Policy language and state machine model for dynamic authorization in physical access control

• US 20080086643A1
• Filed: 10/10/2006
• Published: 04/10/2008
• Est. Priority Date: 10/10/2006
• Status: Active Grant

• Current Assignee: Honeywell International Inc.
• Original Assignee: Honeywell International Inc.
• Inventors: Ganesh, Arul, Chaturvedi, Namit, Balasubramanian, Meenakshi
• Granted Patent: US 7,853,987 B2
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: G07C 9/20 involving the use of a pass

Abstract

An automaton capable of providing an access control decision upon receiving an access control request is produced by processing context based access control policies specified in a formal descriptive language, and by converting the context based access control policies to the automaton.

Claims

1. A method implemented on a computer for producing an automaton capable of providing an access control decision upon receiving an access control request, the method comprising:

accepting context based access control policies specified in a formal descriptive language;

processing the context based access control policies specified in the formal descriptive language; and

,

converting the context based access control policies to the automaton.

2. The method of claim 1 wherein the processing of the context based access control policies specified in a formal descriptive language comprises processing the context based access control policies in the form of events.

3. The method of claim 2 wherein the processing of the context based access control policies in the form of events comprises processing the context based access control policies in the form of events specified in terms of a user s, a restricted area o of a secured facility, and an access point d permitting entrance to or exit from the restricted area o.

4. The method of claim 2 wherein the processing of the context based access control policies in the form of events comprises processing the context based access control policies in the form of events specified in terms of a user s, a type of user s, a restricted area o of a secured facility, a type of restricted area o, and an access point d permitting entrance to or exit from the restricted area o.

5. The method of claim 1 wherein the processing of the context based access control policies specified in the formal descriptive language comprises processing access control actions and context specified as events, and wherein the events are included in an alphabet set of the language.

6. The method of claim 1 wherein the automaton comprises a finite state machine.

7. The method of claim 1 wherein the converting of the context based access control policies to the automaton comprises:

converting the context based access control policies to formulas including events and variables; and

,

converting the formulas to the automaton.

8. The method of claim 7 wherein the automaton comprises a finite state machine.

9. The method of claim 7 wherein the converting of the context based access control policies to formulas comprises converting the context based access control policies to monadic second order formulas.

10. The method of claim 7 wherein the converting of the context based access control policies to formulas including events and variables comprises converting the context based access control policies to formulas including events specified in terms of a user s, a restricted area o of a secured facility, and an access point d permitting entrance to or exit from the restricted area o.

11. The method of claim 7 wherein the converting of the context based access control policies to formulas including events and variables comprises converting the context based access control policies to formulas including events specified in terms of a user s, a type of user s, a restricted area o of a secured facility, a type of restricted area o, and an access point d permitting entrance to or exit from the restricted area o.

12. The method of claim 7 wherein the converting of the context based access control policies to formulas including events and variables comprises converting the context based access control policies to formulas including events, variables, and Boolean operators.

13. The method of claim 1 further comprising:

formally verifying if a set of behaviors of a facility subject to the access control policies represented as formal descriptive language satisfies one or more of the access control policies; and

,

checking if one or more of the access control policies can be together enforced on a particular facility subject to the access control policies.

14. The method of claim 1 further comprising storing the automaton in memory.

15. The method of claim 14 wherein the storing of the automaton in memory comprises storing the automaton on an identification device carried by a user.

16. The method of claim 14 wherein the storing of the automaton in memory comprises storing the automaton on a door controller.

17. The method of claim 14 wherein the storing of the automaton in memory comprises storing the automaton in a plurality of memories.

18. A method implemented on a computer for producing finite state automata capable of providing an access control decision upon receiving an access control request, the method comprising:

reading context based access control policies specified in a formal descriptive language;

converting the context based access control policies specified in the formal descriptive language to Monadic Second Order formulae; and

,

converting the Monadic Second Order formulae to the finite state automata.

19. The method of claim 18 wherein the converting of the context based access control policies comprises converting the context based access control policies specified in the formal descriptive language to Monadic Second Order event based formulae.

20. The method of claim 19 wherein the event based formulae contain terms relating to a user s, a restricted area o of a secured facility, and an access point d permitting entrance to or exit from the restricted area o.

21. The method of claim 19 wherein the event based formulae contain terms relating to a user s, a type of user s, a restricted area o of a secured facility, a type of restricted area o, and an access point d permitting entrance to or exit from the restricted area o.

22. The method of claim 18 wherein the converting of the context based access control policies comprises converting the context based access control policies specified in the formal descriptive language to Monadic Second Order event and variable based formulae.

23. The method of claim 18 wherein the converting of the context based access control policies comprises converting the context based access control policies specified in the formal descriptive language to Monadic Second Order event, variable, and Boolean operator based formulae.

24. The method of claim 18 further comprising storing the finite state automata in memory.

25. The method of claim 24 wherein the storing of the finite state automata in memory comprises storing the finite state automata on an identification device carried by a user.

26. The method of claim 24 wherein the storing of the finite state automata in memory comprises storing the finite state automata on a door controller.