Context and device state driven authorization for devices
In some examples, a target device may store a policy that includes one or more conditions. For example, a condition of the policy may specify that each device of the multiple devices have a certificate that was deployed to each device when each device was provisioned. A condition of the policy may specify that each device of the multiple devices be within a predetermined distance (or within a particular distance range) from the target device. A condition of the policy may specify that each device of the plurality of devices have a beacon secret that is periodically broadcast out-of-band by a local beacon. While the conditions of the policy are satisfied, the target device may grant the multiple devices access to the target device. If the target device determines that the conditions of the policy are no longer being satisfied, the target device may deny (or reduce) access.
1. A method comprising:
determining, by one or more processors of a target device, that each device of a plurality of devices satisfies each condition of a plurality of conditions specified by an access policy, wherein the plurality of conditions comprise:
a first condition of the plurality of conditions specifying that each device of the plurality of devices includes a certificate that is provided to each device during provisioning;
a second condition of the plurality of conditions specifying that each device of the plurality of devices is within a predetermined distance threshold from the target device;
a third condition of the plurality of conditions specifying that each device of the plurality of devices includes a beacon secret that is broadcast to each device at a predetermined time interval; and
a fourth condition of the plurality of conditions specifying that a privilege level associated with each device of the plurality of devices satisfies at least a particular privilege level specified by the access policy;
granting, by the one or more processors, the plurality of devices access to the target device based at least in part on determining that all of the plurality of devices satisfy each of the conditions of the access policy;
receiving, by the one or more processors, a message from a particular device of the plurality of devices; and
initiating, by the target device, an action based at least in part on the message.
2. The method of claim 1 , wherein determining that each device of the plurality of devices include the certificate comprises:
performing a certificate-based handshake between the target device and each device of the plurality of devices.
3. The method of claim 1 , further comprising:
receiving a new beacon secret; and
based at least in part on determining that at least one device did not receive the new beacon secret:
denying the at least one device of the plurality of devices access to the target device; or
reducing a level of access of the at least one device to the target device.
4. The method of claim 1 , wherein the predetermined distance threshold comprises at least one of:
a minimum distance between each device and the target device; or
a maximum distance between each device and the target device.
5. The method of claim 1 , wherein each device of the plurality of devices performs a certificate-based handshake with other devices of the plurality of devices.
6. The method of claim 1 , wherein the access policy is stored in a memory of the target device.
7. The method of claim 1 , further comprising:
determining that an unauthorized device does not satisfy at least a particular condition of the plurality of conditions specified by the access policy; and
creating a security notification associated with the unauthorized device.
8. A target device comprising:
one or more processors; and
one or more non-transitory computer-readable storage media to store instructions executable by the one or more processors to perform operations comprising:
determining that each device of a plurality of devices satisfies each condition of a plurality of conditions specified by an access policy, wherein the plurality of condition comprise:
a first condition of the plurality of conditions specifying that each device of the plurality of devices includes a certificate;
a second condition of the plurality of conditions specifying that each device of the plurality of devices is within a predetermined distance threshold from the target device;
a third condition of the plurality of conditions specifying that each device of the plurality of devices includes a beacon secret that is broadcast to each device at a predetermined time interval; and
a fourth condition of the plurality of conditions specifying that a privilege level associated with each device of the plurality of devices satisfies at least a particular privilege level specified by the access policy;
granting the plurality of devices access to the target device based at least in part on determining that all of the plurality of devices satisfy each of the conditions of the access policy;
receiving a message from a particular device of the plurality of devices; and
initiating an action based at least in part on the message.
9. The target device of claim 8 , wherein determining that each device of the plurality of devices include the certificate comprises:
performing a certificate-based handshake between each device of the plurality of devices and the target device.
10. The target device of claim 8 , the operations further comprising:
receiving a new beacon secret; and
based at least in part on determining that at least one device did not receive the new beacon secret:
denying the at least one device of the plurality of devices access to the target device; or
reducing a level of access of the at least one device to the target device.
11. The target device of claim 8 , wherein the predetermined distance threshold comprises at least one of:
a minimum distance between each device and the target device; or
a maximum distance between each device and the target device.
12. The target device of claim 8 , wherein each device of the plurality of devices performs a certificate-based handshake with other devices of the plurality of devices before being granted access to the target device.
13. The target device of claim 8 , the operations further comprising:
determining that an unauthorized device does not satisfy at least a particular condition of the plurality of conditions specified by the access policy; and
creating a security notification associated with the unauthorized device.
14. The target device of claim 8 , wherein a particular device of the plurality of devices is provided with the certificate when the particular device is provisioned.
15. One or more non-transitory computer-readable storage media to store instructions executable by one or more processors of a target device to perform operations comprising:
determining that each device of a plurality of devices satisfies each condition of a plurality of conditions specified by an access policy, wherein the plurality of condition comprise:
a first condition of the plurality of conditions specifying that each device of the plurality of devices includes a certificate that is provided to each device during provisioning;
a second condition of the plurality of conditions specifying that each device of the plurality of devices is within a predetermined distance threshold from the target device;
a third condition of the plurality of conditions specifying that each device of the plurality of devices includes a beacon secret that is broadcast to each device at a predetermined time interval; and
a fourth condition of the plurality of conditions specifying that a privilege level associated with each device of the plurality of devices satisfies at least a particular privilege level specified by the access policy;
granting each device of the plurality of devices access to the target device based at least in part on determining that all of the plurality of devices satisfy each of the conditions of the access policy;
receiving a message from a particular device of the plurality of devices; and
initiating an action based at least in part on the message.
16. The one or more non-transitory computer-readable storage media of claim 15 , further comprising:
receiving a new beacon secret broadcast by a beacon at a predetermined time interval; and
replacing a beacon secret stored in the one or more non-transitory computer-readable storage media with the new beacon secret.
17. The one or more non-transitory computer-readable storage media of claim 15 , the operations further comprising:
receiving a new beacon secret; and
based at least in part on determining that at least one device did not receive the new beacon secret:
denying the at least one device of the plurality of devices access to the target device; or
reducing a level of access of the at least one device to the target device.
18. The one or more non-transitory computer-readable storage media of claim 15 , wherein the predetermined distance threshold comprises at least one of:
a minimum distance between each device and the target device; or
a maximum distance between each device and the target device.
19. The one or more non-transitory computer-readable storage media of claim 15 , wherein determining that each device of the plurality of devices includes the certificate comprises:
performing a certificate-based handshake between the target device and each device of the plurality of devices.
20. The one or more non-transitory computer-readable storage media of claim 15 , further comprising:
determining that an unauthorized device does not satisfy at least a particular condition of the plurality of conditions specified by the access policy; and
sending a security notification indicating a presence of the unauthorized device.