System and method for controlling network access in wireless environment

• US 20050138424A1
• Filed: 12/22/2003
• Published: 06/23/2005
• Est. Priority Date: 12/22/2003
• Status: Active Grant

• Current Assignee: Lenovo PC International Limited (Lenovo Group Ltd.)
• Original Assignee: International Business Machines Corporation
• Inventors: Cromer, Daryl Carvis, Locker, Howard Jeffrey, Springfield, Randall Scott, Challener, David Carroll, Ovies, Hernando
• Granted Patent: US 7,620,997 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

When an authenticated wireless computer loses connectivity to a wireless access point of a network and roams to another access point, the wireless computer (e.g., a hypervisor in the computer) determines whether the new access point is authorized for secure communication and if so, releases access to secure data on the network through the new access point.

Claims

1. A service comprising:

determining that a mobile computer has lost connectivity to a first access point of a network;

when the mobile computer roams to a second access point of the network, determining whether the second access point is authorized for secure communication and if so,

releasing access to secure data on the network through the second access point.

2. The service of claim 1, wherein the service is undertaken by the mobile computer.

3. The service of claim 2, wherein the service is undertaken by a hypervisor in the mobile computer.

4. The service of claim 1, wherein the service is undertaken by at least one network resource outside the mobile computer.

5. The service of claim 1, wherein the mobile computer is authenticated at the first access point, prior to losing connectivity thereto.

6. The service of claim 5 wherein releasing access to secure data on the network through the second access point comprises releasing access to a set of secure data which differs from the secure data released when the mobile computer is connected to the first access point.

7. A mobile computer, comprising:

at least one processor;

at least one wireless transceiver in communication with the processor, the processor executing logic including;

determining whether a predetermined communication hardware event has occurred; and

if a predetermined communication hardware event has occurred, selectively configuring the computer in a non-secure mode.

8. The computer of claim 7, wherein the computer cannot access secure data on the network while configured in said non-secure mode.

9. The computer of claim 7, wherein the computer can access a subset of the seucre data on the network while configured in said non-secure mode.

10. The computer of claim 7, wherein the predetermined hardware event is a disconnection from a wireless access point.

11. The computer of claim 7, wherein the computer is configured in the non-secure mode if the computer roams to an access point that is not authorized for secure data transmission.

12. The computer of claim 10, wherein the processor accesses a list of authorized access points to undertake the act of selectively configuring.

13. The computer of claim 10, wherein the processor receives a network signal from a wireless access point to indicate whether the wireless access point is an authorized access point to undertake the act of selectively configuring.

14. A system including a mobile computer and a network including secure data, comprising:

means for determining that the mobile computer has lost connectivity to a first access point of the network;

means for determining whether a second access point of the network to which the mobile computer has roamed is authorized for secure communication; and

means for permitting the mobile computer to access secure data on the network through the second access point.

15. The system of claim 14, wherein the means are embodied in the mobile computer.

16. The system of claim 15, wherein the means are embodied by a hypervisor in the mobile computer.

17. The system of claim 14, wherein the means are embodied by at least one network resource outside the mobile computer.

18. The system of claim 14, wherein the mobile computer is authenticated at the first access point, prior to losing connectivity thereto.

19. A method comprising:

establishing communication between a mobile computer and a network through an access point; and

based on at least one of;

a location, and an identification, of the access point, selectively granting the computer access to secure assets in the network.

20. The method of claim 19, wherein the act of selectively granting is undertaken by the mobile computer.

21. The method of claim 20, wherein the act of selectively granting is undertaken by a hypervisor in the mobile computer.

22. The method of claim 19, wherein the computer is configured to access a first set of network assets when communicating through a first access point and a second set of network assets when communicating through a second access point.