Device management based on wireless beacons

• US 10,313,874 B2
• Filed: 10/13/2015
• Issued: 06/04/2019
• Est. Priority Date: 04/16/2014
• Status: Active Grant

• Current Assignee: JAMF Software, LLC (Jamf Holding Corp.)
• Original Assignee: JAMF Software, LLC (Jamf Holding Corp.)
• Inventors: Amundsen, Nicholas, Sippert, Rebekah, Ingraham, IV, Cyrus, Becker, Bradley, Levenhagen, Eric
• Primary Examiner(s): Miah, Liton
• Application Number:
  US14/882,223
• Publication Number:
  US 20160037333A1
• Time in Patent Office: 1,330 Days
• CPC Class Codes: G06F 3/1454 involving copying of the display data of a local workstation or window to a remote workstation or window so that an actual copy of the data is displayed simultaneously on two or more displays, e.g. teledisplay
• CPC Class Codes: H04M 1/72403 with means for local support of applications that increase the functionality
• CPC Class Codes: H04M 1/72445 for supporting Internet browser applications
• CPC Class Codes: H04M 1/72457 according to geographic location
• CPC Class Codes: H04M 1/724631 by limiting the access to the user interface, e.g. locking a touch-screen or a keypad
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring
• CPC Class Codes: H04W 48/02 Access restriction performed under specific conditions
• CPC Class Codes: H04W 48/04 based on user or terminal location or mobility data, e.g. moving direction, speed
• CPC Class Codes: H04W 76/10 Connection setup
• CPC Class Codes: H04W 8/22 Processing or transfer of terminal data, e.g. status or physical capabilities

Abstract

A particular method includes detecting, at a managed computing device, a signal from a wireless beacon device via a first wireless connection. The signal is detected while particular functionality is inaccessibly at the managed computing device. The method further includes, in response to detecting the signal, transmitting a first message from the managed computing device to a device management server via a second wireless connection, where the first message identifies the wireless beacon device. The method further includes receiving, at the managed computing device in response to the identification of the wireless beacon device in the first message, a second message that grants the managed computing device access to the particular functionality while the managed computing device is within a transmission range of the wireless beacon device.

Claims

1. A method comprising:

detecting, at a managed device, a signal from a wireless beacon via a first wireless connection between the managed device and the wireless beacon, wherein the signal is detected while the managed device does not have authorization to access a particular functionality;

in response to detecting the signal, generating a first message that includes a beacon identifier associated with the wireless beacon;

transmitting the first message from the managed device to a device management server via a second wireless connection;

receiving, at the managed device via the second wireless connection in response to the beacon identifier in the first message, a second message granting, to the managed device, the authorization to access the particular functionality while the managed device is within a transmission range of the wireless beacon; and

in response to an exit of the managed device from the transmission range of the wireless beacon, receiving at the managed device via the second wireless connection a third message from the device management server, the third message revoking from the managed device the authorization to access the particular functionality.

2. The method of claim 1, further comprising:

detecting, at the managed device, the exit of the managed device from the transmission range of the wireless beacon;

in response to detecting the exit, transmitting a fourth message from the managed device to the device management server, wherein the fourth message indicates the exit; and

receiving the third message at the managed device from the device management server in response to the fourth message.

3. The method of claim 1, wherein the exit from the transmission range is detected based on:

a detected absence of the signal;

a signal strength of the signal being less than a threshold;

a second signal strength of a second signal associated with a second wireless beacon being greater than the signal strength of the signal;

or

any combination thereof.

4. The method of claim 1, wherein the first wireless connection comprises a personal area network connection.

5. The method of claim 1, wherein the second wireless connection comprises an IEEE 802.11 connection, a fourth generation (4G) connection, or a third generation (3G) connection.

6. The method of claim 1, wherein granting the authorization to access the particular functionality comprises configuring the managed device to access a particular printer.

7. The method of claim 1, wherein granting the authorization to access the particular functionality includes triggering installation of an application by an operating system of the managed device, the application operable to perform the particular functionality.

8. The method of claim 1, wherein the second message further includes at least one command to be executed by an operating system of the managed device.

9. The method of claim 1, wherein the signal carries the beacon identifier associated with the wireless beacon and the first message includes the beacon identifier and a user identifier.

10. The method of claim 1, wherein the particular functionality comprises an application functionality that is unrelated to a functionality of the wireless beacon, and wherein the particular functionality is accessible while the managed computing device detects a signal from the wireless beacon.

11. The method of claim 1, wherein the signal includes a region identifier associated with a set of geographic regions and a sub-region identifier associated with a particular geographic region of the set of geographic regions.

12. A method comprising:

receiving, at a device management server, a first message from a managed device via an access point, wherein the first message includes a first identifier associated with a first wireless beacon, wherein the first wireless beacon is associated with a first wireless network connection, and wherein the first message indicates that the managed device is within a range of the first wireless beacon;

in response to the first message, initiating transmission, via a second wireless connection, of a second message to the managed device granting the managed device authorization to access a particular functionality; and

in response an exit of the managed device from the range of the first wireless beacon, initiating transmission, via the second wireless connection, of a third message to the managed device to revoke from the managed device the authorization to access the particular functionality.

13. The method of claim 12, wherein initiating transmission of the second message includes requesting a push notification service to send an instruction to the managed device to cause the managed device to check-in with the device management server.

14. The method of claim 12, wherein the first identifier is associated with a wireless beacon region associated with a transmission range of each of a plurality of wireless beacons.

15. The method of claim 14, wherein the device management server stores an association between the wireless beacon region and a Wile indicating that the authorization to access the particular functionality is to be granted to managed devices in the wireless beacon region.

16. The method of claim 14, wherein the first identifier includes one or more sub-identifiers that identify one or more sub-regions of the wireless beacon region, each of the sub-identifiers corresponding to a particular beacon of the plurality of wireless beacons.

17. The method of claim 16, wherein the device management server stores an association between a particular sub-region and a rule indicating that the authorization to access the particular functionality is to be granted to managed devices in the particular sub-region.

18. The method of claim 12, wherein granting the authorization to access the particular functionality includes granting the managed device authorization to access a virtual private network (VPN).

19. A computer-readable storage device storing instructions that, when executed by a processor, cause the processor to perform operations including:

receiving, at a device management server, input indicating that authorization to access a particular functionality is to be granted to each computing device associated with a particular user identifier (ID) while the computing device is within a transmission range of a wireless beacon, the wireless beacon associated with a first wireless connection;

receiving a first message from a managed computing device, the first message having a beacon identifier associated with the wireless beacon and having the user ID, the first message indicating that the managed computing device is within the transmission range of the wireless beacon;

in response to the first message, initiating transmission, via a second wireless connection, of a second message to the managed computing device, the second message granting the managed computing device the authorization to access the particular functionality during a time period that the managed computing device is within the transmission range of the wireless beacon; and

in response to an exit of the managed computing device from the transmission range of the wireless beacon, initiating transmission, via the second wireless connection, of a third message to the managed computing device to revoke from the managed computing device the authorization to access the particular functionality.