Systems and methods for enforcing access-control policies in an arbitrary physical space

1. A computer-implemented method for enforcing access-control policies in an arbitrary physical space, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:

identifying a collection of devices that are located within a predetermined physical space;

determining a physical location of each device in the collection of devices;

establishing, based on the collection of devices:

a list of controlled devices, selected from the collection of devices, that are subject to an access-control policy that describes restricted functions of each controlled device in the list of controlled devices; and

a list of monitoring devices, selected from the collection of devices, that are capable of observing actions performed by users within a physical proximity;

matching, based at least on comparing the physical locations of each device in the collection of devices, each of the controlled devices with at least one of the monitoring devices that is capable of observing actions performed by users within physical proximity to the controlled device;

monitoring, for each of the controlled devices and by each of the monitoring devices matched to the controlled device, one or more actions performed by a user as part of a user attempt to access a restricted function from among the restricted functions of the controlled device; and

performing a security action based on the user attempt to access the restricted function of the controlled device that was observed by at least one monitoring device that is matched to the controlled device.

2. The method of claim 1 , wherein identifying the collection of devices comprises identifying a command-and-control device that maintains a registry of devices registered to the command-and-control device.

3. The method of claim 2 , wherein identifying the collection of devices comprises executing a device-discovery function of the command-and-control device.

4. The method of claim 1 , further comprising mapping, by at least one of the monitoring devices in the list of monitoring devices, boundary features of the predetermined physical space, wherein the boundary features denote separations between distinct regions of the predetermined physical space.

5. The method of claim 4 , wherein the monitoring device used to map the boundary features of the predetermined physical space comprises a self-propelled monitoring device that is capable of moving through the predetermined physical space.

6. The method of claim 4 , wherein the boundary features comprise at least one of:

a wall;

a window;

a threshold;

stairs; and

a railing.

7. The method of claim 1 , wherein establishing the list of monitoring devices comprises:

determining monitoring functions that are available to each of the monitoring devices; and

associating each of the monitoring devices in the list of monitoring devices with the monitoring functions that are available to the monitoring device.

8. The method of claim 1 , further comprising tracking the physical location of at least one monitoring device over time.

9. The method of claim 1 , wherein matching the controlled device with the monitoring device comprises determining that the monitoring device is capable of monitoring a particular region in proximity to the controlled device.

10. The method of claim 1 , wherein performing the security action comprises at least one of:

disabling the controlled device;

disabling a function of the controlled device;

generating a log entry that describes the user activity within proximity to the controlled device; and

notifying an administrator of the user activity.

11. A system for enforcing access-control policies in an arbitrary physical space, the system comprising:

an identification module, stored in a memory of the system, that identifies a collection of devices that are located within a predetermined physical space;

a determination module, stored in a memory of the system, that determines a physical location of each device in the collection of devices;

an establishing module, stored in a memory of the system, that establishes, based on the collection of devices:

a list of controlled devices, selected from the collection of devices, that are subject to an access-control policy that describes restricted functions of each controlled device in the list of controlled devices; and

a list of monitoring devices, selected from the collection of devices, that are capable of observing actions performed by users within a physical proximity;

a matching module, stored in a memory of the system, that matches, based at least on comparing the physical locations of each device in the collection of devices, each of the controlled devices with at least one of the monitoring devices that is capable of observing actions performed by users within physical proximity to the controlled device;

a monitoring module, stored in a memory of the system, that:

monitors, for each of the controlled devices and by each of the monitoring devices matched to the controlled device, one or more actions performed by a user as part of a user attempt to access a restricted function from among the restricted functions of the controlled device; and

performs a security action based on the user attempt to access the restricted function of the controlled device that was observed by at least one monitoring device that is matched to the controlled device; and

at least one physical computer processor configured to execute the identification module, the determination module, the establishing module, the matching module, and the monitoring module.

12. The system of claim 11 , wherein the identification module identifies the collection of devices by identifying a command-and-control device that maintains a registry of devices registered to the command-and-control device.

13. The system of claim 12 , wherein the identification module identifies the collection of devices by executing a device-discovery function of the command-and-control device.

14. The system of claim 11 , further comprising a mapping module, stored in memory, that maps, by at least one of the monitoring devices in the list of monitoring devices, boundary features of the predetermined physical space, wherein the boundary features denote separations between distinct regions of the predetermined physical space.

15. The system of claim 14 , wherein the monitoring device used to map the boundary features of the predetermined physical space comprises a self-propelled monitoring device that is capable of moving through the predetermined physical space.

16. The system of claim 14 , wherein the boundary features comprise at least one of:

a wall;

a window;

a threshold;

stairs; and

a railing.

17. The system of claim 11 , wherein the establishing module establishes the list of monitoring devices by:

determining monitoring functions that are available to each of the monitoring devices; and

associating each of the monitoring devices in the list of monitoring devices with the monitoring functions that are available to the monitoring device.

18. The system of claim 11 , further comprising a tracking module, stored in memory, that tracks the physical location of at least one monitoring device over time.

19. The system of claim 11 , wherein the matching module matches the controlled device with the monitoring device by determining that the monitoring device is capable of monitoring a particular region in proximity to the controlled device.

20. A non-transitory computer-readable medium comprising one or more computer-readable instructions for enforcing access-control policies in an arbitrary physical space that, when executed by at least one processor of a computing device, cause the computing device to:

identify a collection of devices that are located within a predetermined physical space;

determine a physical location of each device in the collection of devices; establish, based on the collection of devices:

a list of controlled devices, selected from the collection of devices, that are subject to an access-control policy that describes restricted functions of each controlled device in the list of controlled devices; and

a list of monitoring devices, selected from the collection of devices that are capable of observing actions performed by users within a physical proximity;

match, based at least on comparing the physical locations of each device in the collection of devices, each of the controlled devices with at least one of the monitoring devices that is capable of observing actions performed by users within physical proximity to the controlled device;

monitor, for each of the controlled devices and by each of the monitoring devices matched to the controlled device, one or more actions performed by a user as part of a user attempt to access a restricted function from among the restricted functions of the controlled device; and

perform a security action based on the user attempt to access the restricted function of the controlled device that was observed by at least one monitoring device that is matched to the controlled device.