# US 11,122,438 B2 · Map-based techniques for visualizing user access data and for configuring and enforcing location-based access policies > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,122,438 B2 - Document ID: US11122438B2 - Status: Granted - Kind: B2 - Application number: 16/402,541 - Filed: 2019-05-03 - Published: 2020-11-05 - Granted: 2021-09-14 - Earliest claimed: 2019-05-03 - Assignees: EMC IP Holding Company LLC - Applicants: EMC IP Holding Company LLC - Inventors: Naveen Sunkavally; Leandro E. Diato; Alex Zaslavsky; Victor Malchikov - Web page: https://patentgrep.com/patent/US11122438B2 ## CPC - G06F 16/29: Geographical information databases - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 21/30: Authentication, i.e. establishing the identity or authorisation of security principals - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04W 12/06: Authentication - H04W 12/64: using geofenced areas - H04W 12/67: Risk-dependent, e.g. selecting a security level depending on risk profiles - G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Techniques are provided for visualizing user access data and for configuring and enforcing location-based access policies. One method comprises obtaining a plurality of risk-based policies specified by administrators using a map-based interface for multiple geographic regions, wherein the map-based interface comprises one or more zoom levels within each geographic region of the geographic regions, and wherein each geographic region has an associated aggregated risk score indicating a level of risk for user access events that occurred within the respective geographic region; and performing the following steps, in response to a user access event: determining a geolocation of the user access event; identifying a particular geographic region associated with the determined geolocation; identifying one or more of the plurality of risk-based policies associated with the particular geographic region; and processing the user access event based on the identified risk-based policies associated with the particular geographic region. ## Claims ### Claim 1 A method, comprising: obtaining a plurality of risk-based policies specified by one or more administrators using a map-based interface for a plurality of geographic regions, wherein the map-based interface comprises one or more zoom levels within each geographic region of the plurality of geographic regions and an indication of an associated aggregated risk score for each of the plurality of geographic regions indicating a level of risk for a plurality of user access events that occurred within the respective geographic region, wherein each of the plurality of user access events comprises a given user attempting to gain access to one or more computer-related resources and is associated with a geohash-encoded string corresponding to the respective geographic region; and in response to a further user access event: determining a geolocation of the further user access event; converting the geolocation of the user access event to a geohash-encoded string; identifying a particular geographic region associated with the determined geolocation by matching the geohash-encoded string of the further user access event to geohash-encoded strings of the plurality of geographic regions; identifying one or more of the plurality of risk-based policies associated with the particular geographic region; and processing the user access event based on the identified one or more risk-based policies associated with the particular geographic region, wherein the method is performed by at least one processing device comprising a processor coupled to a memory. ### Claim 2 (depends on 1) The method of claim 1, wherein the identified one or more risk-based policies associated with the particular geographic region specify one or more of: allow the further user access event, deny the further user access event and require an additional step-up authentication. ### Claim 3 (depends on 2) The method of claim 2, wherein the one or more administrators employ the map-based interface to one or more of define the one or more risk-based policies, define one or more alarms for a violation of the one or more risk-based policies and define one or more remediation actions for the violation of the one or more risk-based policies. ### Claim 4 (depends on 1) The method of claim 1, wherein said matching comprises using a prefix-matching technique. ### Claim 5 (depends on 1) The method of claim 1, wherein the map-based interface further comprises a visualization tool to visualize user access data for a plurality of the user access events and the corresponding risk score for each user access event. ### Claim 6 (depends on 1) The method of claim 1, wherein at least one of the geographic regions corresponds to a point of interest of an enterprise organization, and wherein the map-based interface further comprises a tool for configuring the point of interest of the enterprise organization. ### Claim 7 (depends on 6) The method of claim 6, wherein the map-based interface further comprises a tool for specifying the point of interest of the enterprise organization with an arbitrary shape. ### Claim 8 (depends on 1) The method of claim 1, wherein the map-based interface further comprises a tool for filtering access data of the plurality of user access events that are included in the computation of the aggregated risk score for one or more of the geographic regions. ### Claim 9 (depends on 1) The method of claim 1, wherein the one or more computer-related resources comprises an application, and wherein each of the plurality of user access events is further associated with at least one of: a device identifier of the user, a sub-network identifier, and an identifier of the application. ### Claim 10 A computer program product, comprising a non-transitory machine-readable storage medium having encoded therein executable code of one or more software programs, wherein the one or more software programs when executed by at least one processing device perform the following steps: obtaining a plurality of risk-based policies specified by one or more administrators using a map-based interface for a plurality of geographic regions, wherein the map-based interface comprises one or more zoom levels within each geographic region of the plurality of geographic regions and an indication of an associated aggregated risk score for each of the plurality of geographic regions indicating a level of risk for a plurality of user access events that occurred within the respective geographic region, wherein each of the plurality of user access events comprises a given user attempting to gain access to one or more computer-related resources and is associated with a geohash-encoded string corresponding to the respective geographic region; and in response to a further user access event: determining a geolocation of the further user access event; converting the geolocation of the user access event to a geohash-encoded string; identifying a particular geographic region associated with the determined geolocation by matching the geohash-encoded string of the further user access event to geohash-encoded strings of the plurality of geographic regions; identifying one or more of the plurality of risk-based policies associated with the particular geographic region; and processing the user access event based on the identified one or more risk-based policies associated with the particular geographic region. ### Claim 11 (depends on 10) The computer program product of claim 10, wherein the one or more administrators employ the map-based interface to one or more of define the one or more risk-based policies, define one or more alarms for a violation of the one or more risk-based policies and define one or more remediation actions for the violation of the one or more risk-based policies. ### Claim 12 (depends on 10) The computer program product of claim 10, wherein said matching comprises using a prefix-matching technique. ### Claim 13 (depends on 10) The computer program product of claim 10, wherein the map-based interface further comprises at least one of: a visualization tool to visualize user access data for a plurality of the user access events and the corresponding risk score for each user access event; and a tool for filtering access data of the plurality of user access events that are included in the computation of the aggregated risk score for one or more of the geographic regions. ### Claim 14 (depends on 10) The computer program product of claim 10, wherein at least one of the geographic regions corresponds to a point of interest of an enterprise organization, and wherein the map-based interface further comprises a tool for configuring the point of interest of the enterprise organization. ### Claim 15 An apparatus, comprising: a memory; and at least one processing device, coupled to the memory, operative to implement the following steps: obtaining a plurality of risk-based policies specified by one or more administrators using a map-based interface for a plurality of geographic regions, wherein the map-based interface comprises one or more zoom levels within each geographic region of the plurality of geographic regions and an indication of an associated aggregated risk score for each of the plurality of geographic regions indicating a level of risk for a plurality of user access events that occurred within the respective geographic region, wherein each of the plurality of user access events comprises a given user attempting to gain access to one or more computer-related resources is associated with a geohash-encoded string corresponding to the respective geographic region; and in response to a further user access event: determining a geolocation of the further user access event; converting the geolocation of the user access event to a geohash-encoded string; identifying a particular geographic region associated with the determined geolocation by matching the geohash-encoded string of the further user access event to geohash-encoded strings of the plurality of geographic regions; identifying one or more of the plurality of risk-based policies associated with the particular geographic region; and processing the user access event based on the identified one or more risk-based policies associated with the particular geographic region. ### Claim 16 (depends on 15) The apparatus of claim 15, wherein the one or more administrators employ the map-based interface to one or more of define the one or more risk-based policies, define one or more alarms for a violation of the one or more risk-based policies and define one or more remediation actions for the violation of the one or more risk-based policies. ### Claim 17 (depends on 15) The apparatus of claim 15, wherein said matching comprises using a prefix-matching technique. ### Claim 18 (depends on 15) The apparatus of claim 15, wherein the map-based interface further comprises a visualization tool to visualize user access data for a plurality of the user access events and the corresponding risk score for each user access event. ### Claim 19 (depends on 15) The apparatus of claim 15, wherein at least one of the geographic regions corresponds to a point of interest of an enterprise organization, and wherein the map-based interface further comprises a tool for configuring the point of interest of the enterprise organization. ### Claim 20 (depends on 15) The apparatus of claim 15, wherein the map-based interface further comprises a tool for filtering access data of the plurality user access events that are included in the computation of the aggregated risk score for one or more of the geographic regions.