INFERENCE-BASED DETECTION OF PROXIMITY CHANGES

• US 20190313252A1
• Filed: 04/26/2019
• Published: 10/10/2019
• Est. Priority Date: 11/19/2014
• Status: Active Grant

• Current Assignee: Imprivata Incorporated
• Original Assignee: Imprivata Incorporated
• Inventors: TING, David, MALEZIS, Gus, MAFERA, Jason, SLAK, Alain, MIRI, Aaron, ORAMASIONWU, Paul
• Granted Patent: US 10,917,788 B2
• Time in Patent Office: Days
• CPC Class Codes: G06N 3/02 Neural networks
• CPC Class Codes: G06N 3/042 Knowledge-based neural networks; Logical representations of neural networks
• CPC Class Codes: G06N 3/044 Recurrent networks, e.g. Hopfield networks
• CPC Class Codes: G06N 7/01 Probabilistic graphical models, e.g. probabilistic networks
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 24/08 Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
• CPC Class Codes: H04W 76/10 Connection setup
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

Embodiments of the present invention analyze multiple factors—such as user input events, device motion data, other data from the endpoint, or data from an external system (such as a real-time location system)—to make a probabilistic determination whether a walkaway event has occurred.

Claims

1. A method of detecting departure of a previously authenticated user from proximity to a secure resource, the method comprising the steps of:

establishing a wireless communication link between the secure resource and a device proximate thereto;

verifying, by the secure resource, an association between the authenticated user and the device;

monitoring over time, by the secure resource, a signal strength of the wireless communication link and periodically storing, in a computer memory, values indicative of the monitored signal strength;

periodically analyzing, by the secure resource, the stored values for patterns indicative of a walkaway event and, when a pattern indicative of a walkaway event is detected, assigning a probability thereto; and

if the probability exceeds a threshold specified by a security policy, registering a walkaway event and terminating the authenticated user'"'"'s access to the secure resource.

2. The method of claim 1, wherein the secure resource verifies the association by communication with a location server having access to a user database.

3. The method of claim 1, wherein the authenticated user'"'"'s access to the secure resource is terminated by ending a session hosted by the secure resource.

4. The method of claim 1, wherein the authenticated user'"'"'s access to the secure resource is terminated by launching a privacy screen removable only by a new authentication.

5. The method of claim 1, wherein the wireless communication link is a short-range wireless protocol.

6. The method of claim 5, wherein the short-range wireless protocol is Bluetooth Low Energy.

7. The method of claim 1 wherein the threshold is a first threshold and, if the probability does not exceed the first threshold but does exceed a second threshold lower than the first threshold, further comprising the step of obtaining, by the secure resource, corroborating data indicative of the probability of a walkaway event.

8. The method of claim 7, wherein the corroborating data is a GPS location obtained from the device.

9. The method of claim 7, wherein the corroborating data is pedestrian dead reckoning.

10. The method of claim 1, wherein the analyzing step is performed with a recurrent neural network.

11. The method of claim 1, further comprising, by the secure resource following the user'"'"'s authentication, subscribing to location events of the user with a location server configured to broadcast location events to subscribers thereto.

12. A system comprising a plurality of secure resources, each of the secure resources comprising:

a processor;

a computer memory including stored instructions executable by the processor for implementing (i) an authentication module and (ii) an event-monitoring module;

a wireless interface for establishing wireless communication links with user devices proximate to the secure resource;

RSSI circuitry configured to monitor a signal strength of a wireless communication link between the wireless interface and a user device, and periodically storing, in the computer memory, values indicative of the monitored signal strength,

wherein;

the authentication module is configured to authenticate a user and verify an association between the authenticated user and the linked user device; and

the event-monitoring module is configured to (i) periodically analyze the stored values for patterns indicative of a walkaway event and, when a pattern indicative of a walkaway event is detected, assign a probability thereto; and

(ii) if the probability exceeds a threshold specified by a security policy, terminating the authenticated user'"'"'s access to the secure resource.

13. The system of claim 12, further comprising a user database storing associations between users and the user devices.

14. The system of claim 12, wherein the event-monitoring module is configured to terminate the authenticated user'"'"'s access to the secure resource by ending a session hosted by the secure resource.

15. The system of claim 12, wherein the event-monitoring module is configured to terminate the authenticated user'"'"'s access to the secure resource by launching a privacy screen removable only by a new authentication by the authentication module.

16. The system of claim 12, wherein the wireless communication link is a short-range wireless protocol.

17. The system of claim 16, wherein the short-range wireless protocol is Bluetooth Low Energy.

18. The system of claim 12, wherein the threshold is a first threshold and the event-monitoring module is configured to obtain, if the probability does not exceed the first threshold but does exceed a second threshold lower than the first threshold, corroborating data indicative of the probability of a walkaway event.

19. The system of claim 18, wherein the corroborating data is a GPS location obtained from the user device via the wireless interface.

20. The system of claim 12, further comprising:

a plurality of tracking sensors at different locations in an institutional space, each of the tracking sensors being configured to detect a proximate presence of an individual or a device and to produce signals indicative thereof; and

a location server in operative communication with the tracking sensors and the secure resources via a network, the location server further including computer storage defining;

(i) a user location database that stores records for a plurality of users, each of the records including a current location of the user based on signals from the tracking sensors;

(ii) a device location database that stores records for a plurality of devices, each of the records including a current location of the device; and

(iii) a subscription database that stores records for a plurality of applications each running on a different device, each of the records specifying an application and one or more location events to which the application has subscribed, wherein (i) the secure resources are configured to subscribe to location events of the user with the location server, and (ii) the location server is configured to receive signals from the tracking sensors, interpret the received signals as events, and notify secure resources upon occurrence of events to which they subscribe.

21. The system of claim 12, wherein the event-monitoring module implements a recurrent neural network.