to obtain the assistance from the external validation server; and in response to failing to obtain the assistance from the external validation server: the access control server analyzing the access requester history data to determine a threshold access level for the access requester, wherein the access requester history data describes a history of attempts to access resources by a set of users, wherein the set of users includes the access requester, and wherein the threshold access level is an expression of how likely the access requester is a legitimate access requester; the access control server selecting a session profile for the access requester based on the threshold access level for the access requester, wherein the session profile indicates one or more actions the access requester is authorized to perform in the network; and based on the session profile, the access control server authorizing, without accessing one or more external servers to authenticate the one or more credentials that are normally handled by the one or more external servers, the access requester to perform one or more actions in the network. ### Claim 2 (depends on 1) The method of claim 1, wherein analyzing the access requester history data includes applying one or more threshold filters to the access requester history data to result in determining the threshold access level. ### Claim 3 (depends on 1) The method of claim 1, wherein the session profile is selected by mapping the threshold access level to one or more stored session profiles for the access requester. ### Claim 4 (depends on 1) The method of claim 1, wherein the access requester history data identifies one or more prior unsuccessful access requests from the access requester. ### Claim 5 (depends on 1) The method of claim 1, further comprising: prior to analyzing the access requester history data, storing the access requester history data, for the access requester, at a client of the access control server. ### Claim 6 (depends on 1) The method of claim 1, further comprising: prior to analyzing the analyzing access requester history data, storing the access requester history data, for the access requester, at the access control server. ### Claim 7 (depends on 1) The method of claim 1, further comprising: prior to analyzing the access requester history data, storing the access requester history data for the access requester, wherein the access requester history data is imported, and wherein the access requester history data describes activity for the access requester prior to the importation. ### Claim 8 (depends on 1) The method of claim 1, wherein selecting the session profile is performed by a client of the access control server. ### Claim 9 (depends on 1) The method of claim 1, further comprising: requesting the access requester to supply additional authentication or access control information; analyzing the additional authentication or access control information with the access requester history data to determine the threshold access level. ### Claim 10 (depends on 1) The method of claim 1, further comprising: storing local accounting data that includes information about the session profile assigned to the access requester. ### Claim 11 (depends on 10) The method of claim 10, further comprising: periodically querying the access control server to determine a status of the access control server until the status indicates that the access control server is able to process future access requests; and in response to determining that the status indicates that the access control server is able to process future access requests, updating the access control server with the local accounting data. ### Claim 12 An apparatus for authorizing an access requester to access a data communication network, comprising: one or more processors; and a machine-readable medium carrying one or more sequences of instructions, which when executed by the one or more processors, causes: receiving, from an access requester that does not have access to a data communication network, a request to access the data communication network; the access control server attempting to obtain assistance from an external validation server that normally handles one or more credentials used for authentication to process the request; storing and maintaining, separate from the external validation server, access requester history data for the access requester, wherein the access requester history data comprises one or more of a location of validation of one or more prior access requests, a length of time since a last successful access request from the access requester, a length of time that an account associated with the access requester has existed, a type of credential associated with the access request, a group membership associated with the access requester, a MAC address or other unique identifier associated with the access request, or a status credential that represents a security configuration of a device associated with the assess requester; determining that an access control server cannot process the access request associated with the access requester, wherein said determining that the access control server cannot process the access request includes failing to obtain the assistance from the external validation server; and in response to failing to obtain the assistance from the external validation server: the access control server analyzing access requester history data to determine a threshold access level for the access requester, wherein the access requester history data describes a history of attempts to access resources by a set of users, wherein the set of users includes the access requester, and wherein the threshold access level is an expression of how likely the access requester is a legitimate access requester; the access control server selecting a session profile for the access requester based on the threshold access level for the access requester, wherein the session profile indicates one or more actions the access requester is authorized to perform in the network; and based on the session profile, the access control server authorizing, without accessing one or more external servers to authenticate credentials that are normally handled by the one or more external servers, the access requester to perform one or more actions in the network. ### Claim 13 (depends on 12) The apparatus of claim 12, wherein analyzing the access requester history data includes applying one or more threshold filters to the access requester history data to result in determining the threshold access level. ### Claim 14 (depends on 12) The apparatus of claim 12, wherein the session profile is selected by mapping the threshold access level to one or more stored session profiles for the access requester. ### Claim 15 (depends on 12) The apparatus of claim 12, wherein the access requester history data identifies one or more prior unsuccessful access requests from the access requester. ### Claim 16 (depends on 12) The apparatus of claim 12, further comprising: prior to analyzing the access requester history data, storing the access requester history data, for the access requester, at a client of the access control server. ### Claim 17 (depends on 12) The apparatus of claim 12, further comprising: prior to analyzing the access requester history data, storing the access requester history data, for the access requester, at the access control server. ### Claim 18 (depends on 12) The apparatus of claim 12, further comprising: prior to analyzing the access requester history data, storing the access requester history data for the access requester, wherein the access requester history data is imported, and wherein the access requester history data describes activity for the access requester prior to the importation. ### Claim 19 (depends on 12) The apparatus of claim 12, wherein selecting the session profile is performed by a client of the access control server. ### Claim 20 (depends on 12) The apparatus of claim 12, further comprising: requesting the access requester to supply additional authentication or access control information; analyzing the additional authentication or access control information with the access requester history data to determine the threshold access level. ### Claim 21 (depends on 12) The apparatus of claim 12, further comprising: storing local accounting data that includes information about the session profile assigned to the access requester. ### Claim 22 (depends on 12) The apparatus of claim 12, further comprising: periodically querying the access control server to determine a status of the access control server until the status indicates that the access control server is able to process future access requests; and in response to determining that the status indicates that the access control server is able to process future access requests, updating the access control server with the local accounting data. ### Claim 23 An apparatus for authorizing an access requester to access a data communication network, comprising: means for receiving, from an access requester that does not have access to a data communication network, a request to access the data communication network; means for the access control server attempting to obtain assistance from an external validation server that normally handles one or more credentials used for authentication to process the request; means for storing and maintaining, separate from the external validation server, access requester history data for the access requester, wherein the access requester history data comprises one or more of a location of validation of one or more prior access requests, a length of time since a last successful access request from the access requester, a length of time that an account associated with the access requester has existed, a type of credential associated with the access request, a group membership associated with the access requester, a MAC address or other unique identifier associated with the access request, or a status credential that represents a security configuration of a device associated with the assess requester; means for determining that an access control server cannot process the access request associated with the access requester, wherein said means for determining that the access control server cannot process the access request includes means for determining a failure to obtain the assistance from the external validation server; means, responsive to the means for determining that the access control server cannot process the access request, for the access control server analyzing access requester history data to determine a threshold access level for the access requester, wherein the access requester history data describes a history of attempts to access resources by a set of users, wherein the set of users includes the access requester, and wherein the threshold access level is an expression of how likely the access requester is a legitimate access requester; means for the access control server selecting a session profile for the access requester based on the threshold access level for the access requester, wherein the session profile indicates one or more actions the access requester is authorized to perform in the network; and means, based on the session profile, for the access control server authorizing, without accessing one or more external servers to authenticate credentials that are normally handled by the one or more external servers, the access requester to perform one or more actions in the network. ### Claim 24 (depends on 23) The apparatus of claim 23, wherein the means for analyzing the access requester history data includes means for applying one or more threshold filters to the access requester history data to result in determining the threshold access level. ### Claim 25 (depends on 23) The apparatus of claim 23, wherein the session profile is selected by mapping the threshold access level to one or more stored session profiles for the access requester. ### Claim 26 (depends on 23) The apparatus of claim 23, wherein the access requester history data identifies one or more prior unsuccessful access requests from the access requester. ### Claim 27 (depends on 23) The apparatus of claim 23, further comprising: means for, prior to analyzing the access requester history data, storing the access requester history data, for the access requester, at a client of the access control server. ### Claim 28 (depends on 23) The apparatus of claim 23, further comprising: means for, prior to analyzing the access requester history data, storing the access requester history data, for the access requester, at the access control server. ### Claim 29 (depends on 23) The apparatus of claim 23, further comprising: means for, prior to analyzing the access requester history data, storing the access requester history data for the access requester, wherein the access requester history data is imported, and wherein the access requester history data describes activity for the access requester prior to the importation. ### Claim 30 (depends on 23) The apparatus of claim 23, wherein selecting the session profile is performed by a client of the access control server. ### Claim 31 (depends on 23) The apparatus of claim 23, further comprising: means for requesting the access requester to supply additional authentication or access control information; and means for analyzing the additional authentication or access control information with the access requester history data to determine the threshold access level. ### Claim 32 (depends on 23) The apparatus of claim 23, further comprising: means for storing local accounting data that includes information about the session profile assigned to the access requester. ### Claim 33 (depends on 23) The apparatus of claim 23, further comprising: means for periodically querying the access control server to determine a status of the access control server until the status indicates that the access control server is able to process future access requests; and in response to determining that the status indicates that the access control server is able to process future access requests, updating the access control server with the local accounting data.