Systems and methods for enforcing access-control policies in an arbitrary physical space

• US 10,462,184 B1
• Filed: 06/28/2016
• Issued: 10/29/2019
• Est. Priority Date: 06/28/2016
• Status: Active Grant

• Current Assignee: Gen Digital Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Gu, Lei, Sokolov, Ilya, McCorkendale, Bruce
• Primary Examiner(s): Jhaveri, Jayesh M
• Application Number:
  US15/195,677
• Time in Patent Office: 1,218 Days
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04W 4/021 Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
• CPC Class Codes: H04W 4/33 for indoor environments, e.g. buildings

Abstract

The disclosed computer-implemented method for enforcing access-control policies in an arbitrary physical space may include (i) identifying a collection of devices that are located within a predetermined physical space, (ii) determining the physical location of each device in the collection of devices, (iii) establishing, based on the collection of devices, (a) a list of controlled devices that are subject to an access-control policy and (b) a list of monitoring devices that are capable of monitoring user activity within a physical proximity, (iv) matching each controlled device with at least one monitoring device that is capable of monitoring user activity within physical proximity to the controlled device, and (v) monitoring, for each controlled device and by each monitoring device matched to the controlled device, user activity within proximity to the controlled device. Various other methods, systems, and computer-readable media are also disclosed.

Claims

1. A computer-implemented method for enforcing access-control policies in an arbitrary physical space, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

identifying a collection of devices that are located within a predetermined physical space;

determining a physical location of each device in the collection of devices;

establishing, based on the collection of devices;

a list of controlled devices, selected from the collection of devices, that are subject to an access-control policy that describes restricted functions of each controlled device in the list of controlled devices; and

a list of monitoring devices, selected from the collection of devices, that are capable of observing actions performed by users within a physical proximity;

matching, based at least on comparing the physical locations of each device in the collection of devices, each of the controlled devices with at least one of the monitoring devices that is capable of observing actions performed by users within physical proximity to the controlled device;

monitoring, for each of the controlled devices and by each of the monitoring devices matched to the controlled device, one or more actions performed by a user as part of a user attempt to access a restricted function from among the restricted functions of the controlled device; and

performing a security action based on the user attempt to access the restricted function of the controlled device that was observed by at least one monitoring device that is matched to the controlled device.

2. The method of claim 1, wherein identifying the collection of devices comprises identifying a command-and-control device that maintains a registry of devices registered to the command-and-control device.

3. The method of claim 2, wherein identifying the collection of devices comprises executing a device-discovery function of the command-and-control device.

4. The method of claim 1, further comprising mapping, by at least one of the monitoring devices in the list of monitoring devices, boundary features of the predetermined physical space, wherein the boundary features denote separations between distinct regions of the predetermined physical space.

5. The method of claim 4, wherein the monitoring device used to map the boundary features of the predetermined physical space comprises a self-propelled monitoring device that is capable of moving through the predetermined physical space.

6. The method of claim 4, wherein the boundary features comprise at least one of:

a wall;

a window;

a threshold;

stairs; and

a railing.

7. The method of claim 1, wherein establishing the list of monitoring devices comprises:

determining monitoring functions that are available to each of the monitoring devices; and

associating each of the monitoring devices in the list of monitoring devices with the monitoring functions that are available to the monitoring device.

8. The method of claim 1, further comprising tracking the physical location of at least one monitoring device over time.

9. The method of claim 1, wherein matching the controlled device with the monitoring device comprises determining that the monitoring device is capable of monitoring a particular region in proximity to the controlled device.

10. The method of claim 1, wherein performing the security action comprises at least one of:

disabling the controlled device;

disabling a function of the controlled device;

generating a log entry that describes the user activity within proximity to the controlled device; and

notifying an administrator of the user activity.

11. A system for enforcing access-control policies in an arbitrary physical space, the system comprising:

an identification module, stored in a memory of the system, that identifies a collection of devices that are located within a predetermined physical space;

a determination module, stored in a memory of the system, that determines a physical location of each device in the collection of devices;

an establishing module, stored in a memory of the system, that establishes, based on the collection of devices;

a list of controlled devices, selected from the collection of devices, that are subject to an access-control policy that describes restricted functions of each controlled device in the list of controlled devices; and

a list of monitoring devices, selected from the collection of devices, that are capable of observing actions performed by users within a physical proximity;

a matching module, stored in a memory of the system, that matches, based at least on comparing the physical locations of each device in the collection of devices, each of the controlled devices with at least one of the monitoring devices that is capable of observing actions performed by users within physical proximity to the controlled device;

a monitoring module, stored in a memory of the system, that;

monitors, for each of the controlled devices and by each of the monitoring devices matched to the controlled device, one or more actions performed by a user as part of a user attempt to access a restricted function from among the restricted functions of the controlled device; and

performs a security action based on the user attempt to access the restricted function of the controlled device that was observed by at least one monitoring device that is matched to the controlled device; and

at least one physical computer processor configured to execute the identification module, the determination module, the establishing module, the matching module, and the monitoring module.

12. The system of claim 11, wherein the identification module identifies the collection of devices by identifying a command-and-control device that maintains a registry of devices registered to the command-and-control device.

13. The system of claim 12, wherein the identification module identifies the collection of devices by executing a device-discovery function of the command-and-control device.

14. The system of claim 11, further comprising a mapping module, stored in memory, that maps, by at least one of the monitoring devices in the list of monitoring devices, boundary features of the predetermined physical space, wherein the boundary features denote separations between distinct regions of the predetermined physical space.

15. The system of claim 14, wherein the monitoring device used to map the boundary features of the predetermined physical space comprises a self-propelled monitoring device that is capable of moving through the predetermined physical space.

16. The system of claim 14, wherein the boundary features comprise at least one of:

a wall;

a window;

a threshold;

stairs; and

a railing.

17. The system of claim 11, wherein the establishing module establishes the list of monitoring devices by:

determining monitoring functions that are available to each of the monitoring devices; and

associating each of the monitoring devices in the list of monitoring devices with the monitoring functions that are available to the monitoring device.

18. The system of claim 11, further comprising a tracking module, stored in memory, that tracks the physical location of at least one monitoring device over time.

19. The system of claim 11, wherein the matching module matches the controlled device with the monitoring device by determining that the monitoring device is capable of monitoring a particular region in proximity to the controlled device.

20. A non-transitory computer-readable medium comprising one or more computer-readable instructions for enforcing access-control policies in an arbitrary physical space that, when executed by at least one processor of a computing device, cause the computing device to:

identify a collection of devices that are located within a predetermined physical space;

determine a physical location of each device in the collection of devices;

establish, based on the collection of devices;

a list of controlled devices, selected from the collection of devices, that are subject to an access-control policy that describes restricted functions of each controlled device in the list of controlled devices; and

a list of monitoring devices, selected from the collection of devices that are capable of observing actions performed by users within a physical proximity;

match, based at least on comparing the physical locations of each device in the collection of devices, each of the controlled devices with at least one of the monitoring devices that is capable of observing actions performed by users within physical proximity to the controlled device;

monitor, for each of the controlled devices and by each of the monitoring devices matched to the controlled device, one or more actions performed by a user as part of a user attempt to access a restricted function from among the restricted functions of the controlled device; and

perform a security action based on the user attempt to access the restricted function of the controlled device that was observed by at least one monitoring device that is matched to the controlled device.