System and method for implementing a two-person access rule using mobile devices

• US 9,232,402 B2
• Filed: 11/21/2013
• Issued: 01/05/2016
• Est. Priority Date: 11/21/2013
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Horton, Michael R.
• Primary Examiner(s): Shaheed, Khalid
• Assistant Examiner(s): TACSIK, ERNEST G
• Application Number:
  US14/086,458
• Publication Number:
  US 20150140964A1
• Time in Patent Office: 775 Days
• Field of Search: 726/4, 726/2, 726/28
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04W 12/088 using filters or firewalls
• CPC Class Codes: H04W 4/02 Services making use of location information

Abstract

A system using mobile devices and a network provides access authentication, authorization and accounting to computing resources using a two-person access rule solution approach. A central access control server coordinates a rule-based authorization process in which a requesting user and one or more authorizing users are engaged in real-time communications to facilitate approved access to a sensitive resource. The technique utilizes mobile cellular interfaces and location service technologies, while also providing traditional security control measures of voice and visual verification of user identities.

Claims

1. A method for granting access to a resource, comprising:

by a central access authorization system, receiving from an access control broker agent a request to grant authorization for a requestor to access a resource;

by the central access authorization system, establishing a secure data connection between the central access authorization system and an authorizer mobile app running on an authorizing user mobile device;

by the central access authorization system, transmitting via the secure data connection to the authorizer mobile app at least an identity of the requestor and an identity of the resource;

by the central access authorization system, establishing a real-time person-to-person communications connection between the mobile device of the requestor and the authorizing user mobile device, permitting the requesting user and the authorizing user to verbally converse in real-time;

by the central access authorization system, subsequent to the real-time person-to-person communications, receiving via the secure data connection an authorization message from the authorizer mobile app; and

by the central access authorization system, based on the authorization message and based on rules associated with the resource, transmitting to the access control broker a message granting access to the resource by the requestor.

2. The method of claim 1, further comprising:

receiving from the authorizer mobile app geolocation data pertaining to the authorizing user mobile device; and

wherein the rules associated with the resource include a rule pertaining to the geolocation data.

3. The method of claim 1 wherein the real-time person-to-person communications connection between the requestor and the authorizing user mobile device is selected from a voice connection and a video connection based on rules for the particular resource.

4. The method of claim 1 wherein requesting user device is a mobile device and the method further comprises:

receiving from the requesting user device geolocation data pertaining to the requesting user device; and

wherein the rules associated with the resource include a rule pertaining to the geolocation data.

5. The method of claim 1 further comprising:

by the central access authorization system, determining a biometric indicator from the real-time person-to-person communications connection between the requestor and the authorizing user mobile device; and

wherein transmitting to the access control broker a message granting access to the resource by the requestor is further based on the biometric indicator.

6. The method of claim 1 wherein the real-time person-to-person communications connection between the requestor and the authorizing user mobile device is a voice connection.

7. The method of claim 1 wherein the real-time person-to-person communications connection between the requestor and the authorizing user mobile device is a video connection.

8. The method of claim 1, further comprising:

by the central access authorization system, generating an authorization request session identifier for processing the request to grant authorization for a requestor to access a resource;

transmitting to the authorizer mobile app a digitally signed contact message including the authorization request session identifier.

9. A central access authorization system comprising:

a processor;

a wide area network interface connected to the processor; and

a computer readable storage device having stored thereon computer readable instructions that, when executed by the processor, cause the processor to perform operations comprising;

receiving from an access control broker agent a request to grant authorization for a requestor to access a resource;

establishing via the wide area network interface a secure data connection between the central access authorization system and an authorizer mobile app running on an authorizing user mobile device;

transmitting via the secure data connection to the authorizer mobile app at least an identity of the requestor and an identity of the resource;

establishing via the wide area network interface a real-time person-to-person communications connection between the mobile device of the requestor and the authorizing user mobile device, permitting the requesting user and the authorizing user to verbally converse in real-time;

subsequent to the real-time person-to-person communications, receiving via the secure data connection an authorization message from the authorizer mobile app; and

based on the authorization message and based on rules associated with the resource, transmitting to the access control broker a message granting access to the resource by the requestor.

10. The central access authorization system of claim 9, wherein the operations further comprise:

receiving from the authorizer mobile app geolocation data pertaining to the authorizing user mobile device; and

wherein the rules associated with the resource include a rule pertaining to the geolocation data.

11. The central access authorization system of claim 9 wherein the real-time person-to-person communications connection between the requestor and the authorizing user mobile device is selected from a voice connection and a video connection based on rules for the particular resource.

12. The central access authorization system of claim 9 wherein requesting user device is a mobile device and the operations further comprise:

receiving from the requesting user device geolocation data pertaining to the requesting user device; and

wherein the rules associated with the resource include a rule pertaining to the geolocation data.

13. The central access authorization system of claim 9 wherein the operations further comprise:

by the central access authorization system, determining a biometric indicator from the real-time person-to-person communications connection between the requestor and the authorizing user mobile device; and

wherein transmitting to the access control broker a message granting access to the resource by the requestor is further based on the biometric indicator.

14. The central access authorization system of claim 9 wherein the real-time person-to-person communications connection between the requestor and the authorizing user mobile device is a voice connection.

15. The central access authorization system of claim 9 wherein the real-time person-to-person communications connection between the requestor and the authorizing user mobile device is a video connection.

16. The central access authorization system of claim 9, wherein the operations further comprise:

generating an authorization request session identifier for processing the request to grant authorization for a requestor to access a resource; and

transmitting to the authorizer mobile app a digitally signed contact message including the authorization request session identifier.

17. A tangible computer-readable medium having stored thereon computer readable instructions for granting access to a resource, wherein execution of the computer readable instructions by a processor causes the processor to perform operations comprising:

receiving from an access control broker agent a request to grant authorization for a requestor to access a resource;

establishing a secure data connection between the central access authorization system and an authorizer mobile app running on an authorizing user mobile device;

transmitting via the secure data connection to the authorizer mobile app at least an identity of the requestor and an identity of the resource;

establishing a real-time person-to-person communications connection between the mobile device of the requestor and the authorizing user mobile device, permitting the requesting user and the authorizing user to verbally converse in real-time;

subsequent to the real-time person-to-person communications, receiving via the secure data connection an authorization message from the authorizer mobile app; and

based on the authorization message and based on rules associated with the resource, transmitting to the access control broker a message granting access to the resource by the requestor.

18. The tangible computer-readable medium of claim 17, wherein the operations further comprise:

receiving from the authorizer mobile app geolocation data pertaining to the authorizing user mobile device; and

wherein the rules associated with the resource include a rule pertaining to the geolocation data.

19. The tangible computer-readable medium of claim 17 wherein the real-time person-to-person communications connection between the requestor and the authorizing user mobile device is selected from a voice connection and a video connection based on rules for the particular resource.

20. The tangible computer-readable medium of claim 17 wherein requesting user device is a mobile device and the operations further comprise:

receiving from the requesting user device geolocation data pertaining to the requesting user device; and

wherein the rules associated with the resource include a rule pertaining to the geolocation data.