Location Based Access Control

• US 20120303827A1
• Filed: 05/24/2011
• Published: 11/29/2012
• Est. Priority Date: 05/24/2011
• Status: Abandoned Application

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: NEYSTADT, Eugene (John), ALON, Daniel, ROSE, Daniel, LEVY, Elan
• Application Number:
  US13/114,044
• Publication Number:
  US 20120303827A1
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals

Abstract

A policy enforcement system may use device location as a parameter for granting or denying access to a resource. An access policy may include location parameters that may permit or deny access to the resource based on the physical location of the device. In some cases, the location may be authenticated by a server that may verify the device'"'"'s location. The access policy may grant or deny full or partial access to the resource, which may be a data resource, such as a file, database, URL, or other information, an application resource, or a physical resource such as a network or a peripheral device. The policy enforcement system may use the device location for regulatory compliance, restricting access to sensitive information, or as a primary or secondary condition for limiting access to a resource.

Claims

1. A method performed on at least one computer processor, said method comprising:

receiving a first location for a first device and a first request for access to a resource;

applying an access control policy to said first request, said access control policy comprising a set of conditions for permitting access to said resource, at least one of said set of conditions comprising a location parameter;

determining that said first request complies with said access control policy and permitting said first device to access said resource;

receiving a second location for said first device and a second request for access to a resource;

applying said access control policy to said second request;

determining that said second request does not comply with said access control policy and denying said second device to access said resource;

2. The method of claim 1, said first location being an authenticated location.

3. The method of claim 2, said second location being a self-reported location.

4. The method of claim 3, said first location being the same location as said second location.

5. The method of claim 1, said resource being a network resource.

6. The method of claim 1, said resource being a data resource.

7. The method of claim 1, said resource being an application resource.

8. The method of claim 1, said at least one of said set of conditions comprising a proximity to a third location.

9. The method of claim 8, said third location being a predefined location.

10. The method of claim 8, said third location being a location for said resource, said resource being movable.

11. The method of claim 8, said proximity being determined by a maximum distance.

12. A system comprising:

an access control server comprising;

at least one processor;

an access control policy comprising a set of conditions for permitting access to a resource, at least one of said set of conditions comprising a location parameter;

an access control system that;

receives a first request for said resource and a first location for a first device;

applies said access control policy to said first request;

determines that said first request complies with said access control policy, and permits access to said resource for said first device.

13. The system of claim 12 further comprising:

a location authentication server comprising;

at least one processor;

a location processor that;

receives a location authentication request from said first device;

generates an authenticated location token; and

transmits said authenticated location token.

14. The system of claim 13, said authentication location token being transmitted to said first device and received from said first device by said access control system.

15. The system of claim 13, said authentication location token being transmitted to said access control system without being transmitted to said first device.

16. The system of claim 13, said location processor that further:

receives a self-reporting location statement from said first device.

17. The system of claim 16, said location processor that further:

receives a location for said first device from a secondary source.

18. The system of claim 17, said authenticated token being digitally signed by said location authentication server.

19. A method performed on at least one computer processor on a first device, said method comprising:

identifying a resource to access;

determining a location for said first device;

transmitting said location to a location authentication server;

transmitting a request to access said resource, said resource having an access control policy that uses location information to permit or deny access to said resource, said location complying with said access control policy; and

receiving access to said resource.

20. The method of claim 19, further comprising:

receiving an authenticated location token from said location authentication server; and

transmitting said authentication location token to said resource.