System, method and computer program product for managing access to systems, products, and data based on information associated with a physical location of a user

• US 10,084,796 B2
• Filed: 11/06/2017
• Issued: 09/25/2018
• Est. Priority Date: 04/03/2013
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Harrison, Daniel Thomas
• Primary Examiner(s): Rahman, Mahfuzur
• Application Number:
  US15/804,906
• Publication Number:
  US 20180131703A1
• Time in Patent Office: 323 Days
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals

Abstract

In accordance with embodiments, there are provided mechanisms and methods for managing access to data based on information associated with a physical location of a user. These mechanisms and methods for managing access to systems, products, or data based on information associated with a physical location of a user can enable improved data management efficiency, enhanced data management accuracy, decreased data management costs, decreased licensing costs, increased security, additional marketing opportunities, etc.

Claims

1. A method, comprising:

maintaining, by a computer system, permission information indicating that a first user'"'"'s access to a data store is based at least in part on a physical location of a second user, wherein the permission information further controls access to the data store based on time frame information indicative of a time frame during which the data store can be accessed;

receiving, by the computer system, location information indicating a current location of the first user and a current location of the second user, wherein the current location of the first user is determined by a device of the first user that includes a global positioning system (GPS) and the current location of the second user is determined by a device of the second user that includes a GPS, wherein the location information includes a timestamp indicative of a time at which the current location of the first user was determined;

determining, by the computer system, whether a first distance from the current location of the first user to the current location of the second user is within a predetermined distance indicated by the permission information, wherein the predetermined distance specifies a particular distance between the first user and the second user; and

based on the first distance being within the predetermined distance, the computer system enabling the first user to access data within the data store, wherein enabling the first user to access the data includes determining that the time indicated by the timestamp is within the time frame indicated by the time frame information.

2. The method of claim 1, further comprising:

receiving, by the computer system, additional information indicating an updated location of the second user;

determining, by the computer system, whether a second distance from the current location of the first user to the updated location of the second user is within the predetermined distance; and

based on the second distance not being within the predetermined distance, the computer system preventing the first user from accessing the data.

3. The method of claim 1, further comprising:

receiving, by the computer system, additional information indicating an updated timestamp associated with the current location of the first user; and

in response to determining that a time indicated by the updated timestamp is not within the time frame, the computer system preventing the first user from accessing the data.

4. The method of claim 1, wherein enabling the first user to access the data includes:

providing, to the first user by the computer system, login information for logging into the computer system to access the data.

5. The method of claim 1, wherein the permission information indicates two or more permissions, and wherein enabling access to the data includes:

receiving, by the computer system, a selection by the first user of one of the two or more permissions such that the first user accesses particular data associated with the permission indicated by the selection.

6. The method of claim 1, wherein the permission information indicates that a particular number of users are allowed to access the data at a single time.

7. The method of claim 1, wherein the time frame information specifies one or more times of day during which the data store can be accessed.

8. A non-transitory computer readable medium having program instructions stored thereon that are capable of causing a computer system to perform operations comprising:

receiving, from a global positioning system (GPS) enabled device of a first user, location information indicating a location of the first user

receiving, from a GPS-enabled device of a second user, additional location information indicating a location of the second user;

determining that the first user is within a predetermined distance from the second user based on the location of the first user and the location of the second user;

receiving an indication that identifies a time associated with the first user being within the predetermined distance from the second user;

providing the first user with access to particular data based on the first user being within the predetermined distance from the second user and the time associated with the first user being within a time frame during which access to the particular data is enabled;

subsequent to providing the first user access to the particular data, determining whether the first user is within the predetermined distance from the second user; and

in response to determining that the first user is not within the predetermined distance from the second user, preventing the first user from accessing the particular data.

9. The non-transitory computer readable medium of claim 8, wherein the operations further comprise:

maintaining a set of permissions that specify, for a given permission, data that is accessible based on the first user'"'"'s distance from the second user.

10. The non-transitory computer readable medium of claim 9, wherein providing the first user with access to the particular data includes:

determining two or more permissions in the set of permissions that provide access to data based on the first user being within the predetermined distance from the second user;

presenting the two or more permissions to the first user; and

receiving a selection of one of the two or more permissions, wherein the selected permission specifies the particular data.

11. The non-transitory computer readable medium of claim 8, wherein providing the first user with access to the particular data includes:

providing, to the first user, system credentials that are usable by the first user to access the particular data while the first user is within the predetermined distance of the second user.

12. The non-transitory computer readable medium of claim 9, wherein providing the first user with access to the particular data includes:

receiving, from the first user, identity information usable to identify the first user; and

determining at least one permission in the set of permissions that corresponds to the identity information, wherein the at least one permission specifies the particular data.

13. A system, comprising:

one or more processors; and

memory having program instructions stored thereon that are executable by the one or more processors to perform operations comprising;

identifying a first location that corresponds to a first user and a second location that corresponds to a second user, wherein the first location is identified using location information from a global positioning system (GPS) enabled device of the first user and the second location is identified using location information from a GPS-enabled device of the second user, and wherein the first location is associated with a timestamp indicative of a time when the first location was determined;

determining one or more permissions based on a distance between the first location and the second locations and the time indicated by the timestamp being within a particular period of time, wherein the one or more permissions grant access to particular data, and wherein the one or more permissions are associated with the particular period of time during which the particular data can be accessed; and

based on the determined one or more permissions, granting the first user access to the particular data.

14. The system of claim 13, wherein the operations further comprise:

identifying a new location that corresponds to the first user; and

in response to determining that the new location is not within a particular distance of the second location that corresponds to the second user, denying the first user access to the particular data, wherein the particular distance is associated with the one or more permissions.

15. The system of claim 13, wherein the operations further comprise:

receiving a second timestamp subsequent to granting the first user access to the particular data in accordance with the one or more permissions; and

in response to determining that the second timestamp specifies a time outside of the particular period of time during which the particular data can be accessed, denying the first user access to the particular data.

16. The system of claim 13, wherein determining the one or more permissions includes:

receiving, from the first user, system login information; and

determining the one or more permissions by determining that the system login information corresponds to the one or more permissions.

17. The system of claim 13, further comprising a multi-tenant on-demand database system that includes the one or more processors and the memory.