Method and apparatus for token-based access of related resources

• US 8,950,002 B2
• Filed: 08/15/2011
• Issued: 02/03/2015
• Est. Priority Date: 08/15/2011
• Status: Active Grant

• Current Assignee: Bank of America Corp.
• Original Assignee: Bank of America Corp.
• Inventors: Radhakrishnan, Rakesh, Frick, Cynthia Ann, Marian, Radu, Barbir, Abdulkader Omar, Badhwar, Rajat P.
• Primary Examiner(s): Zaidi, Syed
• Application Number:
  US13/210,213
• Publication Number:
  US 20130047266A1
• Time in Patent Office: 1,268 Days
• Field of Search: 726/28, 726/4, 726/22, 713/185, 709/229
• US Class Current: 726/28
• CPC Class Codes: G06F 21/40 by quorum, i.e. whereby two or more security principals are required
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

According to one embodiment, an apparatus may store a plurality of tokens indicating that a user is attempting to access a resource. The apparatus may determine an authorization level for the user based at least in part upon the plurality of tokens. The authorization level may indicate whether the user is authorized to access the resource. The apparatus may then determine a related resource that shares a relationship with the resource, and determine that the authorization level indicates that the user is authorized to access the related resource. The apparatus may then communicate a decision token indicating that the user is authorized to access the resource and the related resource.

Claims

1. An apparatus comprising:

a memory that stores a plurality of tokens indicating that a user is attempting to access a resource; and

a processor that;

determines a related resource that shares a relationship with the resource, wherein;

the resource is a composite resource;

the related resource is a sub-resource of the composite resource; and

the related resource is accessed in conjunction with accessing the resource;

receives a risk token computed based at least in part upon the resource and the related resource;

determines a numeric authorization level for the user based at least in part upon the plurality of tokens and the risk token, the numeric authorization level indicating whether the user is authorized to access the resource, wherein the composite resource comprises at least one sub-resource that the user is not authorized to access based on the numeric authorization level and at least one sub-resource that the user is authorized to access based on the numeric authorization level;

compares the numeric authorization level to a numeric threshold;

determines, based at least in part on the comparison between the numeric authorization level and the numeric threshold, that the user is authorized to access the related resource;

communicates a decision token indicating that the user is authorized to access the resource and the related resource;

receives a recomputed risk token computed based at least in part upon;

a form of authentication performed by the user; and

the presence of network jitter;

re-determines determine the numeric authorization level based at least in part upon the recomputed risk token;

determines, based at least in part upon the recomputed risk token, that the user is authorized to access the at least one sub-resource; and

communicates a second decision token indicating that the user is authorized to access the resource, the related resource, and the at least one sub-resource.

2. The apparatus of claim 1, the memory further stores a plurality of token-based rules, wherein a token-based rule facilitates the determination of the related resource.

3. The apparatus of claim 1, wherein the determination of the related resource is based on a token-based rule.

4. A method for determining resource contexts comprising:

storing a plurality of tokens indicating that a user is attempting to access a resource;

determining, by the processor, a related resource that shares a relationship with the resource, wherein;

the resource is a composite resource;

the related resource is a sub-resource of the composite resource; and

the related resource is accessed in conjunction with accessing the resource;

receiving a risk token computed based at least in part upon the resource and the related resource;

determining, by a processor, a numeric authorization level for the user based at least in part upon the plurality of tokens and the risk token, the numeric authorization level indicating whether the user is authorized to access the resource, wherein the composite resource comprises at least one sub-resource that the user is not authorized to access based on the numeric authorization level and at least one sub-resource that the user is authorized to access based on the numeric authorization level;

comparing, by the processor, the numeric authorization level to a numeric threshold;

determining, by the processor, based at least in part on the comparison between the numeric authorization level and the numeric threshold, that the user is authorized to access the related resource;

communicating a decision token indicating that the user is authorized to access the resource and the related resource;

receiving a recomputed risk token computed based at least in part upon;

a form of authentication performed by the user; and

the presence of network jitter;

re-determining, by the processor, the numeric authorization level based at least in part upon the recomputed risk token;

determining, by the processor, based at least in part upon the recomputed risk token, that the user is authorized to access the at least one sub-resource; and

communicating a second decision token indicating that the user is authorized to access the resource, the related resource, and the at least one sub-resource.

5. The method of claim 4, further comprising storing a plurality of token-based rules, wherein a token-based rule facilitates the determination of the related resource.

6. The method of claim 4, wherein the determination of the related resource is based on a token-based rule.

7. One or more computer-readable non-transitory storage media embodying software that when executed:

stores a plurality of tokens indicating that a user is attempting to access a resource; and

determines a related resource that shares a relationship with the resource, wherein;

the resource is a composite resource;

the related resource is a sub-resource of the composite resource; and

the related resource is accessed in conjunction with accessing the resource;

receives a risk token computed based at least in part upon the resource and the related resource;

determines a numeric authorization level for the user based at least in part upon the plurality of tokens and the risk token, the numeric authorization level indicating whether the user is authorized to access the resource, wherein the composite resource comprises at least one sub-resource that the user is not authorized to access and at least one sub-resource that the user is authorized to access;

compares the numeric authorization level to a numeric threshold;

determines, based at least in part on the comparison between the numeric authorization level and the numeric threshold, that the user is authorized to access the related resource;

communicates a decision token indicating that the user is authorized to access the resource and the related resource;

receives a recomputed risk token computed based at least in part upon;

a form of authentication performed by the user; and

the presence of network jitter;

re-determines determine the numeric authorization level based at least in part upon the recomputed risk token;

determines, based at least in part upon the recomputed risk token, that the user is authorized to access the at least one sub-resource; and

communicates a second decision token indicating that the user is authorized to access the resource, the related resource, and the at least one sub-resource.

8. The media of claim 7 embodying software that when executed further stores a plurality of token-based rules, wherein a token-based rule facilitates the determination of the related resource.

9. The media of claim 7, wherein the determination of the related resource is based on a token-based rule.