Systems and methods for enforcing access-control policies

A system for enforcing access-control policies, the system comprising:

• a determination module, stored in memory, that determines, by an access-control system executing on a command-and-control device that manages a controlled device that is subject to an access-control policy that describes circumstances under which differing users are permitted to access certain functions of the controlled device, that a user is attempting to access a restricted function of the controlled device;
• a locating module, stored in memory, that searches the physical area surrounding the controlled device for at least one additional device that is in physical proximity to the controlled device and is capable of acquiring context information about the identity of the user at least in part by:
• determining a physical location of the controlled device;
• determining a physical location of the at least one additional device;
• and
• determining that the physical location of the at least one additional device is in physical proximity to the physical location of the controlled device;
• an acquiring module, stored in memory, that acquires context information from the additional device that provides information about the identity of the user;
• an establishing module, stored in memory, that establishes the identity of the user based on the context information acquired from the additional device;
• a recognizing module, stored in memory, that recognizes content that the user is attempting to access via the controlled device based on information that includes a description of the content that the user is attempting to access;
• an enforcing module, stored in memory, that provides the identity of the user to the access-control system, thereby enabling the access-control system to enforce the access-control policy based on the identity of the user and the content that the user is attempting to access via the controlled device;
• and
• at least one physical processor configured to execute the determination module, the locating module, the acquiring module, the establishing module, the recognizing module and the enforcing module.

A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• determine, by an access-control system executing on a command-and-control device that manages a controlled device that is subject to an access-control policy that describes circumstances under which differing users are permitted to access certain functions of the controlled device, that a user is attempting to access a restricted function of the controlled device;
• search the physical area surrounding the controlled device for at least one additional device that is in physical proximity to the controlled device and is capable of acquiring context information about the identity of the user at least in part by:
• determining a physical location of the controlled device;
• determining a physical location of the at least one additional device;
• and
• determining that the physical location of the at least one additional device is in physical proximity to the physical location of the controlled device;
• acquire context information from the additional device that provides information about the identity of the user;
• establish the identity of the user based on the context information acquired from the additional device;
• recognize content that the user is attempting to access via the controlled device based on information that includes a description of the content that the user is attempting to access;
• and
• provide the identity of the user to the access-control system, thereby enabling the access-control system to enforce the access-control policy based on the identity of the user and the content that the user is attempting to access via the controlled device.