Systems and methods for automatically adjusting user access permissions based on beacon proximity

1. A computer-implemented method for automatically adjusting user access permissions based on beacon proximity, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

configuring, at an access-management server that controls access to a network resource, a security policy that specifies an access level at which devices may access the network resource when the devices are within range of a short-range wireless signal from a secure beacon that is associated with a specific physical location and incorporates at least one anti-spoofing mechanism;

creating a registry of multiple secure beacons in association with a specific security policy for each secure beacon in the registry, wherein:

the registry contains an entry for the secure beacon;

each additional secure beacon in the registry is located in a different physical location from other secure beacons in the registry; and

each specific security policy in the registry establishes a policy that is appropriate to the physical location of the additional secure beacon that is associated with the specific security policy;

identifying a network-enabled device that is attempting to access the network resource that is controlled by the access-management server and protected by the security policy;

determining, at the access-management server, that the network-enabled device is located at the specific physical location based at least in part on receiving, from the network-enabled device, information demonstrating that the network-enabled device is within range of the short-range wireless signal from the secure beacon; and

establishing, at the access-management server and according to the security policy, the access level at which the network-enabled device is allowed to access the network resource based at least in part on determining that the network-enabled device is located at the specific physical location.

2. The method of claim 1 , wherein the secure beacon periodically rotates the shortrange wireless signal by altering information contained within the short-range wireless signal to prevent attackers from spoofing the short-range wireless signal.

3. The method of claim 2 , wherein the secure beacon reports the rotation of the short-range wireless signal to the access-management server.

4. The method of claim 1 , wherein:

the secure beacon signs the information contained in the short-range wireless signal with a digital signature;

the digital signature enables the network-enabled device to demonstrate the authenticity and the integrity of the short-range wireless signal to the access-management server; and

determining that the network-enabled device is within range of the short-range wireless signal from the secure beacon comprises:

receiving, at the access-management server, the signed information contained in the short-range wireless signal from the network-enabled device; and

verifying the digital signature attached to the signed information.

5. The method of claim 1 , wherein the secure beacon comprises an active beacon that periodically transmits the short-range wireless signal.

6. The method of claim 1 , wherein the secure beacon comprises a passive beacon that only transmits the short-range wireless signal in response to a probe signal from the network-enabled device.

7. The method of claim 1 , wherein the secure beacon is embedded within a physical object that is expected to remain stationary.

8. The method of claim 1 , wherein establishing the access level at which the network-enabled device may access the network resource comprises one or more of:

preventing the network-enabled device from accessing at least one network resource; and

granting the network-enabled device access to at least one secure network resource.

9. The method of claim 1 , further comprising determining that the network-enabled device is within range of an additional short-range wireless signal from an additional secure beacon.

10. The method of claim 1 , wherein the secure beacon comprises at least one mechanism that prevents attackers from spoofing the short-range wireless signal.

11. The method of claim 1 , wherein the short-range wireless signal contains information describing one or more of:

the time at which the secure beacon transmitted the short-range wireless signal;

a unique identifier associated with the secure beacon;

a group identifier associated with a collection of beacons that includes the secure beacon; and

physical location information associated with the secure beacon.

12. A system for automatically adjusting user access permissions based on beacon proximity, the system comprising:

a configuration module, stored in a memory of the system, that:

configures, at an access-management server that controls access to a network resource, a security policy that specifies an access level at which devices may access the network resource when the devices are within range of a short-range wireless signal from a secure beacon that is associated with a specific physical location and incorporates at least one anti-spoofing mechanism; and

creates a registry of multiple secure beacons in association with a specific security policy for each secure beacon in the registry, wherein:

the registry contains an entry for the secure beacon;

each additional secure beacon in the registry is located in a different physical location from other secure beacons in the registry; and

each specific security policy in the registry establishes a policy that is appropriate to the physical location of the additional secure beacon that is associated with the specific security policy;

an identification module, stored in the memory, that identifies a network-enabled device that is attempting to access the network resource that is protected by a security policy;

a determination module, stored in the memory, that determines, at the access-management server, that the network-enabled device is located at the specific physical location based at least in part on receiving, from the network-enabled device, information demonstrating that the network-enabled device is within range of the short-range wireless signal from the secure beacon;

an establishing module, stored in the memory, that establishes, at the access-management server and according to the security policy, the access level at which the network-enabled device is allowed to access the network resource based at least in part on determining that the network-enabled device is located at the specific physical location; and

at least one physical processor configured to execute the configuration module, the identification module, the determination module, and the establishing module.

13. The system of claim 12 , wherein the secure beacon periodically rotates the shortrange wireless signal by altering information contained within the short-range wireless signal to prevent attackers from spoofing the short-range wireless signal.

14. The system of claim 13 , wherein the secure beacon reports the rotation of the short-range wireless signal to the access-management server.

15. The system of claim 12 , wherein:

the secure beacon signs the information contained in the short-range wireless signal with a digital signature;

the digital signature enables the network-enabled device to demonstrate the authenticity and the integrity of the short-range wireless signal to the access-management server; and

the determination module determines that the network-enabled device is within range of the short-range wireless signal from the secure beacon by:

receiving, at the access-management server, the signed information contained in the short-range wireless signal from the network-enabled device; and

verifying the digital signature attached to the signed information.

16. The system of claim 12 , wherein the secure beacon comprises an active beacon that periodically transmits the short-range wireless signal.

17. The system of claim 12 , wherein the secure beacon comprises a passive beacon that only transmits the short-range wireless signal in response to a probe signal from the network-enabled device.

18. A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

configure, at an access-management server that controls access to a network resource, a security policy that specifies an access level at which devices may access the network resource when the devices are within range of a short-range wireless signal from a secure beacon that is associated with a specific physical location and incorporates at least one anti-spoofing mechanism;

create a registry of multiple secure beacons in association with a specific security policy for each secure beacon in the registry, wherein:

the registry contains an entry for the secure beacon;

each additional secure beacon in the registry is located in a different physical location from other secure beacons in the registry; and

each specific security policy in the registry establishes a policy that is appropriate to the physical location of the additional secure beacon that is associated with the specific security policy;

identify a network-enabled device that is attempting to access the network resource that is controlled by the access-management server and protected by the security policy;

determine, at the access-management server, that the network-enabled device is located at the specific physical location based at least in part on receiving, from the network-enabled device, information demonstrating that the network-enabled device is within range of the short-range wireless signal from the secure beacon; and

establish, at the access-management server and according to the security policy, the access level at which the network-enabled device is allowed to access the network resource based at least in part on determining that the network-enabled device is located at the specific physical location.