Location-based access control in a data network

• US 20030217122A1
• Filed: 02/28/2003
• Published: 11/20/2003
• Est. Priority Date: 03/01/2002
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: Extreme Networks, Inc.
• Inventors: Roese, John J., Graham, Richard W., Harrington, David, Frattura, David
• Granted Patent: US 8,972,589 B2
• Time in Patent Office: Days
• US Class Current: 709/219
• CPC Class Codes: G01S 5/02 using radio waves using satellite radio beacon systems for determining position G01S19/00
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 61/10 of different types
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services
• CPC Class Codes: H04W 4/20 Services signaling; Auxiliary data signalling, i.e. transmitting data via a non-traffic channel
• CPC Class Codes: H04W 4/50 : Service provisioning or reconfiguring
• CPC Class Codes: H04W 64/00 : Locating users or terminals or network equipment for network management purposes, e.g. mobility management
• CPC Class Codes: H04W 8/26 : Network addressing or numbering for mobility support
• CPC Class Codes: Y10S 707/99932 : Access augmentation or optimizing
• CPC Class Codes: Y10S 707/99939 : Privileged access

Abstract

A request for network access is received from a client device at a network entry device of a network infrastructure. The network infrastructure determines a physical location of the client device and determines authorization of the client device based on the physical location. The approach can include providing the physical location along with other user credentials to an authorizing device. The method can also include determining a level of service based on the physical location. Communication for the approach can make use of the IEEE 802.1Xprotocol.

Claims

1. A method comprising,

receiving, at a network entry device of a network infrastructure, a request for network access from a client device;

determining, by the network infrastructure, a physical location of the client device; and

determining authorization of the client device based on the physical location.

2. The method of claim 1 wherein determining authorization further comprises determining authorization by the network entry device.

3. The method of claim 1 wherein determining authorization further comprises providing the physical location along with other user credentials to the authorizing device.

4. The method of claim 1 wherein determining authorization further comprises determining a level of service based on the physical location.

5. The method of claim 4 further comprising,

receiving, at the network entry device, user credentials, and

wherein determining authorization further comprises determining a level of service based on the physical location and the user credentials.

6. The method of claim 1 wherein determining authorization further comprises authorizing a user associated with the client device if a level of trust associated with the physical location is not less than a predefined threshold.

7. The method of claim 1 wherein determining authorization further comprising communicating in accord with IEEE 802.1X.

8. A system comprising:

a network infrastructure configured to determine a physical location of a client device, the network infrastructure including;

a network entry device configured to receive a request for network access from a client device and determine authorization of the client device based on the physical location.

9. The system of claim 8 wherein the network entry device is further configured to determine a level of service based on the physical location.

10. The system of claim 8 wherein the network entry device is further configured to receive user credentials and to determine a level of service based on the physical location and the user credentials.

11. The system of claim 8 wherein the network entry device is further configured to authorize a user associated with the client device if a level of trust associated with the physical location is not less than a predefined threshold.

12. The system of claim 8 wherein the network entry device is further configured to communicate in accord with IEEE 802.1X.

13. An article comprising a machine-readable medium that stores executable instruction signals that cause a machine to:

receive, at a network entry device of a network infrastructure, a request for network access from a client device;

determine, by the network infrastructure, a physical location of the client device; and

determine authorization of the client device based on the physical location.