Apparatus and method for determining resource trust levels

1. An apparatus comprising:

a memory operable to:

store a plurality of token-based rules, wherein a token-based rule facilitates access to a resource; and

store a plurality of resource tokens associated with the resource; and

a processor communicatively coupled to the memory and operable to:

receive a first resource token indicating that access to the resource has been requested;

determine, based at least in part upon the first resource token, at least one token-based rule from the plurality of token-based rules, wherein:

the at least one token-based rule associates a first access value with at least one resource token, wherein the at least one resource token indicates at least one of:

that the resource is associated with a trusted platform module security device; and

that the resource is associated with a virtual private network;

the first access value indicates the risk associated with granting access to the resource; and

the at least one token-based rule specifies at least one condition under which access to the resource should be granted, the first access value associated with the at least one condition;

determine that the at least one resource token associated with the first access value is included in the plurality of resource tokens;

determine, based at least in part upon the at least one token-based rule, a second access value associated with the at least one resource token in response to the determination that the plurality of resource tokens comprises the at least one resource token, wherein the second access value indicates a chance that at least one of that access is granted to an unrequested resource and that the resource corrupts the device;

determine, based at least upon the at least one token-based rule, that the second access value is insufficient to grant access to the resource by comparing the second access value with the first access value;

determine, in response to the determination that the value of the second, access value is insufficient to grant access to the resource, that access to the resource should be denied;

communicate a first decision token indicating that access by at least one of the user and the device to the resource should be denied;

receive an updated resource token;

redetermine the second access value based at least in part upon the updated resource token;

determine, based at least in part upon the at least one token-based rule, that the redetermined second access value is sufficient to grant access to the resource by comparing the redetermined second access value with the first access value; and

communicate a second decision token indicating that access by at least one of the user and the device to the resource should be granted.

2. The apparatus of claim 1 , wherein the processor is further operable to:

receive an updated resource token indicating that a form of authentication associated with the resource has been performed;

redetermine the value of the second access value based at least in part upon the updated resource token; and

determine, based at least in part upon the at least one token-based rule, that the redetermined value of the second access value is sufficient to grant access to the resource.

3. The apparatus of claim 1 , wherein the processor is further operable to:

receive an updated resource token indicating that security associated with the resource has not been compromised;

redetermine the value of the second access value based at least in part upon the updated resource token; and

determine, based at least in part upon the at least one token-based rule, that the redetermined value of the second access value is sufficient to grant access to the resource.

4. The apparatus of claim 1 , wherein the at least one resource token indicates at least one of:

that the resource has performed Kerberos authentication; and

that the resource is associated with a digital certificate.

5. The apparatus of claim 1 , wherein the at least one resource token indicates at least one of:

that the resource is associated with a firewall; and

that the resource is not infected by a virus.

6. The apparatus of claim 1 , wherein:

the at least one token-based rule associates the second access value with a combination of resource tokens; and

the value of the second access value corresponds to the number of resource tokens included in the combination of resource tokens.

7. A method comprising:

storing, by a memory, a plurality of token-based rules, wherein a token-based rule facilitates access to a resource;

storing, by the memory, a plurality of resource tokens associated with the resource;

receiving, by a processor communicatively coupled to the memory, a first resource token indicating that access to the resource has been requested;

determining, by the processor, based at least in part upon the first resource token, at least one token-based rule from the plurality of token-based rules, wherein:

the at least one token-based rule associates a first access value with at least one resource token, wherein the at least one resource token indicates at least one of:

that the resource is associated with a trusted platform module security device; and

that the resource is associated with a virtual private network;

the first access value indicates the risk associated with granting access to the resource; and

the at least one token-based rule specifies at least one condition under which access to the resource should be granted, the first access value associated with the at least one condition;

determining, by the processor, that the at least one resource token associated with the first access value is included in the plurality of resource tokens;

determining, by the processor, based at least in part upon the at least one token-based rule, a second access value associated with the at least one resource token in response to the determination that the plurality of resource tokens comprises the at least one resource token, wherein the second access value indicates a chance that at least one of that access is granted to an unrequested resource and that the resource corrupts the device;

determining, by the processor, based at least upon the at least one token-based rule, that the second access value is insufficient to grant access to the resource by comparing the second access value with the first access value;

determining, by the processor, in response to the determination that the value of the second access value is insufficient to grant access to the resource, that access to the resource should be denied;

communicating a first decision token indicating that access by at least one of the user and the device to the resource should be denied;

receiving an updated resource token;

redetermining, by the processor, the second access value based at least in part upon the updated resource token;

determining, by the processor, based at least in part upon the at least one token-based rule, that the redetermined second access value is sufficient to grant access to the resource by comparing the redetermined second access value with the first access value; and

communicating a second decision token indicating that access by at least one of the user and the device to the resource should be granted.

8. The method of claim 7 , further comprising:

receiving, by the processor, an updated resource token indicating that a form of authentication associated with the resource has been performed;

redetermining, by the processor, the value of the second access value based at least in part upon the updated resource token; and

determining, by the processor, based at least in part upon the at least one token-based rule, that the redetermined value of the second access value is sufficient to grant access to the resource.

9. The method of claim 7 , further comprising:

receiving, by the processor, an updated resource token indicating that security associated with the resource has not been compromised;

redetermining, by the processor, the value of the second access value based at least in part upon the updated resource token; and

determining, by the processor, based at least in part upon the at least one token-based rule, that the redetermined value of the second access value is sufficient to grant access to the resource.

10. The method of claim 7 , wherein the at least one resource token indicates at least one of:

that the resource has performed Kerberos authentication; and

that the resource is associated with a digital certificate.

11. The method of claim 7 , wherein the at least one resource token indicates at least one of:

that the resource is associated with a firewall; and

that the resource is not infected by a virus.

12. The method of claim 7 , wherein:

the at least one token-based rule associates the second access value with a combination of resource tokens; and

the value of the second access value corresponds to the number of resource tokens included in the combination of resource tokens.

13. One or more computer-readable non-transitory storage media embodying software that is operable when executed to:

store a plurality of token-based rules, wherein a token-based rule facilitates access to a resource;

store a plurality of resource tokens associated with the resource;

receive a first resource token indicating that access to the resource has been requested;

determine, based at least in part upon the first resource token, at least one token-based rule from the plurality of token-based rules, wherein:

the at least one token-based rule associates a first access value with at least one resource token, wherein the at least one resource token indicates at least one of:

that the resource is associated with a trusted platform module security device; and

that the resource is associated with a virtual private network;

the first access value indicates the risk associated with granting access to the resource; and

the at least one token-based rule specifies at least one condition under which access to the resource should be granted, the first access value associated with the at least one condition;

determine that the at least one resource token associated with the first access value is included in the plurality of resource tokens;

determine, based at least in part upon the at least one token-based rule, a second access value associated with the at least one resource token in response to the determination that the plurality of resource tokens comprises the at least one resource token, wherein the second access value indicates a chance that at least one of that access is granted to an unrequested resource and that the resource corrupts the device;

determine, based at least upon the at least one token-based rule, that the second access value is insufficient to grant access to the resource by comparing the second access value with the first access value;

determine, in response to the determination that the value of the second access value is insufficient to grant access to the resource, that access to the resource should be denied;

communicate a first decision token indicating that access by at least one of the user and the device to the resource should be denied;

receive an updated resource token;

redetermine the second access value based at least in part upon the updated resource token;

determine, based at least in part upon the at least one token-based rule, that the redetermined second access value is sufficient to grant access to the resource by comparing the redetermined second access value with the first access value; and

communicate a second decision token indicating that access by at least one of the user and the device to the resource should be granted.

14. The media of claim 13 embodying software further operable when executed to:

receive an updated resource token indicating that a form of authentication associated with the resource has been performed;

redetermine the value of the second access value based at least in part upon the updated resource token; and

determine, based at least in part upon the at least one token-based rule, that the redetermined value of the second access value is sufficient to grant access to the resource.

15. The media of claim 13 embodying software further operable when executed to:

receive an updated resource token indicating that security associated with the resource has not been compromised;

redetermine the value of the second access value based at least in part upon the updated resource token; and

determine, based at least in part upon the at least one token-based rule, that the redetermined value of the second access value is sufficient to grant access to the resource.

16. The media of claim 13 , wherein the at least one resource token indicates at least one of:

that the resource has performed Kerberos authentication; and

that the resource is associated with a digital certificate.

17. The media of claim 13 , wherein the at least one resource token indicates at least one of:

that the resource is associated with a firewall; and

that the resource is not infected by a virus.

18. The media of claim 13 , wherein:

the at least one token-based rule associates the second access value with a combination of resource tokens; and

the value of the second access value corresponds to the number of resource tokens included in the combination of resource tokens.