Apparatus and Method for Expert Decisioning

• US 20130047201A1
• Filed: 05/24/2012
• Published: 02/21/2013
• Est. Priority Date: 08/15/2011
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Radhakrishnan, Rakesh
• Granted Patent: US 8,726,340 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

According to one embodiment, an apparatus may store at least one subject token associated with a user and a device, at least one resource token associated with the resource, and at least one network token associated with a network. The apparatus may determine various access values associated with these stored tokens. The apparatus may then determine the value of a first access value based on the values of these various access values. The apparatus may determine that the value of the first access value is insufficient to grant access to the resource and determine that access by at least one of the user and the device to the resource over the network should be denied.

Claims

1. An apparatus comprising:

a memory operable to;

store a plurality of token-based rules, wherein a token-based rule facilitates access to a resource;

store at least one subject token associated with a user and a device;

store at least one resource token associated with the resource; and

store at least one network token associated with a network; and

a processor communicatively coupled to the memory and operable to;

determine that access to a resource has been requested;

determine at least one token-based rule in response to the determination that access has been requested, wherein;

the at least one token-based rule associates a first access value with at least a second access value, a third access value, and a fourth access value; and

the at least one token-based rule conditions access to the resource upon the value of the first access value;

determine the value of the second access value based at least in part upon the at least one subject token;

determine the value of the third access value based at least in part upon the at least one resource token;

determine the value of the fourth access value based at least in part upon the at least one network token;

determine, based at least in part upon the at least one token-based rule, the value of the first access value in response to determining the values of the second, third, and fourth access values;

determine, based at least in part upon the at least one token-based rule, that the value of the first access value is insufficient to grant access to the resource; and

determine, in response to the determination that the value of the first access value is insufficient to grant access to the resource, that access by at least one of the user and the device to the resource over the network should be denied.

2. The apparatus of claim 1, wherein the processor is further operable to:

receive an updated subject token;

redetermine the value of the second access value based at least in part upon the updated subject token;

redetermine the value of the first access value in response to redetermining the value of the second access value; and

determine, based at least in part upon the at least one token-based rule, that the redetermined value of the first access value is sufficient to grant access to the resource.

3. The apparatus of claim 1, wherein the processor is further operable to:

receive an updated resource token;

redetermine the value of the third access value based at least in part upon the updated resource token;

redetermine the value of the first access value in response to redetermining the value of the third access value; and

determine, based at least in part upon the at least one token-based rule, that the redetermined value of the first access value is sufficient to grant access to the resource.

4. The apparatus of claim 1, wherein the processor is further operable to:

receive an updated network token;

redetermine the value of the fourth access value based at least in part upon the updated network token;

redetermine the value of the first access value in response to redetermining the value of the fourth access value; and

determine, based at least in part upon the at least one token-based rule, that the redetermined value of the first access value is sufficient to grant access to the resource.

5. The apparatus of claim 1, wherein the value of the first access value corresponds to the magnitude of the values of the second, third, and fourth access values.

6. The apparatus of claim 1, wherein the processor is further operable to generate a risk token associated with a risk associated with granting at least one of the user and the device access to the resource over the network, wherein the first access value indicates the risk.

7. A method comprising:

storing, by a memory, a plurality of token-based rules, wherein a token-based rule facilitates access to a resource;

storing, by the memory, at least one subject token associated with a user and a device;

storing, by the memory, at least one resource token associated with the resource;

storing, by the memory, at least one network token associated with a network;

determining, by a processor communicatively coupled to the memory, that access to a resource has been requested;

determining, by the processor, at least one token-based rule in response to the determination that access has been requested, wherein;

the at least one token-based rule associates a first access value with at least a second access value, a third access value, and a fourth access value; and

the at least one token-based rule conditions access to the resource upon the value of the first access value;

determining, by the processor, the value of the second access value based at least in part upon the at least one subject token;

determining, by the processor, the value of the third access value based at least in part upon the at least one resource token;

determining, by the processor, the value of the fourth access value based at least in part upon the at least one network token;

determining, by the processor, based at least in part upon the at least one token-based rule, the value of the first access value in response to determining the values of the second, third, and fourth access values;

determining, by the processor, based at least in part upon the at least one token-based rule, that the value of the first access value is insufficient to grant access to the resource; and

determining, by the processor, in response to the determination that the value of the first access value is insufficient to grant access to the resource, that access by at least one of the user and the device to the resource over the network should be denied.

8. The method of claim 7, further comprising:

receiving, by the processor, an updated subject token;

redetermining, by the processor, the value of the second access value based at least in part upon the updated subject token;

redetermining, by the processor, the value of the first access value in response to redetermining the value of the second access value; and

determining, by the processor, based at least in part upon the at least one token-based rule, that the redetermined value of the first access value is sufficient to grant access to the resource.

9. The method of claim 7, further comprising:

receiving, by the processor, an updated resource token;

redetermining, by the processor, the value of the third access value based at least in part upon the updated resource token;

redetermining, by the processor, the value of the first access value in response to redetermining the value of the third access value; and

determining, by the processor, based at least in part upon the at least one token-based rule, that the redetermined value of the first access value is sufficient to grant access to the resource.

10. The method of claim 7, further comprising:

receiving, by the processor, an updated network token;

redetermining, by the processor, the value of the fourth access value based at least in part upon the updated network token;

redetermining, by the processor, the value of the first access value in response to redetermining the value of the fourth access value; and

determining, by the processor, based at least in part upon the at least one token-based rule, that the redetermined value of the first access value is sufficient to grant access to the resource.

11. The method of claim 7, wherein the value of the first access value corresponds to the magnitude of the values of the second, third, and fourth access values.

12. The method of claim 7, further comprising generating, by the processor, a risk token associated with a risk associated with granting at least one of the user and the device access to the resource over the network, wherein the first access value indicates the risk.

13. One or more computer-readable non-transitory storage media embodying software that is operable when executed to:

store a plurality of token-based rules, wherein a token-based rule facilitates access to a resource;

store at least one subject token associated with a user and a device;

store at least one resource token associated with the resource;

store at least one network token associated with a network;

determine that access to a resource has been requested;

determine at least one token-based rule in response to the determination that access has been requested, wherein;

the at least one token-based rule associates a first access value with at least a second access value, a third access value, and a fourth access value; and

the at least one token-based rule conditions access to the resource upon the value of the first access value;

determine the value of the second access value based at least in part upon the at least one subject token;

determine the value of the third access value based at least in part upon the at least one resource token;

determine the value of the fourth access value based at least in part upon the at least one network token;

determine, based at least in part upon the at least one token-based rule, the value of the first access value in response to determining the values of the second, third, and fourth access values;

determine, based at least in part upon the at least one token-based rule, that the value of the first access value is insufficient to grant access to the resource; and

determine, in response to the determination that the value of the first access value is insufficient to grant access to the resource, that access by at least one of the user and the device to the resource over the network should be denied.

14. The media of claim 13 embodying software further operable when executed to:

receive an updated subject token;

redetermine the value of the second access value based at least in part upon the updated subject token;

redetermine the value of the first access value in response to redetermining the value of the second access value; and

determine, based at least in part upon the at least one token-based rule, that the redetermined value of the first access value is sufficient to grant access to the resource.

15. The media of claim 13 embodying software further operable when executed to:

receive an updated resource token;

redetermine the value of the third access value based at least in part upon the updated resource token;

redetermine the value of the first access value in response to redetermining the value of the third access value; and

determine, based at least in part upon the at least one token-based rule, that the redetermined value of the first access value is sufficient to grant access to the resource.

16. The media of claim 13 embodying software further operable when executed to:

receive an updated network token;

redetermine the value of the fourth access value based at least in part upon the updated network token;

redetermine the value of the first access value in response to redetermining the value of the fourth access value; and

determine, based at least in part upon the at least one token-based rule, that the redetermined value of the first access value is sufficient to grant access to the resource.

17. The media of claim 13, wherein the value of the first access value corresponds to the magnitude of the values of the second, third, and fourth access values.

18. The media of claim 13 embodying software further operable when executed to generate a risk token associated with a risk associated with granting at least one of the user and the device access to the resource over the network, wherein the first access value indicates the risk.