Systems, devices, software, and methods for location based device and application management

• US 10,270,784 B1
• Filed: 03/20/2018
• Issued: 04/23/2019
• Est. Priority Date: 03/20/2017
• Status: Active Grant

• Current Assignee: Cruzeiro Associates, Inc. (Acclaim Technical Services, Inc.)
• Original Assignee: Cruzeiro Associates, Inc. (Acclaim Technical Services, Inc.)
• Inventors: Narges, Eric, Bishop, Edward
• Primary Examiner(s): Afshar, Kamran
• Assistant Examiner(s): Seyedvosoghi, Farid
• Application Number:
  US15/926,020
• Time in Patent Office: 399 Days
• Field of Search: 455411
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 12/64 using geofenced areas
• CPC Class Codes: H04W 4/021 Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring
• CPC Class Codes: H04W 48/04 based on user or terminal location or mobility data, e.g. moving direction, speed
• CPC Class Codes: H04W 48/16 Discovering, processing access restriction or access information

Abstract

Systems, devices, software, and methods of the present invention enable users and owners/operators, such as employers, vendors, and other administrators to restrict the accessibility and use of applications residing on mobile and portable user devices, when those user devices are near or within a controlled area, such as non-residential and residential properties, and/or access a controlled network, either locally or remotely. The device management system may impose restrictions on one or more user devices that may include, for example, one or more of disabling applications, preventing applications from being enabled, deleting applications, limiting or preventing applications from being downloaded, and/or performing application inventories on the user device. When the user device is no longer in, on, and/or around their facilities and/or networks, the device management system may remove or impose the restrictions on the user device.

Claims

1. A system comprising:

an administrator device including at least one processor running a device management system administrator application to;

communicate with a user device;

detect when the user device attempts to access a controlled area or controlled network by receiving a connection request or message from the user device including a MAC address or other device identifier; and

determining location information associated with the user device indicating the user device is in or near the controlled area or on the controlled network;

perform an inventory of applications on the user device;

identify restrictions for each application when the user device is in the controlled area or on the controlled network,

the restrictions associated with

a white list for applications with unrestricted use, and at least one of

a black list for applications that are not allowed to be used,

a gray list for applications that have some restrictions on use, and

a banned list for applications that are deleted upon detection;

assign each application to a list based on the identified restrictions;

impose the identified restrictions for each application on the user device when the user device accesses the controlled area or network; and

remove the identified restrictions on the applications on the user device when the user device is no longer accessing the controlled area or network.

2. The system of claim 1, where:

the user device includes memory and at least one processor coupled to the memory, to;

detect when the user device is accessing the controlled area or network,

impose restrictions on the one or more applications on the user device received from the device management system administrator application, when the user device accesses the controlled area or network, and

remove the restrictions on the more one or more applications on the user device, when the user device is no longer accessing the controlled area or network.

3. The system of claim 1, where the restrictions include one or more of:

disabling applications on the user device;

preventing applications on the user device from being enabled;

enabling applications on the user device;

enabling features in applications on the user device;

deleting applications on the user device; and

,

limiting or preventing applications from being downloaded on the user device.

4. The system of claim 1, where user device is detected via a geofence in communication with the device management system administrator application.

5. The system of claim 1, where, when imposing restrictions, the at least one processor to:

compare the application inventory to an application restriction database;

identify applications not in the application restriction database;

assign default restrictions to applications not in the application restriction database; and

apply default restrictions and restrictions in the application restriction database to the applications on the user device.

6. A method comprising:

communicating, via an administrator device including at least one process executing a device management system administrator application, with a user device;

detecting, by device management system administrator application, when the user device attempts to access a controlled area or network;

detecting the user device includes one or more of;

receiving a connection request or message from the user device including a MAC address or other device identifier;

receiving, by the user device, a controlled network or area identifier; and

,

determining location information associated with the user device indicating the user device is in or near the controlled area or on the controlled network;

performing, by device management system administrator application, an inventory of applications on the user device;

identifying, by device management system administrator application, restrictions for each application when the user device is in the controlled area or on the controlled network;

the restrictions associated with

a white list for applications with unrestricted use, and at least one of

a black list for applications that are not allowed to be used,

a gray list for applications that have some restrictions on use, and

a banned list for applications that are deleted upon detection;

assigning, by device management system administrator application, each application to a list based on the identified restrictions;

imposing, by device management system administrator application, the identified restrictions for each application on the user device when the user device accesses the controlled area or network; and

removing, by device management system administrator application, the identified restrictions on the applications on the user device when the user device is no longer accessing the controlled area or network.

7. The method of claim 6, where the restrictions include one or more of:

disabling applications on the user device;

preventing applications on the user device from being enabled;

enabling applications on the user device;

enabling features in applications on the user device;

deleting applications on the user device; and

,

limiting or preventing applications from being downloaded on the user device.

8. The method of claim 6, where removing restrictions does not include re-installation of applications that have been deleted.

9. The method of claim 6, where detecting the user device includes one or more of:

receiving a connection request or message from the user device including a MAC address or other device identifier;

receiving, by the user device, a controlled network or area identifier; and

,

determining location information associated with the user device indicating the user device is in or near the controlled area or on the controlled network.

10. The method of claim 6, where imposing restrictions includes one or more of:

performing an application inventory of the user device;

comparing the application inventory to an application restriction database;

identifying applications not in the application restriction database;

assigning default restrictions to applications not in the application restriction database; and

applying default restrictions and restrictions in the application restriction database to the applications on the user device.

11. The method of claim 6, where imposing and removing

restrictions on the application is performed by the user device.

12. A non-transitory computer readable medium storing instructions, the instructions comprising:

one or more instructions which, when executed by at least one processor, cause the at least one processor to;

communicate with a user device;

detect when the user device attempts to access a controlled area or controlled network by

receiving a connection request or message from the user device including a MAC address or other device identifier;

determining location information associated with the user device indicating the user device is in or near the controlled area or on the controlled network;

perform an inventory of applications on the user device;

identify restrictions for each application when the user device is in the controlled area or on the controlled network;

the restrictions associated with

a white list for applications with unrestricted use, and at least one of

a black list for applications that are not allowed to be used,

a gray list for applications that have some restrictions on use, and

a banned list for applications that are deleted upon detection;

assign each application to a list based on the identified restrictions;

impose the identified restrictions for each application on the user device when the user device accesses the controlled area or network; and

remove the identified restrictions on the applications on the user device when the user device is no longer accessing the controlled area or network.

13. The non-transitory computer readable medium of claim 12, where the restrictions include one or more of:

disabling applications on the user device;

preventing applications on the user device from being enabled;

enabling applications on the user device;

enabling features in applications on the user device;

deleting applications on the user device; and

,

limiting or preventing applications from being downloaded on the user device.

14. The non-transitory computer readable medium of claim 12, where removing restrictions does not include re-installation of applications that have been deleted.

15. The non-transitory computer readable medium of claim 12, where the one or more instructions, when executed by the at least one processor, further cause the at least one processor to:

compare the application inventory to an application restriction database;

identify applications not in the application restriction database;

assign default restrictions to applications not in the application restriction database; and

apply default restrictions and restrictions in the application restriction database to the applications on the user device.

16. A non-transitory computer readable medium storing instructions, the instructions comprising:

one or more instructions which, when executed by at least one processor, cause the at least one processor to;

communicate with a user device;

detect when the user device attempts to access a controlled area or network;

perform an inventory of applications on the user device;

compare the inventory of applications to an application restriction database;

identify applications not in the application restriction database;

assign default restrictions to applications not in the application restriction database;

identify restrictions for each application when the user device is in the controlled area or on the controlled network;

the restrictions associated with

a white list for applications with unrestricted use, and at least one of

a black list for applications that are not allowed to be used,

a gray list for applications that have some restrictions on use, and

a banned list for applications that are deleted upon detection;

assign each application to a list based on the identified restrictions;

impose the identified restrictions for each application on the user device when the user device accesses the controlled area or network; and

remove the identified restrictions on the applications on the user device when the user device is no longer accessing the controlled area or network.