Controlling access to content

• US 10,587,595 B1
• Filed: 12/30/2015
• Issued: 03/10/2020
• Est. Priority Date: 12/30/2014
• Status: Active Grant

• Current Assignee: MidCap Financial Trust
• Original Assignee: Acronis International GmbH (Acronis AG)
• Inventors: Naef, Frederick Edward
• Primary Examiner(s): Lemma, Samson B
• Assistant Examiner(s): Cruz-Franqui, Richard W
• Application Number:
  US14/984,995
• Time in Patent Office: 1,532 Days
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/61 Time-dependent
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/021 Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
• CPC Class Codes: H04W 48/08 Access restriction or access information delivery, e.g. discovery data delivery signalling during connection H04W76/00

Abstract

Methods and systems for controlling access to content are described. The method may include detecting, at a client electronic device, the presence of a beacon device signal emitted from a beacon device. The method may further include determining, based on the beacon device signal, whether the content is accessible from the client electronic device. The method may also include, in response to determining that the content is accessible from the client electronic device, providing access to the content at the client electronic device.

Claims

1. A method for controlling access to content, the method comprising:

selecting a location for distributing content, wherein the content is relevant to an activity at the location;

attaching a beacon device at the location, wherein the beacon device has a signal range within the location, wherein the beacon device signal comprises a unique beacon ID which is detectable at the client electronic device and usable to determine whether the content is accessible from the client electronic device;

detecting, at a client electronic device, the presence of a beacon device signal emitted from the beacon device, wherein the client device is a mobile device;

determining, based on the beacon device signal, whether the content is accessible from the client electronic device,

wherein determining whether the content is accessible from the client electronic device is further based on a content access policy set at a policy server and wherein a level of access to the content is based upon the content access policy and whether the content is accessible by the client electronic device based on whether the unique beacon ID detected by content access module running on client electronic device matches that of the beacon device, validating timestamp beacon device using a public key, and confirming the timestamp is in an acceptable range before allowing access to content on mobile device;

transmitting private key and unique identifier, using policy server, to beacon device;

transmitting, from the policy server, the public key to the client electronic device; and

in response to determining that the content is accessible from the client electronic device, providing access to the content at the client electronic device.

2. The method of claim 1, wherein determining whether the content is accessible from the client electronic device is further based on a content access policy set at a policy server and wherein a level of access to the content is based upon the content access policy.

3. The method of claim 1, further comprising:

receiving a content access policy at the client electronic device; and

wherein the determining whether the content is accessible from the client electronic device is further based on the content access policy and the determining is performed without the client electronic device being in communication with the policy server from which the content access policy was received.

4. The method of claim 1, wherein providing access to the content at the client electronic device comprises at least one of:

receiving the content at the client electronic device in response to determining that the content is accessible from the client electronic device; and

pre-loading the content on the client electronic device prior to determining that the content is accessible and unlocking the content on the client electronic device in response to determining that the content is accessible from the client electronic device using a decrypted timestamp.

5. The method of claim 1, wherein the beacon device is a Bluetooth Low Energy device.

6. The method of claim 1, wherein the beacon device signal comprises the unique ID which is detectable at the client electronic device and usable to determine whether the content is accessible from the client electronic device.

7. The method of claim 1, further comprising:

in response to determining that the content is accessible from the client electronic device, decrypting the content such that the content is accessible from the client electronic device, wherein the location is a testing room and the content is a test.

8. The method of claim 1, further comprising:

in response to determining that at least one of the beacon device signal and the unique ID is not detectable at the client electronic device, removing access to the content at the client electronic device.

9. The method of claim 8, wherein access to the content at the client electronic device is removed after a delay based on content access policy.

10. The method of claim 3, wherein the content access policy includes at least one of:

an indication of one or more users having access to the content based on detecting the presence of a beacon device signal emitted from a particular beacon device;

an indication of a level of access to the content for each of the one or more users; and

an encryption key usable to access the content.

11. The method of claim 1, further comprising:

detecting, at the client electronic device, the presence of another beacon device signal emitted from another beacon device; and

wherein providing access to the content at the client electronic device is also in response to detecting the presence of the other beacon device signal emitted from the other beacon device.

12. The method of claim 1, further comprising:

detecting, at the client electronic device, the presence of a client electronic device signal emitted from another client electronic device; and

wherein providing access to the content at the client electronic device is also in response to detecting the presence of the client electronic device signal emitted from the other client electronic device.

13. The method of claim 1, wherein the beacon device is another client electronic device, and the beacon device signal is a client electronic device signal from the other client electronic device.

14. The method of claim 1, further comprising:

determining a first device proximity associated with the client electronic device based on the beacon device signal; and

rendering a first portion of the content at the client electronic device based on, at least in part, the first device proximity.

15. The method of claim 14, further comprising:

detecting, at the client electronic device, another beacon device signal emitted from another beacon device;

determining a second device proximity associated with the client electronic device based on the other beacon device signal; and

rendering a second portion of the content at the client electronic device based on the second device proximity.

16. The method of claim 1, further comprising:

controlling one or more features available from a client application for accessing the content based on at least one of the proximity of the beacon device to the client electronic device and the content access policy.

17. The method of claim 13, further comprising:

requiring two-factor authentication to verify that a specific user is in a room where the beacon device is present prior to providing access to the content.

18. The method of claim 1, further comprising:

handcuffing the content to the client electronic device based on the presence of a beacon device.

19. A method for controlling access to content, the method comprising:

attaching a beacon device at a location wherein secure content is selectively distributed, wherein the beacon device has a signal range within the location;

receiving, from a policy server, a content access policy at the beacon device;

emitting, from the beacon device, a beacon device signal representative of at least a portion of the content access policy and a unique beacon ID;

storing a private key at the beacon device and a corresponding public key at the policy server; and

transmitting, from the policy server, the public key to the client electronic device, wherein the private key is used to encrypt information from the beacon device which is used by the client electronic device to confirm the identity of the beacon device to prevent spoofing;

transmitting the encrypted information, wherein the encrypted information comprises a time stamp; and

wherein the beacon device signal is receivable by a client electronic device and usable by the client electronic device to provide access to the content based on a presence of the beacon device signal,

wherein the client device is a mobile device, wherein the mobile device is running a content access module that determines whether the content is accessible by the mobile device based on whether the unique beacon ID detected by content access module matches that of the beacon device, validating timestamp from beacon device using the public key, and confirming the timestamp is in an acceptable range before allowing access to content on mobile device,

wherein the content is relevant to an activity at the location.

20. The method of claim 19, wherein the beacon device signal further comprises a unique ID emitted based on time and date provisions of the content access policy, and wherein access to the content from the client electronic device is provided or removed based on a presence of the unique ID.

21. The method of claim 19, wherein the unique ID is altered to correspond to particular content accessible by the client electronic device based on the content access policy, and wherein the particular content accessible by the client electronic device changes based on the altering of the unique ID.

22. The method of claim 19, further comprising:

requiring two-factor authentication to verify that a specific user is in a room where the beacon device is present prior to providing access to the content.

23. The method of claim 19, wherein the policy server is linked to a business specific system or server used, in part, to determine the content access policy.

24. The method of claim 19, wherein the beacon device is located in a sealed room which prevents the beacon unique ID from leaving the sealed room to prevent spoofing.

25. A system for controlling access to content, the system comprising:

at least one beacon device that emits a beacon device signal comprising a unique ID, wherein the beacon device signal has a ranged sized for a room, the at least one beacon device configured to attach to a position in the room;

at least one client electronic device configured to receive the beacon device signal, a content access policy, and the content, wherein the content is selected for an activity specific to the room;

a content access module running at the at least one client electronic device that determines whether the content is accessible by the at least one client electronic device based on whether the unique ID detected by content access module matches that of the at least one beacon device, validating a timestamp from beacon device using the beacon public key, and confirming the timestamp is in an acceptable range before allowing access to content;

a policy server that provides the content access policy to the at least one client electronic device, wherein the policy server pushes a private key and the unique ID to the beacon device; and

a content repository that provides the content to the client electronic device, wherein the content is not accessible until the client electronic device is in the room, wherein the content access module receives the beacon public key and the unique ID.