Protecting physical locations with continuous multi-factor authentication systems

This disclosure relates to methods, systems, and non-transitory computer-readable storage media for integrating a multi-factor authentication system with a security system. The present technology can receive authentication data descriptive of a user associated with a user device. The present technology can also permit the user to access a secure physical location. The present technology can also limit capabilities of the user device while the user is within the secure physical location.

DESCRIPTION OF THE RELATED TECHNOLOGY

The present technology pertains to integrating a multi-factor authentication system with a security system, and more specifically, the present technology pertains to utilizing a multi-factor authentication system agent to disable functions of a personal computing device within a secure physical location.

BACKGROUND

Security breaches are a major problem facing today's enterprises. The average cost of a security breach has risen to over 8 million dollars, and approximately one-quarter of these breaches are committed by internal actors, whether intentionally or accidentally. Disincentivizing security breaches would be a major boon to today's enterprises, saving them money, loss of trust, and PR debacles.

While security breaches can take a variety of forms, one common type of breach involves an unauthorized or authorized individual gaining access to a secure physical location. Once inside, this individual could conduct espionage to steal enterprise secrets or other valuable and secure information.

DETAILED DESCRIPTION

Without intent to limit the scope of the disclosure, examples of instruments, apparatus, methods, and their related results according to the embodiments of the present disclosure are given below. Note that titles or subtitles may be used in the examples for the convenience of a reader, which in no way should limit the scope of the disclosure. Unless otherwise defined, technical and scientific terms used herein have the meaning as commonly understood by one of ordinary skill in the art to which this disclosure pertains. In the case of conflict, the present document, including definitions will control. Additional features and advantages of the disclosure will be set forth in the description which follows, and in part will be obvious from the description, or can be learned by practice of the herein disclosed principles. The features and advantages of the disclosure can be realized and obtained by means of the instruments and combinations particularly pointed out in the appended claims. These and other features of the disclosure will become more fully apparent from the following description and appended claims or can be learned by the practice of the principles set forth herein.

Overview

The present technology provides methods, systems, and non-transitory computer-readable storage media for integrating a multi-factor authentication system with a security system.

A method can include receiving authentication data descriptive of a user associated with a user device. The method can also include permitting the user to access a secure physical location. The method can also include, while the user is within the secure physical location, limiting capabilities of the user device.

In some embodiments of the method, the method can further include, in response to receiving the request to access the secure physical location, sending a first request for a first portion of the authentication data descriptive of the user to a continuous multi-factor authentication application on the user device.

In some embodiments of the method, the method can include wherein in addition to sending the request for the authentication data descriptive of the user to the continuous multi-factor authentication application on the user device, also sending a second request for a second portion of the authentication data descriptive of the user to devices in proximity to an entrance to the secure physical location.

In some embodiments of the method, the first request for the first portion of the authentication data descriptive of the user can specify characteristics of a type and/or quality of the first portion of authentication data descriptive of the user, wherein the type and/or quality of the first portion of the authentication data descriptive of the user is specified in an access policy for the secure physical location.

In some embodiments of the method, the user can be permitted to access the secure physical location when the authentication data descriptive of the user associated with the user device meets authentication criteria defined in an access policy configured on an authentication service.

In some embodiments of the method, permitting the user to access the secure physical location includes sending a communication to a lock actuation device associated with the secure physical location, wherein the communication is a trusted communication which indicates that the user associated with the user device should be permitted to access the secure physical location.

In some embodiments of the method, limiting the capabilities of the user device includes receiving, from the user device, an indication that the user is about to enter or has entered the secure physical location. The method can also include sending a communication to a security application on the user device informing the security application about at least one secure area technological requirement as defined in an access policy configured on an authentication service. The method can also include receiving a communication from the security application confirming that the user device has been configured to meet the at least one secure area technological requirement.

In some embodiments of the method, the request to access the secure physical location can be at least one request from each user device in proximity to the secure physical location, and permitting the user to access the secure physical location is conditional upon receiving the authentication data descriptive of each user associated each user device that meets authentication criteria defined in an access policy.

In some embodiments of the method, the method also includes receiving personal identifying information from at least one device in proximity to the user. The method also includes determining that the personal identifying information identifies an individual other than the user of the user device. The method also includes providing access or taking additional steps as defined in an access policy for the secure physical location, wherein the access policy defines a protocol for an authenticated user being accompanied by a non-authenticated individual.

A system can include at least one processor and a non-transitory computer-readable storage medium comprising instructions stored thereon which, when executed by the at least one processor, cause the at least one processors to receive authentication data descriptive of a user associated with a user device. The at least one processors can also be caused to permit the user to access a secure physical location. The at least one processors can also be caused to, while the user is within the secure physical location, limit capabilities of the user device.

In some embodiments of the system, the at least one processors can also be caused to, in response to receiving the request to access the secure physical location, send a first request for a first portion of the authentication data descriptive of the user to a continuous multi-factor authentication application on the user device.

In some embodiments of the system, the at least one processors can also be caused to send a second request for a second portion of the authentication data descriptive of the user to devices in proximity to an entrance to the secure physical location.

In some embodiments of the system, the first request for the first portion of the authentication data descriptive of the user can specify characteristics of a type and/or quality of the first portion of authentication data descriptive of the user, wherein the type and/or quality of the first portion of the authentication data descriptive of the user is specified in an access policy for the secure physical location.

In some embodiments of the system, the request to access the secure physical location can be at least one request from each user device in proximity to the secure physical location, and permitting the user to access the secure physical location is conditional upon receiving the authentication data descriptive of each user associated each user device that meets authentication criteria defined in an access policy.

In some embodiments of the system, the at least one processors and the non-transitory computer-readable storage medium can be part of a security system.

A non-transitory computer-readable storage medium can include instructions stored thereon which, when executed by a processor, cause the processor to receive authentication data descriptive of a user associated with a user device. The instructions can also cause the processor to permit the user to access a secure physical location. The instructions can also cause the processor to, while the user is within the secure physical location, limit capabilities of the user device.

In some embodiments of the non-transitory computer-readable storage medium, the user can be permitted to access the secure physical location when the authentication data descriptive of the user associated with the user device meets authentication criteria defined in an access policy configured on an authentication service.

In some embodiments of the non-transitory computer-readable storage medium, permitting the user to access the secure physical location can cause the processor to send a communication to a lock actuation device associated with the secure physical location, wherein the communication is a trusted communication which indicates that the user associated with the user device should be permitted to access the secure physical location.

In some embodiments of the non-transitory computer-readable storage medium, limiting the capabilities of the user device can cause the processor to receive, from the user device, an indication that the user is about to enter or has entered the secure physical location. Limiting the capabilities of the user device can also cause the processor to send a communication to a security application on the user device informing the security application about at least one secure area technological requirement as defined in an access policy configured on an authentication service. Limiting the capabilities of the user device can also cause the processor to receive a communication from the security application confirming that the user device has been configured to meet the at least one secure area technological requirement.

In some embodiments of the non-transitory computer-readable storage medium, the instructions can cause the processor to receive personal identifying information from at least one device in proximity to the user. The instructions can also cause the processor to determine that the personal identifying information identifies an individual other than the user of the user device. The instructions can also cause the processor to provide access or take additional steps as defined in an access policy for the secure physical location, wherein the access policy defines a protocol for an authenticated user being accompanied by a non-authenticated individual.

DESCRIPTION OF EXAMPLE EMBODIMENTS

Security breaches are a serious problem are a serious problem for enterprise operations. In 2020, the average cost of a security breach was over $8 m per breach.

Security systems provide some protection against unauthorized security breaches committed by obtaining unauthorized access to secure physical locations. While existing systems may utilize keypads, retina scans, or other means to identify individuals before they can enter secure physical locations, these solutions can be improved upon. For example, many existing systems are only one or two dimensional in nature and can be spoofed, whereas multi-factor authentication and continuous multi-factor authentication systems have been developed to increase the security of devices and can be integrated with existing systems or new systems to provide additional factors for added security. By integrating such authentication systems with security systems for secure physical locations, the security of these secure physical locations could be greatly increased.

The present technology addresses this problem. By leveraging an integration of an authentication system and a security system, unauthorized individuals are more likely to be identified at the point of entry to secure physical locations and thus denied access to sensitive information.

Furthermore, even when authorized individuals obtain entry to secure physical locations, they may still act as adversaries and conduct espionage. The present technology further addresses this problem. While authorized individuals are within the secure physical location, the security system can limit capabilities of authorized individual's devices to prevent photography, audio/video recording, or other espionage capabilities. When the individual leaves the secure physical location, these capabilities can be re-enabled.

This disclosure will first discuss an example continuous multi-factor authentication (CMFA) system. Then, the disclosure will discuss example embodiments for increasing the security of secure physical locations that leverage an integration of an authentication system with a security system. Finally, the disclosure will discuss an example computing system which can be used to execute the present technology.

FIG.1illustrates an example continuous multi-factor authentication (CMFA) system in accordance with some aspects of the present technology. User110can gain authorized access to resource170by using CMFA device120.

Resource170can be any service, resource, device, or entity which requires authentication of user110. For example, resource170can be a social media service, bank, hospital, motor vehicle department, bar, voting system, Internet of Things (JOT) device, or access device. In some embodiments, resource170can be accessed by user110through an access device, such as a mobile phone or personal computer. In some embodiments, resource170can be accessed by user110through an application that is specifically designed for accessing resource170, or through a more general application which can access multiple services, such as a web browser, or portions of an operating system. In some embodiments, resource170can be the same device as CMFA device120. In some embodiments, resource170can be a plurality of resources, such as an access device and a service which receive separate authentications from trusted authentication provider160.

Resource170can authenticate the identity of user110through trusted authentication provider160, which can be in communication with CMFA device120. Data gathered by CMFA device120can be used for authentication of user110to resource170via trusted authentication provider160. Trusted authentication provider160can receive an identification credential, such as an IDActivKey, from CMFA device120via CMFA application150that is unique to resource170for user110. Trusted authentication provider160can also receive a trust score from CMFA device120via trust score generator140. Upon receiving an IDActivKey and a trust score, trusted authentication provider160can use this information in tandem with access requirements received from resource170to authenticate user110to resource170.

To generate identification credentials, CMFA Device120can be associated with user110and can gather biometric, behavioral, and contextual data from user110. The biometric, behavioral, or contextual data, or some combination thereof, can be used by IDActivKey generator130to generate a unique IDActivKey corresponding to resource170. These biometrics can include, for example, fingerprints, facial detection, retinal scans, voice identification, or gait data, among other biometrics. For each resource170, a cryptographic seed from a pseudo-arbitrary number generator in trusted platform module (TPM)180can be used to select a sampling of the biometric data to be used in an IDActivKey for the application in question. In some embodiments, the IDActivKey may only be derived when CMFA device120determines that certain behavioral and contextual requirements indicate compliance with a policy. In some embodiments, there can be a “master” IDActivKey that is used to gain access to trusted authentication provider160.

In some embodiments, behavioral and contextual data can be used to ensure that the context of user110is acceptable as specified by a policy of resource170. Behavioral and contextual data can be used by trust score generator140, which can generate a trust score as a measure of confidence in the authentication of user110, and as a measure of confidence that the authenticated user110is still present and behaving acceptably as specified by a policy of resource170.

In some embodiments, trusted computing implementations, such as TPM180, can rely on roots of trust. Roots of trust can provide assurances that the root has been implemented in a way that renders it trustworthy. A certificate can identify the manufacturer and evaluated assurance level (EAL) of TPM180. Such certification can provide a level of confidence in the roots of trust used in TPM180. Moreover, a certificate from a platform manufacturer may provide assurance that TPM180was properly installed on a system that is compliant with specific requirements so the root of trust provided by the platform may be trusted. Some implementations can rely on three roots of trust in a trusted platform, including roots of trust for measurement (RTM), storage (RTS), and reporting (RTR).

Trust score generator140can generate a trust score for user110using behavioral and contextual data, the surrounding environment, or other sources. For example, location information can be derived from the network that user110is using. These data can include information about location, movement, or device behavior. The trust score reflects a confidence level that user110complies with a policy specified by resource170. This includes the confidence that user110is the person operating the current session.

Trusted authentication provider160can request updated IDActivKeys and trust scores at different intervals depending on the requirements specified by the access policies defined by resource170. It can send new access policies received from resource170during a session to CMFA device120. Trusted authentication provider160can shield private information from resource170, providing authentication without revealing personal information such as birth dates, social security numbers, or marital status, etc. In some embodiments, trusted authentication provider160need only inform resource170that access should be granted, while in some embodiments trusted authentication provider160can send an IDActivKey to resource170.

User110can be any user including an employee, contractor, client, member of an organization, or private individual, etc. attempting to access a service. User110can use an access device to access resource170which may or may not be the same device as CMFA device120. In some embodiments, CMFA device120can be used to authenticate an access device.

CMFA device120can be hardware, software-only, or combinations thereof. CMFA device120can be a mobile device or a personal computer; it may or may not be the same device as access device. In some embodiments, CMFA device120can include secure hardware such as TPM180. In some embodiments, one or more of IDActivKey generator130, TPM180, and trust score generator140can be located in a physically separate and secure portion of CMFA device120.

WhileFIG.1only illustrates one resource170, it should be appreciated that there can be any number of resources170. Each resource170can have an access policy, and any IDActivKey will be unique to each respective resource170.

On its own, the CMFA system illustrated inFIG.1provides a means to authenticate a user110using CMFA device120. To use the authentication generated by the CMFA system to facilitate access to a secure physical location, the CMFA system can be integrated with a security system. These integrations are explored inFIGS.2A and2B.

FIG.2Aillustrates an example sequence diagram in accordance with some aspects of the present technology. The sequence diagram illustrates how a CMFA system, such as that illustrated inFIG.1, can be integrated with a security system to improve security for a secure physical location.

CMFA device120can run security application210. Security application210can communicate with security server220as well as CMFA application150to integrate the CMFA system and the security system. Together, security application210and security server220can permit access to the secure physical location.

When a user, such as user110illustrated inFIG.1, wants to gain access to the secure physical location, security application210on CMFA device120can send a request to access the secure physical location to security server220, and security server220can receive the access request. The access request can also be triggered by having CMFA device120in proximity to an entrance to the secure physical location, CMFA device120communicating with an entrance device, or via other means. The access request can be received from the entrance device, such as a wall-mounted keypad, or other device. The access request can also be initiated by a user operating CMFA Device120.

The access request can contain initial authentication data descriptive of user110. This initial authentication data can speed up the authentication of user110, or the initial authentication data may be necessary to begin the authentication process. The initial authentication data descriptive of user110may include biometrics, behavior, or context, as illustrated inFIG.1.

In response to receiving the access request, security server220can request authentication data descriptive of user110. Security server220can send a first request for a first portion of the authentication data descriptive of user110to trusted authentication provider160, which can then forward the request to CMFA application150on CMFA device120. The first request for the first portion of the authentication data descriptive of user110can specify characteristics of a type and/or quality of the first portion of authentication data descriptive of user110, wherein the type and/or quality of the first portion of the authentication data descriptive of user110can be specified in an access policy for the secure physical location. The specified characteristics of the type and/or quality of the authentication data descriptive of user110can include biometrics, such as facial recognition data, fingerprint data, or vocal recognition data; behavior, such as activity on CMFA device120; and/or context, such as the physical location of CMFA device120and, in turn, user110.

The access policy can be defined by a security administrator, and can specify the conditions under which a user can access the secure physical location. Such conditions can include time of day, security clearance of the user, presence of other individuals, or other factors. The request to access the secure physical location can include requests from each user device, such as CMFA device120, an access device operated by user110, or other devices in proximity to the secure physical location.

Security server220can also send a second request for a second portion of the authentication data descriptive of user110to devices230. Devices230can be in proximity to user110and the entrance to the secure area, and can include security cameras, Bluetooth devices, or Internet routers. Devices230can be devices in proximity to an entrance to the secure physical location. Devices230can be identified in an access policy for the secure physical location, and the access policy can specify characteristics of the second portion of the authentication data descriptive of user110.

In some embodiments, as shown inFIG.2A, security server220can receive authentication data descriptive of user110from CMFA application on CMFA device120via trusted authentication provider160and/or from devices230. The authentication data descriptive of user110can contain data about an identity of user110and a physical location of user110. When the original request to access the secure area contains initial authentication data descriptive of user110, or when server220has otherwise obtained initial authentication data, based on the initial authentication data descriptive of the user, server220can request authentication data descriptive of the user from trusted authentication provider160and receive the authentication data descriptive of the user110from trusted authentication provider160. A continuous multi-factor authentication system, such as the one illustrated inFIG.1and represented by CMFA application150on CMFA device120and trusted authentication provider160, can generate the authentication data descriptive of user110, which can include biometrics, behavior, and/or context. The authentication data descriptive of user110can be generated from authentication factors received from CMFA device120or a related access device and/or from devices230, and can be generated by security server220.

Security server220can perform an authentication of user110using the authentication data descriptive of user110received from trusted authentication provider160and/or devices230. Security server220can evaluate the authentication data descriptive of user110against authentication criteria. These authentication criteria can be set by a security administrator, and can set thresholds for trust scores, number of authentication factors available, or other parameters.

In some embodiments, trusted authentication provider160can receive authentication data descriptive of user110and perform the authentication of user110. The authentication data descriptive of user110can be received from CMFA device120and/or from devices230. Trusted authentication provider160can evaluate the authentication data descriptive of user110against authentication criteria and send the evaluation to security server220.

User110can be permitted to access the secure physical location when the authentication data descriptive of user110associated with CMFA device120meets authentication criteria defined in an access policy configured on trusted authentication provider160, security server220, or another service. Security server220or trusted authentication provider160can determine that the personal identifying information in the authentication data descriptive of the user identifies an individual other than user110, and can provide access or take additional steps as defined in an access policy for the secure physical location, where the access policy can define a protocol for user110to be accompanied by a non-authenticated individual.

Security server220can permit user110to access the secure physical location and send this permission to security application210on CMFA device120. Security server220or security application210can send a communication to a lock actuation device associated with the secure physical location, wherein the communication is a trusted communication which indicates that user110associated with CMFA device120should be permitted to access the secure physical location.

Permitting multiple users110to access the secure physical location can be conditional upon receiving authentication data descriptive of each user110associated with a respective CMFA device120that meets authentication criteria defined in an access policy. Access policies can allow one user110to authorize another user110with certain levels of security clearance, or as guests, including via printing authentication materials like guest badges.

Granting access can be withheld until certain other criteria are met. When multiple people are in a party and not all are independently authorized as detailed above, there can be a separate protocol for guest clearance before access is granted. Guests may be asked to download security application210on their own devices, or to leave their own devices at the entrance location, or to turn off their devices. Security application210can, for instance, be downloaded via a QR code posted next to the entrance to the secure physical location. For authorized users, they may be asked to leave secondary devices at the entrance location or download security application210on these secondary devices or turn off secondary devices. Devices can be detected at the entrance using metal detectors or other types of scanners and confiscated.

The integration of the authentication system and the security system allows the security system to better assure the identity of a user requesting access, and thus better protect the assets within the secure physical location. However, even authorized users can become security threats. The present technology, in addition to securing the entrances of secure physical locations, can prevent espionage while users are within the secure physical location.

FIG.2Billustrates an example sequence diagram in accordance with some aspects of the present technology. The sequence diagram illustrates how a CMFA system, such as that illustrated inFIG.1, can be integrated with a security system to improve security for a secure physical location.

Security server220can receive an indication that the user is within the secure physical location from CMFA application150on CMFA device120and/or from devices230. Devices230can include security cameras, Wi-Fi access points, or Bluetooth beacons. This indication can occur after user110has been given permission to access the secure physical location, as illustrated inFIG.2A.

Security server220can forward the entrance indication to security application210and thus limit capabilities of CMFA device120while user110is within the secure physical location. Security application210, under instructions from security server220, can disable certain functions of CMFA device120, such as microphone functions, camera functions, Bluetooth functions, Wi-Fi functions, and/or cellular data functions.

Security server220via security application210can disable the certain functions of CMFA device120by using a virtual private network to block all network access to CMFA device120. Security server220can limit the capabilities of CMFA device120by sending a communication to security application210on CMFA device120informing security application110about at least one secure area technological requirement as defined in an access policy configured on an authentication service such as trusted authentication provider150, and receive a communication from security application210confirming that CMFA device120has been configured to meet the at least one secure area technological requirement. The secure area technological requirements can include having up-to-date operating systems, applications, hardware, and/or other requirements. Security server220via security application210can limit the capabilities of CMFA device120prior to permitting user110to access the secure physical location. Security server220via security application210can limit the capabilities of CMFA device120after CMFA device120or user110is detected within the secure physical location. These limitations can serve to reduce the likelihood of espionage committed by user110. What capabilities are limited can be set by an access policy, and can vary with security clearance, number of users, time of days, type of user device, or other factors.

Security server220can receive an indication that user110is not within the secure physical location. Security server220can receive the exit indication from devices230, including Bluetooth beacons, ultrasonic beacons, and/or QR codes, and/or from CMFA application150on CMFA device120.

Security server220can forward the exit indication to security application210, which can enable all functions of CMFA device120.

FIG.3shows an example of computing system300, which can be for example any computing device making up CMFA device120or security server220, or any component thereof in which the components of the system are in communication with each other using connection305. Connection305can be a physical connection via a bus, or a direct connection into processor310, such as in a chipset architecture. Connection305can also be a virtual connection, networked connection, or logical connection.

Example system300includes at least one processing unit (CPU or processor)310and connection305that couples various system components including system memory315, such as read-only memory (ROM)320and random access memory (RAM)325to processor310. Computing system300can include a cache of high-speed memory312connected directly with, in close proximity to, or integrated as part of processor310.

Processor310can include any general purpose processor and a hardware service or software service, such as services332,334, and336stored in storage device330, configured to control processor310as well as a special-purpose processor where software instructions are incorporated into the actual processor design. Processor310may essentially be a completely self-contained computing system, containing multiple cores or processors, a bus, memory controller, cache, etc. A multi-core processor may be symmetric or asymmetric.

To enable user interaction, computing system300includes an input device345, which can represent any number of input mechanisms, such as a microphone for speech, a touch-sensitive screen for gesture or graphical input, keyboard, mouse, motion input, speech, etc. Computing system300can also include output device335, which can be one or more of a number of output mechanisms known to those of skill in the art. In some instances, multimodal systems can enable a user to provide multiple types of input/output to communicate with computing system300. Computing system300can include communications interface340, which can generally govern and manage the user input and system output. There is no restriction on operating on any particular hardware arrangement, and therefore the basic features here may easily be substituted for improved hardware or firmware arrangements as they are developed.

The storage device330can include software services, servers, services, etc., that when the code that defines such software is executed by the processor310, it causes the system to perform a function. In some embodiments, a hardware service that performs a particular function can include the software component stored in a computer-readable medium in connection with the necessary hardware components, such as processor310, connection305, output device335, etc., to carry out the function.