# US 8,572,714 B2 · Apparatus and method for determining subject assurance level

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,572,714 B2
- Document ID: US8572714B2
- Status: Granted
- Kind: B2
- Application number: 13/479,509
- Filed: 2012-05-24
- Published: 2013-02-21
- Granted: 2013-10-29
- Earliest claimed: 2011-08-15
- Assignees: Bank of America Corporation
- Applicants: Rakesh Radhakrishnan
- Inventors: Rakesh Radhakrishnan
- Web page: https://patentgrep.com/patent/US8572714B2

## CPC

- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- G06F 21/335: {for accessing specific resources, e.g. using Kerberos tickets}
- G06F 21/34: involving the use of external additional devices, e.g. dongles or smart cards
- G06F 21/44: Program or device authentication
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)}
- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- H04L 63/102: {Entity profiles}
- H04W 4/029: Location-based management or tracking services
- H04W 4/90: Services for handling of emergency or hazardous situations, e.g. earthquake and tsunami warning systems [ETWS]
- H04W 12/082: using revocation of authorisation
- H04W 12/084: using delegated authorisation, e.g. open authorisation [OAuth] protocol
- H04W 12/088: using filters or firewalls
- H04W 4/02: Services making use of location information
- H04W 4/80: Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

According to one embodiment, an apparatus may store a plurality of token-based rules. The apparatus may further store a plurality of subject tokens associated with at least one of a user and a device. The apparatus may receive a resource token indicating that access to a resource has been requested. The apparatus may determine the value of an access value associated with the at least one subject token. The apparatus may then determine that the value of the access value is insufficient to grant access to the resource. The apparatus may then determine that access by at least one of the user and the device to the resource should be denied.

## Claims

### Claim 1

An apparatus comprising:
a memory operable to:
store a plurality of token-based rules, wherein a token-based rule facilitates access to a resource; and
store a plurality of subject tokens associated with at least one of a user and a device; and
a processor communicatively coupled to the memory and operable to:
receive a resource token indicating that access to the resource has been requested;
determine, based at least in part upon the resource token, at least one token-based rule from the plurality of token-based rules, wherein:
the at least one token-based rule associates an access value with at least one subject token;
the access value indicates the risk associated with granting at least one of the user and the device access to the resource; and
the at least one token-based rule conditions access to the resource upon the value of the access value;
determine that the plurality of subject tokens comprises the at least one subject token;
determine, based at least in part upon the at least one token-based rule, the value of the access value associated with the at least one subject token in response to the determination that the plurality of subject tokens comprises the at least one subject token;
determine, based at least in part upon the at least one token-based rule, that the value of the access value is insufficient to grant access to the resource; and
determine, in response to the determination that the value of the access value is insufficient to grant access to the resource, that access by at least one of the user and the device to the resource should be denied.

### Claim 2 (depends on 1)

The apparatus of claim 1, wherein the processor is further operable to:
receive an updated subject token indicating that at least one form of authentication has been performed;
redetermine the value of the access value based at least in part upon the updated subject token; and
determine, based at least in part upon the at least one token-based rule, that the redetermined value of the access value is sufficient to grant access to the resource; and
determine, in response to the determination that the redetermined value of the access value is sufficient to grant access to the resource, that access by at least one of the user and the device to the resource should be granted.

### Claim 3 (depends on 1)

The apparatus of claim 1, wherein the at least one subject token indicates at least one of:
a trusted platform module security device of the device; and
a subscriber identity module of the device.

### Claim 4 (depends on 1)

The apparatus of claim 1, wherein the at least one subject token indicates at least one of:
that the device is not infected by a virus;
a firewall of the device; and
that the device is operable to perform biometric authentication.

### Claim 5 (depends on 1)

The apparatus of claim 1, wherein the at least one subject token indicates at least one of:
that biometric authentication has been performed; and
that an account associated with the user has not been compromised.

### Claim 6 (depends on 1)

The apparatus of claim 1, wherein:
the at least one token-based rule associates the access value with a combination of subject tokens; and
the value of the access value corresponds to the number of subject tokens included in the combination of subject tokens.

### Claim 7

A method comprising:
storing, by a memory, a plurality of token-based rules, wherein a token-based rule facilitates access to a resource;
storing, by the memory, a plurality of subject tokens associated with at least one of a user and a device;
receiving, by a processor communicatively coupled to the memory, a resource token indicating that access to the resource has been requested;
determining, by the processor, based at least in part upon the resource token, at least one token-based rule from the plurality of token-based rules, wherein:
the at least one token-based rule associates an access value with at least one subject token;
the access value indicates the risk associated with granting at least one of the user and the device access to the resource; and
the at least one token-based rule conditions access to the resource upon the value of the access value;
determining, by the processor, that the plurality of subject tokens comprises the at least one subject token;
determining, by the processor, based at least in part upon the at least one token-based rule, the value of the access value associated with the at least one subject token in response to the determination that the plurality of subject tokens comprises the at least one subject token;
determining, by the processor, based at least in part upon the at least one token-based rule, that the value of the access value is insufficient to grant access to the resource; and
determining, by the processor, in response to the determination that the value of the access value is insufficient to grant access to the resource, that access by at least one of the user and the device to the resource should be denied.

### Claim 8 (depends on 7)

The method of claim 7, further comprising:
receiving, by the processor, an updated subject token indicating that at least one form of authentication has been performed;
redetermining, by the processor, the value of the access value based at least in part upon the updated subject token; and
determining, by the processor, based at least in part upon the at least one token-based rule, that the redetermined value of the access value is sufficient to grant access to the resource; and
determining, by the processor, in response to the determination that the redetermined value of the access value is sufficient to grant access to the resource, that access by at least one of the user and the device to the resource should be granted.

### Claim 9 (depends on 7)

The method of claim 7, wherein the at least one subject token indicates at least one of:
a trusted platform module security device of the device; and
a subscriber identity module of the device.

### Claim 10 (depends on 7)

The method of claim 7, wherein the at least one subject token indicates at least one of:
that the device is not infected by a virus;
a firewall of the device; and
that the device is operable to perform biometric authentication.

### Claim 11 (depends on 7)

The method of claim 7, wherein the at least one subject token indicates at least one of:
that biometric authentication has been performed; and
that an account associated with the user has not been compromised.

### Claim 12 (depends on 7)

The method of claim 7, wherein:
the at least one token-based rule associates the access value with a combination of subject tokens; and
the value of the access value corresponds to the number of subject tokens included in the combination of subject tokens.

### Claim 13

One or more computer-readable non-transitory storage media embodying software that is operable when executed to:
store a plurality of token-based rules, wherein a token-based rule facilitates access to a resource;
store a plurality of subject tokens associated with at least one of a user and a device;
receive a resource token indicating that access to the resource has been requested;
determine, based at least in part upon the resource token, at least one token-based rule from the plurality of token-based rules, wherein:
the at least one token-based rule associates an access value with at least one subject token;
the access value indicates the risk associated with granting at least one of the user and the device access to the resource; and
the at least one token-based rule conditions access to the resource upon the value of the access value;
determine that the plurality of subject tokens comprises the at least one subject token;
determine, based at least in part upon the at least one token-based rule, the value of the access value associated with the at least one subject token in response to the determination that the plurality of subject tokens comprises the at least one subject token;
determine, based at least in part upon the at least one token-based rule, that the value of the access value is insufficient to grant access to the resource; and
determine, in response to the determination that the value of the access value is insufficient to grant access to the resource, that access by at least one of the user and the device to the resource should be denied.

### Claim 14 (depends on 13)

The media of claim 13 embodying software further operable when executed to:
receive an updated subject token indicating that at least one form of authentication has been performed;
redetermine the value of the access value based at least in part upon the updated subject token; and
determine, based at least in part upon the at least one token-based rule, that the redetermined value of the access value is sufficient to grant access to the resource; and
determine, in response to the determination that the redetermined value of the access value is sufficient to grant access to the resource, that access by at least one of the user and the device to the resource should be granted.

### Claim 15 (depends on 13)

The media of claim 13, wherein the at least one subject token indicates at least one of:
a trusted platform module security device of the device; and
a subscriber identity module of the device.

### Claim 16 (depends on 13)

The media of claim 13, wherein the at least one subject token indicates at least one of:
that the device is not infected by a virus;
a firewall of the device; and
that the device is operable to perform biometric authentication.

### Claim 17 (depends on 13)

The media of claim 13, wherein the at least one subject token indicates at least one of:
that biometric authentication has been performed; and
that an account associated with the user has not been compromised.

### Claim 18 (depends on 13)

The media of claim 13, wherein:
the at least one token-based rule associates the access value with a combination of subject tokens; and
the value of the access value corresponds to the number of subject tokens included in the combination of subject tokens.