Apparatus and method for determining subject assurance level

A method comprising:

• storing, by a memory, a plurality of token-based rules, wherein a token-based rule facilitates access to a resource;
• storing, by the memory, a plurality of subject tokens associated with at least one of a user and a device;
• receiving, by a processor communicatively coupled to the memory, a resource token indicating that access to the resource has been requested;
• determining, by the processor, based at least in part upon the resource token, at least one token-based rule from the plurality of token-based rules, wherein:
• the at least one token-based rule associates an access value with at least one subject token;
• the access value indicates the risk associated with granting at least one of the user and the device access to the resource;
• and
• the at least one token-based rule conditions access to the resource upon the value of the access value;
• determining, by the processor, that the plurality of subject tokens comprises the at least one subject token;
• determining, by the processor, based at least in part upon the at least one token-based rule, the value of the access value associated with the at least one subject token in response to the determination that the plurality of subject tokens comprises the at least one subject token;
• determining, by the processor, based at least in part upon the at least one token-based rule, that the value of the access value is insufficient to grant access to the resource;
• and
• determining, by the processor, in response to the determination that the value of the access value is insufficient to grant access to the resource, that access by at least one of the user and the device to the resource should be denied.

One or more computer-readable non-transitory storage media embodying software that is operable when executed to:

• store a plurality of token-based rules, wherein a token-based rule facilitates access to a resource;
• store a plurality of subject tokens associated with at least one of a user and a device;
• receive a resource token indicating that access to the resource has been requested;
• determine, based at least in part upon the resource token, at least one token-based rule from the plurality of token-based rules, wherein:
• the at least one token-based rule associates an access value with at least one subject token;
• the access value indicates the risk associated with granting at least one of the user and the device access to the resource;
• and
• the at least one token-based rule conditions access to the resource upon the value of the access value;
• determine that the plurality of subject tokens comprises the at least one subject token;
• determine, based at least in part upon the at least one token-based rule, the value of the access value associated with the at least one subject token in response to the determination that the plurality of subject tokens comprises the at least one subject token;
• determine, based at least in part upon the at least one token-based rule, that the value of the access value is insufficient to grant access to the resource;
• and
• determine, in response to the determination that the value of the access value is insufficient to grant access to the resource, that access by at least one of the user and the device to the resource should be denied.