IP Library Granted Patent US 10,749,876
Granted Patent B2
US 10,749,876 · App. 16/424,922 · Granted Aug 18, 2020

Adaptive and dynamic access control techniques for securely communicating devices

Inventors: Arthur Bendersky (Tel Aviv, IL); Dima Barboi (Tel Aviv, IL)
Assignee: CyberArk Software Ltd.
H04L63/107G06F21/31G06F21/44H04L63/0492H04W12/0605G06F2221/2111G06F2221/2129G06F2221/2139
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 10,749,876
App. No.
16/424,922
Filed
May 29, 2019
Granted
Aug 18, 2020
Kind
B2
Art Unit
2435
USPC
726/3
Abstract

Disclosed embodiments relate to adaptively and dynamically monitoring and managing a proximity status between securely communicating devices. Techniques include identifying a secure connection session established between an endpoint computing resource and an auxiliary computing device associated with a user; receiving real-time proximity data associated with at least one of the user or the auxiliary computing device; receiving proximity data associated with the endpoint computing resource; determining, based on the real-time proximity data associated with at least one of the user or the auxiliary computing device and the proximity data associated with the endpoint computing resource, whether at least one of the auxiliary computing device or the user has left the proximity to the endpoint computing resource; and implementing, based on the determining, an automatic session control action for the secure connection session.

Claims (37)

1. A non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for adaptively and dynamically monitoring and managing a proximity status between securely communicating devices, the operations comprising:

identifying a secure connection session established between an endpoint computing resource and an auxiliary computing device associated with a user, the secure connection session being established based upon an authentication of at least one of the auxiliary computing device or a user of the auxiliary computing device; wherein the authentication includes authenticating the user through a concurrent verification of an identity of the auxiliary computing device and a physical presence of the user in a proximity to the endpoint computing resource;

receiving real-time proximity data associated with at least one of the user or the auxiliary computing device, the real-time proximity data being transmitted by the auxiliary computing device;

receiving proximity data associated with the endpoint computing resource;

determining, based on the real-time proximity data associated with at least one of the user or the auxiliary computing device and the proximity data associated with the endpoint computing resource, whether at least one of the auxiliary computing device or the user has left the proximity to the endpoint computing resource; and

implementing, based on the determining, an automatic session control action for the secure connection session.

2. The non-transitory computer readable medium of claim 1 , wherein the auxiliary computing device is one among a plurality of auxiliary computing devices, and receiving the real-time proximity data includes receiving real-time proximity data from each of the plurality of auxiliary computing devices.

3. The non-transitory computer readable medium of claim 1 , wherein the session control action includes prompting the auxiliary computing device for authentication of at least one of the auxiliary computing device or the user of the auxiliary computing device.

4. The non-transitory computer readable medium of claim 1 , wherein the session control action includes sending a challenge to at least one of the auxiliary computing device or the user of the auxiliary computing device.

5. The non-transitory computer readable medium of claim 1 , wherein the session control action includes terminating the secure connection session.

6. The non-transitory computer readable medium of claim 1 , wherein the real-time proximity data associated with the auxiliary computing device is at least one of:

determined by the auxiliary computing device and received by the endpoint computing resource; or

determined by the endpoint computing resource.

7. The non-transitory computer readable medium of claim 1 , wherein the real-time proximity data associated with the auxiliary computing device includes at least one of:

a connection status of a short-range wireless communications session between the auxiliary computing device and the endpoint computing resource;

a geographical location of the auxiliary computing device;

a connection status of a wireless network connection used by the auxiliary computing device;

an activity level generated by a personal activity monitoring sensor of the auxiliary computing device; or

an imaging status generated by an imaging interface of the auxiliary computing device.

8. The non-transitory computer readable medium of claim 1 , wherein the receiving of the real-time proximity data associated with the auxiliary computing device and the receiving of the proximity data associated with the endpoint computing resource are performed by the endpoint computing resource.

9. The non-transitory computer readable medium of claim 1 , wherein the receiving of the real-time proximity data associated with the auxiliary computing device and the receiving of the proximity data associated with the endpoint computing resource are performed by the auxiliary computing device.

10. The non-transitory computer readable medium of claim 1 , wherein the receiving of the real-time proximity data associated with the auxiliary computing device and the receiving of the proximity data associated with the endpoint computing resource are performed by a network resource separate from the endpoint computing resource and the auxiliary computing device.

11. A computer-implemented method for adaptively and dynamically monitoring and managing a proximity status between securely communicating devices, the method comprising:

identifying a secure connection session established between an endpoint computing resource and an auxiliary computing device associated with a user, the secure connection session being established based upon an authentication of at least one of the auxiliary computing device or a user of the auxiliary computing device; wherein the authentication includes authenticating the user through a concurrent verification of an identity of the auxiliary computing device and a physical presence of the user in a proximity to the endpoint computing resource;

receiving real-time proximity data associated with at least one of the user or the auxiliary computing device, the real-time proximity data being transmitted by the auxiliary computing device;

receiving proximity data associated with the endpoint computing resource;

determining, based on the real-time proximity data associated with at least one of the user or the auxiliary computing device and the proximity data associated with the endpoint computing resource, whether at least one of the auxiliary computing device or the user has left the proximity with the endpoint computing resource; and

implementing, based on the determining, an automatic session control action for the secure connection session.

12. The computer-implemented method of claim 11 , further comprising applying a confidence level to the real-time proximity data associated with the auxiliary computing device.

13. The computer-implemented method of claim 11 , further comprising applying a confidence level to the determining that the auxiliary computing device has left the proximity to the endpoint computing resource.

14. The computer-implemented method of claim 13 , further comprising identifying current use of the endpoint computing resource despite the determining that the auxiliary computing device has left the proximity to the endpoint computing resource.

15. The computer-implemented method of claim 14 , further comprising determining, based on the confidence level and the current use of the endpoint computing resource, a risk that the endpoint computing resource is being used in an unauthorized manner.

16. The computer-implemented method of claim 15 , further comprising generating an alert based on the determined risk that the endpoint computing resource is being used in an unauthorized manner.

17. The computer-implemented method of claim 15 , further comprising prompting the auxiliary computing device for authentication of at least one of the user of the auxiliary computing device or the auxiliary computing device based on the determined risk that the endpoint computing resource is being used in an unauthorized manner.

18. The computer-implemented method of claim 15 , further comprising terminating the secure connection session based on the determined risk that the endpoint computing resource is being used in an unauthorized manner.

19. The computer-implemented method of claim 11 , further comprising conditioning an ability to write code to the endpoint computing resource based on the determination of whether the auxiliary computing device has left the proximity to the endpoint computing resource.

20. The computer-implemented method of claim 11 , further comprising conditioning an ability to modify software or configuration files of the endpoint computing resource based on the determination of whether the auxiliary computing device has left the proximity to the endpoint computing resource.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded May 29, 2019
From: BENDERSKY, ARTHUR; BARBOI, DIMA
To: CYBERARK SOFTWARE LTD.
Reel/Frame 049306/0348 →
Continuity (4)
Continuation In Part 16298149 · Mar 11, 2019
Continuation In Part 16266386 · Feb 4, 2019
Continuation In Part 16059556 · Aug 9, 2018
Related Publication 20200053096A1 · Feb 13, 2020