Context and device state driven authorization for devices
In some examples, a target device determines that each device of a plurality of devices (i) includes a certificate that is provided to each device during provisioning, (ii) is within a predetermined distance from the target device, (iii) includes a beacon secret that is broadcast to each device at a predetermined time interval, and (iv) that either: (a) a privilege level associated with at least one device of the plurality of devices satisfies a particular privilege level specified by an access policy or (b) a number of the plurality devices with the determined distance from the target device satisfies a predetermined number specified by the access policy. The target device grants at least one device of the plurality of devices access to the target device, and receives a message from the at least one device. The target device initiates an action based at least in part on the message.
1. A method comprising:
determining, by one or more processors of a target device, that each device of a plurality of devices includes a certificate that is provided to each device during provisioning;
determining, by the one or more processors, that each device of the plurality of devices is within a predetermined distance from the target device;
determining, by the one or more processors, that each device of the plurality of devices includes a beacon secret that is broadcast to each device at a predetermined time interval; and
determining, by the one or more processors, that either:
a privilege level associated with at least one device of the plurality of devices satisfies a particular privilege level specified by an access policy; or
a number of the plurality of devices within the predetermined distance from the target device satisfies a predetermined number specified by the access policy;
granting, by the one or more processors, at least one device of the plurality of devices access to the target device;
receiving, by the one or more processors, a message from the at least one device of the plurality of devices; and
initiating, by the target device, an action based at least in part on the message.
2. The method of claim 1 , wherein determining that each device of the plurality of devices includes the certificate comprises:
performing a certificate-based handshake between the target device and each device of the plurality of devices.
3. The method of claim 1 , further comprising:
receiving a new beacon secret; and
based at least in part on determining that at least one device did not receive the new beacon secret:
denying the at least one device of the plurality of devices access to the target device; or
reducing a level of access of the at least one device to the target device.
4. The method of claim 1 , wherein the predetermined distance comprises at least one of:
a minimum distance between each device and the target device; or
a maximum distance between each device and the target device.
5. The method of claim 1 , wherein each device of the plurality of devices performs a certificate-based handshake with other devices of the plurality of devices.
6. The method of claim 1 , further comprising:
determining that an unauthorized device does not satisfy at least a particular condition specified by the access policy; and
creating a security notification associated with the unauthorized device.
7. The method of claim 1 , wherein the target device comprises one of:
a streaming media player; or
a remote-controlled robotic device.
8. A target device comprising:
one or more processors; and
one or more non-transitory computer-readable storage media to store instructions executable by the one or more processors to perform operations comprising:
determining that each device of a plurality of devices includes a certificate that is provided to each device during provisioning;
determining that each device of the plurality of devices is within a predetermined distance from the target device;
determining that each device of the plurality of devices includes a beacon secret that is broadcast to each device at a predetermined time interval; and
determining that either:
a privilege level associated with at least one device of the plurality of devices satisfies a particular privilege level specified by an access policy; or
a number of the plurality of devices within the predetermined distance from the target device satisfies a predetermined number specified by the access policy;
granting, by the one or more processors, at least one device of the plurality of devices access to the target device;
receiving, by the one or more processors, a message from the at least one device of the plurality of devices; and
initiating, by the target device, an action based at least in part on the message.
9. The target device of claim 8 , wherein determining that each device of the plurality of devices include the certificate comprises:
performing a certificate-based handshake between each device of the plurality of devices and the target device.
10. The target device of claim 8 , the operations further comprising:
receiving a new beacon secret; and
based at least in part on determining that at least one device did not receive the new beacon secret:
denying the at least one device of the plurality of devices access to the target device; or
reducing a level of access of the at least one device to the target device.
11. The target device of claim 8 , wherein the predetermined distance comprises at least one of:
a minimum distance between each device and the target device; or
a maximum distance between each device and the target device.
12. The target device of claim 8 , wherein each device of the plurality of devices performs a certificate-based handshake with other devices of the plurality of devices before being granted access to the target device.
13. The target device of claim 8 , the operations further comprising:
determining that an unauthorized device does not satisfy at least a particular condition of the access policy; and
creating a security notification associated with the unauthorized device.
14. The target device of claim 8 , wherein the target device comprises one of:
a streaming media player; or
a remote-controlled robotic device.
15. One or more non-transitory computer-readable storage media to store instructions executable by one or more processors of a target device to perform operations comprising:
determining that each device of a plurality of devices includes a certificate that is provided to each device during provisioning;
determining that each device of the plurality of devices is within a predetermined distance from the target device;
determining that each device of the plurality of devices includes a beacon secret that is broadcast to each device at a predetermined time interval; and
determining that either:
a privilege level associated with at least one device of the plurality of devices satisfies a particular privilege level specified by an access policy; or
a number of the plurality of devices within the predetermined distance from the target device satisfies a predetermined number specified by the access policy;
granting, by the one or more processors, at least one device of the plurality of devices access to the target device;
receiving, by the one or more processors, a message from the at least one device of the plurality of devices; and
initiating, by the target device, an action based at least in part on the message.
16. The one or more non-transitory computer-readable storage media of claim 15 , further comprising:
receiving a new beacon secret broadcast by a beacon at a predetermined time interval; and
replacing a beacon secret stored in the one or more non-transitory computer-readable storage media with the new beacon secret.
17. The one or more non-transitory computer-readable storage media of claim 15 , the operations further comprising:
receiving a new beacon secret; and
based at least in part on determining that at least one device did not receive the new beacon secret:
denying the at least one device of the plurality of devices access to the target device; or
reducing a level of access of the at least one device to the target device.
18. The one or more non-transitory computer-readable storage media of claim 15 , wherein the predetermined distance comprises at least one of:
a minimum distance between each device and the target device; or
a maximum distance between each device and the target device.
19. The one or more non-transitory computer-readable storage media of claim 15 , wherein determining that each device of the plurality of devices includes the certificate comprises:
performing a certificate-based handshake between the target device and each device of the plurality of devices.
20. The one or more non-transitory computer-readable storage media of claim 15 , further comprising:
determining that an unauthorized device does not satisfy at least a particular condition of the access policy; and
sending a security notification indicating a presence of the unauthorized device.