Method and apparatus for token-based packet prioritization

• US 8,732,814 B2
• Filed: 08/15/2011
• Issued: 05/20/2014
• Est. Priority Date: 08/15/2011
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Radhakrishnan, Rakesh, Frick, Cynthia Ann, Marian, Radu, Barbir, Abdulkader Omar, Badhwar, Rajat P.
• Primary Examiner(s): GOLDBERG, ANDREW C
• Application Number:
  US13/210,222
• Publication Number:
  US 20130047249A1
• Time in Patent Office: 1,009 Days
• Field of Search: 726/12
• US Class Current: 726/12
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24

Abstract

According to one embodiment, an apparatus may receive a hard token that identifies a device and a subject token indicating that a user is a high priority user. The subject token may include a user identifier associated with the high priority user. The apparatus may apply a token-based rule that facilitates packet prioritization in response to receiving the subject token. In response to applying the token-based rule, the apparatus may communicate a notification token to at least one network component. The notification token may include the user identifier associated with the high priority user, the device identifier associated with the device, and instructions to prioritize any packet communications associated with the user identifier or the device identifier. The apparatus may then communicate at least one token to facilitate the provisioning of a container to the device associated with the high priority user.

Claims

1. An apparatus comprising a processor operable to:

receive a request from a user of a device to access a resource;

receive a hard token comprising a device identifier that identifies the device;

receive a subject token indicating that the user is a high priority user, wherein the subject token includes a user identifier associated with the high priority user;

correlate the hard token with the subject token to indicate that the device is associated with the high priority user;

apply a token-based rule that facilitates packet prioritization in response to receiving the subject token indicating a high priority user;

check if the device is compliant to consume the resource prior to granting access to the resource, wherein compliance is checked by ensuring that the device contains one of a compliant version of firmware, a compliant operating system, and hardware compliant with a hardware requirement;

if the device is not compliant to consume the resource, deny access to the resource;

if the device is compliant to consume the resource, in response to applying the token-based rule, communicate a notification token to at least one network component, wherein the notification token includes the user identifier associated with the high priority user, the device identifier associated with the device associated with the high priority user, and instructions to prioritize any packet communications associated with the user identifier or the device identifier; and

communicate at least one token to facilitate the provisioning of a container to the device associated with the high priority user, wherein the container comprises a virtual machine associated with the device.

2. The apparatus of claim 1, wherein a plurality of packets that are communicated to provision the container to the device associated with the high priority user are prioritized over other packets in response to the notification token.

3. The apparatus of claim 1, the processor further operable to communicate to at least one network server a session token that includes the user identifier and the device identifier such that a process that runs during a session associated with the high priority user will be prioritized over other processes.

4. The apparatus of claim 3, wherein the session token is designated as high priority.

5. The apparatus of claim 3, wherein the at least one network server comprises a secure token server.

6. The apparatus of claim 1, wherein the network components comprises one of a router, a switch, and a gateway.

7. A method for implementing token-based prioritization of packets, comprising:

receiving a request from a user of a device to access a resource;

receiving a hard token comprising a device identifier that identifies the device;

receiving a subject token indicating that the user is a high priority user, wherein the subject token includes a user identifier associated with the high priority user;

correlating the hard token with the subject token to indicate that the device is associated with the high priority user;

applying a token-based rule that facilitates packet prioritization in response to receiving the subject token indicating a high priority user;

checking if the device is compliant to consume the resource prior to granting access to the resource, wherein compliance is checked by ensuring that the device contains one of a compliant version of firmware, a compliant operating system, and hardware compliant with a hardware requirement;

if the device is not compliant to consume the resource, denying access to the resource;

if the device is compliant to consume the resource, in response to applying the token-based rule, communicating a notification token to at least one network component, wherein the notification token includes the user identifier associated with the high priority user, the device identifier associated with the device associated with the high priority user, and instructions to prioritize any packet communications associated with the user identifier or the device identifier; and

communicating at least one token to facilitate the provisioning of a container to the device associated with the high priority user, wherein the container comprises a virtual machine associated with the device.

8. The method of claim 7, wherein a plurality of packets that are communicated to provision the container to the device associated with the high priority user are prioritized over other packets in response to the notification token.

9. The method of claim 7, further comprising communicating to at least one network server a session token that includes the user identifier and the device identifier such that a process that runs during a session associated with the high priority user will be prioritized over other processes.

10. The method of claim 9, wherein the session token is designated as high priority.

11. The method of claim 9, wherein the at least one network server comprises a secure token server.

12. The method of claim 7, wherein the network components comprises one of a router, a switch, and a gateway.

13. One or more computer-readable non-transitory storage media embodying software that is operable when executed to:

receive a request from a user of a device to access a resource;

receive a hard token comprising a device identifier that identifies the device;

receive a subject token indicating that the user is a high priority user, wherein the subject token includes a user identifier associated with the high priority user;

correlate the hard token with the subject token to indicate that the device is associated with the high priority user;

apply a token-based rule that facilitates packet prioritization in response to receiving the subject token indicating a high priority user;

check if the device is compliant to consume the resource prior to granting access to the resource, wherein compliance is checked by ensuring that the device contains one of a compliant version of firmware, a compliant operating system, and hardware compliant with a hardware requirement;

if the device is not compliant to consume the resource, deny access to the resource;

if the device is compliant to consume the resource, in response to applying the token-based rule, communicate a notification token to at least one network component, wherein the notification token includes the user identifier associated with the high priority user, the device identifier associated with the device associated with the high priority user, and instructions to prioritize any packet communications associated with the user identifier or the device identifier; and

communicate at least one token to facilitate the provisioning of a container to the device associated with the high priority user, wherein the container comprises a virtual machine associated with the device.

14. The media of claim 13, wherein a plurality of packets that are communicated to provision the container to the device associated with the high priority user are prioritized over other packets in response to the notification token.

15. The media of claim 13 embodying software further operable when executed to communicate to at least one network server a session token that includes the user identifier and the device identifier such that a process that runs during a session associated with the high priority user will be prioritized over other processes.

16. The media of claim 15, wherein the session token is designated as high.

17. The media of claim 15, wherein the at least one network server comprises a secure token server.

18. The media of claim 13, wherein the network components comprises one of a router, a switch, and a gateway.