Method and apparatus for making token-based access decisions

A method for facilitating access to a resource using token-based rules, comprising:

• storing a plurality of token-based rules, wherein a token-based rule facilitates access to a resource;
• storing a plurality of tokens indicating a user is using a device to request access to a resource over a network, the plurality of tokens comprising at least one of a subject token indicating a form of authentication provided by the user and a resource token indicating a form of authentication provided by the resource;
• mapping the subject token to an identity assurance level and the resource token to a trust level, wherein the trust level indicates the security provided by a form of authentication provided by the resource;
• receiving a risk token indicating the risk associated with granting at least one of the user and the device access to the resource, the risk token computed using at least the subject token and the resource token;
• mapping the risk token to a risk level;
• determining, by a processor, at least one token-based rule based at least in part upon the plurality of tokens and the risk token, wherein the at least one token-based rule indicates access may be granted only if the identity assurance level is at least a first value, trust level is at least a second value, and the risk level is at least a third value;
• determining, by the processor, token levels corresponding to particular tokens in the plurality of tokens, each token level comprising a numerical value based at least in part upon an Open Systems Interconnection layer associated with the particular tokens in the plurality of tokens;
• determining, by the processor, based upon the at least one token-based rule, the identity assurance level, the trust level, the risk level, and the token levels that access should be granted to the resource;
• communicating a decision token representing the determination that access should be granted;
• and
• generating a session token representing a session, the session facilitating access by the device to the resource.

One or more computer-readable non-transitory storage media embodying software that is operable when executed by a processor to:

• store a plurality of token-based rules, wherein a token-based rule facilitates access to a resource;
• store a plurality of tokens indicating a user is using a device to request access to a resource over a network, the plurality of tokens comprising at least one of a subject token indicating a form of authentication provided by the user and a resource token indicating a form of authentication provided by the resource;
• map the subject token to an identity assurance level and the resource token to a trust level, wherein the trust level indicates the security provided by a form of authentication provided by the resource;
• receive a risk token indicating the risk associated with granting at least one of the user and the device access to the resource, the risk token computed using at least the subject token and the resource token;
• map the risk token to a risk level;
• determine at least one token-based rule based at least in part upon the plurality of tokens and the risk token, wherein the at least one token-based rule indicates access may be granted only if the identity assurance level is at least a first value, trust level is at least a second value, and the risk level is at least a third value;
• determine token levels corresponding to particular tokens in the plurality of tokens, each token level comprising a numerical value based at least in part upon an Open Systems Interconnection layer associated with the particular tokens in the plurality of tokens;
• determine, based upon the at least one token-based rule, the identity assurance level, the trust level, the risk level, and the token levels that access should be granted to the resource;
• communicate a decision token representing the determination that access should be granted;
• and
• generate a session token representing a session, the session facilitating access by the device to the resource.