Access authorization based on physical location

Patent metadata

Field	Value
Publication number	US-2016284146-A1
Application number	US-201514974083-A
Country	US
Kind code	A1
Filing date	Dec 18, 2015
Priority date	Mar 27, 2015
Publication date	Sep 29, 2016
Grant date	—

Abstract

An approach for access authorization to a protected resource is provided. The approach provisions a physical access badge identifier to a door controller. The approach receives a swipe event, wherein the swipe event includes a door controller identifier and the physical access badge identifier. The approach creates an authorization request to access a protected resource, wherein the authorization request includes a request from a user for access to a protected resource. The approach identifies one or more security policies for the protected resource. The approach determines whether to permit access to the protected resource based, at least in part, on the one or more security policies and the swipe event. Responsive to a determination to permit access to the protected resource, the approach permits access to the protected resource, wherein permitting access to the protected resource includes validating an authentication session for a user.

First claim

1 . A method for access authorization to a protected resource, the method comprising:
provisioning, by one or more computer processors, a physical access badge identifier to a door controller, wherein provisioning a physical access badge identifier to a door controller, includes:
creating, by one or more computer processors, one or more user accounts, wherein the one or more user accounts includes at least an employee ID, an authorization level, and a user access password;
retrieving, by one or more computer processors, user information from the one or more user accounts associated with a user;
associating, by one or more computer processors, the physical access badge identifier with user information from the one or more user accounts associated with the user; and
storing, by one or more computer processors, the one or more user accounts associated with the user in a database;
receiving, by one or more computer processors, a swipe event, wherein the swipe event includes a door controller identifier and the physical access badge identifier, wherein receiving a swipe event, includes:
sending, by one or more computer processors, the swipe event to a physical access control system; and
storing, by one or more computer processors, the door controller identifier and the physical access badge identifier in a database;
creating, by one or more computer processors, an authorization request to access a protected resource, wherein the authorization request is created in response to receiving a request from a user for access to a protected resource from a first room, and wherein the protected resource is an information technology (IT) application accessible only in the first room; identifying, by one or more computer processors, one or more security policies for the protected resource, wherein identifying one or more security policies for the protected resource, includes:
retrieving, by one or more computer processors, a physical access badge identifier for a user from a database;
retrieving, by one or more computer processors, a swipe event associated with the physical access badge identifier for the user from a database, wherein the swipe event identifies a physical location for a most recent swipe event associated with the physical access badge identifier; and
identifying, by one or more computer processors, the one or more security policies for the protected resource associated with the physical location of the physical access badge identifier of the user and the swipe event;
determining, by one or more computer processors, whether to permit access to the protected resource based, at least in part, on the one or more security policies and the swipe event, wherein determining whether to permit access to the protected resource includes at least retrieving, by one or more computer processors, a plurality of badge identifiers for other users currently located in the first room with the user and comparing the plurality of badge identifiers for other users to the one or more security policies for the protected resource; responsive to a determination to permit access to the protected resource, permitting, by one or more computer processors, access to the protected resource, wherein permitting access to the protected resource includes validating an authentication session for a user; and responsive to a determination to not permit access to the protected resource, denying, by one or more computer processors, access to the protected resource, wherein denying access to the protected resource includes invalidating an authentication session for a user.

Assignees

• IBM

Inventors

• Moore David P
• Pearson Craig

Classifications

• G07C9/22 Primary

  in combination with an identity check of the pass holder · CPC title

• G06F16/22

  Indexing; Data structures therefor; Storage structures · CPC title

• G07C9/00174 Primary

  Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys (mechanical locks with electric permutation E05B49/00; arrangements for sensing or reading record carriers G06K7/00; electronic switching H03K17/00) · CPC title

• G07C9/27 Primary

  with central registration · CPC title