Patent ID: 12197994

DETAILED DESCRIPTION

To help prevent unauthorized access to certain environments (e.g., offices, buildings, laboratories, or warehouses), a conventional security platform typically is configured to only allow access to an environment for credentialed users. For example, some security platforms include one or more identification (ID) tags each storing a respective user identification (ID) for a corresponding user. A user ID stored on an ID tag includes data indicating a name, title, identification number, or any combination thereof of a corresponding user. Additionally, each ID tag includes wireless communication circuitry configured to wirelessly communicate with another device using one or more wireless protocols (e.g., Near Field Communication (NFC), Radio Frequency Identification (RFID), high-frequency RFID). The security platform further includes one or more security readers configured to control access to a respective environment based on a user ID received from an ID tag. For example, a security reader is configured to unlock an entryway (e.g., door) of a respective environment based on the user ID received from an ID tag. To this end, each security reader includes wireless communication circuitry configured to wirelessly communicate with another device (e.g., an ID tag) using one or more wireless protocols (e.g., NFC, RFID, high-frequency RFID). Further, each security reader includes or otherwise has access to user credentials for one or more respective users. For example, one or more security readers of a security platform are configured to access one or more databases storing user credentials for one or more respective users. As another example, one or more security readers of a security platform are configured to store user credentials for one or more respective users. The user credentials for a respective user include, for example, data indicating the identity of the user (e.g., user's name, user's title, user's identification number), access rights of the user (e.g., basic access, administrator access), certain environments the user is allowed to access, or any combination thereof.

To access an environment using these security platforms, an ID tag is configured to provide the user ID stored on the ID tag to a security reader using a wireless protocol. For example, the wireless communication circuitry of the ID tag is configured to provide the user ID stored on the ID tag to the communication circuitry of a security reader using NFC. In response to receiving the user ID, the security reader compares the user ID to one or more user credentials stored on or otherwise accessible to the security reader. Based on the comparison of the user ID to the user credentials, the security reader allows access to the environment by, for example, unlocking a door. As an example, the security reader compares the user ID to the user credentials to determine whether the user ID matches an identity of a user in the user credentials. If the user ID does not match an identity of a user in the user credentials, the security reader denies access to the environment and does not open the door. If the user ID does match the identity of a user in the user credentials, the security reader allows access based on the level of access for the user, certain environments the user is allowed to access, or both indicated in the user credentials.

However, while the security platform helps prevent unauthorized access to certain environments, the security platform is not configured to help prevent the removal of sensitive devices from the environments. A sensitive device, for example, includes a compute-enabled phone (i.e., smartphone), laptop computer, desktop computer, flash drive, hard drive, solid-state drive, circuit board, or the like that stores or is otherwise associated with sensitive data. As such, systems and techniques disclosed herein are directed to helping prevent the removal of sensitive devices from one or more environments. For example, a security platform includes one or more security tags each configured to be affixed to a respective sensitive device. Each security tag is configured to help ensure a sensitive device stays within a respective range and includes, for example, a wireless communication circuitry, displacement sensor, storage, and an alarm. To help ensure a sensitive device stays within a respective range, a security tag receives one or more user credentials and one or more allowed distances from a security reader. For example, the wireless communication circuitry of the security reader provides data indicating one or more user credentials and one or more allowed distances to the wireless communication circuitry of the security tag. After receiving the user credentials and allowed distances, the security tag then stores the received user credentials and allowed distances in the storage of the security tag. The stored user credentials include, for example, data indicating the identification of one or more respective users and the access rights of one or more respective users. These access rights, for example, indicate whether a user is authorized to activate a security tag, deactivate a security tag alarm, or both. Further, the stored allowed distances, for example, include data indicating respective maximum distances associated with one or more ranges.

After the user credentials and allowed distances are stored on the security tag, the security tag polls for one or more ID tags using one or more communication protocols. In response to detecting the presence of an ID tag, the security tag then requests and receives the user ID stored on the ID tag. The security tag compares the user ID to the user credentials stored on the security tag to determine if the user identified in the user ID has access rights to activate the security tag. In response to determining that the user identified in the user ID does not have access rights to activate the security tag, the security tag continues to poll for ID tags. In response to determining that the user identified in the user ID does have access rights to activate the security tag, the security tag stores the received user ID and requests a user ID from a second ID tag. For example, the communication circuitry of the security tag requests a second ID from a second ID tag using one or more communication protocols. The security tag then receives, via a communication protocol, a second user ID from a second ID tag and stores the received second user ID. Once the second user ID is stored, the security tag determines a distance threshold based on a stored allowed distance. The distance threshold, for example, represents a radius or another representation of a covered area from a predetermined point within which the security tag is allowed to move.

The security tag also includes a displacement sensor configured to determine the distance the security tag has moved away from a predetermined point. In response to the displacement sensor determining the security tag has moved a distance away from the predetermined point equal to or greater than the distance threshold, the security tag activates an alarm. In this way, the security tag helps ensure a sensitive device stays within a respective range by activating an alarm once the security tag affixed to a sensitive device moves a threshold distance away from a predetermined point. Because the security tag helps ensure a sensitive device stays within a respective range, the security tag also helps ensure that sensitive devices do not leave certain environments. Further, after the alarm of a security tag is activated, the security tag is configured to receive one or more user IDs from one or more ID tags via one or more communication protocols. After receiving a user ID when the alarm is activated, the security tag determines whether the user identified by the user ID has access rights to deactivate an alarm of a security tag. For example, the security tag determines whether the user credentials stored on the security tag indicate the user identified in the user ID is allowed to deactivate the alarm of the security tag. If the access rights of the user identified in the user ID indicate the user is allowed to deactivate the alarm, the security tag deactivates the alarm. In this way, only users with certain access rights are able to deactivate an alarm of a security tag, further helping ensure that sensitive devices do not leave certain environments.

As used herein, the term “circuitry” includes hardwired circuitry, programmable circuitry, or a combination thereof. For example, circuitry may include circuitry of an application-specific integrated circuit (ASIC) that is hardwired or hardcoded to perform corresponding functions, one or more processors that execute software stored in one or more memories or other storage media to perform corresponding functions, programmable logic that has been programmed to perform corresponding functions, or some combination thereof.

FIG.1illustrates a security platform100configured to secure a sensitive device within a specified environment, such as an office, building, laboratory, or warehouse. To this end, security platform100includes security tag102which includes communication circuitry104, displacement sensor106, storage108, and alarm114. In embodiments, security tag102is affixed to a sensitive device130via, for example, adhesive, screws, bolts, clamps, and the like. As an example, security tag102is affixed to a housing131of sensitive device130. Sensitive device130includes, for example, a smartphone, laptop computer, flash drive, hard drive, solid-state drive, or any combination thereof which is configured to store or otherwise associated with sensitive data (e.g., confidential data, proprietary data). According to embodiments, security tag102is configured to help ensure sensitive device130stays within a range126. Range126represents, for example, a threshold distance from a predetermined point. Within the example embodiment presented inFIG.1, range126is represented as a circle having a radius corresponding to a threshold distance from the center of the circle representing range126(e.g., a predetermined point). However, it will be appreciated that as the environment in which the security platform100may impact the shape of the range126. As such, in other implementations, the range126may have a non-circular, irregular shape. To help ensure sensitive device130stays within range126, displacement sensor106of security tag102is configured to track the distance128security tag102has moved away from a predetermined point. For example, referring to the example embodiment presented inFIG.1, displacement sensor106tracks the distance128security tag102has moved away from the center (e.g., a predetermined point) of the circle representing range126. Displacement sensor106includes, for example, one or more accelerometers, time-of-flight (ToF) sensors, laser distance sensors, ultrasonic distance sensors, radar sensors, or any combination thereof. As an example, displacement sensor106includes an accelerometer configured to measure the acceleration of security tag102(e.g., the acceleration of the sensitive device130to which security tag102is affixed). Based on the measured acceleration, security tag102, displacement sensor106, or both determine a representation of the distance128security tag102has moved away from a predetermined point (e.g., the distance128the sensitive device130to which security tag102is affixed has moved away from the predetermined point). The representation of the distance128, for example, includes a value that is derived from one or more measurements taken by displacement sensor106and that represents an approximation of the distance128security tag102has moved away from a predetermined point.

According to embodiments, security tag102is configured to compare the determined distance128(e.g., representation of the distance128) security tag102has moved away from a predetermined point to a threshold distance to determine whether security tag102is within range126. For example, security tag102is configured to determine whether the determined representation of distance128security tag102has moved away from a predetermined point is equal to or greater than a predetermined threshold distance associated with range126(e.g., a predetermined threshold distance representative of range126). In response to the determined representation of distance128being less than the predetermined threshold distance associated with range126, displacement sensor106continues to track the distance128security tag102has moved away from a predetermined point. In response to the representation of the determined distance128being equal to or greater than the predetermined threshold distance associated with range126, security tag102is configured to activate alarm114. Alarm114, for example, includes one or more output devices (e.g., speakers, buzzers, lights, motors) configured to output an audio alarm (e.g., siren, buzzer, klaxon, beeps, chirps), a visual alarm (e.g., blinking lights, flashing lights, lights having one or more colors), a haptic alarm or any combination thereof. For example, in response to the determined distance128being equal to or greater than the predetermined threshold distance associated with range126, security tag102is configured to activate alarm114including a speaker that outputs beeps, a siren, chirps, or any combination thereof. In this way, security tag102helps ensure a sensitive device130stays within an environment by activating alarm114(e.g., audio alarm, visual alarm, haptic alarm) when the sensitive device130moves outside range126. As an example, in response to a user carrying a sensitive device130having security tag102affixed outside of range126, alarm114will activate, helping prevent the user from removing the sensitive device130from the environment.

In embodiments, to further help ensure a sensitive device130remains within the specified environment, security tag102is configured to be implemented in a security platform100including one or more ID tags116and one or more security readers118. Each ID tag116, for example, includes circuitry to store a respective user ID122for a corresponding user (e.g., a user associated with the ID tag116). Each user ID122includes data representing the name, title, identification number, or other identifier of a corresponding user, or any combination thereof. Further, each ID tag116includes communication circuitry132configured to communicatively couple to one or more other devices (e.g., security reader118or security tag102) using one or more wireless communication protocols (e.g., NFC, RFID, high-frequency RFID). For example, an ID tag116includes a wireless communication circuitry (e.g., communication circuitry132) configured to wirelessly communicatively couple to security reader118, security tag102, or both using NFC protocols. Though the example embodiment presented inFIG.1depicts security platform100as including three ID tags (116-1,116-2,116-N) representing an N number of ID tags (N>1), in other embodiments, security platform100can include any number of ID tags.

Security reader118, for example, includes circuitry configured to control access to an environment (e.g., building, office, laboratory, warehouse). As an example, security reader118is configured to unlock a door or other entranceway of an environment. To this end, security reader118includes circuitry configured to store or otherwise access user credentials110. For example, in embodiments, security reader118is configured to access one or more user credentials110for one or more respective users stored in one or more databases (not shown for clarity). User credentials110associated with a respective user include, for example, data indicating the identity of the user (e.g., user's name, user's title, user's identification number), access rights of the user (e.g., whether a user is allowed to activate a security tag102, deactivate a security tag alarm, or both), certain environments the user is allowed to access, or any combination thereof. Further, according to some embodiments, security reader118also stores or is otherwise configured to access one or more allowed distances124. An allowed distance124, for example, includes data indicating a range126for one or more sensitive devices130. In embodiments, each allowed distance124is associated with one or more users, types of sensitives devices, certain sensitive devices130, access rights (e.g., basic access, administrator access), or any combination thereof.

Additionally, security reader118includes communication circuitry134configured to communicatively couple to one or more other devices (e.g., ID tag116, security tag102) using one or more wireless communication protocols. For example, security reader118includes a wireless communication circuitry (e.g., communication circuitry134) configured to communicatively couple to security ID tag116, security tag102, or both using NFC. To allow access to an environment, security reader118initially receives, via communication circuitry134, a user ID122from an ID tag116. After receiving the user ID122, security reader118compares the user ID122to one or more user credentials110. For example, security reader118compares the user ID122to one or more user credentials110to determine whether the user ID122matches an identity of a user indicated in one or more user credentials110. If the received user ID122does not match an identity of a user in the user credentials110(e.g., the user ID122is unknown to security reader118), security reader118denies access to the environment. If the user ID122does match the identity of a user in the user credentials110, security reader118allows access based on the level of access for the user, certain environments the user is allowed to access, or both indicated in the user credentials110. In some embodiments, communication between security reader118and one or more ID tags116is encrypted. To this end, security reader118and one or more ID tags116are each configured to store one or more security keys120. Security keys120, for example, include cryptographic keys used to encrypt and decrypt data. For example, when transmitting data (e.g., user ID122), an ID tag116, security reader118, or both are configured to first encrypt the data using one or more security keys120. Likewise, an ID tag116, security reader118, or both are configured to first decrypt received data using one or more security keys120.

According to embodiments, security tag102is configured to operate in two or more modes. For example, security tag102is configured to operate in a provision mode, usage mode, low power mode, active mode, or any combination thereof. While in a provision mode, security tag102is configured to accept and store data used to configure security tag102. As an example, in some embodiments, while in a provision mode, security tag102is configured to request one or more user credentials110, security keys120, allowed distances124, or any combination thereof from security reader118. To request data from security reader118, security tag102sends data indicating the request to security reader118using communication circuitry104. Communication circuitry104is configured to communicatively couple to one or more other devices (e.g., ID tag116, security reader118) using one or more wireless communication protocols. For example, security tag102includes a wireless communication circuitry (e.g., communication circuitry104) configured to communicatively couple to security ID tag116, security reader118, or both using NFC. In response to receiving a request for one or more user credentials110, security keys120, allowed distances124, or any combination thereof from security tag102, security reader118is configured to, via communication circuitry134, send the requested user credentials110, security keys120, and allowed distances124to security tag102. Security tag102then stores the requested user credentials110, security keys120, and allowed distances124in storage108. Storage108, for example, includes solid-state memory, flash memory, or both configured to store data. In embodiments, security tag102encrypts one or more user credentials110using one or more received security keys120before storing the user credentials110in storage108.

After security tag102stores the requested user credentials110, security keys120, and allowed distances124in storage108, security tag102enters a usage mode. While in a usage mode, security tag102polls for one or more ID tags116. As an example, security tag102enters a low-power mode that continuously or periodically polls for one or more ID tags116. In response to detecting an ID tag116, security tag102requests the user ID122stored on the ID tag116and receives the user ID122using one or more wireless communication protocols. For example, communication circuitry104is configured to receive the user ID122using NFC communication protocols. Once the user ID122is received from the ID tag116, security tag102stores the user ID122in storage108as user IDs112. In embodiments, security tag102is configured to first decrypt the received user ID122using one or more security keys120in storage108. Further, security tag102compares the user ID122to the user credentials110stored on the security tag102to determine whether the user identified by the user ID122has access rights to activate security tag102. As an example, security tag102first determines whether the user credentials110stored on security tag102include data associated with the user identified in the received user ID122. If the user credentials110do include data associated with the user identified in the received user ID122, security tag102then determines the access rights of the user indicated in the user credentials110to determine whether the user identified by the received user ID122has access rights to activate security tag102. In response to the user identified by the received user ID122not having access rights to activate security tag102, security tag102continues to poll for one or more ID tags116. In response to the user identified by the received user ID122having access rights to activate security tag102, security tag102then requests a second user ID122from a second ID tag116. For example, security tag102, via communication circuitry104, transmits a request for a user ID122to devices (e.g., ID tags116) within the range of communication circuitry104.

In response to receiving a second user ID122from a second ID tag116, security tag102is configured to store the second user ID122in storage108as user IDs112. According to embodiments, for example, security tag102is configured to first decrypt the second user ID122using one or more security keys120in storage108before storing the second user ID122in storage108. Additionally, in response to receiving a second user ID122from a second ID tag116, security tag102is configured to enter an active mode. While in an active mode, security tag102is configured to determine a range126based on one or more allowed distances124stored on security tag102. As an example, based on a stored allowed distance124, security tag102determines a distance threshold (e.g., maximum distance) away from a predetermined point that represents the range126. According to embodiments, security tag102is configured to determine the range126based on an allowed distance124associated with a user identified in user IDs112(e.g., the user identified in the second user ID122), a type of device of sensitive device130, or both. After determining a range126, displacement sensor106then tracks the distance128security tag102has moved away from a predetermined point and determines whether security tag102, and by association, sensitive device130, is still within the determined range126. In response to security tag102leaving range126, security tag102activates alarm114. That is to say, in response to security tag102moving a distance128away from a predetermined point equal to or greater than a distance threshold associated with (e.g., representative of) a range126, security tag102activates alarm114.

To deactivate alarm114, security tag102is configured to request a user ID122from one or more ID tags116. For example, security tag102, via communication circuitry104, transmits a request for a user ID122to one or more devices (e.g., ID tags116) within the range of communication circuitry104. In response to receiving the user ID122while alarm114is active, security tag102compares the received user ID122to the user credentials110stored on the security tag102to determine whether the user identified by the user ID122has access rights to deactivate alarm114. That is to say, security tag102determines whether the user ID122is authorized to deactivate the alarm. As an example, security tag102first determines whether the user credentials110stored on security tag102include data associated with the user identified in the received user ID122. If the user credentials110do include data associated with the user identified in the received user ID122, security tag102then determines the access rights of the user indicated in the user credentials110to determine whether the user identified by the received user ID122has access rights to deactivate alarm114. In response to the user identified by the received user ID122not having access rights to deactivate alarm114, alarm114continues to be active. In response to the user identified by the received user ID122having access rights to deactivate alarm114(e.g., in response to the user ID122being authorized to deactivate the alarm), security tag102deactivates alarm114. In this way, alarm114is only deactivated by a user having the appropriate access rights (e.g., having an ID tag116with the correct access rights). Because alarm114is only deactivated by a user having the appropriate access rights, alarm114will continue to be active if an unauthorized user attempts to remove a sensitive device130with security tag102affixed from range126, helping ensure the sensitive device130does not leave the range126, an environment, or both.

FIGS.2to5each presents a corresponding example configuration for security tag102. For example,FIGS.2to5each presents one or more components implemented as communication circuitry104, displacement sensor106, storage108, alarm114, or any combination thereof of security tag102. Referring now toFIG.2, an example configuration200for security tag102is presented. Within example configuration200, security tag102includes displacement sensor106, alarm114, secure element232, microcontroller unit234, communication frontend236, battery238, power management unit240, and storage108. Microcontroller unit234, for example, includes one or more processor cores, memories, or both configured to perform one or more instructions, operations, or both for security tag102. In embodiments, microcontroller unit234is configured to receive and provide data to displacement sensor106, alarm114, secure element232, communication frontend236, power management unit240, and storage108. Secure element232, for example, includes circuitry configured to encrypt, decrypt, and store data. For example, using one or more security keys120, secure element232is configured to encrypt and store user credentials110, security keys120, allowed distances124, user IDs122, or any combination thereof received from security reader118, one or more ID tags116, or both. As another example, using one or more security keys120, secure element232is configured to decrypt one or more received user IDs122received from one or more ID tags116. In embodiments, for example, secure element232is implemented in security platform100as storage108.

Communication frontend236, for example, includes circuitry configured to poll for one or more devices (e.g., ID tags116, security reader118), transmit data to one or more devices, receive data from one or more devices, or any combination thereof using one or more wireless communication protocols. As an example, communication frontend236includes an NFC-compatible frontend configured to receive data from one or more ID tags116, security reader118, or both. According to embodiments, communication frontend236is implemented in security platform100as at least a portion of communication circuitry104. Battery238provides power to components of the security tag102. To control the voltage, current, or both of battery238provided to displacement sensor106, alarm114, secure element232, microcontroller unit234, communication frontend236, or any combination thereof, security tag102includes power management unit240. Power management unit240includes, for example, a microcontroller or other circuitry configured to control the voltage and current provided from battery238to one or more components of security tag102(e.g., displacement sensor106, alarm114, secure element232, microcontroller unit234, communication frontend236). As an example, when security tag102is operating in a low-power mode, power management unit240is configured to control the voltage and current provided from battery238to one or more components of security tag102so as to reduce the amount of power consumed by the components and extend the battery life of battery238.

Referring now toFIG.3, another example configuration300for security tag102is presented. Within example configuration300, security tag102includes displacement sensor106, alarm114, secure element232, NFC controller342, battery238, and power management unit240. NFC controller342, for example, includes one or more microcontrollers (e.g., microcontroller unit234) and/or other circuitry configured to communicatively couple to one or more devices using wireless signaling compliant with NFC protocols. For example, NFC controller342is configured to receive one or more user credentials110, security keys120, allowed distances124, and user IDs122from security reader118, one or more ID tags116, or both using NFC-based wireless signaling. In embodiments, at least a portion of NFC controller342is implemented in security platform100as communication circuitry104.

Referring now toFIG.4, an example configuration400for security tag102is presented. Within example configuration400, security tag102includes displacement sensor106, alarm114, secure microcontroller unit444, communication frontend236, battery238, and power management unit240. Secure microcontroller unit444includes, for example, one or more microcontrollers (e.g., microcontroller unit234) and/or other circuitry configured to encrypt, decrypt, and store data. For example, using one or more security keys120, secure microcontroller unit444is configured to encrypt and store user credentials110, security keys120, allowed distances124, user IDs122, or any combination thereof received from security reader118, one or more ID tags116, or both. As another example, using one or more security keys120, secure microcontroller unit444is configured to decrypt one or more received user IDs122received from one or more ID tags116. In embodiments, at least a portion of secure microcontroller unit444is implemented in security platform100as storage108.

Referring now toFIG.5, another example configuration500for security tag102is presented. Within example configuration500, security tag102includes displacement sensor106, alarm114, secure near field communication controller (secure NFC controller)546, battery238, and power management unit240. Secure NFC controller546includes one or more microcontrollers (e.g., microcontroller unit234) and/or other circuitry configured to communicatively couple to one or more devices using NFC-based wireless signaling. For example, secure NFC controller546is configured to receive one or more user credentials110, security keys120, allowed distances124, and user IDs122from security reader118, one or more ID tags116, or both using NFC-based wireless signaling. Further, secure NFC controller546includes circuitry configured to encrypt, decrypt, and store data. For example, using one or more security keys120, secure NFC controller546is configured to encrypt and store user credentials110, security keys120, allowed distances124, user IDs122, or any combination thereof received from security reader118, one or more ID tags116, or both. In embodiments, one or more portions of secure NFC controller546are implemented in security platform100as communication circuitry104and storage108.

Referring now toFIG.6, an example method600for provisioning a security tag is presented. At block605of example method600, security tag102enters a provision mode. While in a provision mode, security tag102is configured to, for example, receive and store data used to configure security tag102. To this end, at block610, security tag102is configured to receive, from security reader118, one or more user credentials110, security keys120, allowed distances124, or any combination thereof. For example, while in a provision mode, communication circuitry104of security tag102is configured to transmit a provision request to one or more devices using one or more communication protocols (e.g., NFC, RFID, high-frequency RFID). The provision request, for example, includes data requesting one or more user credentials110, security keys120, allowed distances124, or any combination thereof. In response to receiving the provision request, security reader118transmits the requested user credentials110, security keys120, and allowed distances124to security tag102using one or more communication protocols. At block615, security tag102stores the received user credentials110, security keys120, and allowed distances124in storage108. In embodiments, security tag102is configured to first decrypt, encrypt, or both one or more of the received user credentials110, security keys120, allowed distances124, or any combination thereof using one or more of the received security keys120before storing the data in storage108.

At block620, security tag102determines whether provisioning of the security tag102has been completed. In response to determining that provisioning of the security tag102has been completed, the security tag102moves to block625. In response to determining that provisioning of the security tag102has not been completed, the security tag102moves back to block605. For example, in embodiments, security tag102determines whether a predetermined threshold number of user credentials110, security keys120, allowed distances124, or any combination thereof has been stored in storage108. In response to the number of user credentials110, security keys120, allowed distances124, or any combination thereof being less than the predetermined threshold number, the security tag102determines that provisioning of the security tag102has not been completed and moves to block605. In response to the number of user credentials110, security keys120, allowed distances124, or any combination thereof being equal to or greater than the predetermined threshold number, the security tag102determines that provisioning of the security tag102has been completed and moves to block620. At block625, security tag102enters a usage mode. While in the usage mode, for example, security tag102is configured to poll for one or more ID tags116.

Referring now toFIG.7, an example method700for determining a security tag is within a determined range is presented. At block705of example method700, security tag102enters a low-power mode and polls for one or more ID tags116. For example, while in a low-power mode, security tag102, via communication circuitry104, periodically sends out a request for one or more user IDs122to one or more ID tags116using one or more communication protocols. In response to receiving such a request, an ID tag116is configured to transmit an initial user ID122stored on the ID tag116to security tag102using one or more wireless communication protocols. At block710, security tag102determines whether a user identified in a received initial user ID122has access rights to activate security tag102. For example, security tag102first determines whether the user credentials110stored on security tag102include data associated with the user identified in the initial user ID122. If the user credentials110do not include data associated with the user identified in the received user ID122(e.g., the user is unknown to security tag102), security tag102moves back to block705and continues to poll ID tags116. If the user credentials110do include data associated with the user identified in the initial user ID122(e.g., the user is known to security tag102), security tag102then determines the access rights of the user indicated in the user credentials110to determine whether the user identified by the initial user ID122has access rights to activate security tag102. In response to the user identified by the initial user ID122not having access rights to activate security tag102, security tag102moves back to block705and continues to poll ID tags116. In response to the user identified by the initial user ID122having access rights to activate security tag102, security tag102moves to block715. At block715, security tag102is configured to store the initial user ID122in storage108.

At block720, security tag102, via communication circuitry104, is configured to request a user ID122from another ID tag116using one or more communication protocols. For example, security tag102is configured to request a user ID122from a second ID tag116within a functional range of communication circuitry104. In response to receiving the request for a user ID122, the second ID tag116transmits the user ID122stored on the second ID tag116to security tag102using one or more wireless communication protocols. Once the user ID122is received from the second ID tag116, security tag102stores the user ID122in storage108. According to some embodiments, at block720, security tag102is configured to determine a range126based on one or more allowed distances124stored on security tag102. For example, based on a stored allowed distance124, security tag102determines a distance threshold (e.g., maximum distance) away from a predetermined point that represents a range126. In embodiments, at block720, security tag102is configured to determine a range126based on an allowed distance124associated with the user identified in the user ID112received from the second ID tag116, a type of device of sensitive device130(e.g., smartphone, laptop computer, flash drive, hard drive, solid-state drive) to which the security tag102is affixed, or both.

At block725, security tag102determines whether security tag102is within a range126. As an example, displacement sensor106of security tag102tracks the distance128security tag102has moved away from a predetermined point (e.g., the center of a range126). To track the distance128, displacement sensor106first takes one or more measurements representing, for example, an acceleration of security tag102, movement of security tag102, position of security tag102, or any combination thereof, to name a few. Security tag102, displacement sensor106, or both then determine a representation of the distance128security tage102has moved away from a predetermined point. The representation of the distance128, for example, includes a value representation an approximation of the distance128security tage102has moved away from a predetermined point based on one or more measurements taken by displacement sensor106. After the representation of distance128is determined, security tag102compares the representation of distance128to a predetermined threshold distance representative of range126(e.g., representative of a maximum distance away from a predetermined point). In response to security tag102determining that the representation of distance128is less than the predetermined threshold distance (e.g., determining that security tag102is still within range126), security tag102continues to track the distance128security tag102has moved away from a predetermined point and repeats block725. In response to security tag102determining that the representation of distance128is equal to or greater than the predetermined threshold distance (e.g., determining that security tag102is outside range126), security tag102moves to block730. At block730, security tag102activates alarm114. For example, security tag102activates an audio alarm, a visual alarm, a haptic alarm, or any combination thereof. As such, security tag102helps ensure a sensitive device130stays within a range126by activating alarm114once security tag102is affixed to the sensitive device130moves a threshold distance away from a predetermined point.

Referring now toFIG.8, an example method800for deactivating the alarm of a security tag is presented. At block805of example method800, security tag102determines whether security tag102remains within a specified range (e.g., range126). In response to security tag102still being within the range126, security tag102continues to monitor whether security tag102is within the range126. In response to security tag102being outside the range126, security tag102activates alarm114(e.g., audio alarm, visual alarm, haptic alarm) at block810. Also at block810, when alarm114is active, security tag102is configured to receive a user ID122from an ID tag116. At block815, security tag102determines whether the user identified in the received user ID122has access rights to deactivate alarm114. For example, security tag102first determines whether the user credentials110stored on security tag102include data associated with the user identified in the user ID122received from ID tag116. If the user credentials110do not include data associated with the user identified in the received user ID122(e.g., the user is unknown to security tag102), alarm114remains active and security tag102waits to receive another user ID122. Security tag102then repeats block815. If the user credentials110do include data associated with the user identified in the received user ID122, security tag102determines the access rights of the user indicated in the user credentials110to determine whether the user identified by the initial user ID122has access rights to deactivate alarm114. In response to the user identified by the initial user ID122not having access rights to deactivate alarm114, alarm114remains active and security tag102security tag102waits to receive another user ID122. Security tag102then repeats block815. In response to the user identified by the initial user ID122having access rights to deactivate alarm114, security tag102moves to block820. At block820, security tag102deactivates alarm114. In this way, only authorized users are able to deactivate the alarm114of a security tag102once the security tag102has left a range126, helping ensure security tag102remains within the range126.

In some embodiments, certain aspects of the techniques described above may be implemented by one or more processors of a processing system executing software. The software comprises one or more sets of executable instructions stored or otherwise tangibly embodied on a non-transitory computer-readable storage medium. The software can include the instructions and certain data that, when executed by the one or more processors, manipulate the one or more processors to perform one or more aspects of the techniques described above. The non-transitory computer-readable storage medium can include, for example, a magnetic or optical disk storage device, solid-state storage devices such as Flash memory, a cache, random access memory (RAM), or other non-volatile memory device or devices, and the like. The executable instructions stored on the non-transitory computer-readable storage medium may be in source code, assembly language code, object code, or another instruction format that is interpreted or otherwise executable by one or more processors.

A computer-readable storage medium may include any storage medium, or combination of storage media, accessible by a computer system during use to provide instructions and/or data to the computer system. Such storage media can include but is not limited to, optical media (e.g., compact disc (CD), digital versatile disc (DVD), Blu-Ray disc), magnetic media (e.g., floppy disc, magnetic tape, or magnetic hard drive), volatile memory (e.g., random access memory (RAM) or cache), non-volatile memory (e.g., read-only memory (ROM) or Flash memory), or microelectromechanical systems (MEMS)-based storage media. The computer-readable storage medium may be embedded in the computing system (e.g., system RAM or ROM), fixedly attached to the computing system (e.g., a magnetic hard drive), removably attached to the computing system (e.g., an optical disc or Universal Serial Bus (USB)-based Flash memory) or coupled to the computer system via a wired or wireless network (e.g., network accessible storage (NAS)).

Note that not all of the activities or elements described above in the general description are required, that a portion of a specific activity or device may not be required, and that one or more further activities may be performed, or elements included, in addition to those described. Still, further, the order in which activities are listed is not necessarily the order in which they are performed. Also, the concepts have been described with reference to specific embodiments. However, one of ordinary skill in the art appreciates that various modifications and changes can be made without departing from the scope of the present disclosure as set forth in the claims below. Accordingly, the specification and figures are to be regarded in an illustrative rather than a restrictive sense, and all such modifications are intended to be included within the scope of the present disclosure.

Benefits, other advantages, and solutions to problems have been described above with regard to specific embodiments. However, the benefits, advantages, solutions to problems, and any feature(s) that may cause any benefit, advantage, or solution to occur or become more pronounced are not to be construed as a critical, required, or essential feature of any or all the claims. Moreover, the particular embodiments disclosed above are illustrative only, as the disclosed subject matter may be modified and practiced in different but equivalent manners apparent to those skilled in the art having the benefit of the teachings herein. No limitations are intended to the details of construction or design herein shown, other than as described in the claims below. It is therefore evident that the particular embodiments disclosed above may be altered or modified and all such variations are considered within the scope of the disclosed subject matter. Accordingly, the protection sought herein is as set forth in the claims below.