Network access control

• US 10,644,880 B1
• Filed: 03/08/2019
• Issued: 05/05/2020
• Est. Priority Date: 03/24/2016
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Roths, Andrew Jay, Solsona-Palomar, Marc
• Primary Examiner(s): Avery, Jeremiah L
• Application Number:
  US16/296,681
• Time in Patent Office: 424 Days
• Field of Search: None
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/043 using a trusted network node as an anchor
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 12/60 Context-dependent security
• CPC Class Codes: H04W 12/61 Time-dependent
• CPC Class Codes: H04W 76/10 Connection setup

Abstract

This disclosure describes methods, apparatus, and systems related to controlled access data allocation. A device may receive a first request from a first device to establish a first connection with a wireless network. The device may receive a second request from a second device to establish a second connection with the wireless network. The device may determine a first access data for the first device, wherein the first access data is associated with a first access configuration. The device may determine a second access data for the second device, wherein the second access data is associated with a second access configuration, wherein the second access configuration is different from the first access configuration. The device may send the first access data to the first device. The device may send the second access data to the second device. The device may establish the first connection with the first device, wherein the first connection is at the first access configuration. The device may establish the second connection with the second device, wherein the second connection is at the second access configuration.

Claims

1. A device comprising:

memory that stores computer-executable instructions; and

at least one processor configured to access the memory and execute the computer-executable instructions to;

receive first data that identifies a first device;

receive second data that identifies a second device;

determine a first access configuration for the first device using the first data, wherein the first access configuration comprises a first set of restrictions associated with access to a wireless network by the first device;

determine a second access configuration for the second device using the second data, wherein the second access configuration comprises a second set of restrictions associated with access to the wireless network by the second device, wherein the second access configuration is different than the first access configuration;

determine that the first device is attempting to complete an action that is restricted by the first set of restrictions; and

prevent the action from being completed.

2. The device of claim 1, wherein the device is an access point, and wherein the action is (i) a communication, or (ii) a request to access content.

3. The device of claim 1, wherein the at least one processor is further configured to execute the computer-executable instructions to:

determine that the first device is authorized to access the wireless network; and

determine that the second device is authorized to access the wireless network.

4. The device of claim 1, wherein the at least one processor is further configured to execute the computer-executable instructions to perform at least one of:

generate modified access configuration data based at least in part on the first access configuration;

prohibit access to the wireless network by the first device;

or

temporarily prohibit access to the wireless network by the first device.

5. The device of claim 1, wherein the action is a request to access content, and wherein the at least one processor is further configured to execute the computer-executable instructions to:

determine that a current time is not within a timeframe during which accessing content is allowed.

6. The device of claim 1, wherein the at least one processor is further configured to execute the computer-executable instructions to perform at least one of:

(i) randomly determine the first data;

or

(ii) send an access data request, wherein the access data request comprises device information associated with the first device, and receive a response message comprising the first data.

7. The device of claim 1, wherein the at least one processor is configured to prevent the action from being completed by denying a request to access content.

8. The device of claim 1, wherein the first access configuration is associated with a plurality of devices, and wherein the first set of restrictions comprises a network access duration restriction, a time of day access restriction, a predetermined data usage limit restriction, a bandwidth allocation restriction, a relative device priority restriction, an Internet access limit restriction, or a parental control restriction.

9. A method comprising:

receiving, by a device, first data that identifies a first device;

receiving second data that identifies a second device;

determining a first access configuration for the first device using the first data, wherein the first access configuration comprises a first set of restrictions associated with access to a wireless network by the first device;

determining a second access configuration for the second device using the second data, wherein the second access configuration comprises a second set of restrictions associated with access to the wireless network by the second device, wherein the second access configuration is different than the first access configuration;

determining that the first device is attempting to complete an action that is restricted by the first set of restrictions; and

preventing the action from being completed.

10. The method of claim 9, wherein determining that the first device is attempting to complete the action that is restricted by the first set of restrictions comprises determining that the first device is attempting to complete (i) a communication, or (ii) a request to access content that is restricted by the first set of restrictions.

11. The method of claim 9, further comprising:

determining that the first device is authorized to access the wireless network; and

determining that the second device is authorized to access the wireless network.

12. The method of claim 9, further comprising at least one of:

generating modified access configuration data based at least in part on the first access configuration;

prohibiting access to the wireless network by the first device;

or

temporarily prohibiting access to the wireless network by the first device.

13. The method of claim 9, wherein the action is a request to access content, the method further comprising:

determining that a current time is not within a timeframe during which accessing content is allowed.

14. The method of claim 9, further comprising either:

(i) randomly determining the first data;

or

(ii) sending an access data request, wherein the access data request comprises device information associated with the first device, and receiving a response message comprising the first data.

15. The method of claim 9, wherein preventing the action from being completed comprises denying a request to access content.

16. The method of claim 9, wherein the first access configuration is associated with a plurality of devices, and wherein the first set of restrictions comprises a network access duration restriction, a time of day access restriction, a predetermined data usage limit restriction, a bandwidth allocation restriction, a relative device priority restriction, an Internet access limit restriction, or a parental control restriction.

17. A method comprising:

determining, by an access point, first data that identifies a first device;

receiving second data that identifies a second device;

determining a first set of restrictions for the first device using the first data, wherein the first set of restrictions is associated with access to a wireless network by the first device;

determining a second set of restrictions for the second device using the second data, wherein the second set of restrictions is associated with access to the wireless network by the second device, and wherein the second set of restrictions is different than the first set of restrictions;

determining that the first device is attempting to access content that is restricted by the first set of restrictions; and

preventing access to the content.

18. The method of claim 17, wherein the action is a request to access content, the method further comprising:

determining that a current time is not within a timeframe during which accessing content is allowed.

19. The method of claim 17, further comprising:

determining that the first device is authorized to access the wireless network; and

determining that the second device is authorized to access the wireless network.

20. The method of claim 17, further comprising either:

(i) randomly determining the first data;

or

(ii) sending an access data request, wherein the access data request comprises device information associated with the first device, and receiving a response message comprising the first data.