# US 8,474,031 B2 · Access control method and apparatus > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,474,031 B2 - Document ID: US8474031B2 - Status: Granted - Kind: B2 - Application number: 11/917,346 - Filed: 2005-06-28 - Published: 2010-06-03 - Granted: 2013-06-25 - Earliest claimed: 2005-06-28 - Assignees: Hewlett-Packard Development Company, L.P. - Applicants: Ravigopal Vennelakanti; Savio Fernandes - Inventors: Ravigopal Vennelakanti; Savio Fernandes - Web page: https://patentgrep.com/patent/US8474031B2 ## CPC - G06F 21/33: using certificates - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 2221/2113: Multi-level security, e.g. mandatory access control - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method of controlling access to computing resources, comprising providing a first computing device with access to a database containing data indicative of computing resources access to which is controlled by the first computing device and a minimum security capability that a second computing device must possess to access the respective resources, assigning the second computing device a security capability, providing the second computing device with data indicative of the security capability, configuring the first computing device to respond to data indicative of the security capability and data indicative of a desired access from the second computing device by ascertaining the minimum required security capability corresponding to the desired access and by comparing the minimum required security capability with the security capability of the second computing device, and providing the desired access if the security capability of the second computing device meets the minimum security capability for the desired access. ## Claims ### Claim 1 A method of controlling access to computing resources, comprising: providing a first computing device with access to a database containing data indicative of a plurality of computing resources access to which is controlled by said first computing device and a minimum level of required security capability that a second computing device must possess to be provided with access to said respective computing resources; assigning said second computing device a security capability; determining security audit data in real-time, after manufacture of the second computing device, the security audit data including at least current hardware and software configuration and current software state of the second computing device; providing said second computing device with data indicative of said security capability; configuring said first computing device to respond to receiving said data indicative of said security capability and data indicative of a desired access from said second computing device by ascertaining the minimum level of required security capability corresponding to said desired access and by comparing said minimum level of required security capability with said security capability of said second computing device; and providing said desired access if said security capability of said second computing device meets said minimum security capability for said desired access. ### Claim 2 (depends on 1) A method as claimed in claim 1, further comprising transmitting a message indicating a desired access from said second computing device to said first computing device, and subsequently transmitting said data indicative of said security capability data to said first computing device upon request of said first computing device. ### Claim 3 (depends on 1) A method as claimed in claim 1, including assigning the security capability of said second computing device according to a metric for categorizing said second computing device depending on compliance of said second computing device with a set of security standards and security requirements. ### Claim 4 (depends on 1) A method as claimed in claim 1, including storing said data indicative of said security capability in a digital certificate. ### Claim 5 (depends on 4) A method as claimed in claim 4, including storing said digital certificate in a trusted platform module chip provided in said second computing device. ### Claim 6 (depends on 1) A method as claimed in claim 1, including the first computing device sending a request to the second computing device for security audit data, the security audit data including at least the current hardware and software configuration and the current software state of the second computing device. ### Claim 7 (depends on 6) A method as claimed in claim 6, including the second computing device generating said security audit data by conducting a security audit during use of the second computing device, after manufacture of the second computing device, in a secure area of the second computing device upon receiving said request. ### Claim 8 A method of requesting access to a remote computing resource from a user computing device, comprising: providing said user computing device with data indicative of a security capability of said user computing device, the security capability verified after manufacture of the user computing device by cross checking against real-time security audit data, and the security audit data including at least current hardware and software configuration and current software state of the user computing device; transmitting to a remote computing device said security capability and data indicative of a desired access, so that said remote computing device can assess whether said security capability meets a minimum level of required security capability specified for said desired access; and receiving data indicative of allowance of said desired access if said security capability meets said minimum level of required security capability specified for said desired access. ### Claim 9 (depends on 8) A method as claimed in claim 8, including receiving electronically a request for security audit data pertaining to said user computing device from said remote computing device. ### Claim 10 (depends on 9) A method as claimed in claim 9, including generating said security audit data by conducting a security audit upon receiving said request, and transmitting said security audit data to said remote computing device. ### Claim 11 An access control system for controlling access to a computing resource from a user computing device, comprising: an access server; a database accessible by said access server containing data indicative of a plurality of types of computing resources access to which is controlled by said access server and of a minimum level of required security capability that said user computing device must possess to be granted said respective types of access to said access server, the security capability determined in real-time using at least security audit data, after manufacture of the user computing device, and the security audit data including at least current hardware and software configuration and current software state of the user computing device; wherein said access server is configured to receive data indicative of said security capability and data indicative of a desired access from said user computing device, to ascertain from said database the minimum level of required security capability corresponding to said desired access, to compare said minimum level of required security capability with said security capability of said user computing device, and to provide said desired access if said security capability of said user computing device meets said minimum security capability for said desired access. ### Claim 12 (depends on 11) A system as claimed in claim 11, wherein said data indicative of a security capability of said user computing device is in the form of data indicative of a security capability classification. ### Claim 13 (depends on 11) A system as claimed in claim 11, including memory provided in said user computing device containing said data indicative of said security capability of said user computing device. ### Claim 14 (depends on 11) A system as claimed in claim 11, wherein said access server is configured to send a request to said user computing device for security audit data. ### Claim 15 (depends on 14) A system as claimed in claim 14, wherein said request is adapted to prompt said user computing device to generating said security audit data by conducting a security audit upon receiving said request. ### Claim 16 A user computing device for use in accessing a remote computing resource, comprising: a telecommunications module for accessing said remote computing resource; a processor in data communication with said telecommunications module; and software executable on said processor; wherein said user computing device is controllable to transmit a request for access to said remote computing resource, to receive in response a request for security data pertaining to said user computing device software from or on behalf of said remote computing resource, and to respond to said request by returning said security data, the security data determined using real-time security audit data, after manufacture of the user computing device, and the security audit data including at least current hardware and software configuration and current software state of the user computing device. ### Claim 17 (depends on 16) A user computing device as claimed in claim 16, wherein said user computing device is further adapted to respond to said request by conducting a security audit of said user computing device to generate security audit data and subsequently to return said security audit data either as said security data or as a component of said security data. ### Claim 18 (depends on 1) A computer readable medium storing non-transient program data that, when executed by a processor on a computing device, implements a method as defined in claim 1. ### Claim 19 (depends on 8) A computer readable medium storing non-transient program data that, when executed by a processor on a computing device, implements a method as defined in claim 8. ### Claim 20 (depends on 1) A method as claimed in claim 1, further comprising executing program code in a trusted environment, the program code measuring security. ### Claim 21 (depends on 1) A method as claimed in claim 1, further comprising the second computing device undergoing audit and re-certification to upgrade the security class of the mobile device.