Method and system for dynamic adjustment of computer security based on personal proximity

• US 20070083915A1
• Filed: 10/06/2005
• Published: 04/12/2007
• Est. Priority Date: 10/06/2005
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Janakiraman, Janani, Ullman, Lorin, Corley, Carole
• Application Number:
  US11/245,311
• Publication Number:
  US 20070083915A1
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2139 Recurrent verification

Abstract

A method, system, apparatus, or computer program product is presented for performing authorization operations with respect to a set of computational resources in a data processing system. Each person that accesses resources in a data processing system is associated with a personal proximity device, such as an electronic badge, the presence of which can be detected by appropriate detecting devices near the computational resources of the data processing system. A first person is permitted to access an authorized subset of computational resources, and the location of the first person can be determined by the detecting devices. At some point in time, the presence of a second person is detected and the corresponding location is determined. A spatial relationship between the locations of the first person and the second person is computed, e.g., a distance, the authorized privileges of the first person are modified based on the computed spatial relationship.

Claims

1. A method for performing authorization operations with respect to a set of computational resources in a data processing system, the method comprising:

automatically permitting access to an authorized subset of computational resources for a first person;

automatically determining a first physical location for the first person and a second physical location for a second person using one or more personal proximity detection devices;

computing a spatial relationship between the first physical location and the second physical location; and

automatically modifying the authorized subset of computational resources based on the spatial relationship.

2. The method of claim 1 further comprising:

denying access by the first person to a resource in the modified authorized subset of computational resources.

3. The method of claim 1 further comprising:

evaluating an authorization policy to determine the authorized subset of computational resources.

4. The method of claim 1 further comprising:

computing a physical distance between the first physical location and the second physical location; and

performing a modification of the authorized subset of computational resources using the computed physical distance as an input to determining the spatial relationship.

5. The method of claim 1 further comprising:

performing a modification of the authorized subset of computational resources in response to a determination that the first physical location and the second physical location are contained within a common physical structure.

6. The method of claim 1 further comprising:

retrieving a first authorization policy that is associated with the first person;

determining a first subset of computational resources that is permitted to be accessed by the first person in accordance with the first authorization policy;

retrieving a second authorization policy that is associated with the second person;

determining a second subset of computational resources that is permitted to be accessed by the second person in accordance with the second authorization policy; and

comparing the first subset of computational resources and the second subset of computational resources.

7. The method of claim 6 further comprising:

computing an intersecting subset of computational resources between the first subset of computational resources and the second subset of computational resources; and

restricting the modified authorized subset of computational resources for the first person to be equal to or less than the intersecting subset of computational resources.

8. The method of claim 6 further comprising:

enhancing the modified authorized subset of computational resources for the first person to include a computational resource from the second subset of computational resources that is permitted to be accessed by the second person.

9. The method of claim 1 further comprising:

receiving information in a wireless signal from a portable electronic device that is associated with a person; and

determining a physical location for a person based on the received wireless signal.

10. A computer program product on a computer-readable storage medium for use in a data processing system for performing authorization operations with respect to a set of computational resources, the computer program product comprising:

means for automatically permitting access to an authorized subset of computational resources for a first person;

means for automatically determining a first physical location for the first person and a second physical location for a second person using one or more personal proximity detection devices;

means for computing a spatial relationship between the first physical location and the second physical location; and

means for automatically modifying the authorized subset of computational resources based on the spatial relationship.

11. The computer program product of claim 10 further comprising:

means for denying access by the first person to a resource in the modified authorized subset of computational resources.

12. The computer program product of claim 10 further comprising:

means for evaluating an authorization policy to determine the authorized subset of computational resources.

13. The computer program product of claim 10 further comprising:

means for computing a physical distance between the first physical location and the second physical location; and

means for performing a modification of the authorized subset of computational resources using the computed physical distance as an input to determining the spatial relationship.

14. The computer program product of claim 10 further comprising:

means for performing a modification of the authorized subset of computational resources in response to a determination that the first physical location and the second physical location are contained within a common physical structure.

15. The computer program product of claim 10 further comprising:

means for receiving information in a wireless signal from a portable electronic device that is associated with a person; and

means for determining a physical location for a person based on the received wireless signal.

16. The computer program product of claim 10 further comprising:

means for retrieving a first authorization policy that is associated with the first person;

means for determining a first subset of computational resources that is permitted to be accessed by the first person in accordance with the first authorization policy;

means for retrieving a second authorization policy that is associated with the second person;

means for determining a second subset of computational resources that is permitted to be accessed by the second person in accordance with the second authorization policy;

means for computing an intersecting subset of computational resources between the first subset of computational resources and the second subset of computational resources; and

means for restricting the modified authorized subset of computational resources for the first person to be equal to or less than the intersecting subset of computational resources.

17. The computer program product of claim 10 further comprising:

means for retrieving a first authorization policy that is associated with the first person;

means for determining a first subset of computational resources that is permitted to be accessed by the first person in accordance with the first authorization policy;

means for retrieving a second authorization policy that is associated with the second person;

means for determining a second subset of computational resources that is permitted to be accessed by the second person in accordance with the second authorization policy;

means for enhancing the modified authorized subset of computational resources for the first person to include a computational resource from the second subset of computational resources that is permitted to be accessed by the second person.

18. An apparatus for use in a data processing system for performing authorization operations with respect to a set of computational resources, the apparatus comprising:

means for automatically permitting access to an authorized subset of computational resources for a first person;

means for automatically determining a first physical location for the first person and a second physical location for a second person using one or more personal proximity detection devices;

means for computing a spatial relationship between the first physical location and the second physical location; and

means for automatically modifying the authorized subset of computational resources based on the spatial relationship.

19. The apparatus of claim 18 further comprising:

means for denying access by the first person to a resource in the modified authorized subset of computational resources.

20. The apparatus of claim 18 further comprising:

means for retrieving a first authorization policy that is associated with the first person;

means for determining a first subset of computational resources that is permitted to be accessed by the first person in accordance with the first authorization policy;

means for retrieving a second authorization policy that is associated with the second person;

means for determining a second subset of computational resources that is permitted to be accessed by the second person in accordance with the second authorization policy;

means for computing an intersecting subset of computational resources between the first subset of computational resources and the second subset of computational resources; and

means for restricting the modified authorized subset of computational resources for the first person to be equal to or less than the intersecting subset of computational resources.