System and method for location-based security

• US 10,244,347 B2
• Filed: 06/28/2017
• Issued: 03/26/2019
• Est. Priority Date: 09/18/2014
• Status: Active Grant

• Current Assignee: BOOZ Allen Hamilton Holding Corporation
• Original Assignee: BOOZ Allen Hamilton Holding Corporation
• Inventors: Myers, Gary Jason, Welsh, Matthias, Knight, II, Robert Wayne, Schaefer, Timothy
• Primary Examiner(s): Holloway, III, Edwin C
• Application Number:
  US15/635,720
• Publication Number:
  US 20170303131A1
• Time in Patent Office: 636 Days
• Field of Search: 340 52
• CPC Class Codes: G06F 1/1684 Constructional details or arrangements related to integrated I/O peripherals not covered by groups G06F1/1635 - G06F1/1675
• CPC Class Codes: G06F 1/1698 the I/O peripheral being a sending/receiving arrangement to establish a cordless communication link, e.g. radio or infrared link, integrated cellular phone details of antennas disposed inside a computer H01Q1/2266
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06K 7/10366 the interrogation device being adapted for miscellaneous applications
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/023 using mutual or relative location information between multiple location based services [LBS] targets or of distance thresholds
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

A mobile computing device, including: a first memory device having first computer-readable instructions tangibly recorded thereon; a first hardware processor configured to execute the first computer-readable instructions recorded on the first memory device; and an RFID component that includes a transceiver configured to receive a proximity signal from at least one RFID reader when the RFID component is within a predetermined range of the at least one RFID reader, and a second memory device configured to store the proximity signal, wherein the first hardware processor is configured to, upon executing the instructions recorded on the first memory device, control at least one operation of the mobile computing device in accordance with the proximity signal received by the transceiver of the RFID component from the at least one RFID reader.

Claims

1. A mobile computing device, comprising:

a first memory device having first computer-readable instructions tangibly recorded thereon;

a first hardware processor configured to execute the first computer-readable instructions recorded on the first memory device; and

an RFID component that includes a transceiver and a second memory device, the transceiver of the RFID component being configured to receive a first proximity signal from a first RFID reader when the RFID component is within a predetermined range of the first RFID reader, and to receive a second proximity signal from a second RFID reader when the RFID component is within a predetermined range of the second RFID reader, the second memory device of the RFID component being configured to store the first and second proximity signals,

wherein the first proximity signal includes a first control policy identifying a first set of operations that are performable by the mobile computing device, and the second proximity signal includes a second control policy identifying a second set of operations that are performable by the mobile computing device,

wherein the first hardware processor is configured to, upon executing the instructions recorded on the first memory device, enable the mobile computing device to perform the first set of operations identified in the first control policy when the transceiver of the RFID component receives the first proximity signal while the RFID component is within the predetermined range of the first RFID reader, and to disable the mobile computing device from performing the first set of operations when the transceiver of the RFID component does not receive the first proximity signal while the RFID component is not within the predetermined range of the first RFID reader to receive the first proximity signal, and

wherein the first hardware processor is configured to, upon executing the instructions recorded on the first memory device, enable the mobile computing device to perform the second set of operations identified in the second control policy when the transceiver of the RFID component receives the second proximity signal while the RFID component is within the predetermined range of the second RFID reader, and to disable the mobile computing device from performing the second set of operations when the transceiver of the RFID component does not receive the second proximity signal while the RFID component is not within the predetermined range of the second RFID reader to receive the second proximity signal.

2. The mobile computing device of claim 1, wherein the first hardware processor is configured to, in enabling or disabling access to the first or second set of operations of the mobile computing device, at least one of:

control at least one hardware component of the mobile computing device;

control at least one operating system recorded on the first memory device;

control at least one hypervisor recorded on the first memory device; and

control at least one application program executable on the mobile computing device.

3. The mobile computing device of claim 1, wherein the first hardware processor is configured to, based on the first control policy included in the first proximity received from the first RFID reader, enable access to at least one of a first executable application stored in the first memory device, a first file stored in the first memory device, a first operating system of the mobile computing device, and a first peripheral hardware component with which the mobile computing device is configured to communicate, and

wherein the first hardware processor is configured to, based on the second control policy included in the second proximity signal received from the second RFID reader, enable access to at least one of a second executable application stored in the first memory device, a second file stored in the first memory device, a second operating system of the mobile computing device, and a second peripheral hardware component with which the mobile computing device is configured to communicate.

4. The mobile computing device of claim 1, wherein the first proximity signal includes first location-related data indicating a current physical location of at least one of the RFID component and the first RFID reader, and

wherein the second proximity signal includes second location-related data indicating a current physical location of at least one of the RFID component and the second RFID reader.

5. The mobile computing device of claim 4, wherein the first hardware processor is configured to compare the first location-related data with the first control policy, and determine which of the first set of operations of the mobile computing device are permitted to be performed based on the comparison, and

wherein the first hardware processor is configured to compare the second location-related data with the first control policy, and determine which of the second set of operations of the mobile computing device are permitted to be performed based on the comparison.

6. The mobile computing device of claim 5, wherein the first hardware processor is configured to, based on at least one of (i) the comparison of the first location-related data with the first control policy and (ii) the comparison of the second location-related data with the second control policy, enable or disable access to at least one of:

a hardware component of the mobile computing device;

at least one operating system recorded on the first memory device;

at least one hypervisor recorded on the first memory device; and

at least one application program executable on the mobile computing device.

7. The mobile computing device of claim 1, wherein at least one of the first set of operations and the second set of operations relate to a power state of the mobile computing device,

wherein the first hardware processor is configured to control the power state of the mobile computing device based on the least one of the first set of operations and the second set of operations.

8. The mobile computing device of claim 1, wherein the first set of operations identified in the first control policy are different from the second set of operations identified in the second control policy.

9. A system comprising:

the mobile computing device of claim 1;

a first RFID reader configured to communicate wirelessly with the RFID component of the mobile computing device and transmit the first proximity signal to the RFID component of the mobile computing device when the RFID component is within the predetermined range of the first RFID reader, the first RFID reader being arranged in a first location of a building;

a second RFID reader configured to communicate wirelessly with the RFID component of the mobile computing device and transmit the second proximity signal to the RFID component of the mobile computing device when the RFID component is within the predetermined range of the second RFID reader, the second RFID reader being arranged in a second location distinct from the first location of the building; and

at least one server configured to update the first control policy included in the first proximity signal, and to update the second control policy included in the second proximity signal transmitted by the second RFID reader,

wherein the first set of operations identified in the first control policy are different from the second set of operations identified in the second control policy.

10. The system of claim 9, wherein the first RFID reader is configured to transmit the first proximity signal containing the updated first control policy to the mobile computing device when the mobile computing device is within the predetermined range of the first RFID reader, and

wherein the second RFID reader is configured to transmit the second proximity signal containing the updated second control policy to the mobile computing device when the mobile computing device is within the predetermined range of the second RFID reader.

11. The system of claim 9, wherein the second memory device is configured to store the first proximity signal containing the updated first control policy, and to store the second proximity signal containing the updated second control policy, and

wherein the first hardware processor is configured to, upon executing the instructions recorded on the first memory device, enable or disable access to the first set of operations based on the updated first control policy, and to enable or disable access to the second set of operations based on the updated second control policy.

12. The system of claim 9, wherein the second location is arranged in the building in which the first location is arranged.

13. A mobile computing device, comprising:

a first memory device having first computer-readable instructions tangibly recorded thereon;

a first hardware processor configured to execute the first computer-readable instructions recorded on the first memory device; and

an RFID component that includes a transceiver and a second memory device, the transceiver of the RFID component being configured to receive a first proximity signal from a first RFID reader when the RFID component is within a predetermined range of the first RFID reader, and to receive a second proximity signal from a second RFID reader when the RFID component is within a predetermined range of the second RFID reader, the second memory device of the RFID component being configured to store the first and second proximity signals,

wherein the first proximity signal includes a first control policy identifying a first set of operations that are performable by the mobile computing device, and the second proximity signal includes a second control policy identifying a second set of operations that are performable by the mobile computing device,

wherein the first hardware processor is configured to, upon executing the instructions recorded on the first memory device, disable the mobile computing device from performing the first set of operations identified in the first control policy when the transceiver of the RFID component receives the first proximity signal while the RFID component is within the predetermined range of the first RFID reader, and to enable the mobile computing device to perform the first set of operations when the transceiver of the RFID component does not receive the first proximity signal while the RFID component is not within the predetermined range of the first RFID reader to receive the first proximity signal, and

wherein the first hardware processor is configured to, upon executing the instructions recorded on the first memory device, disable the mobile computing device from performing the second set of operations identified in the second control policy when the transceiver of the RFID component receives the second proximity signal while the RFID component is within the predetermined range of the second RFID reader, and to disable the mobile computing device to perform the second set of operations when the transceiver of the RFID component does not receive the second proximity signal while the RFID component is not within the predetermined range of the second RFID reader to receive the second proximity signal.

14. The mobile computing device of claim 13, wherein the first hardware processor is configured to, in enabling or disabling access to the first or second set of operations of the mobile computing device, at least one of:

control at least one hardware component of the mobile computing device;

control at least one operating system recorded on the first memory device;

control at least one hypervisor recorded on the first memory device; and

control at least one application program executable on the mobile computing device.

15. The mobile computing device of claim 13, wherein the first hardware processor is configured to, based on the first control policy included in the first proximity received from the first RFID reader, disable access to at least one of a first executable application stored in the first memory device, a first file stored in the first memory device, a first operating system of the mobile computing device, and a first peripheral hardware component with which the mobile computing device is configured to communicate, and

wherein the first hardware processor is configured to, based on the second control policy included in the second proximity signal received from the second RFID reader, disable access to at least one of a second executable application stored in the first memory device, a second file stored in the first memory device, a second operating system of the mobile computing device, and a second peripheral hardware component with which the mobile computing device is configured to communicate.

16. The mobile computing device of claim 13, wherein the first proximity signal includes first location-related data indicating a current physical location of at least one of the RFID component and the first RFID reader, and

wherein the second proximity signal includes second location-related data indicating a current physical location of at least one of the RFID component and the second RFID reader.

17. The mobile computing device of claim 16, wherein the first hardware processor is configured to compare the first location-related data with the first control policy, and determine which of the first set of operations of the mobile computing device are to be disabled based on the comparison, and

wherein the first hardware processor is configured to compare the second location-related data with the first control policy, and determine which of the second set of operations of the mobile computing device are to be disabled based on the comparison.

18. The mobile computing device of claim 17, wherein the first hardware processor is configured to, based on the comparison of the first location-related data with the first control policy and the comparison of the second location-related data with the second control policy, enable or disable access to at least one of:

a hardware component of the mobile computing device;

at least one operating system recorded on the first memory device;

at least one hypervisor recorded on the first memory device; and

at least one application program executable on the mobile computing device.

19. The mobile computing device of claim 13, wherein at least one of the first set of operations and the second set of operations relate to a power state of the mobile computing device,

wherein the first hardware processor is configured to control the power state of the mobile computing device based on the least one of the first set of operations and the second set of operations.

20. The mobile computing device of claim 13, wherein the first set of operations identified in the first control policy are different from the second set of operations identified in the second control policy.

21. A system comprising:

the mobile computing device of claim 13;

a first RFID reader configured to communicate wirelessly with the RFID component of the mobile computing device and transmit the first proximity signal to the RFID component of the mobile computing device when the RFID component is within the predetermined range of the first RFID reader, the first RFID reader being arranged in a first location of a building;

a second RFID reader configured to communicate wirelessly with the RFID component of the mobile computing device and transmit the second proximity signal to the RFID component of the mobile computing device when the RFID component is within the predetermined range of the second RFID reader, the second RFID reader being arranged in a second location distinct from the first location of the building; and

at least one server configured to update the first control policy included in the first proximity signal, and to update the second control policy included in the second proximity signal transmitted by the second RFID reader.

22. The system of claim 21, wherein the first RFID reader is configured to transmit the first proximity signal containing the updated first control policy to the mobile computing device when the mobile computing device is within the predetermined range of the first RFID reader, and

wherein the second RFID reader is configured to transmit the second proximity signal containing the updated second control policy to the mobile computing device when the mobile computing device is within the predetermined range of the second RFID reader.

23. The system of claim 22, wherein the second memory device is configured to store the first proximity signal containing the updated first control policy, and to store the second proximity signal containing the updated second control policy, and

wherein the first hardware processor is configured to, upon executing the instructions recorded on the first memory device, enable or disable access to the first set of operations based on the updated first control policy, and to enable or disable access to the second set of operations based on the updated second control policy.

24. The system of claim 21, wherein the second location is arranged in the building in which the first location is arranged.

25. A method for controlling at least one operation of a mobile computing device, which includes a first memory device having first computer-readable instructions tangibly recorded thereon, a first hardware processor configured to execute the first computer-readable instructions recorded on the first memory device, and an RFID component that includes a transceiver and a second memory device, the method comprising:

receiving, by the transceiver of the RFID component, a first proximity signal from a first RFID reader when the RFID component is within a predetermined range of the first RFID reader, the first proximity signal including a first control policy identifying a first set of operations that are performable by the mobile computing device;

receiving, by the transceiver of the RFID component, a second proximity signal from a second RFID reader when the RFID component is within a predetermined range of the second RFID reader, the second proximity signal including a second control policy identifying a second set of operations that are performable by the mobile computing device;

storing, by the second memory device of the transceiver, the first and second proximity signals received by the transceiver;

enabling, by the first hardware processor executing the instructions recorded on the first memory device, the mobile computing device to perform the first set of operations identified in the first control policy when the transceiver of the RFID component receives the first proximity signal while the RFID component is within the predetermined range of the first RFID reader;

disabling, by the first hardware processor executing the instructions recorded on the first memory device, the mobile computing device from performing the first set of operations when the transceiver of the RFID component does not receive the first proximity signal while the RFID component is not within the predetermined range of the first RFID reader to receive the first proximity signal;

enabling, by the first hardware processor executing the instructions recorded on the first memory device, the mobile computing device to perform the second set of operations identified in the second control policy when the transceiver of the RFID component receives the second proximity signal while the RFID component is within the predetermined range of the second RFID reader; and

disabling, by the first hardware processor executing the instructions recorded on the first memory device, the mobile computing device from performing the second set of operations when the transceiver of the RFID component does not receive the second proximity signal while the RFID component is not within the predetermined range of the second RFID reader to receive the second proximity signal.

26. A non-transitory computer-readable storage medium storing instructions which, when executed by a hardware processor of a mobile computing device, cause the hardware processor to perform a method for controlling at least one operation of the mobile computing device, the mobile computing device including a first memory device having first computer-readable instructions tangibly recorded thereon, a first hardware processor configured to execute the first computer-readable instructions recorded on the first memory device, and an RFID component that includes a transceiver and a second memory device, the method comprising:

receiving, by the transceiver of the RFID component, a first proximity signal from a first RFID reader when the RFID component is within a predetermined range of the first RFID reader, the first proximity signal including a first control policy identifying a first set of operations that are performable by the mobile computing device;

receiving, by the transceiver of the RFID component, a second proximity signal from a second RFID reader when the RFID component is within a predetermined range of the second RFID reader, the second proximity signal including a second control policy identifying a second set of operations that are performable by the mobile computing device;

storing, by the second memory device of the transceiver, the first and second proximity signals received by the transceiver;

enabling, by the first hardware processor executing the instructions recorded on the first memory device, the mobile computing device to perform the first set of operations identified in the first control policy when the transceiver of the RFID component receives the first proximity signal while the RFID component is within the predetermined range of the first RFID reader;

disabling, by the first hardware processor executing the instructions recorded on the first memory device, the mobile computing device from performing the first set of operations when the transceiver of the RFID component does not receive the first proximity signal while the RFID component is not within the predetermined range of the first RFID reader to receive the first proximity signal;

enabling, by the first hardware processor executing the instructions recorded on the first memory device, the mobile computing device to perform the second set of operations identified in the second control policy when the transceiver of the RFID component receives the second proximity signal while the RFID component is within the predetermined range of the second RFID reader; and

disabling, by the first hardware processor executing the instructions recorded on the first memory device, the mobile computing device from performing the second set of operations when the transceiver of the RFID component does not receive the second proximity signal while the RFID component is not within the predetermined range of the second RFID reader to receive the second proximity signal.