Device management based on wireless beacons

• US 10,484,867 B2
• Filed: 04/05/2019
• Issued: 11/19/2019
• Est. Priority Date: 04/16/2014
• Status: Active Grant

• Current Assignee: JAMF Software, LLC (Jamf Holding Corp.)
• Original Assignee: JAMF Software, LLC (Jamf Holding Corp.)
• Inventors: Amundsen, Nicholas, Sippert, Rebekah, Ingraham, IV, Cyrus, Becker, Bradley, Levenhagen, Eric
• Primary Examiner(s): Miah, Liton
• Application Number:
  US16/376,646
• Publication Number:
  US 20190239065A1
• Time in Patent Office: 228 Days
• CPC Class Codes: G06F 3/1454 involving copying of the display data of a local workstation or window to a remote workstation or window so that an actual copy of the data is displayed simultaneously on two or more displays, e.g. teledisplay
• CPC Class Codes: H04M 1/72403 with means for local support of applications that increase the functionality
• CPC Class Codes: H04M 1/72445 for supporting Internet browser applications
• CPC Class Codes: H04M 1/72457 according to geographic location
• CPC Class Codes: H04M 1/724631 by limiting the access to the user interface, e.g. locking a touch-screen or a keypad
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring
• CPC Class Codes: H04W 48/02 Access restriction performed under specific conditions
• CPC Class Codes: H04W 48/04 based on user or terminal location or mobility data, e.g. moving direction, speed
• CPC Class Codes: H04W 76/10 Connection setup
• CPC Class Codes: H04W 8/22 Processing or transfer of terminal data, e.g. status or physical capabilities

Abstract

A particular method includes detecting, at a managed computing device, a signal from a wireless beacon device via a first wireless connection. The signal is detected while particular functionality is inaccessibly at the managed computing device. The method further includes, in response to detecting the signal, transmitting a first message from the managed computing device to a device management server via a second wireless connection, where the first message identifies the wireless beacon device. The method further includes receiving, at the managed computing device in response to the identification of the wireless beacon device in the first message, a second message that grants the managed computing device access to the particular functionality while the managed computing device is within a transmission range of the wireless beacon device.

Claims

1. An apparatus comprising:

a processor; and

a memory storing instructions that, when executed by the processor, cause the processor to perform operations comprising;

receiving, at a device management server, a first message from a managed device via an access point, wherein the first message includes a first identifier associated with a first wireless beacon, wherein the first wireless beacon is associated with a first wireless network connection, and wherein the first message indicates that the managed device is within a range of the first wireless beacon;

in response to the first message, initiating transmission, via a second wireless connection, of a second message to the managed device granting the managed device authorization to access a particular functionality; and

in response to detecting the managed device at a location outside of the range of the first wireless beacon, initiating transmission, via the second wireless connection, of a third message to the managed device to revoke from the managed device the authorization to access the particular functionality.

2. The apparatus of claim 1, wherein initiating transmission of the second message includes requesting a push notification service to send an instruction to the managed device to cause the managed device to check-in with the device management server.

3. The apparatus of claim 1, wherein the first identifier is associated with a wireless beacon region associated with a transmission range of each of a plurality of wireless beacons.

4. The apparatus of claim 3, wherein the device management server stores an association between the wireless beacon region and a rule indicating that the authorization to access the particular functionality is to be granted to managed devices located within the wireless beacon region.

5. The apparatus of claim 3, wherein the first identifier includes one or more sub-identifiers that identify one or more sub-regions of the wireless beacon region, each of the sub-identifiers corresponding to a particular beacon of the plurality of wireless beacons.

6. The apparatus of claim 5, wherein the device management server stores an association between a particular sub-region and a rule indicating that the authorization to access the particular functionality is to be granted to managed devices located within the particular sub-region.

7. The apparatus of claim 1, wherein granting the authorization to access the particular functionality includes granting the managed device authorization to access a virtual private network (VPN).

8. An apparatus comprising:

a processor; and

a memory storing instructions that, when executed by the processor, cause the processor to perform operations comprising;

detecting, at a managed device, a signal from a wireless beacon via a first wireless connection between the managed device and the wireless beacon, wherein the signal is detected while the managed device does not have authorization to access a particular functionality;

in response to detecting the signal, generating a first message that includes a beacon identifier associated with the wireless beacon;

initiating transmission of the first message from the managed device to a device management server via a second wireless connection;

detecting, at the managed device via the second wireless connection in response to the beacon identifier in the first message, a second message granting, to the managed device, the authorization to access the particular functionality while the managed device is within a transmission range of the wireless beacon; and

in response to detecting the managed device at a location outside of the transmission range of the wireless beacon, detecting at the managed device via the second wireless connection, a third message from the device management server, the third message revoking from the managed device the authorization to access the particular functionality.

9. The apparatus of claim 8, wherein the operations further comprise:

in response to detecting the managed device at the location outside of the transmission range of the wireless beacon, initiating transmission of a fourth message from the managed device to the device management server, wherein the fourth message indicates that the managed device is at the location outside of the transmission range of the wireless beacon; and

detecting the third message at the managed device from the device management server after transmission of the fourth message.

10. The apparatus of claim 8, wherein detection of the managed device at the location outside of the transmission range is based on:

a detected absence of the signal;

a signal strength of the signal being less than a threshold;

a second signal strength of a second signal associated with a second wireless beacon being greater than the signal strength of the signal;

or

any combination thereof.

11. The apparatus of claim 8, wherein the first wireless connection comprises a personal area network connection.

12. The apparatus of claim 8, wherein the second wireless connection comprises an IEEE 802.11 connection, a fourth generation (4G) connection, or a third generation (3G) connection.

13. The apparatus of claim 8, wherein granting the authorization to access the particular functionality comprises configuring the managed device to access a particular printer.

14. The apparatus of claim 8, wherein granting the authorization to access the particular functionality includes triggering installation of an application by an operating system of the managed device, the application operable to perform the particular functionality.

15. The apparatus of claim 8, wherein the second message further includes at least one command to be executed by an operating system of the managed device.

16. The apparatus of claim 8, wherein the signal carries the beacon identifier associated with the wireless beacon and the first message includes the beacon identifier and a user identifier.

17. A computer-readable storage device storing instructions that, when executed by a processor, cause the processor to perform operations including:

detecting, at a managed device, a signal from a wireless beacon via a first wireless connection between the managed device and the wireless beacon, wherein the signal is detected while the managed device does not have authorization to access a particular functionality;

in response to detecting the signal, generating a first message that includes a beacon identifier associated with the wireless beacon;

initiating transmission of the first message from the managed device to a device management server via a second wireless connection;

detecting, at the managed device via the second wireless connection in response to the beacon identifier in the first message, a second message granting, to the managed device, the authorization to access the particular functionality while the managed device is within a transmission range of the wireless beacon; and

in response to detecting the managed device at a location outside of the transmission range of the wireless beacon, detecting at the managed device via the second wireless connection, a third message from the device management server, the third message revoking from the managed device the authorization to access the particular functionality.

18. The computer-readable storage device of claim 17, wherein granting the authorization to access the particular functionality comprises configuring the managed device to access a particular printer.

19. The computer-readable storage device of claim 17, wherein granting the authorization to access the particular functionality includes triggering installation of an application by an operating system of the managed device, the application operable to perform the particular functionality.

20. The computer-readable storage device of claim 17, wherein the signal carries the beacon identifier associated with the wireless beacon and the first message includes the beacon identifier and a user identifier.