CROSS-REFERENCE TO RELATED APPLICATION

This application claims priority to Chinese Patent Application No. PCT/CN2019/080474, on file at the China National Intellectual Property Administration (CNIPA), having a filing date of Mar. 29, 2019, and having “Controlling Access to a Protected Resource using a Heat Map” as a title, the contents and teachings of which are herein incorporated by reference in their entirety.

BACKGROUND

A conventional approach to performing authentication involves comparing a current set of authentication factors from a user device, which is operated by a user, to an expected set of authentication factors. If the current set of authentication factors matches the expected set of authentication factors, authentication is considered successful. However, if the current set of authentication factors does not match the expected set of authentication factors, authentication is considered unsuccessful.

Such authentication may be used to control access to a computerized resource. Along these lines, if authentication is considered successful, the user device is provided access to the computerized resource. However, if authentication is considered unsuccessful, the user device is denied access to the computerized resource.

SUMMARY

It should be understood that the above-described conventional authentication approach is extremely inflexible. For example, it may be convenient to require a relatively weak form of authentication when an employee of a company logs on to a work laptop while at the company's office. However, a stronger form of authentication may be required for authentication on the same work laptop when the laptop currently resides in a less-trusted environment such as at a café or at a hotel in a different city. Unfortunately, the above-described conventional authentication approach is limited in that it does not impose different types of authentication based on the location of the work laptop.

One way to address this lack of flexibility is for the company to install geofencing technology at the company's office facility. Along these lines, the company may add specialized equipment (e.g., wireless transceivers such as IEEE 802.11 or 802.15 transceivers, etc.) to establish a fixed geofenced zone over the company's office facility. When the employee then uses the laptop within the geofenced zone, the employee is required to login using a standard form of authentication (e.g., a password) since the employee is currently within the company's office facility. However, when the employee uses the laptop outside of the geofenced zone, the employee is required to login using a stronger form of authentication (e.g., a password and a one-time pass code (OTP)) since the employee is currently in a less trusted area.

Improved techniques are directed to controlling access to a protected resource using a heat map that defines different zones of trustworthiness within a geographic region. For example, an endpoint device may require (i) relatively weak authentication when the endpoint device is within a well-trusted zone defined by the heat map, (ii) stronger authentication when the endpoint device is within a less-trusted zone defined by the heat map, and so on. Moreover, the zones defined by the heat map may change over time (e.g., boundaries between zones may move, zones may grow/shrink, etc.) based on a variety of factors such as the presence/absence of other trustworthy devices within the vicinity, the time of day, recent events, etc. With such improved techniques, the heat map enables virtual geofencing for access control to be established over any geographic region.

For example, suppose that an employee of a company brings an endpoint device such as a laptop computer to an out of state conference to enable the employee to access a protected resource such as a confidential file, email, a virtual desktop, etc. A datacenter may remotely monitor the current location of the endpoint device (e.g., via a location signal sent from the laptop computer) and see that the employee is alone at an unfamiliar location. Accordingly, the datacenter may generate a heat map that defines a zone of low trustworthiness for the unfamiliar location and, since the endpoint device is within the zone of low trustworthiness, require strong authentication from the endpoint device such as a valid password and a valid OTP from a hardware token in the employee's possession. In such a situation, it is considered acceptable to burden the employee with having to possess and operate the hardware token to obtain the OTP for successful authentication. Such features protect against undesirable situations such as someone stealing the endpoint device and attempting to access the protected resource from a remote location.

Alternatively, suppose that an entire team of employees travels to the out of state conference and that each employee brings a respective endpoint device. In this situation, it may be considered too burdensome or too inconvenient to require every employee to bring a hardware token and enter both a password and an OTP to successfully authenticate. Rather, the datacenter may monitor the current locations of all of the endpoint devices and see that the employees are together within the same conference hall. Accordingly, the datacenter may generate a heat map that defines a zone of relatively strong trustworthiness that covers the conference hall even if that location is new and unfamiliar. As a result, the datacenter may simply require routine authentication from each endpoint device such as just a valid password (i.e., it is clear that the entire team of employees are together) rather than require every employee at the conference to carry and operate a hardware token for authentication. That is, the datacenter may consider requiring each employee to carry and use a respective hardware token to be excessive in guarding against the extreme unlikely situation of someone stealing all of the endpoint devices and attempting to access all of the protected resources from the same location.

One embodiment is directed to a method of controlling access to a set of protected resources. The method includes receiving a location signal which identifies a current geolocation of an endpoint device. The method further includes, based on the current geolocation identified by the location signal, generating a heat map corresponding to a geographic region that includes the current geolocation of the endpoint device, the heat map defining one or more security zones within the geographic region. The method further includes, selecting a particular security level from multiple security levels based on a security zone of the heat map associated with the current geolocation of the endpoint device, and communicating the selected security level to the endpoint device. The selected security level is associated with security requirements to be satisfied by the endpoint device in order for the endpoint device to access the set of protected resources.

In some arrangements, each security level identifies a respective authentication process among multiple selectable authentication processes. The particular security level identifies a particular authentication process of the multiple selectable authentication processes. Additionally, the method further includes, after communicating the selected security level to the endpoint device, performing an authentication operation in accordance with the particular authentication process, the endpoint device being granted access to the set of protected resources when a result of the authentication operation is successful, and the endpoint device being denied access to the set of protected resources when the result of the authentication operation is unsuccessful.

In some arrangements, the method further includes receiving current endpoint data provided from multiple endpoint devices. The heat map is generated based on the current endpoint data provided from the multiple endpoint devices.

Another embodiment is directed to a method of controlling access to a set of protected resources (i.e., one or more resources). The method includes receiving a location signal which identifies a current geolocation of a client device (or endpoint device). The method further includes, based on the current geolocation identified by the location signal, performing a heat map identification operation that identifies a heat map covering a geographic region that includes the current geolocation of the client device. The heat map defines multiple security zones within the geographic region. The method further includes performing a security level selection operation that selects a particular security level from multiple security levels based on which security zone of the multiple security zones defined by the heat map covers the current geolocation of the client device. The particular security level imposes a set of security requirements that must be satisfied by the client device in order for the client device to access the set of protected resources.

In some arrangements, each security level identifies a respective authentication process among multiple selectable authentication processes, the particular security level identifying a particular authentication process of the multiple selectable authentication processes. Additionally, the method further includes, after the security level selection operation is performed, performing an authentication operation in accordance with the particular authentication process. The client device is granted access to the set of protected resources when a result of the authentication operation is successful, and the client device is denied access to the set of protected resources when the result of the authentication operation is unsuccessful.

In some arrangements, performing the heat map identification operation that identifies the heat map includes receiving current endpoint data provided from multiple endpoint devices, and constructing the heat map based on the current endpoint data provided from the multiple endpoint devices. Here, the presence of endpoint devices operated by other users in close vicinity to the client device increases the level of trustworthiness at the location of the client device.

In some arrangements, the current endpoint data provided from the multiple endpoint devices identifies, for each endpoint device of the multiple endpoint devices, (i) a set of location parameters identifying a current geolocation of that endpoint device and (ii) a current heat score for that endpoint device. Additionally, the geographic region covered by the heat map includes different areas. Furthermore, constructing the heat map based on the current endpoint data provided from the multiple endpoint devices includes performing a heat map generation operation which includes, for each area of the different areas of the geographic region, identifying which endpoint devices provided current endpoint data having a set of location parameters identifying a current geolocation covered by that area and generating an aggregate heat score from the current heat scores for those endpoint devices.

In some arrangements, the different areas of the heat map form an area array. Additionally, a result of the heat map generation operation includes an array of aggregate heat scores which corresponds to the area array. Furthermore, constructing the heat map based on the current endpoint data provided from the multiple endpoint devices further includes applying a set of thresholds to each aggregate heat score of the array of aggregate heat scores to form the multiple security zones defined by the heat map.

In some arrangements, the multiple endpoint devices belong to an enterprise network infrastructure. Additionally, constructing the heat map based on the current endpoint data provided from the multiple endpoint devices further includes, prior to applying the set of thresholds to each aggregate heat score of the array of aggregate heat scores, dynamically generating the set of thresholds based on a current time of day and a current security status of the enterprise network infrastructure.

In some arrangements, the current endpoint data provided from the multiple endpoint devices includes, for each endpoint device of the multiple endpoint devices, (i) a security score that identifies a current measure of trustworthiness contributed by that endpoint device and (ii) a mobility score that identifies a current measure of mobility for that endpoint device. Additionally, the method further includes: providing, for each endpoint device of the multiple endpoint devices, a respective heat value for that endpoint device based on (i) the security score that identifies the current measure of trustworthiness contributed by that endpoint device and (ii) the mobility score that identifies the current measure of mobility for that endpoint device, the respective heat value serving as the current heat score for that endpoint device.

In some arrangements, the method further includes: providing, for each endpoint device of the multiple endpoint devices, a respective security value for that endpoint device based on (i) a set of applications currently installed on that endpoint device, (ii) a set of wireless networks currently sensed by that endpoint device, and (iii) a current location of the endpoint device. The respective security value may serve as the security score that identifies the current measure of trustworthiness contributed by that endpoint device.

In certain arrangements, one or more of the endpoint devices may be an enrolled or managed device (e.g., a device that is configured/provisioned by an enterprise or organization in an ongoing manner). Here, for such a device, the set of applications may impose or set particular policies, indicate particular status, perform particular processes or provide particular services, and so on to influence the security value for that device.

In some arrangements, the method further includes: providing, for each endpoint device of the multiple endpoint devices, a respective mobility value for that endpoint device based on (i) a device type for that endpoint device, (ii) a daily travel measurement for that endpoint device, and (iii) a comparison between historical tracking data for that endpoint device and current tracking data for that endpoint device. The respective mobility value may serve as the mobility score that identifies the current measure of mobility for that endpoint device.

Other criteria/parameters/features may influence the mobility value of the endpoint devices as well. For example, for devices operated by different users, various mobility data may be historically tracked and compared to current mobility data for those devices. In particular, first mobility data may be tracked and compared for a first device operated by a first user. Likewise, second mobility data may be tracked and compared for a second device operated by a second user, and so on. Accordingly, the mobility value for the first device operated by the first user may be different from the mobility value for the second device operated by the second user, etc. due to differences in each user's mobility data history, even if the devices are identical in terms of hardware version, software version, firmware, updates, etc.

In some arrangements, constructing the heat map based on the current endpoint data provided from the multiple endpoint devices further includes: after the heat map generation operation is performed, adjusting zonal boundaries separating the multiple security zones within the geographic region based on updated endpoint data provided from multiple endpoint devices. Accordingly, the heat map is dynamic, e.g., boundaries may move, zones may grow/shrink, etc.

In some arrangements, performing the authentication operation in accordance with the particular authentication process includes:(i) generating an authentication result based on a set of authentication factors, the authentication result indicating whether the client device is currently security compliant, and(ii) performing an access control operation based on the authentication result, the access control operation providing the client device with access to the set of protected resources when the authentication result indicates that the client device is currently security compliant and denying the client device access to the set of protected resources when the authentication result indicates that the client device is currently not security compliant.

In some arrangements, the authentication result indicates that the client device is currently security compliant. Additionally, performing the authentication operation further includes providing the client device with wireless access to virtual desktop hosted from a remote virtual desktop server.

In some arrangements, the authentication result indicates that the client device is currently security compliant. Additionally, performing the authentication operation further includes providing the client device with wireless access to an enterprise network environment or a network resource.

Another embodiment is directed to a computer program product having a non-transitory computer readable medium that stores a set of instructions to control access to a set of protected resources. The set of instructions, when carried out by computerized circuitry, causing the computerized circuitry to perform a method of:(A) receiving a location signal which identifies a current geolocation of an endpoint device;(B) based on the current geolocation identified by the location signal, generating a heat map corresponding to a geographic region that includes the current geolocation of the endpoint device, the heat map defining one or more security zones within the geographic region;(C) selecting a particular security level from multiple security levels based on a security zone of the heat map associated with the current geolocation of the endpoint device; and(D) communicating the selected security level to the endpoint device, wherein the selected security level is associated with security requirements to be satisfied by the endpoint device in order for the endpoint device to access the set of protected resources.

Yet another embodiment is directed to an electronic apparatus which includes a communications interface, memory, and control circuitry coupled to the communications interface and the memory. The memory stores instructions that, when carried out by the control circuitry, cause the control circuitry to:(A) receive a location signal which identifies a current geolocation of an endpoint device;(B) based on the current geolocation identified by the location signal, generate a heat map corresponding to a geographic region that includes the current geolocation of the endpoint device, the heat map defining one or more security zones within the geographic region;(C) select a particular security level from multiple security levels based on a security zone of the heat map associated with the current geolocation of the endpoint device; and(D) communicate the selected security level to the endpoint device, wherein the selected security level is associated with security requirements to be satisfied by the endpoint device in order for the endpoint device to access the set of protected resources.

It should be understood that, in the cloud context, some electronic circuitry is formed by remote computer resources distributed over a network. Such a computerized environment is capable of providing certain advantages such as distribution of hosted services and resources (e.g., software as a service, platform as a service, infrastructure as a service, etc.), enhanced scalability, etc.

Other embodiments are directed to electronic systems and apparatus, processing circuits, computer program products, and so on. Some embodiments are directed to various methods, electronic components and circuitry that are involved in controlling access to a protected resource using a heat map.

