# US 10,375,114 B1 · Systems and methods for enforcing access-control policies > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,114 B1 - Document ID: US10375114B1 - Status: Granted - Kind: B1 - Application number: 15/194,403 - Filed: 2016-06-27 - Granted: 2019-08-06 - Earliest claimed: 2016-06-27 - Assignees: Symantec Corporation - Applicants: Symantec Corporation - Inventors: Lei Gu; Ilya Sokolov; Bruce McCorkendale - Web page: https://patentgrep.com/patent/US10375114B1 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/102: {Entity profiles} - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The disclosed computer-implemented method for enforcing access-control policies may include (i) determining that a user is attempting to access a controlled device that is subject to an access-control policy, (ii) locating at least one additional device that is in physical proximity to the controlled device, (iii) acquiring context information from the additional device that provides information about the identity of the user, (iv) establishing the identity of the user based on the context information acquired from the additional device, and (v) enforcing the access-control policy based on the identity of the user. Various other methods, systems, and computer-readable media are also disclosed. ## Claims ### Claim 1 A computer-implemented method for enforcing access-control policies, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: determining, by an access control system executing on a command-and-control device that manages a controlled device that is subject to an access-control policy that describes circumstances under which differing users are permitted to access certain functions of the controlled device, that a user is attempting to access a restricted function of the controlled device; searching the physical area surrounding the controlled device for at least one additional device that is in physical proximity to the controlled device and is capable of acquiring context information about the identity of the user at least in part by: determining a physical location of the controlled device; determining a physical location of the at least one additional device; and determining that the physical location of the at least one additional device is in physical proximity to the physical location of the controlled device; acquiring context information from the additional device that provides information about the identity of the user; establishing the identity of the user based on the context information acquired from the additional device; recognizing content that the user is attempting to access via the controlled device based on information that includes a description of the content that the user is attempting to access; and providing the identity of the user to the access-control system, thereby enabling the access-control system to enforce the access-control policy based on the identity of the user and the content that the user is attempting to access via the controlled device. ### Claim 2 (depends on 1) The method of claim 1, wherein acquiring the context information comprises acquiring at least one of: a photograph of the user; a video of the user; a recording of the user's voice; a series of keystrokes entered by the user on the controlled device; and a Wi-Fi signal interference pattern of the user. ### Claim 3 (depends on 1) The method of claim 1, wherein the additional device comprises a self-propelled device that is capable of relocating itself in physical space. ### Claim 4 (depends on 1) The method of claim 1, wherein recognizing the content comprises observing a display of the controlled device via the additional device. ### Claim 5 (depends on 1) The method of claim 1, wherein the command-and-control device: monitors a plurality of controlled devices that comprises the controlled device; and enforces access-control policies for the plurality of controlled devices. ### Claim 6 (depends on 1) The method of claim 1, wherein establishing the identity of the user comprises matching the context information to a previously established user profile. ### Claim 7 (depends on 6) The method of claim 6, wherein enforcing the access-control policy comprises enforcing an access-control policy that is associated with the previously established user profile. ### Claim 8 (depends on 1) The method of claim 1, wherein establishing the identity of the user comprises determining an approximate age of the user. ### Claim 9 (depends on 1) The method of claim 1, wherein enforcing the access-control policy comprises performing a security action that comprises at least one of: notifying a supervisor of the controlled device that the user attempted to access the controlled device; generating a log entry that describes the user's attempt to access the controlled device; restricting at least one function of the controlled device; and disabling the controlled device. ### Claim 10 A system for enforcing access-control policies, the system comprising: a determination module, stored in memory, that determines, by an access-control system executing on a command-and-control device that manages a controlled device that is subject to an access-control policy that describes circumstances under which differing users are permitted to access certain functions of the controlled device, that a user is attempting to access a restricted function of the controlled device; a locating module, stored in memory, that searches the physical area surrounding the controlled device for at least one additional device that is in physical proximity to the controlled device and is capable of acquiring context information about the identity of the user at least in part by: determining a physical location of the controlled device; determining a physical location of the at least one additional device; and determining that the physical location of the at least one additional device is in physical proximity to the physical location of the controlled device; an acquiring module, stored in memory, that acquires context information from the additional device that provides information about the identity of the user; an establishing module, stored in memory, that establishes the identity of the user based on the context information acquired from the additional device; a recognizing module, stored in memory, that recognizes content that the user is attempting to access via the controlled device based on information that includes a description of the content that the user is attempting to access; an enforcing module, stored in memory, that provides the identity of the user to the access-control system, thereby enabling the access-control system to enforce the access-control policy based on the identity of the user and the content that the user is attempting to access via the controlled device; and at least one physical processor configured to execute the determination module, the locating module, the acquiring module, the establishing module, the recognizing module and the enforcing module. ### Claim 11 (depends on 10) The system of claim 10, wherein the acquiring module acquires the context information by acquiring at least one of: a photograph of the user; a video of the user; a recording of the user's voice; a series of keystrokes entered by the user on the controlled device; and a Wi-Fi signal interference pattern of the user. ### Claim 12 (depends on 10) The system of claim 10, wherein the additional device comprises a self-propelled device that is capable of relocating itself in physical space. ### Claim 13 (depends on 10) The system of claim 10, wherein the recognizing module recognizes the content by observing a display of the controlled device via the additional device. ### Claim 14 (depends on 10) The system of claim 10, wherein the command-and-control device: monitors a plurality of controlled devices that comprises the controlled device; and enforces access-control policies for the plurality of controlled devices. ### Claim 15 (depends on 10) The system of claim 10, wherein the establishing module establishes the identity of the user by matching the context information to a previously established user profile. ### Claim 16 (depends on 15) The system of claim 15, wherein the enforcing module enforces the access-control policy by enforcing an access-control policy that is associated with the previously established user profile. ### Claim 17 (depends on 10) The system of claim 10, wherein the establishing module establishes the identity of the user by determining an approximate age of the user. ### Claim 18 A non-transitory computer-readable medium comprising one or more computer-readable instructions that, when executed by at least one processor of a computing device, cause the computing device to: determine, by an access-control system executing on a command-and-control device that manages a controlled device that is subject to an access-control policy that describes circumstances under which differing users are permitted to access certain functions of the controlled device, that a user is attempting to access a restricted function of the controlled device; search the physical area surrounding the controlled device for at least one additional device that is in physical proximity to the controlled device and is capable of acquiring context information about the identity of the user at least in part by: determining a physical location of the controlled device; determining a physical location of the at least one additional device; and determining that the physical location of the at least one additional device is in physical proximity to the physical location of the controlled device; acquire context information from the additional device that provides information about the identity of the user; establish the identity of the user based on the context information acquired from the additional device; recognize content that the user is attempting to access via the controlled device based on information that includes a description of the content that the user is attempting to access; and provide the identity of the user to the access-control system, thereby enabling the access-control system to enforce the access-control policy based on the identity of the user and the content that the user is attempting to access via the controlled device.