Geographically based access management for internet of things device data

• US 10,117,101 B2
• Filed: 08/30/2017
• Issued: 10/30/2018
• Est. Priority Date: 03/31/2016
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Inventors: Girdhar, Dhiraj, Meehan, Kevin, Peck, Brian Christopher, Shah, Dhara
• Primary Examiner(s): Mizrahi, Diane
• Application Number:
  US15/691,153
• Publication Number:
  US 20170366977A1
• Time in Patent Office: 426 Days
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/64 using geofenced areas
• CPC Class Codes: H04W 4/021 Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

The proliferation of IOT devices has led to an increase in sensitive, cloud-stored data. To provide further protection, IOT device data may be secured by geographically based access controls as a supplement to or in place of traditional password protection. A geographically based access control restricts data accessibility to designated geographical areas. In this manner, a requesting device may not access geo-fence protected IOT device data unless the requesting device is located within a designated geographical area. Geo-fence parameters utilized for creation of a geo-fence policy may be pre-specified or generated based on operating conditions. For example, a user may provide location data, such as an address or geographical coordinate, and a radial distance from the location for which data access is permissible. Additionally, geo-fence parameters can be automatically determined based on criteria such as an IOT device type or data usage characteristics.

Claims

1. A method comprising:

based on receiving first data from a first measuring device, determining a category of the first data;

identifying one or more geographical areas based, at least in part, on the category of the first data and a current location of the first measuring device;

generating an access policy for the first data based, at least in part, on the identified geographical areas; and

securing access to the first data based, at least in part, on the access policy.

2. The method of claim 1 further comprising:

based on receipt of a request to access the first data from a requesting device, identifying a location of the requesting device; and

based on determining that the location of the requesting device satisfies the access policy, supplying the first data.

3. The method of claim 2 further comprising, based on determining that the location of the requesting device does not satisfy the access policy, responding to the request with a portion of the first data which is exempted from the access policy.

4. The method of claim 2 further comprising:

associating a time period with at least one of the geographical areas in the access policy;

wherein supplying the first data is also based on determining that the request was received within the associated time period.

5. The method of claim 1, wherein identifying the one or more geographical areas based, at least in part, on the category of the first data comprises determining typical usage locations corresponding to the category of the first data.

6. The method of claim 5, wherein the category of the first data is a protected health information;

wherein at least one of the geographical areas corresponds to a location of medical personnel.

7. The method of claim 1 further comprising determining the current location of the first measuring device.

8. The method of claim 1, wherein determining the category of the first data comprises determining a type of the first measuring device.

9. The method of claim 1 further comprising:

determining a security level for the first data based, at least in part, on the category of the first data; and

determining a size of at least one of the geographical areas based, at least in part, on the security level, wherein the at least one geographical area is smaller if the security level indicates heightened security and larger if the security level indicates lower security.

10. One or more non-transitory machine-readable media having program code for providing geographically based access controls for data stored therein, the program code to:

based on receiving first data from a first measuring device, determine a category of the first data;

identify one or more geographical areas based, at least in part, on the category of the first data and a current location of the first measuring device;

generate an access policy for the first data based, at least in part, on the identified geographical areas; and

secure access to the first data based, at least in part, on the access policy.

11. The machine-readable media of claim 10 further comprising program code to:

based on receipt of a request to access the first data from a requesting device, identify a location of the requesting device; and

based on a determination that the location of the requesting device satisfies the access policy, supply the first data.

12. An apparatus comprising:

a processor; and

a non-transitory machine-readable medium having program code executable by the processor to cause the apparatus to,

based on receiving first data from a first measuring device, determine a category of the first data;

identify one or more geographical areas based, at least in part, on the category of the first data and a current location of the first measuring device;

generate an access policy for the first data based, at least in part, on the identified geographical areas; and

secure access to the first data based, at least in part, on the access policy.

13. The apparatus of claim 12 further comprising program code executable by the processor to cause the apparatus to:

based on receipt of a request to access the first data from a requesting device, identify a location of the requesting device; and

based on a determination that the location of the requesting device satisfies the access policy, supply the first data.

14. The apparatus of claim 13 further comprising program code executable by the processor to cause the apparatus to, based on a determination that the location of the requesting device does not satisfy the access policy, respond to the request with a portion of the first data which is exempted from the access policy.

15. The apparatus of claim 13 further comprising program code executable by the processor to cause the apparatus to:

associate a time period with at least one of the geographical areas in the access policy;

wherein the program code executable by the processor to cause the apparatus to supply the first data is also based on a determination that the request was received within the associated time period.

16. The apparatus of claim 12, wherein the program code executable by the processor to cause the apparatus to identify the one or more geographical areas based, at least in part, on the category of the first data comprises program code executable by the processor to cause the apparatus to determine typical usage locations corresponding to the category of the first data.

17. The apparatus of claim 16, wherein the category of the first data is a protected health information;

wherein at least one of the geographical areas corresponds to a location of medical personnel.

18. The apparatus of claim 12 further comprising program code executable by the processor to cause the apparatus to determine the current location of the first measuring device.

19. The apparatus of claim 12, wherein the program code executable by the processor to cause the apparatus to determine the category of the first data comprises program code executable by the processor to cause the apparatus to determine a type of the first measuring device.

20. The apparatus of claim 12 further comprising program code executable by the processor to cause the apparatus to:

determine a security level for the first data based, at least in part, on the category of the first data; and

determine a size of at least one of the geographical areas based, at least in part, on the security level, wherein the at least one geographical area is smaller if the security level indicates heightened security and larger if the security level indicates lower security.