Systems and methods for security verification in electronic learning systems and other systems

• US 9,396,327 B2
• Filed: 05/16/2011
• Issued: 07/19/2016
• Est. Priority Date: 05/16/2011
• Status: Active Grant

• Current Assignee: D2L Corporation
• Original Assignee: D2L Corporation
• Inventors: Auger, Jeremy Jason, Cepuran, Brian John
• Primary Examiner(s): HERZOG, MADHURI R
• Application Number:
  US13/108,399
• Publication Number:
  US 20120297454A1
• Time in Patent Office: 1,891 Days
• Field of Search: 726 1- 7, 726 26- 30, 713182-186, 709217-229
• US Class Current: 1/1
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G09B 5/125 the stations being mobile
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time

Abstract

The embodiments described herein relate to security verification systems and methods. In some aspects, there is provided a security verification server comprising a server processor. The server processor is adapted to provide at least one account identifier, receive at least one command for execution, determine whether to activate one or more available additional permission sets to execute the received command, and if it is determined that one or more additional permission sets should be activated to execute the received command, activate those permission sets by executing the security verification processes associated therewith.

Claims

1. A security verification system for an electronic learning environment, the system comprising:

at least one client computer having a client processor, the client processor adapted to send at least one command for execution; and

at least one server having a server processor in data communication with the at least one client computer, the server processor being adapted to;

provide an account for allowing access to the electronic learning environment, the account being associated with a plurality of permission sets, wherein at least a subset of permission sets are associated with corresponding ones of a plurality of roles in relation to the electronic learning environment, the plurality of permission sets including;

(i) a first permission set available for activation, the first permission set comprising permissions to execute a first plurality of commands associated with a first user role for a first electronic learning course available on the electronic learning environment, the first plurality of commands being executable when the first permission set is activated, and the first permission set having a first security verification process associated therewith to activate the first permission set; and

(ii) a second permission set available for activation, the second permission set being different from the first permission set, the second permission set comprising permissions to execute a second plurality of commands associated with a second user role for a second electronic learning course available on the electronic learning environment, the second plurality of commands being executable when the second permission set is activated, and the second permission set having a second security verification process associated therewith to activate the second permission set;

wherein once one of the first or the second permission sets is activated, the activated permission set remains activated for a defined period and the server processor is further adapted to deactivate the activated permission set upon expiry of the defined period.

2. The security system of claim 1 further comprising a portable electronic device in data communication with the server, and wherein the first security verification process comprises sending information to that portable electronic device.

3. The security system of claim 2, wherein the first security verification process comprises receiving a response to the information sent to the portable electronic device.

4. A security verification server comprising a server processor and a memory storing instructions which, when executed by the server processor, cause the server processor to:

provide an account for allowing access to an electronic learning environment, the account being associated with plurality of permission sets, wherein at least a subset of permission sets are associated with corresponding ones of a plurality of roles in relation to the electronic learning environment, the plurality of permission sets including;

(i) a first permission set available for activation, the first permission set comprising permissions to execute a first plurality of commands associated with a first user role for a first electronic learning course available on the electronic learning environment, the first plurality of commands being executable when the first permission set is activated, and the first permission set having a first security verification process associated therewith to activate the first permission set; and

(ii) a second permission set available for activation, the second permission set being different from the first permission set, the second permission set comprising permissions to execute a second plurality of commands associated with a second user role for a second electronic learning course available on the electronic learning environment, the second plurality of commands being executable when the second permission set is activated, and the second permission set having a second security verification process associated therewith to activate the second permission set;

wherein once one of the first or the second permission sets is activated, the activated permission set remains activated for a defined period and the server processor is further adapted to deactivate the activated permission set upon expiry of the defined period.

5. The server of claim 4, wherein the server processor is further adapted to:

receive first input, via the first security verification process, to activate the first permission set; and

receive second input, via the second security verification process, to activate the second permission set.

6. The server of claim 5, wherein the server processor is further adapted to:

receive a command for execution from a client computer, the command having a command-specific requirement that a given permission set is required to be activated before the command is executed;

determine whether the activated first permission set or the activated second permission set constitutes the given permission set that is required to be activated before the command is executed; and

if it is determined that the activated first permission set or the activated second permission set constitutes the given permission set that is required to be activated before the command is executed, allow the command to be executed, otherwise, do not allow the command to be executed.

7. The server of claim 6, wherein the server processor is further adapted to determine an operational context associated with the received command, and modify a command-specific requirement of the received command based on the operational context.

8. The server of claim 7, wherein the operational context includes location information indicative of the location of where the command is received from.

9. The server of claim 7, wherein the operational context includes time information indicative of when the command was received.

10. The server of claim 4, wherein the account is associated with a third permission set, the third permission set comprising permissions to execute a third plurality of commands in a given operational context.

11. The server of claim 4, wherein the account is associated with a fourth permission set, the fourth permission set comprising permissions to execute a fourth plurality of commands that are associated with a functional task.

12. The server of claim 4, wherein the first security verification process comprises at least one of a passive security verification process and an active security verification process.

13. The server of claim 12, wherein when the first security verification process includes a passive security verification process, the server is further adapted to send at least one notice to a contact associated with the account.

14. The server of claim 12, wherein when the first security verification process includes an active security verification process, the server is further adapted to receive input from a client computer, and based on the received input, determine whether to activate the permission set.

27. The server of claim 4, wherein the first user role for the first electronic learning course comprises a student role, and the second user role for the second electronic learning course comprises an instructor role.

15. A security verification method for an electronic learning environment, the method to be performed by a server comprising a server processor, the method comprising:

the server providing an account for allowing access to an electronic learning environment, the account being associated with plurality of permission sets, wherein at least a subset of permission sets are associated with corresponding ones of a plurality of roles in relation to the electronic learning environment, the plurality of permission sets including;

(i) a first permission set available for activation, the first permission set comprising permissions to execute a first plurality of commands associated with a first user role for a first electronic learning course available on the electronic learning environment, the first plurality of commands being executable when the first permission set is activated, and the first permission set having a first security verification process associated therewith to activate the first permission set; and

(ii) a second permission set available for activation, the second permission set being different from the first permission set, the second permission set comprising permissions to execute a second plurality of commands associated with a second user role for a second electronic learning course available on the electronic learning environment, the second plurality of commands being executable when the second permission set is activated, and the second permission set having a second security verification process associated therewith to activate the second permission set;

wherein when one of the first or second permission sets is activated, the activated permission set remains activated for a defined period and the activated permission set is deactivated upon expiry of the defined period.

16. The method of claim 15, further comprising:

receiving first input, via the first security verification process, to activate the first permission set; and

receiving second input, via the second security verification process, to activate the second permission set.

17. The method of claim 16, further comprising:

receiving a command for execution from a client computer, the command having a command-specific requirement that a given permission set is required to be activated before the command is executed;

determining whether the activated first permission set or the activated second permission set constitutes the given permission set that is required to be activated before the command is executed; and

if it is determined that the activated first permission set or the activated second permission set constitutes the given permission set that is required to be activated before the command is executed, allowing the command to be executed, otherwise, do not allow the command to be executed.

18. The method of claim 17, further comprising determining an operational context associated with the received command, and modifying a command-specific requirement of the received command based on the operational context.

19. The method of claim 18, wherein the operational context includes location information indicative of the location of where the command is received from.

20. The method of claim 18, wherein the operational context includes time information indicative of when the command was received.

21. The method of claim 15, wherein the account is associated with a third permission set, the third permission set comprising permissions to execute a third plurality of commands in a given operational context.

22. The method of claim 15, wherein the account is associated with a fourth permission set, the fourth permission set comprising permissions to execute a fourth plurality of commands that are associated with a functional task.

23. The method of claim 15, wherein the first security verification process comprises at least one of a passive security verification process and an active security verification process.

24. The method according to claim 23, wherein the passive security verification process comprises sending at least one notice to a contact associated with the account.

25. The method according to claim 23, wherein the active security verification process comprises requesting and receiving additional input prior to activating the permission set associated therewith.

28. The method of claim 15, wherein the first user role for the first electronic learning course comprises a student role, and the second user role for the second electronic learning course comprises an instructor role.

26. A computer readable medium comprising instructions which, when executed by a processor of a server, causes the processor to perform a method of security verification, the method comprising:

providing an account for allowing access to the electronic learning environment, the account being associated with plurality of permission sets, wherein at least a subset of permission sets are associated with corresponding ones of a plurality of roles in relation to the electronic learning environment, the plurality of permission sets including;

(i) a first permission set available for activation, the first permission set comprising permissions to execute a first plurality of commands associated with a first user role for a first electronic learning course available on the electronic learning environment, the first plurality of commands being executable when the first permission set is activated, and the first permission set having a first security verification process associated therewith to activate the first permission set; and

(ii) a second permission set available for activation, the second permission set being different from the first permission set, the second permission set comprising permissions to execute a second plurality of commands associated with a second user role for a second electronic learning course available on the electronic learning environment, the second plurality of commands being executable when the second permission set is activated, and the second permission set having a second security verification process associated therewith to activate the second permission set;

wherein when one of the first or second permission sets is activated, the activated permission set remains activated for a defined period and the activated permission set is deactivated upon expiry of the defined period.