Systems and methods for enforcing access-control policies

• US 10,375,114 B1
• Filed: 06/27/2016
• Issued: 08/06/2019
• Est. Priority Date: 06/27/2016
• Status: Active Grant

• Current Assignee: Gen Digital Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Gu, Lei, Sokolov, Ilya, McCorkendale, Bruce
• Primary Examiner(s): Steinle, Andrew J
• Application Number:
  US15/194,403
• Time in Patent Office: 1,135 Days
• Field of Search: None
• CPC Class Codes: G06F 21/604 Tools and structures for managing or administering access control systems
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

The disclosed computer-implemented method for enforcing access-control policies may include (i) determining that a user is attempting to access a controlled device that is subject to an access-control policy, (ii) locating at least one additional device that is in physical proximity to the controlled device, (iii) acquiring context information from the additional device that provides information about the identity of the user, (iv) establishing the identity of the user based on the context information acquired from the additional device, and (v) enforcing the access-control policy based on the identity of the user. Various other methods, systems, and computer-readable media are also disclosed.

Claims

1. A computer-implemented method for enforcing access-control policies, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

determining, by an access control system executing on a command-and-control device that manages a controlled device that is subject to an access-control policy that describes circumstances under which differing users are permitted to access certain functions of the controlled device, that a user is attempting to access a restricted function of the controlled device;

searching the physical area surrounding the controlled device for at least one additional device that is in physical proximity to the controlled device and is capable of acquiring context information about the identity of the user at least in part by;

determining a physical location of the controlled device;

determining a physical location of the at least one additional device; and

determining that the physical location of the at least one additional device is in physical proximity to the physical location of the controlled device;

acquiring context information from the additional device that provides information about the identity of the user;

establishing the identity of the user based on the context information acquired from the additional device;

recognizing content that the user is attempting to access via the controlled device based on information that includes a description of the content that the user is attempting to access; and

providing the identity of the user to the access-control system, thereby enabling the access-control system to enforce the access-control policy based on the identity of the user and the content that the user is attempting to access via the controlled device.

2. The method of claim 1, wherein acquiring the context information comprises acquiring at least one of:

a photograph of the user;

a video of the user;

a recording of the user'"'"'s voice;

a series of keystrokes entered by the user on the controlled device; and

a Wi-Fi signal interference pattern of the user.

3. The method of claim 1, wherein the additional device comprises a self-propelled device that is capable of relocating itself in physical space.

4. The method of claim 1, wherein recognizing the content comprises observing a display of the controlled device via the additional device.

5. The method of claim 1, wherein the command-and-control device:

monitors a plurality of controlled devices that comprises the controlled device; and

enforces access-control policies for the plurality of controlled devices.

6. The method of claim 1, wherein establishing the identity of the user comprises matching the context information to a previously established user profile.

7. The method of claim 6, wherein enforcing the access-control policy comprises enforcing an access-control policy that is associated with the previously established user profile.

8. The method of claim 1, wherein establishing the identity of the user comprises determining an approximate age of the user.

9. The method of claim 1, wherein enforcing the access-control policy comprises performing a security action that comprises at least one of:

notifying a supervisor of the controlled device that the user attempted to access the controlled device;

generating a log entry that describes the user'"'"'s attempt to access the controlled device;

restricting at least one function of the controlled device; and

disabling the controlled device.

10. A system for enforcing access-control policies, the system comprising:

a determination module, stored in memory, that determines, by an access-control system executing on a command-and-control device that manages a controlled device that is subject to an access-control policy that describes circumstances under which differing users are permitted to access certain functions of the controlled device, that a user is attempting to access a restricted function of the controlled device;

a locating module, stored in memory, that searches the physical area surrounding the controlled device for at least one additional device that is in physical proximity to the controlled device and is capable of acquiring context information about the identity of the user at least in part by;

determining a physical location of the controlled device;

determining a physical location of the at least one additional device; and

determining that the physical location of the at least one additional device is in physical proximity to the physical location of the controlled device;

an acquiring module, stored in memory, that acquires context information from the additional device that provides information about the identity of the user;

an establishing module, stored in memory, that establishes the identity of the user based on the context information acquired from the additional device;

a recognizing module, stored in memory, that recognizes content that the user is attempting to access via the controlled device based on information that includes a description of the content that the user is attempting to access;

an enforcing module, stored in memory, that provides the identity of the user to the access-control system, thereby enabling the access-control system to enforce the access-control policy based on the identity of the user and the content that the user is attempting to access via the controlled device; and

at least one physical processor configured to execute the determination module, the locating module, the acquiring module, the establishing module, the recognizing module and the enforcing module.

11. The system of claim 10, wherein the acquiring module acquires the context information by acquiring at least one of:

a photograph of the user;

a video of the user;

a recording of the user'"'"'s voice;

a series of keystrokes entered by the user on the controlled device; and

a Wi-Fi signal interference pattern of the user.

12. The system of claim 10, wherein the additional device comprises a self-propelled device that is capable of relocating itself in physical space.

13. The system of claim 10, wherein the recognizing module recognizes the content by observing a display of the controlled device via the additional device.

14. The system of claim 10, wherein the command-and-control device:

monitors a plurality of controlled devices that comprises the controlled device; and

enforces access-control policies for the plurality of controlled devices.

15. The system of claim 10, wherein the establishing module establishes the identity of the user by matching the context information to a previously established user profile.

16. The system of claim 15, wherein the enforcing module enforces the access-control policy by enforcing an access-control policy that is associated with the previously established user profile.

17. The system of claim 10, wherein the establishing module establishes the identity of the user by determining an approximate age of the user.

18. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

determine, by an access-control system executing on a command-and-control device that manages a controlled device that is subject to an access-control policy that describes circumstances under which differing users are permitted to access certain functions of the controlled device, that a user is attempting to access a restricted function of the controlled device;

search the physical area surrounding the controlled device for at least one additional device that is in physical proximity to the controlled device and is capable of acquiring context information about the identity of the user at least in part by;

determining a physical location of the controlled device;

determining a physical location of the at least one additional device; and

determining that the physical location of the at least one additional device is in physical proximity to the physical location of the controlled device;

acquire context information from the additional device that provides information about the identity of the user;

establish the identity of the user based on the context information acquired from the additional device;

recognize content that the user is attempting to access via the controlled device based on information that includes a description of the content that the user is attempting to access; and

provide the identity of the user to the access-control system, thereby enabling the access-control system to enforce the access-control policy based on the identity of the user and the content that the user is attempting to access via the controlled device.