Abstract: Techniques are described herein that are capable of evaluating a result of enforcement of access control policies instead of enforcing the access control policies. For instance, a result of enforcement of an access control policy with regard to sign-in processes is evaluated instead of enforcing the access control policy with regard to the sign-in processes. The evaluation includes monitoring access requests that are received during the sign-in processes. Each access request requests access to a resource. The evaluation further includes comparing attributes of each access request against the access control policy that specifies criteria that are to be satisfied as a prerequisite to granting access to the resource to which access is requested by the respective access request. Metadata associated with the sign-in processes is generated instead of enforcing the access control policy with regard to the sign-in processes.

Abstract: Some embodiments control access by applications to resources in a computing environment. An embodiment notes a request from an application to access a resource, determines a compliance status of the application based on access control policy compliance criteria, ascertains an authorization status of the request based on an authorization credential of the request and an authorization requirement of the resource, and responds to the request based on the compliance status and also based on the authorization status, thereby providing fine-grained access control. Access may also be controlled based on a request's beneficiary. An access request response may allow access, deny access, or ask for additional authorization. A compliance classifier reduces risk by dynamically updating compliance status after compliance criteria changes or attribute changes. An identity service access control architecture uses a compliance attribute to improve efficiency.

Abstract: Generally discussed herein are devices, systems, and methods for adaptive authorization using a local route as a named location. A method can include defining a local route and a corresponding local route endpoint, associating a compute resource as a destination of the local route endpoint, defining an adaptive authorization policy that limits access to the compute resource to be through the local route endpoint, and enforcing access to the compute resource based on the defined adaptive authorization policy.

Abstract: A computing system configured to support entities having the ability to indicate capability information for capabilities of the entities is illustrated. Embodiments may include an identity provider computer system comprising at least one processor. The identity provider computer system is configured to receive requests for access tokens from entities. The requests include capability information for the entities. The identity provider computer system is further configured to provide access tokens to the entities which include the capability information. The computing system further includes a resource provider computer system comprising at least one processor configured to receive resource requests and access tokens from entities. The access tokens include the capability information. The resource providers are further configured to provide responses to the entities according to the capability information.

Abstract: Techniques are described herein that are capable of selectively authenticating a user using voice recognition and random representations. A credential that is received from an entity is compared to a reference credential associated with a user. The random representations are caused to be displayed to the entity based at least in part on the credential corresponding to the reference credential. Each random representation has a random entropy. A representation of speech of the entity is analyzed to determine whether a voice characterized by the speech corresponds to a voice profile that characterizes a voice of the user and to determine whether the speech includes a verbal identification of each random representation. The user is selectively authenticated based at least in part on whether the voice corresponds to the voice profile and further based at least in part on whether the speech includes the verbal identification of each random representation.

Abstract: Authenticating computing entities. A method includes at an identity provider, providing a first access token to an entity for use by the entity in obtaining resources from a resource provider. The method further includes, at the identity provider, receiving response information from the entity. The response information from the entity is provided to the entity from the resource provider as a result of the resource provider enforcing policy at the resource provider. At the identity provider, a second access token is provided to the entity. The second access token is provided based on the response information, such that the second access token can be used by the entity to obtain the resources from the resource provider.

Abstract: Managing an authenticated user session. A method includes a resource provider computer system subscribing to a conditional access termination service for an entity configured to obtain resources from the resource provider computer system through a user session. The resource provider computer system receives an event, related to resource requests, for the entity from the conditional access termination service. The resource provider computer system receives a request for resources from the entity. The resource provider computer system evaluates the request with respect to the event. The resource provider computer system responds to the request based on evaluating the request with respect to the event.

Abstract: An embodiment disclosed herein is related to computing systems and method for a computing system to generate an access token that includes an IP address from a request. In the embodiment, a request is received for access to one secured data items. The request may include user credentials that specify that a user making the request is permitted to access the secured data items. The user credentials are validated and an Internet Protocol (IP) address that the request was sent from is determined. An access token is generated that includes the IP address that the request was sent from.

Abstract: Techniques are described herein that are capable of evaluating a result of enforcement of access control policies instead of enforcing the access control policies. For instance, a result of enforcement of an access control policy with regard to sign-in processes is evaluated instead of enforcing the access control policy with regard to the sign-in processes. The evaluation includes monitoring access requests that are received during the sign-in processes. Each access request requests access to a resource. The evaluation further includes comparing attributes of each access request against the access control policy that specifies criteria that are to be satisfied as a prerequisite to granting access to the resource to which access is requested by the respective access request. Metadata associated with the sign-in processes is generated instead of enforcing the access control policy with regard to the sign-in processes.

Abstract: The present invention concerns method for enabling provision of temporary access to an area controlled by a network-connected endpoint device, the method including the steps of: enrolling an access partner in an account for the endpoint device maintained at an access server; receiving from the access partner at the access server, requests for temporary access to the endpoint device; and activating the requests with the endpoint device such that the access partner is provided with temporary access to the area.

Abstract: An embodiment disclosed herein is related to computing systems and method for a computing system to generate an access token that includes an IP address from a request. In the embodiment, a request is received for access to one secured data items. The request may include user credentials that specify that a user making the request is permitted to access the secured data items. The user credentials are validated and an Internet Protocol (IP) address that the request was sent from is determined. An access token is generated that includes the IP address that the request was sent from.

Abstract: Authenticating computing entities. A method includes at an identity provider, providing a first access token to an entity for use by the entity in obtaining resources from a resource provider. The method further includes, at the identity provider, receiving response information from the entity. The response information from the entity is provided to the entity from the resource provider as a result of the resource provider enforcing policy at the resource provider. At the identity provider, a second access token is provided to the entity. The second access token is provided based on the response information, such that the second access token can be used by the entity to obtain the resources from the resource provider.

Abstract: Managing an authenticated user session. A method includes a resource provider computer system subscribing to a conditional access termination service for an entity configured to obtain resources from the resource provider computer system through a user session. The resource provider computer system receives an event, related to resource requests, for the entity from the conditional access termination service. The resource provider computer system receives a request for resources from the entity. The resource provider computer system evaluates the request with respect to the event. The resource provider computer system responds to the request based on evaluating the request with respect to the event.

Abstract: A computing system configured to support entities having the ability to indicate capability information for capabilities of the entities is illustrated. Embodiments may include an identity provider computer system comprising at least one processor. The identity provider computer system is configured to receive requests for access tokens from entities. The requests include capability information for the entities. The identity provider computer system is further configured to provide access tokens to the entities which include the capability information. The computing system further includes a resource provider computer system comprising at least one processor configured to receive resource requests and access tokens from entities. The access tokens include the capability information. The resource providers are further configured to provide responses to the entities according to the capability information.

Abstract: Implementing policy at a resource provider computer system. The method includes a resource provider computer system receiving policy from an identity provider system, the policy being related to an entity that authenticates using the identity provider computer system. The resource provider computer system receives a request for resources from the entity and an access token from the entity. The access token was obtained by the entity from the identity provider computer system as a result of the entity authenticating with the identity provider computer system. The resource provider computer system evaluates the request with respect to the policy. The resource provider computer system responds to the request based on evaluating the request with respect to the policy.

Abstract: The present invention concerns method for enabling provision of temporary access to an area controlled by a network-connected endpoint device, the method including the steps of: enrolling an access partner in an account for the endpoint device maintained at an access server; receiving from the access partner at the access server, requests for temporary access to the endpoint device; and activating the requests with the endpoint device such that the access partner is provided with temporary access to the area.

Abstract: A system for a closure lock comprises a battery-powered remote module with a lock mechanism for operating the lock, the remote module communicating with a base station coupled to a closure controller, the base station able to send lock control signals to the remote module to operate the lock. The module is arranged to have an operation mode and a non-operation mode, power consumption in the non-operation mode being lower than that in the operation mode, and is further configured to switch between the modes based on instructions from the base station. In the non-operation mode, the module maintains a communication link with the base station based on a pre-established synchronisation protocol. The invention provides reliability against interference between base station and remote module, whilst greatly limiting the power consumption of the remote module.

Abstract: A system for a closure lock comprises a battery-powered remote module with a lock mechanism for operating the lock, the remote module communicating with a base station coupled to a closure controller, the base station able to send lock control signals to the remote module to operate the lock. The module is arranged to have an operation mode and a non-operation mode, power consumption in the non-operation mode being lower than that in the operation mode, and is further configured to switch between the modes based on instructions from the base station. In the non-operation mode, the module maintains a communication link with the base station based on a pre-established synchronisation protocol. The invention provides reliability against interference between base station and remote module, whilst greatly limiting the power consumption of the remote module.

Abstract: The present invention relates to an apparatus and method for driving a moveable closure, such as a garage door. In an initialisation process in a setup mode for the door operator for driving a moveable closure between open and closed positions, the apparatus allows selection of opening and/or closing speeds for the closure from a plurality of predefined stored driving speeds. This selection, or the range of stored driving speeds available for selection, is made in accordance with the type of closure to be driven, and this may be established automatically by detecting certain characteristics of movement of the closure as part of the initialisation process.

Abstract: Authenticating internet application sessions. A method includes downloading client side code that when executed implements one or more client side modules including at least one module with message interception functionality. The method includes executing the client side code to implement the one or more client side modules. A request is sent to an internet application server. In response to the request, a message is received from the internet application server indicating that the request is not authorized. The message from the internet application server indicating that the request is not authorized is intercepted at the one or more client side modules. The one or more client side modules, as a result of the message indicating that the request is not authorized, send a request for authentication in a required format for authentication. Authentication is performed without losing user state associated with the request to the internet application server.