# US 8,789,143 B2 · Method and apparatus for token-based conditioning > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,789,143 B2 - Document ID: US8789143B2 - Status: Granted - Kind: B2 - Application number: 13/210,164 - Filed: 2011-08-15 - Published: 2013-02-21 - Granted: 2014-07-22 - Earliest claimed: 2011-08-15 - Assignees: Bank of America Corporation - Applicants: Rakesh Radhakrishnan; Cynthia Ann Frick; Radu Marian; Abdulkader Omar Barbir; Rajat P. Badhwar - Inventors: Rakesh Radhakrishnan; Cynthia Ann Frick; Radu Marian; Abdulkader Omar Barbir; Rajat P. Badhwar - Web page: https://patentgrep.com/patent/US8789143B2 ## CPC - G06F 21/34: involving the use of external additional devices, e.g. dongles or smart cards - H04L 63/102: {Entity profiles} - H04L 63/105: {Multiple levels of security} - G06F 21/35: communicating wirelessly - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - G06F 2221/2113: Multi-level security, e.g. mandatory access control - G06F 2221/2129: Authenticate client device independently of the user - G06F 2221/2137: Time limited access, e.g. to a computer or data - G06F 2221/2151: Time stamp - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract According to one embodiment, an apparatus may store a plurality of tokens indicating a user is requesting access to a resource over a network. The apparatus may determine a condition associated with accessing the resource based on the plurality of tokens. The condition may be determined in addition to a determination to grant or deny access to the resource. The condition may include an obligation to be fulfilled and a message providing instruction regarding how to fulfill the obligation. The apparatus may generate a decision token representing the condition, and communicate the decision token to a resource provider to facilitate enforcement of the condition. ## Claims ### Claim 1 An apparatus comprising: a memory operable to store a plurality of tokens indicating a user is requesting access to a resource over a network, the plurality of tokens comprising a resource token indicating a form of authentication provided by the resource; and a processor operable to: determine at least one condition associated with accessing the resource based on the plurality of tokens, the condition determined in addition to a determination to grant or deny access to the resource, the at least one condition comprising: an obligation to be fulfilled, the obligation comprising: a task to be performed in conjunction with accessing the resource, wherein the task indicates a peripheral device attached to the device should be removed before access may be granted; and a second task that is optional with respect to accessing the resource, the second task indicating synchronizing a system clock of the resource provider with a clock on the network; and a message providing instruction regarding how to fulfill the obligation, wherein the message further indicates a reason access to the resource was not granted; generate a decision token representing the at least one condition; and communicate the decision token to a resource provider to facilitate enforcement of the at least one condition. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the second task further indicates at least one of initializing logging of errors and performance metrics related with granting access to the resource and consuming the resource, and tracking transactions end to end. ### Claim 3 (depends on 1) The apparatus of claim 1, wherein the obligation further comprises a second task indicating that missing information required to access the resource should be provided. ### Claim 4 (depends on 1) The apparatus of claim 1, the memory further operable to store a plurality of token-based rules, wherein a token-based rule facilitates the generation of the decision token. ### Claim 5 (depends on 1) The apparatus of claim 1, wherein the determination of the at least one privilege is based on a token-based rule. ### Claim 6 A method for communicating an access control determination to a resource comprising: storing a plurality of tokens indicating a user is requesting access to a resource over a network, the plurality of tokens comprising a resource token indicating a form of authentication provided by the resource; determining, by a processor, at least one condition associated with accessing the resource based on the plurality of tokens, the condition determined in addition to a determination to grant or deny access to the resource, the at least one condition comprising: an obligation to be fulfilled, the obligation comprising: a task to be performed in conjunction with accessing the resource, wherein the task indicates a peripheral device attached to the device should be removed before access may be granted; and a second task that is optional with respect to accessing the resource, the second task indicating synchronizing a system clock of the resource provider with a clock on the network; and a message providing instruction regarding how to fulfill the obligation, wherein the message further indicates a reason access to the resource was not granted; generating a decision token representing the at least one condition; and communicating, by the processor, the decision token to a resource provider to facilitate enforcement of the at least one condition. ### Claim 7 (depends on 6) The method of claim 6, wherein the second task further indicates at least one of initializing logging of errors and performance metrics related with granting access to the resource and consuming the resource, and tracking transactions end to end. ### Claim 8 (depends on 6) The method of claim 6, wherein the obligation further comprises a second task indicating that missing information required to access the resource should be provided. ### Claim 9 (depends on 6) The method of claim 6, further comprising storing a plurality of token-based rules, wherein a token-based rule facilitates the generation of the decision token. ### Claim 10 (depends on 6) The method of claim 6, wherein the determination of the at least one privilege is based on a token-based rule. ### Claim 11 One or more computer-readable non-transitory storage media embodying software that is operable when executed to: store a plurality of tokens indicating a user is requesting access to a resource over a network, the plurality of tokens comprising a resource token indicating a form of authentication provided by the resource; determine at least one condition associated with accessing the resource based on the plurality of tokens, the condition determined in addition to a determination to grant or deny access to the resource, the at least one condition comprising: an obligation to be fulfilled, the obligation comprising: a task to be performed in conjunction with accessing the resource, wherein the task indicates a peripheral device attached to the device should be removed before access may be granted; and a second task that is optional with respect to accessing the resource, the second task indicating synchronizing a system clock of the resource provider with a clock on the network; and a message providing instruction regarding how to fulfill the obligation, wherein the message further indicates a reason access to the resource was not granted; generate a decision token representing the at least one condition; and communicate the decision token to a resource provider to facilitate enforcement of the at least one condition. ### Claim 12 (depends on 11) The media of claim 11, wherein the second task further indicates at least one of initializing logging of errors and performance metrics related with granting access to the resource and consuming the resource, and tracking transactions end to end. ### Claim 13 (depends on 11) The media of claim 11, wherein the obligation further comprises a second task indicating that missing information required to access the resource should be provided. ### Claim 14 (depends on 11) The media of claim 11 embodying software further operable to store a plurality of token-based rules, wherein a token-based rule facilitates the generation of the decision token. ### Claim 15 (depends on 11) The media of claim 11, wherein the determination of the at least one privilege is based on a token-based rule.