Patent Document

PRIORITY REFERENCE TO PROVISIONAL APPLICATIONS 
       [0001]    This application claims benefit of and hereby incorporates by reference U.S. Provisional Application No. 62/254,229, entitled METHOD AND SYSTEM USING GEO-LOCATION DATA AND INFORMATION FOR ADDED LAYER OF SECURITY, and filed on Nov. 12, 2015 by inventors Alex Lin, Geoff House, Lee McDole, Michael Godlewski, Rudolph Mutter, Timothy Shipman and Jules Panopoulos. 
     
    
     FIELD OF THE INVENTION 
       [0002]    The present invention relates to computer data security. 
       BACKGROUND OF THE INVENTION 
       [0003]    Enterprises store sensitive and private company and customer data on secure file servers. As users become more mobile, it is becoming common for users to remotely access files on these file servers via their mobile computing devices. Typically, a user can login to an enterprise file server using a basic user ID and password, over a secure network such as a virtual private network. This is a relatively weak form of security, and data breaches often occur where sensitive data is accessed and used by unauthorized people. 
         [0004]    As such, it would be of great advantage to provide an additional layer of security for remote access to file servers via mobile devices. 
       SUMMARY 
       [0005]    Embodiments of the present invention provide modules, systems and methods for an additional layer of security for remote access to file servers via mobile devices of authorized users. Access to a file server is granted only if a mobile device is verified to be located within an authorized area of authentication (AAA). If the mobile device is not within the AAA, a temporary AAA, including the current location of the mobile device, may be authorized. 
         [0006]    There is thus provided in accordance with an embodiment of the present invention a system for secure access, including a stationary computing device that controls access to secure data over a secure network, including an AAA generator, generating an AAA for administering the secure data, an AAA validator, validating a mobile computing device that submits an access request for the secure data via a connection over the secure network, by verifying that a current location of the mobile device is within the AAA, and an access controller, enabling the mobile device to access the secure data, only in response to the validator affirmatively validating the mobile device, and a mobile computing device in communication with the stationary device, including a location identifier, dynamically identifying a current location of the mobile device, a connection controller for logging in to and out of the secure network, and an access requestor, submitting to the access controller via the secure network (i) an access request for the secure data, and (ii) the current location of the mobile device. 
         [0007]    There is additionally provided in accordance with an embodiment of the present invention a secure access server computer, including an authorized area of authentication (AAA) generator, generating an AAA for administering secure data, access to which is controlled by the server over a secure network, an AAA validator, validating a mobile device that submits an access request for the secure data via a connection over the secure network, by verifying that a current location of the mobile device is within the AAA; and an access controller, enabling the mobile device to access the secure data over the secure network only in response to the AAA validator affirmatively validating the mobile device. 
         [0008]    There is further provided in accordance with an embodiment of the present invention a mobile device for accessing secure data, including a location identifier, dynamically identifying a current location of the mobile device, a connection controller logging in to and out of a secure network, and an access requestor, submitting to a server computer via a connection over the secure network, both (i) an access request for secure data, access to which is controlled by the server, and (ii) the current location of the mobile device, wherein the server enables access to the secure data only when the current location of the mobile device is within an authorized area of authentication. 
         [0009]    There is yet further provided in accordance with an embodiment of the present invention a method for secure access, including generating, by a stationary computing device, an authorized area of authentication (AAA) for administering secure data, access to which is controlled by the stationary device over a secure network, submitting, by a mobile computing device to the stationary device via a connection over a secure network, a request to access the secure data, further submitting, by the mobile device to the stationary device, a current location of the mobile device, validating, by the stationary device, the mobile device, including verifying that the current location of the mobile device is within the AAA, and granting the mobile device access to the secure data, only in response to the validating being affirmative. 
         [0010]    There is moreover provided in accordance with an embodiment of the present invention a method for a secure access server, including generating an authorized area of authentication (AAA), for administering secure data, access to which is controlled by a server computer over a secure network, receiving, from a mobile computing device via a connection over the secure network, a request to access the secure data, further receiving, from the mobile device over the secure network, a current location of the mobile device, validating the mobile device, comprising verifying that the current location of the mobile device is within the AAA, and enabling the mobile device to access to the secure data, only in response to the validating being affirmative. 
         [0011]    There is additionally provided in accordance with an embodiment of the present invention a method for secure access by a mobile computer device, including identifying a current location of a mobile computing device, submitting, to a server computer via a connection over a secure network, a request to access secure data, access to which is controlled by the server, further submitting to the server over the secure network, the current location, and only when the current location is within an authorized area of authentication (AAA) for the server, receiving, from the server, an enablement to access the secure data. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0012]    The present invention will be more fully understood and appreciated from the following detailed description, taken in conjunction with the drawings in which: 
           [0013]      FIG. 1  is a simplified block diagram of a system for secure access, in accordance with an embodiment of the present invention; 
           [0014]      FIG. 2  is a simplified flowchart of a method for secure access, in accordance with an embodiment of the present invention; 
           [0015]      FIG. 3  is a screen shot of a mobile device prompting a user for his username and password for logging in to a secure network, and acquiring the user&#39;s current location, in accordance with an embodiment of the present invention; 
           [0016]      FIG. 4  is a screen shot showing the user&#39;s current location on a map, in accordance with an embodiment of the present invention; 
           [0017]      FIG. 5  is a screen shot showing the mobile device logging in to the secure network with the username and password, and with the user&#39;s current location, in accordance with an embodiment of the present invention; 
           [0018]      FIG. 6  is a screen shot showing the mobile device informing that user that he is located in an unauthorized area, and prompting the user to request a temporary authorized area of authentication (AAA), in accordance with an embodiment of the present invention; and 
           [0019]      FIG. 7  is a screenshot showing an area centered about the user&#39;s current location, in accordance with an embodiment of the present invention; 
           [0020]      FIG. 8  is a screen shot showing fingerprint identification prior to setting a temporary AAA, in accordance with an embodiment of the present invention; 
           [0021]      FIG. 9  is a screen shot showing that a temporary AAA has been set for the user, in accordance with an embodiment of the present invention; 
           [0022]      FIG. 10  is a screen shot of the user logging out of the secure network, in accordance with an embodiment of the present invention; 
           [0023]      FIG. 11  is a screen shot showing an exemplary log report for an administrator, generated by an access log recorder, in accordance with an embodiment of the present invention; 
           [0024]      FIG. 12  is a screen shot of a temporary AAA being reported to an the administrator, in accordance with an embodiment of the present invention; and 
           [0025]      FIG. 13  is a screen shot showing an exemplary log report generated for an administrator, by an access log recorder, in accordance with an embodiment of the present invention. 
       
    
    
       [0026]    For reference to the figures, the following index of elements and their numerals is provided. Similarly numbered elements represent elements of the same type, but they need not be identical elements. 
         [0000]    
       
         
               
             
               
               
             
           
               
                   
               
               
                 Table of elements in the figures 
               
             
          
           
               
                 Element 
                 Description 
               
               
                   
               
               
                 100 
                 stationary computing device 
               
               
                 110 
                 processor 
               
               
                 120 
                 AAA generator 
               
               
                 130 
                 AAA validator 
               
               
                 140 
                 AAA access controller 
               
               
                 150 
                 organization file server 
               
               
                 160 
                 organization administrator computer 
               
               
                 170 
                 access log recorder 
               
               
                 200 
                 mobile computing device 
               
               
                 210 
                 processor 
               
               
                 220 
                 location identifier 
               
               
                 230 
                 connection controller 
               
               
                 240 
                 access requestor 
               
               
                 250 
                 biometric/passcode scanner 
               
               
                 260 
                 biometric/passcode validator 
               
               
                   
               
             
          
         
       
     
         [0027]    Elements numbered in the  1000 &#39;s are operations of flow charts. 
       DETAILED DESCRIPTION 
       [0028]    In accordance with embodiments of the present invention, modules, systems and methods are provided for an additional layer of security for remote access to file servers via mobile devices. These modules, systems and methods are implemented using computing systems including inter alia servers, clients, network devices, and combinations of such devices. 
         [0029]    Reference is made to  FIG. 1 , which is a simplified block diagram of a system for secure access, in accordance with an embodiment of the present invention.  FIG. 1  shows a stationary computing device  100  and a mobile computing device  200 . Stationary device  100  controls access to an organization&#39;s file server  150  that stores secure data. More generally, file server  150  represents any type of server that allows one or more users of mobile devices to access content of the organization. 
         [0030]    Access to file server  150  via stationary device  100  is managed by an administrator computer  160 . File server  150  is remotely accessible over a secure network, such as a virtual private network (VPN). An access log recorder  170  logs each access to file server  150  and each attempt to access file server  150 , and report the logs to administrator  160 . 
         [0031]    Stationary device  100  may be inter alia a server, a network device, and a combination of such devices. Administrator  160  may be a desktop computer, a laptop computer, a network device, or such other computing device. Administrator  160  manages user accounts and their associated remote devices. In accordance with an embodiment of the present invention, each user and account must be authorized by stationary device  100  before a user may access files on file server  150 . 
         [0032]    Stationary device  100  includes a processor  110 , an authorized area of authentication (AAA) generator  120 , an AAA validator  130 , and an AAA access controller  140 . An “authorized area of authentication” is one or more geographic areas that provide an additional layer of security to supplement conventional user authentication credentials such as username and password. In order to access file server  150 , a user must be authenticated by his current location, in additional to conventional authentication. If the user is not located in an AAA, then his access to file server  150  is denied. The user may request a temporary authentication, as explained in detail below, but otherwise he is not granted access. 
         [0033]    In alternative embodiments of the present invention, one or more of AAA generator  120 , AAA validator  130 , and AAA access controller  140  reside in administrator  160  instead of stationary device  100 . 
         [0034]    Use of AAA is of particular advantage when an organization has mobile users, with mobile computing devices  200  that include a processor  210  and a location identifier  220 , such as inter alia a GPS tracker or an agent that provides location data, that dynamically determines a device&#39;s current geographic location. By transmitting an identifier of the location to stationary device  100 , AAA validator  130  is able to determine whether or not a user of mobile device  200  is located in an AAA. Mobile device  200  also includes a connection controller  230 , for connection to stationary device  100  and to file server  150  over a secure network, and an access requestor  240  for requesting temporary authentication. Regarding the secure network, mobile device  200  may be inter alia on a VPN connection with stationary device  100  and file server  150 . Stationary device  100  and file server  150  may be on that same secure network as well. 
         [0035]    Mobile device  200  also includes a biometric/passcode scanner  250 , which scans a biometric, such as a fingerprint or an iris, or scans a passcode, such as a PIN, of a user who is currently using mobile device  200 ; and a biometric/passcode validator  260 , which validates the user&#39;s biometric/passcode that was scanned by scanner  250 . 
         [0036]    Operation of the various components of stationary device  100  and mobile device  200  is described below with regards to  FIGS. 2-13 . 
         [0037]    Mobile device  200  may be inter alia a smartphone, a tablet computer, a laptop computer and such other remote access device. Stationary device  100 , file server  150 , administrator  160  and mobile device  200  are not limited to any particular operating system. Administrator  160  and mobile device  200  may each be implemented inter alia using an application program interface (API) that communicates with stationary device  100 . 
         [0038]    Reference is made to  FIG. 2 , which is a simplified flowchart of a method  1000  for secure access, in accordance with an embodiment of the present invention. The flowchart of  FIG. 2  is divided into two columns. The left column includes operations performed by stationary device  100 , and the right column includes operations performed by mobile device  200 . At operation  1005  AAA generator  120  generates an AAA for accessing an organization&#39;s secure data stored on file server  150 . The AAA is set by an organization administrator  160 , and includes one or more geographical areas. E.g., the AAA may include various office locations of the organization, and various home locations of employees who work for the organization from their homes. Individual AAAs may be set up by AAA generator  120  for different users on a per-user basis, for different groups of users on a per-group basis, or for an entire enterprise. In an alternative embodiment of the present invention, AAA  120 , which performs operation  1005 , is a component of administrator  160  instead of stationary device  100 . 
         [0039]    At operation  1010  connection controller  230  attempts to log in to a secure network of the organization, such as a virtual private network (VPN), to access file server  150 . At operation  1015  the user presents his credentials, such as username and password, for authentication. At operation  1020  the user&#39;s current location is identified by location identifier  220 , and submitted to AAA validator  130 . Reference is made to  FIG. 3 , which is a screen shot of mobile device  200  prompting a user for his username and password for logging in to the secure network, and acquiring the user&#39;s current location, in accordance with an embodiment of the present invention. Reference is made to  FIG. 4 , which is a screen shot showing the user&#39;s current location on a map, in accordance with an embodiment of the present invention.  FIG. 4  shows the user being located within a circular area between First and Second Street and between 4 th  and 5 th  Avenue. Reference is made to  FIG. 5 , which is a screen shot showing mobile device  200  logging in to the secure network with the username and password, and with the user&#39;s current location, in accordance with an embodiment of the present invention. 
         [0040]    At operation  1025 , AAA validator  130  authenticates mobile device  200  by checking credentials such as username and password. AAA validator  130  also verifies that the location submitted at operation  1020  is within an AAA that was generated at operation  1005 . At decision  1030 , AAA validator  130  decides whether or not the authentication at operation  1025  is verified. If so, then at operation  1035  mobile device  200  is granted access to file server  150 , and mobile device  200  is then enabled to access file server  150  such as via SSH FTP. Otherwise, if authentication is not verified at decision  1030 , then at operation  1040  mobile device  200  is denied access to file server  150 . In either case, the grant of or denial of access is logged by access log recorder  170  at operation  1045 , for reporting to administrator  160 . 
         [0041]    When access to file server  150  is denied at operation  1040  because mobile device  200  is not within an AAA, then at operation  1050  the user of mobile device  200  requests AAA access controller  140  to instantiate a temporary AAA that includes the current location of mobile device  200 , so that the user can temporarily access file server  150 . Reference is made to  FIG. 6 , which is a screen shot showing mobile device  200  informing the user that he is located in an unauthorized area, and prompting the user to request a temporary AAA, in accordance with an embodiment of the present invention. Reference is made to  FIG. 7 , which is a screenshot showing an area centered about the user&#39;s current location, in accordance with an embodiment of the present invention. 
         [0042]    At operation  1055 , biometric/passcode scanner  250  scans a biometric, such as inter alia a fingerprint or iris, of a user who is currently using mobile device  200 , or a passcode, such as inter alia a PIN code, for the user. At operation  1060 , biometric/passcode validator  260  validates the identity of the user, based on the user&#39;s scanned biometric/passcode, to ensure that the user who is currently using mobile device  200  is indeed authorized to use mobile device  200  and request a temporary AAA. Reference is made to  FIG. 8 , which is a screen shot showing fingerprint identification prior to setting a temporary AAA, in accordance with an embodiment of the present invention. 
         [0043]    At decision  1065 , mobile device  200  decides whether or not the validation at operation  1060  is affirmative. If not, then at operation  1070  the request for the temporary AAA is denied, and the user is denied access to file server  150 . Denial of access is then logged by access log recorder  170  at operation  1045 , for reporting to administrator  160 . Otherwise, if decision  1065  decides that the validation is affirmative, then at operation  1075  the request for the temporary AAA is submitted to stationary device  200 , and at operation  1080  AAA access controller  140  sets a temporary AAA for the user, at his current location. Reference is made to  FIG. 9 , which is a screen shot showing that a temporary AAA has been set for the user, in accordance with an embodiment of the present invention. At operation  1035  mobile device  200  is granted access to file server  150 , and mobile device  200  is then enabled to access file server  150  such as via SSH FTP. Access to file server  150  via the temporary AAA is logged by access log recorder  170  at operation  1045 , for reporting to administrator  160 . 
         [0044]    After completion of the user&#39;s access to file server  1050 , the user logs out and the temporary AAA is canceled. Reference is made to  FIG. 10 , which is a screen shot of the user logging out of the secure network by use of a side-bar menu, in accordance with an embodiment of the present invention. Alternatively, the temporary AAA may expire after a designated time period. 
         [0045]    There are many variations for division of processing labor between stationary device  100 , administrator  160  and mobile device  200 , all of which are contemplated by the present invention. Thus inter alia, referring to  FIG. 2 , operations  1060 - 1075 , relating to validating the identity of the user via fingerprint or such other biometric, or via passcode or via another PIN-based mechanism, may be performed by stationary device  100  or alternatively by administrator  160 , instead of mobile device  200 . In such case, mobile device  200  transmits the scanned biometric/passcode to stationary device  100  or administrator  160  after performing operation  1055 , and stationary device  100  or administrator  160  performs the validation, and the denial or grant of access. 
         [0046]    Reference is made to  FIG. 11 , which is a screen shot showing an exemplary log report generated by access log recorder  170  for administrator  160 , in accordance with an embodiment of the present invention. The log report lists authorized logins to file server  160  and unauthorized logins that were blocked, with dates and times, according to username. 
         [0047]    Reference is made to  FIG. 12 , which is a screen shot of a temporary AAA being reported to administrator  160 , in accordance with an embodiment of the present invention. 
         [0048]    Reference is made to  FIG. 13 , which is a screen shot showing an exemplary log report generated by access log recorder  170  for administrator  160 , in accordance with an embodiment of the present invention. Valid user logins are indicated with a check mark, and invalid login attempts are indicated with a dash. The log report identifies locations, including latitude and longitude and addresses of users who logged into file server  150  and attempted to login to file server  150 , according to dates and times. 
         [0049]    It will thus be appreciated that embodiments of the present invention provide modules, systems and methods for data security whereby a remote device is granted access to a file server only when it is currently located in an authorized area of authentication. 
       Implementation Details 
       [0050]    In an embodiment of the subject invention in accordance with the Django Python web framework, an AAA is modeled by the following class definition and table. 
         [0000]    
       
         
               
             
           
               
                   
               
             
             
               
                 # AAA 
               
               
                 class Location(CoreModel): 
               
               
                  name = models.CharField(max_length=125, blank=True, 
               
               
                 null=True) 
               
               
                  status =  
               
               
                 models.PositiveSmallIntegerField(choices=LOCATION_STATUS, 
               
               
                 default=LOCATION_STATUS.temporary) 
               
               
                  latitude = models.FloatField( ) 
               
               
                  longitude = models.FloatField( ) 
               
               
                  radius = models.FloatField(help_text=″(meters)″) 
               
               
                  address = models.CharField(max_length=500,blank=True, 
               
               
                 null=True) 
               
               
                  enabled = models.BooleanField(default=True) 
               
               
                  # required for temporary AAA 
               
               
                  user = models.ForeignKey(User, related_name=″temporary 
               
               
                 locations″, blank=True, null=True) 
               
               
                  temp_start_time = models.DateTimeField(blank=True, 
               
               
                 null=True) 
               
               
                  temp_end_time = models.DateTimeField(blank=True, 
               
               
                 null=True) 
               
               
                   
               
             
          
         
       
     
         [0000]    
       
         
               
             
               
               
               
             
           
               
                 TABLE 
               
             
             
               
                   
               
               
                 “public.users_location” 
               
             
          
           
               
                 Column 
                 Type 
                 Modifiers 
               
               
                   
               
               
                 id 
                 integer 
                 not null default 
               
               
                   
                   
                 nextval 
               
               
                   
                   
                 (‘users_location_id_seq)’::regclass) 
               
               
                 created 
                 timestamp with 
               
               
                   
                 time zone 
               
               
                 name 
                 character 
                 not null 
               
               
                   
                 varying(125) 
               
               
                 latitude 
                 double 
                 not null 
               
               
                   
                 precision 
               
               
                 longitude 
                 double 
                 not null 
               
               
                   
                 precision 
               
               
                 radius 
                 double 
                 not null 
               
               
                   
                 precision 
               
               
                 address 
                 character 
               
               
                   
                 varying(500) 
               
               
                 status 
                 smallint 
                 not null 
               
               
                 user_id 
                 integer 
               
               
                 temp_end_time 
                 timestamp 
               
               
                   
                 with time zone 
               
               
                 temp_start_time 
                 timestamp 
               
               
                   
                 with time zone 
               
               
                 enabled 
                 boolean 
                 not null 
               
               
                   
               
             
          
         
       
     
         [0051]    In an embodiment of the subject invention in accordance with the Django Python web framework, an access attempt is modeled by the following class definition and table. 
         [0000]    
       
         
               
               
             
           
               
                   
               
             
             
               
                   
                 class Access (CoreModel): 
               
               
                   
                  user = models.CharField(max_length=125, blank=True, 
               
               
                   
                 null-True) 
               
               
                   
                  latitude = models.FloatField( ) 
               
               
                   
                  longitude = models.FloatField( ) 
               
               
                   
                  trust_level =  
               
               
                   
                 models.PositiveSmallIntegerField(choices=TRUST_LEVELS) 
               
               
                   
                  allowed = models.BooleanField(default=False) 
               
               
                   
                  authorized_location = models.ForeignKey(Location,  
               
               
                   
                 related_name=″authorized_logins″), blank=True, null=True) 
               
               
                   
                  unauthorized_location =  
               
               
                   
                 models.CharField(max_length=500, blank=True, null=True) 
               
               
                   
               
             
          
         
       
     
         [0000]    
       
         
               
             
               
               
               
             
           
               
                 TABLE 
               
             
             
               
                   
               
               
                 “public.users_access” 
               
             
          
           
               
                 Column 
                 Type 
                 Modifiers 
               
               
                   
               
               
                 id 
                 integer 
                 not null default 
               
               
                   
                   
                 nextval(‘users_access_id_seq)’::regclass) 
               
               
                 created 
                 timestamp with time zone 
               
               
                 latitude 
                 double precision 
                 not null 
               
               
                 longitude 
                 double precision 
                 not null 
               
               
                 trust_level 
                 smallint 
                 not null 
               
               
                 allowed 
                 boolean 
                 not null 
               
               
                 authorized_location_id 
                 integer 
               
               
                 unauthorized 
                 character varying(500) 
               
               
                 location 
               
               
                 user_id 
                 integer 
                 not null 
               
               
                   
               
             
          
         
       
     
         [0052]    In the foregoing specification, the invention has been described with reference to specific exemplary embodiments thereof. It will, however, be evident that various modifications and changes may be made to the specific exemplary embodiments without departing from the broader spirit and scope of the invention. Accordingly, the specification and drawings are to be regarded in an illustrative rather than a restrictive sense.

Technology Category: h