Patent ID: 7650409

Claim:
A method, comprising: performing an automated security scan of a second network device by a first network device to determine at least one of a hardware or software capability of the second network device; determining an attribute for the second network device based, in part, on the determined capability; generating an attribute certificate for the second network device based in part on the attribute; storing the attribute certificate including the attribute on a device other than the second network device; receiving, at the first network device, an authentication request from the second network device for access to a resource over a network; verifying the authentication request from the second network device, or else terminating communication with the second network device; responsive to verifying the authentication request from the second network device, the first network device requesting and receiving from the other device the stored attribute certificate for the second network device; and the first network device determining whether the received attribute certificate for the second network device is valid, where if the attribute certificate is determined valid, authorizing access to the resource over the network based, in part, on the attribute associated with the attribute certificate, or else terminating communication with the second network device, wherein the validity of the received attribute certificate is based on factors comprising: a date range of the attribute certificate, a digital signature on the attribute certificate, and a comparison of an identity listed in the attribute certificate with the verified authentication request.