LOCATION BASED EQUIPMENT DOCUMENTATION ACCESS CONTROL

A document access control system includes a location-based document reader designed to provide a reading service, a location-based physical storage located in a first location and designed to store a physical document, and a location-based document server. The location-based document server stores an electronic document and delivers the electronic document to the location-based document reader. The location-based document reader derives a second location, and provides access to the electronic document based on the first and the second locations.

DETAILED DESCRIPTION

In industrial and factory environments, machinery and equipment is maintained and repaired by technicians who may use physical documents for service history and for instructions useful in servicing the equipment. These documents may be, for example, physically chained to their corresponding equipment cabinet, locked inside the equipment cabinet, or made generally available in a central storage location such as a secure library at the plant or factory. However, the physical documentation may be damaged or lost, and can degrade over time. Additionally, physical documentation may be costly to update, and in some cases, due to error or negligence, may not reflect the most recent service instructions or service history. In the case that a piece of equipment breaks down or malfunctions, the use of incorrect or outdated documentation may not be desired. Also, a piece of equipment's physical documentation may contain proprietary information relating to the piece of equipment which could be intentionally or unintentionally compromised by a business competitor or an employee. It would be beneficial to enable access to electronic versions of the physical documents based on geographic locations of an electronic reading device, such as specific location (e.g., inside a secure area) and/or based on the distance of the electronic reading device from the physical document.

Accordingly, present embodiments include a system configured to provide access control to documentation. The system includes a location-based document reader that may be included in an electronic device. The location-based document reader may determine its geographical location and provide its location to a location-based document server configured to store electronic versions of physical documents. If the location of the location-based document reader is within an allowed range or area, the location-based document server may deliver an electronic version of a physical document via a communicative medium (e.g., the Internet, Wi-Fi, local area networks [LAN], wide area networks [WAN], personal area networks [PAN], Bluetooth, near-field communications [NFC]) and provide access to the document. In certain embodiments, additional identifiers such as a password, a barcode on the equipment cabinet, hardware or software tokens, or biometric authentication methods may be used, for example by the location-based document server, to provide an added layer of security. Accordingly, the location-based document server may determine the level of access provided to the location-based document reader based on one or more of the additional identifiers. In certain embodiments, once the location-based document reader is out of an allowed range of a specific document, or is outside of a certain geographic area, access to the document may be denied and the document may be deleted from the electronic device that comprises the location-based document reader, enabling greater document security. Accordingly, any entity, such as a manufacturer providing the physical documentation, may manage the location-based document server, and the documentation may be more reliably updated and quickly delivered to equipment cabinet sites.

With the foregoing in mind, it may be useful to describe an embodiment of a document access control system, such as a document access control system10illustrated inFIG. 1. In the document access control system10, a location-based document server12may store documentation, service and maintenance history, or a combination thereof, for one or more pieces of equipment. In some embodiments, the location-based document server12may include a secure data repository including a private key encryption system, a token authentication system, a biometric authentication system, a login authentication system, or a combination thereof. The location-based document server12may securely provide access to documentation, service history, logging data, design data, and other equipment or personnel data to one or more authorized locations by utilizing secure data links14over the “Cloud”16(e.g., Internet-based computing system). The secure data links14may securely transfer documentation data using security protocols such as secure shell file transfer protocol (SSH FTP), internet key exchange (IKE), secure socket layer (SSL), transport layer security (TLS), HTTPS (HTTP over TLS/SSL), IP security (IPSec), advanced encryption standard (AES), RSA, or a combination thereof.

As mentioned, the location-based document server12may provide access to documentation service history, and the like, to authorized locations, such as industrial plants18, cell towers20, secure facilities22, factories24, and virtual private networks26. Physical locations such as industrial plants18, secure facilities22, and factories24may include one or more location-based wireless access points (WAPs)28that may utilize a wireless standard such as Wi-Fi (IEEE 802.11) to transfer documentation data within the authorized location. Remote locations accessible through techniques such as a VPN26, may use some additional form of authorization information, such as a password, a hardware or software token, and/or biometric authentication before providing documentation access to a user.

In certain embodiments, an area such as an industrial plant or factory, may include one or more cabinets30, such as a controller cabinet, a factory or industrial machinery equipment cabinets, aircraft parts cabinets, assembly line machinery cabinets, automobiles parts bins, computer and server systems storage systems, utility equipment storage systems, or any other storage system that may store documentation, such as documentation useful in repair and maintenance. The cabinets30may include a control panel31to enable technicians and/or operators to operate the cabinet30. Each cabinet30may include a corresponding allowable location range32delineating a desired area in which documentation related to and/or stored in the cabinet30may be accessed. More specifically, the allowable location range32may include a distance from the cabinet30at which access to electronic documents associated with the cabinet30may be enabled. A person stepping outside of the allowable location range32may not have access to the digital documents, and a person stepping inside of the allowable location range32may be given access to the digital documents. Additionally or alternatively, a geographic region37, such as the region37bounded by a set of geographic coordinates, or defined by a distance about a single geographic coordinate, may be used to provide access to electronic documents related to the cabinet30via the Cloud16.

Additionally, each cabinet30may also include a communication system33for sending and receiving data. The communication system33may include a Global Positioning System (GPS), an indoor positioning system (IPS), a Wi-Fi system, a cell system, a Bluetooth system, an NFC system, or a combination thereof. In certain embodiments, each cabinet30may include physical documentation34stored in a location-based physical storage35that may be used additionally or alternatively to electronic documents stored in the location-based document server12. The physical documentation34may be securely locked inside the physical storage35of the cabinet30with a physical key or any other locking mechanism (biometric lock, magnetic lock, voice-activated password lock).

In order to access electronic documentation related to the cabinet30, a technician36may enter an allowable location range32with an electronic device38such as a tablet, a workstation, a personal digital assistant (PDA), a laptop, a cell phone, an e-reader, or a wearable computing device. The electronic device38may include one or more processors suitable for executing computer instructions as well as memory useful in storing the computer instructions. The electronic device38may include a location-based document reader39that may determine, for example, by using GPS, IPS, cellular methods, or other location determination methods, a location of the electronic device38. The location-based document reader39may use communication circuitry on the electronic device38to transmit the location data of the electronic device38to a WAP28, a cell tower20, a router, or other wireless communication means, which may transmit the location data over a secure links14to the location-based document server12. Non-wireless techniques, such as cables, may also be used. One or more processors included in the location-based document server12may process the location data to determine if the electronic device38is within an allowable location range32. If so, the location-based document server12may utilize a WAP28, a cell tower20, or other wireless or non-wireless communication techniques to transmit documentation corresponding to the cabinet30to the location-based document reader. If a technician40is located outside of an allowable location range32, the location-based document reader39may deny access to the documentation. In other embodiments, the location-based document reader39may delete the documentation once the technician40is located outside of an allowable location range32. In yet other embodiments, the location-based document server12may receive location data from the location-based document reader39determine that the location-based document reader is out of an allowable location range32, and deny access to documentation.

In certain embodiments, the location-based document server12may utilize a WAP28, a cell tower20, or other wireless or non-wireless communication techniques to transmit updated document data to the communication system33of each equipment cabinet30. The document data may then be stored on a cabinet microcontroller41. The cabinet microcontroller41may include a processor, a storage (e.g., physical storage and electronic data storage) to store documentation data for the cabinet, a memory to store instructions to be executed by the processor, and a wireless communication medium, such as Bluetooth or NFC. When the technician36with a location-based document reader39is determined to be within an allowable location range32of the cabinet30, the cabinet microcontroller41may transmit document data to the electronic device38and allow access to document data with the location-based document reader39. Due to the limited range of some wireless communication protocols, such as Bluetooth or NFC, the allowable location range32may be inside a range at which the communication protocol utilized by the cabinet storage device41can effectively transmit data. However, since other communications techniques may be used suitable for communication at long-ranges, the location range32may include a wide variety of distances, such as between 10-100 meters, 50-1000 meters, 1 kilometer-10,000 kilometers.

In further other embodiments, the communication medium on the cabinet microcontroller41may be utilized to verify that a given electronic device38is within the allowable location range32so that the location-based document server12may transmit documentation data directly to the location-based document reader on the electronic device38. For example, the cabinet microcontroller41may utilize the communication medium to transmit a key or password to an electronic device38within the allowable location range32. The electronic device38may transmit the key or password to the location-based document server12to receive access to the cabinet30documentation. The key that may be transmitted by the cabinet microcontroller41may be utilized to decrypt encrypted documentation data. In certain embodiments, the cabinet microcontroller41may receive new keys or passwords from the location-based document server12at pre-determined time intervals, such as every 30 seconds or 1 minute. The updated keys and passwords may prevent users from accessing or decrypting documentation data once they are outside of an allowable location range32.

A technician36located inside an allowable location range32may additionally receive write access from the location-based document server12. The write access may enable a technician36to update service and maintenance history stored on the location-based document server12or the cabinet storage device41. The various security access levels may be provided to enable only desired personnel to edit a document or to view a document. In certain embodiments, changes to documents on the location-based document server12or the cabinet storage device41may be authorized by an administrator or manager before the changes are updated on the location-based document server12. Additionally, in certain embodiments, the location-based document server12or the cabinet storage device41may save previous versions of a specific document so that the document can be recovered in the event that the document was incorrectly updated or for any other reason.

In certain instances, a technician42with an electronic device38including a location-based document reader39may be located in two or more allowable location ranges32of different equipment cabinets30. That is, the technician42may be located in regions intersecting certain ranges32. In some embodiments, the location-based document reader may receive read and/or write access to both cabinets30located in the intersecting ranges32, while, in other embodiments, the location-based document reader39may receive read and/or write access from only one cabinet43or from neither of the cabinets30. Further, in other embodiments, the location-based document reader may receive read and/or write access to a user-selected cabinet30, or the cabinet30that is physically closer to the technician42. Additionally, each cabinet30may include a barcode44that may be scanned by a barcode scanning device on the electronic device38to identify the cabinet30for which documentation access is requested. As will be further discussed in relation toFIG. 2, the barcode44may also be used as authentication data.

In addition to factories and industrial plants, documentation may also be accessed by individuals at authorized secure facilities22. For example, an engineer46at an engineering office may need to update or reference equipment documentation stored on the location-based document server12. The engineer46may receive access with the location-based document reader39at any location in the secure facility22. In certain embodiments, the secure facility22may be a building or a portion of a building, and/or inside the geographic region37. Additionally, the engineer46or other authorized personnel may gain access to documents on the location-based document server12through a VPN26. An administrator of the location-based document server12may designate specific VPNs26to have read and/or write access to the location-based document server12. The engineer46may access the VPN26with a login/password, and the VPN26may provide document read and/or write access to the location-based document reader operating on the electronic device38.

In addition to providing simple read and write access to documentation on the location-based document server12as illustrated inFIG. 1, the document access control system10may utilize different forms of authentication to provide different levels of read and write access.FIG. 2illustrates various embodiments of authentication methods that may be utilized to provide customized levels of access. The level of access of a particular document60stored on the location-based document server12may be determined by location-based authentication processes62, user-based authentication processes64, or a combination thereof. Each authentication process or technique may transmit authentication data to the location-based document server12, and receive document access by way of the document access control system infrastructure illustrated inFIG. 1.

The location-based authentication processes62may combine location data with other forms of information to characterize the level of access a user may receive. For example, a barcode process66of location-based authentication may utilize a barcode44disposed on an equipment cabinet30as illustrated inFIG. 1in conjunction with a location determined by the electronic device38to confirm the user is located in an authorized location to receive documentation and service history regarding the equipment cabinet30. Similarly, a different barcode44may be given to engineers or other authorized personnel for use at a secure facility22. The barcode44may be associated with the location of the secure facility22and an electronic device38scanning the barcode44may only receive access to documentation when the electronic device38is within an allowable location range32associated with the secure location22. Additionally, the barcode44at the secure facility22may enable a different access level than the barcode44disposed on the cabinet30in the factory24or industrial plant18. For example, the technician36at the factory24or industrial plant18may be allowed to access both operation manuals and service history for a specific cabinet30, while an engineer at the secure facility22, such as a research and development facility, may be allowed to access only the operation manuals.

Even when the electronic device38does not include a barcode scanning device, or when barcodes have not been installed on equipment, location-based authentication methods62may still be utilized to determine access levels to a document. For example, an administrator of the location-based document server12may determine and set a variety of allowable location ranges32that may each define a separate access level. Location-based authorization methods62may utilize GPS systems68, IPS systems70, cellular systems, Bluetooth or NFC systems72, or a combination thereof to determine if a user utilizing the electronic device38is within a specific allowable location range32. If a user with an electronic device38is within the specific allowable location range32, the location-based authentication methods62may enable a level of document access based on the allowable location range32. As an example, an engineer at the secure facility22, such as an engineering office, may use the location-based document reader39in the electronic device38to access an operating manual for a given piece of equipment because the engineering office is designated as within the allowable location range32. However, the technician36at the industrial plant18or factory24may enter the allowable location range32corresponding to the cabinet30and may receive access to read the operating manual as well as maintenance history relating to the cabinet30, and, in some embodiments, may receive access to edit and update the maintenance history based on, for example, maintenance performed. In this way, the location-based authentication process62may provide customized levels of access to users that require different access levels to documentation stored on the location-based document server12. Additionally, the location-based authentication method62may enable efficient deployment of location-based documentation access control. To enable location-based documentation access control for the industrial plant18or factory24, the administrator of the location-based document server12may determine the allowable location ranges32of the industrial plant18or the factory24, for example, by determining a distance from the cabinet30, set the allowable location ranges32in the location-based document server12, and assign access levels to each of the allowable location ranges32. A user with an electronic device38that includes the location-based document reader may then enter an allowable location range32and receive a proper level of document access.

In addition to location-based authentication methods62, access to electronic documents may be determined by utilizing user-based authentication methods64. As previously mentioned, a user may enter a login/password74to receive more access to documentation relating to a piece of equipment. For example, a manager at an industrial plant18or factory24may enter a login/password74into a location-based document reader to receive document access outside of allowable location ranges32, enabling the manager to review the maintenance history for several pieces of equipment without having to physically enter each allowable location range32.

Additionally, certain electronic devices38may include a hardware or software token76that may enable different levels of document access. For example, an engineer may need to access documentation for several pieces of equipment while travelling. An electronic device38with the allowable hardware or software token76may be enabled to access the equipment documentation regardless of location. Also, the industrial plant18or factory24may have some electronic devices38that do not have hardware or software tokens76and some electronic devices38that do have hardware or software tokens76. Managers at the industrial plant18or the factory24may receive electronic devices38with the hardware or software tokens76and may be enabled to access any documentation at any location, while technicians36at the industrial plant18or factory24may receive electronic devices38without the hardware or software tokens76and may only be enabled to access specific pieces of documentation when they are in an allowable location range32.

In certain embodiments, the electronic device38containing the location-based document reader may utilize biometric authentication methods78. The biometric authentication methods78may include voice recognition, retina scanning, fingerprint scanning, hand print recognition, signature recognition, or a combination thereof. The location-based document server12may store profiles for potential users that associate biometric data for a given user with a level of access for the user. For example, using biometric authentication methods78, a manager in an industrial plant18or factory24may use any location-based document reader on an electronic device38that includes biometric identification equipment to access documentation for an equipment cabinet30. It should be noted that the location-based authentication methods62and the user-based authentication methods64may be used alone or in combination with each other to achieve a desired level of access control and document security. Indeed, access to the server12may be provided by any combination of authentication processes66,68,70,72,74,76, and78

WhileFIG. 2illustrates different forms of authentication that may be utilized by the location-based document server12,FIG. 3illustrates an embodiment of a process that the location-based document server12may utilize when using a location-based authentication method62to determine a level of access to documentation for a user. The location-based document server12may determine a first location, as represented by block100. The first location may be the allowable location range32that defines where a user may access documentation stored on the location-based document server12, the geographic location37, or a combination thereof. The location-based document server12may store more than one allowable location range32and/or geographic location37. Based on the first location, the location-based document server12may transmit a document60to a location-based document reader, and the location-based document reader may receive the document60, as represented by blocks102and104respectively. Although the location-based document reader may have the document60stored at this point, it may be unable to read the document. The location-based document reader may be programmed to not open the document60at this time, or the document may be unable to be read for other reasons. For instance, the document may be encrypted or password-protected. Additionally, the location-based document server12may transmit more than one document60to the location-based document reader based on the first location. For example, based on a first location, the location-based document server12may transmit both the operating manual and the maintenance history for an equipment cabinet30to the location-based document reader, but at a later time, authentication data may determine which of the pieces of documentation will be able to be displayed.

As represented by block106, the location-based document server12may determine a second location. The second location may refer to the physical location of the electronic device38that includes the location-based document reader and may be determined by the methods described inFIGS. 1 and 2. The location-based document server may also determine other authentication data such as the barcode44and the user-based authentication methods64illustrated inFIG. 2. Based on the second location, the location-based document server12may provide access to the one or more documents60, as represented by block108. As mentioned, the levels of access to a specific document60may be determined by the second location as well as other authentication methods.

Technical effects of the techniques described herein include a document access control system including a location-based document server used to store documentation data and communicate with a location-based document reader. Particularly, the location-based document reader determines and transmits its location to the location-based document server. The location-based document server determines if the location of the location-based document reader falls within an allowable location range. If so, the location-based document reader allows document access to the location-based document reader. The location-based document server may provide different levels of document access based on the location of the location-based document reader, and, in some embodiments, other authentication data. The method of document access control enables greater security and greater control over security for the proprietary documentation stored on the location-based document server. Additionally, the documentation stored on the location-based document server can be updated efficiently, ensuring that an engineer or technician has the most up-to-date copies of a piece of equipment's documentation.