Tailorable access privileges for services based on session access characteristics

摘要

Method and apparatus that provide tailorable access privileges for services based on session access characteristics. In a session between a user and a software application that provides one or more services, there are various access characteristics that describe the security of the session, for example, user authentication and encryption. Various combinations of access characteristics are defined and security levels are associated with the combinations. Each of the available services also has an associated security level. Access characteristics of a session are established after a user logs in to establish a session and the user is authenticated. When a service request is received, the session's access characteristics are used to determine the session's security level. If the session's security level satisfies the security level required by the requested service, access to the service is granted. Otherwise, access is denied. Since the access characteristics are determined when a session is established, and the security levels are tailorable, services can be provided via different channels and devices without compromising security.