Method and Apparatus for Token-Based Conditioning

• US 20130047265A1
• Filed: 08/15/2011
• Published: 02/21/2013
• Est. Priority Date: 08/15/2011
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Radhakrishnan, Rakesh, Frick, Cynthia Ann, Marian, Radu, Barbir, Abdulkader Omar, Badhwar, Rajat P.
• Granted Patent: US 8,789,143 B2
• Time in Patent Office: Days
• US Class Current: 726/28
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2151 Time stamp
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

According to one embodiment, an apparatus may store a plurality of tokens indicating a user is requesting access to a resource over a network. The apparatus may determine a condition associated with accessing the resource based on the plurality of tokens. The condition may be determined in addition to a determination to grant or deny access to the resource. The condition may include an obligation to be fulfilled and a message providing instruction regarding how to fulfill the obligation. The apparatus may generate a decision token representing the condition, and communicate the decision token to a resource provider to facilitate enforcement of the condition.

Claims

1. An apparatus comprising:

a memory operable to store a plurality of tokens indicating a user is requesting access to a resource over a network; and

a processor operable to;

determine at least one condition associated with accessing the resource based on the plurality of tokens, the condition determined in addition to a determination to grant or deny access to the resource, the at least one condition comprising;

an obligation to be fulfilled, the obligation being a task to be performed in conjunction with accessing the resource; and

a message providing instruction regarding how to fulfill the obligation;

generate a decision token representing the at least one condition; and

communicate the decision token to a resource provider to facilitate enforcement of the at least one condition.

2. The apparatus of claim 1, wherein the at least one condition is optional with respect to accessing the resource.

3. The apparatus of claim 1, wherein the task comprises at least one of synchronizing a system clock of the resource provider with a clock on the network, initializing logging of errors and performance metrics related with granting access to the resource and consuming the resource, and tracking transactions end to end.

4. The apparatus of claim 1, wherein the obligation indicates a peripheral device attached to the device should be removed before access may be granted.

5. The apparatus of claim 1, wherein the obligation indicates missing information required to access the resource should be provided.

6. The apparatus of claim 1, wherein the message further indicates a reason access to the resource was not granted.

7. The apparatus of claim 1, the memory further operable to store a plurality of token-based rules, wherein a token-based rule facilitates the generation of the decision token

8. The apparatus of claim 1, wherein the determination of the at least one privilege is based on a token-based rule.

9. A method for communicating an access control determination to a resource comprising:

storing a plurality of tokens indicating a user is requesting access to a resource over a network;

determining, by a processor, at least one condition associated with accessing the resource based on the plurality of tokens, the condition determined in addition to a determination to grant or deny access to the resource, the at least one condition comprising;

an obligation to be fulfilled, the obligation being a task to be performed in conjunction with accessing the resource; and

a message providing instruction regarding how to fulfill the obligation;

generating a decision token representing the at least one condition; and

communicating, by the processor, the decision token to a resource provider to facilitate enforcement of the at least one condition.

10. The method of claim 9, wherein the at least one condition is optional with respect to accessing the resource.

11. The method of claim 9, wherein the task comprises at least one of synchronizing a system clock of the resource provider with a clock on the network, initializing logging of errors and performance metrics related with granting access to the resource and consuming the resource, and tracking transactions end to end.

12. The method of claim 9, wherein the obligation indicates a peripheral device attached to the device should be removed before access may be granted.

13. The method of claim 9, wherein the obligation indicates missing information required to access the resource should be provided.

14. The method of claim 9, wherein the message further indicates a reason access to the resource was not granted.

15. The method of claim 9, further comprising storing a plurality of token-based rules, wherein a token-based rule facilitates the generation of the decision token.

16. The method of claim 9, wherein the determination of the at least one privilege is based on a token-based rule.

17. One or more computer-readable non-transitory storage media embodying software that is operable when executed to:

store a plurality of tokens indicating a user is requesting access to a resource over a network;

determine at least one condition associated with accessing the resource based on the plurality of tokens, the condition determined in addition to a determination to grant or deny access to the resource, the at least one condition comprising;

an obligation to be fulfilled, the obligation being a task to be performed in conjunction with accessing the resource; and

a message providing instruction regarding how to fulfill the obligation;

generate a decision token representing the at least one condition; and

communicate the decision token to a resource provider to facilitate enforcement of the at least one condition.

18. The media of claim 17, wherein the at least one condition is optional with respect to accessing the resource.

19. The media of claim 17, wherein the task comprises at least one of synchronizing a system clock of the resource provider with a clock on the network, initializing logging of errors and performance metrics related with granting access to the resource and consuming the resource, and tracking transactions end to end.

20. The media of claim 17, wherein the obligation indicates a peripheral device attached to the device should be removed before access may be granted.

21. The media of claim 17, wherein the obligation indicates missing information required to access the resource should be provided.

22. The media of claim 17, wherein the message further indicates a reason access to the resource was not granted.

23. The media of claim 17 embodying software further operable to store a plurality of token-based rules, wherein a token-based rule facilitates the generation of the decision token

24. The media of claim 17, wherein the determination of the at least one privilege is based on a token-based rule.