# US 8,789,162 B2 · Method and apparatus for making token-based access decisions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,789,162 B2 - Document ID: US8789162B2 - Status: Granted - Kind: B2 - Application number: 13/210,101 - Filed: 2011-08-15 - Published: 2013-02-21 - Granted: 2014-07-22 - Earliest claimed: 2011-08-15 - Assignees: Bank of America Corporation - Applicants: Rakesh Radhakrishnan - Inventors: Rakesh Radhakrishnan - Web page: https://patentgrep.com/patent/US8789162B2 ## CPC - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - G06F 21/335: {for accessing specific resources, e.g. using Kerberos tickets} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/105: {Multiple levels of security} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract According to one embodiment, an apparatus may store a plurality of token-based rules that facilitate access to a resource, and a plurality of tokens indicating a user is using a device to request access to a resource over a network. The apparatus may receive a risk token indicating the risk associated with granting at least one of the user and the device access to the resource. The risk token may be computed from a set of tokens in the plurality of tokens. The apparatus may determine at least one token-based rule based at least in part upon the plurality of tokens and the risk token. The apparatus may then make an access decision based upon the at least one token-based rule, and communicate a decision token representing the access decision. ## Claims ### Claim 1 An apparatus comprising: a memory configured to: store a plurality of token-based rules, wherein a token-based rule facilitates access to a resource; store a plurality of tokens indicating a user is using a device to request access to a resource over a network, the plurality of tokens comprising at least one of a subject token indicating a form of authentication provided by the user and a resource token indicating a form of authentication provided by the resource; and a processor configured to: map the subject token to an identity assurance level and the resource token to a trust level, wherein the trust level indicates the security provided by a form of authentication provided by the resource; receive a risk token indicating the risk associated with granting at least one of the user and the device access to the resource, the risk token computed using at least the subject token and the resource token; map the risk token to a risk level; determine at least one token-based rule based at least in part upon the plurality of tokens and the risk token, wherein the at least one token-based rule indicates access may be granted only if the identity assurance level is at least a first value, trust level is at least a second value, and the risk level is at least a third value; determine token levels corresponding to particular tokens in the plurality of tokens, each token level comprising a numerical value based at least in part upon an Open Systems Interconnection layer associated with the particular tokens in the plurality of tokens; determine, based upon the at least one token-based rule, the identity assurance level, the trust level, the risk level, and the token levels, that access should be granted to the resource; communicate a decision token representing the determination that access should be granted; and generate a session token representing a session, the session facilitating access by the device to the resource. ### Claim 2 (depends on 1) The apparatus of claim 1, the processor further operable to associate the at least one token-based rule with one or more token levels, wherein a token level comprises one of an identity assurance level, an integrity level, a risk level, and a trust level. ### Claim 3 (depends on 1) The apparatus of claim 1, the processor further operable to map a network token to an integrity level. ### Claim 4 (depends on 1) The apparatus of claim 1, the processor further operable to determine that the numerical value of each token level falls in a pre-defined numerical range. ### Claim 5 (depends on 1) The apparatus of claim 1, the processor further operable to: correlate the plurality of tokens and the risk token with the session token. ### Claim 6 (depends on 1) The apparatus of claim 1, wherein the decision token is communicated to a resource provider. ### Claim 7 (depends on 1) The apparatus of claim 1, wherein the access decision comprises at least one of a decision to grant, a decision to deny, or a decision to condition access to the resource. ### Claim 8 A method for facilitating access to a resource using token-based rules, comprising: storing a plurality of token-based rules, wherein a token-based rule facilitates access to a resource; storing a plurality of tokens indicating a user is using a device to request access to a resource over a network, the plurality of tokens comprising at least one of a subject token indicating a form of authentication provided by the user and a resource token indicating a form of authentication provided by the resource; mapping the subject token to an identity assurance level and the resource token to a trust level, wherein the trust level indicates the security provided by a form of authentication provided by the resource; receiving a risk token indicating the risk associated with granting at least one of the user and the device access to the resource, the risk token computed using at least the subject token and the resource token; mapping the risk token to a risk level; determining, by a processor, at least one token-based rule based at least in part upon the plurality of tokens and the risk token, wherein the at least one token-based rule indicates access may be granted only if the identity assurance level is at least a first value, trust level is at least a second value, and the risk level is at least a third value; determining, by the processor, token levels corresponding to particular tokens in the plurality of tokens, each token level comprising a numerical value based at least in part upon an Open Systems Interconnection layer associated with the particular tokens in the plurality of tokens; determining, by the processor, based upon the at least one token-based rule, the identity assurance level, the trust level, the risk level, and the token levels that access should be granted to the resource; communicating a decision token representing the determination that access should be granted; and generating a session token representing a session, the session facilitating access by the device to the resource. ### Claim 9 (depends on 8) The apparatus of claim 8, the processor further operable to associate the at least one token-based rule with one or more token levels, wherein a token level comprises one of an identity assurance level, an integrity level, a risk level, and a trust level. ### Claim 10 (depends on 8) The method of claim 8, further comprising mapping a network token to an integrity level. ### Claim 11 (depends on 8) The apparatus of claim 8, the processor further operable to determine that the numerical value of each token level falls in a pre-defined numerical range. ### Claim 12 (depends on 8) The method of claim 8, further comprising: correlating the plurality of tokens and the risk token with the session token. ### Claim 13 (depends on 8) The method of claim 8, wherein the decision token is communicated to a resource provider. ### Claim 14 (depends on 8) The method of claim 8, wherein the access decision comprises at least one of a decision to grant, a decision to deny, or a decision to condition access to the resource. ### Claim 15 One or more computer-readable non-transitory storage media embodying software that is operable when executed by a processor to: store a plurality of token-based rules, wherein a token-based rule facilitates access to a resource; store a plurality of tokens indicating a user is using a device to request access to a resource over a network, the plurality of tokens comprising at least one of a subject token indicating a form of authentication provided by the user and a resource token indicating a form of authentication provided by the resource; map the subject token to an identity assurance level and the resource token to a trust level, wherein the trust level indicates the security provided by a form of authentication provided by the resource; receive a risk token indicating the risk associated with granting at least one of the user and the device access to the resource, the risk token computed using at least the subject token and the resource token; map the risk token to a risk level; determine at least one token-based rule based at least in part upon the plurality of tokens and the risk token, wherein the at least one token-based rule indicates access may be granted only if the identity assurance level is at least a first value, trust level is at least a second value, and the risk level is at least a third value; determine token levels corresponding to particular tokens in the plurality of tokens, each token level comprising a numerical value based at least in part upon an Open Systems Interconnection layer associated with the particular tokens in the plurality of tokens; determine, based upon the at least one token-based rule, the identity assurance level, the trust level, the risk level, and the token levels that access should be granted to the resource; communicate a decision token representing the determination that access should be granted; and generate a session token representing a session, the session facilitating access by the device to the resource. ### Claim 16 (depends on 15) The apparatus of claim 15, the processor further operable to associate the at least one token-based rule with one or more token levels, wherein a token level comprises one of an identity assurance level, an integrity level, a risk level, and a trust level. ### Claim 17 (depends on 15) The media of claim 15 embodying software further operable when executed by the processor to map a network token to an integrity level. ### Claim 18 (depends on 15) The apparatus of claim 15, the processor further operable to determine that the numerical value of each token level falls in a pre-defined numerical range. ### Claim 19 (depends on 15) The media of claim 15, embodying software further operable when executed by the processor to: correlate the plurality of tokens and the risk token with the session token. ### Claim 20 (depends on 15) The media of claim 15, wherein the decision token is communicated to a resource provider. ### Claim 21 (depends on 15) The media of claim 15, wherein the access decision comprises at least one of a decision to grant, a decision to deny, or a decision to condition access to the resource.