Wireless manager and method for managing wireless devices

• US 20050260973A1
• Filed: 05/24/2005
• Published: 11/24/2005
• Est. Priority Date: 05/24/2004
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: van de Groenendaal, Joannes G.
• Granted Patent: US 7,469,139 B2
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04M 1/67 by electronic means
• CPC Class Codes: H04M 1/72406 by software upgrading or downloading
• CPC Class Codes: H04M 1/72451 according to schedules, e.g. using calendar applications
• CPC Class Codes: H04M 1/72457 according to geographic location
• CPC Class Codes: H04M 1/72463 to restrict the functionality of the device
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 12/64 using geofenced areas
• CPC Class Codes: H04W 12/73 Access point logical identity
• CPC Class Codes: H04W 4/021 Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
• CPC Class Codes: H04W 48/04 based on user or terminal location or mobility data, e.g. moving direction, speed
• CPC Class Codes: H04W 8/205 Transfer to or from user equipment or user record carrier
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

The disclosure provides a wireless manager operable to receive a request from a mobile device to wirelessly communicate with an enterprise network, with the request including information operable to dynamically identify a location of the mobile device. The wireless manager is further operable to automatically associate an access zone with the mobile device with the access zone comprising at least one logical characteristic, compare the location information to the associated access zone, and, if the location information indicates that the mobile device does not violate the access zone, authorize wireless communications with the enterprise network.

Claims

1. A wireless manager associated with an enterprise network operable to:

intercept a request from a mobile device to wirelessly communicate with an enterprise network, the request including information operable to dynamically identify a location of the mobile device;

automatically associate an access zone with the mobile device, the access zone comprising at least one logical characteristic;

compare the location information to the associated access zone; and

if the location information indicates that the mobile device does not violate the access zone, authorize wireless communications with the enterprise network.

2. The wireless manager of claim 1, further operable to:

monitor the location of the mobile device during the wireless communication; and

invoke at least one action in response to a violation of the location and the access zone.

3. The wireless manager of claim 2, wherein each action is selected from one of:

disabling access to the enterprise network through an associated port;

disabling access to the enterprise network from an associated Internet Protocol (IP) address;

disabling internet sharing through the mobile device;

or

disabling network file sharing by the mobile device.

4. The wireless manager of claim 2, the wireless manager operable to dynamically determine the particular one or more actions based on a role of an end user logged in to the enterprise network through the mobile device.

5. The wireless manager of claim 1, further operable to present to an administrator a graphical user interface (GUI), the GUI including a graphical representation of the access zone and displaying the mobile device and the access zone on an interactive map of the enterprise network.

6. The wireless manager of claim 1, the access zone further comprising at least one physical characteristic and a first of the logical characteristics comprising one of SSID, BSSID, and ESSID.

7. The wireless manager of claim 1, wherein the location comprises a first location and the wireless manager is further operable to:

determine that the mobile device has relocated to a second location; and

automatically redirect the mobile to communicate to a second access point associated with the second location.

8. The wireless manager of claim 2, the violation comprising the determined location being inside the access zone.

9. The wireless manager of claim 1 further operable to:

identify a firmware version of the mobile device once it enters the particular access zone; and

automatically communicate an updated firmware file to the mobile device for automatic installation.

13. The method of claim 1, further comprising dynamically determining the particular one or more actions based on a role of an end user logged in to the enterprise network through the mobile device.

10. A method for managing enterprise mobile devices, comprising:

receiving a request from a mobile device to wirelessly communicate with an enterprise network, the request including information operable to identify a location of the mobile device;

automatically associating an access zone with the mobile device, the access zone comprising at least one logical characteristic;

comparing the location information to the associated access zone; and

if the location information indicates that the mobile device does not violate the access zone, authorizing wireless communications with the enterprise network.

11. The method of claim 10, further comprising:

monitoring the location of the mobile device during the wireless communication; and

invoking at least one action in response to a violation of the location and the access zone.

12. The method of claim 11, wherein each action is selected from one of:

disabling access to the enterprise network through an associated port;

disabling access to the enterprise network from an associated Internet Protocol (IP) address;

disabling internet sharing through the mobile device;

or

disabling network file sharing by the mobile device.

14. The method of claim 10, further comprising presenting to an administrator a graphical user interface (GUI), the GUI including a graphical representation of the access zone and displaying the mobile device and the access zone on an interactive map of the enterprise network.

15. The method of claim 10, the access zone further comprising at least one physical characteristic and a first of the logical characteristics comprising one of SSID, BSSID, and ESSID.

16. The method of claim 10, wherein the location comprises a first location and the method further comprising:

determining that the mobile device has relocated to a second location; and

automatically redirecting the mobile to communicate to a second access point associated with the second location.

17. The method of claim 11, the violation comprising the determined location being inside the access zone.

18. The method of claim 10, further comprising:

identifying a firmware version of the mobile device once it enters the particular access zone; and

automatically communicating an updated firmware file to the mobile device for automatic installation.

19. A system for managing mobile devices, comprising:

memory storing a plurality of access zones, each of at least a subset of the access zones associated with a particular geography of an enterprise network; and

one or more processors operable to;

receive a request from a mobile device to wirelessly communicate with the enterprise network, the request including information operable to dynamically identify a location of the mobile device;

automatically associate one of the plurality of access zones with the mobile device, each access zone comprising at least one logical characteristic;

compare the location information to the associated access zone; and

if the location information indicates that the mobile device does not violate the access zone, authorize wireless communications with the enterprise network.

20. The system of claim 19, the one or more processors operable to:

monitor the location of the mobile device during the wireless communication; and

invoke at least one action in response to a violation of the location and the access zone.

21. The system of claim 20, wherein each action is selected from one of:

disabling access to the enterprise network through an associated port;

disabling access to the enterprise network from an associated Internet Protocol (IP) address;

disabling internet sharing through the mobile device;

or

disabling network file sharing by the mobile device.

22. The system of claim 20, the one or more processors operable to dynamically determine the particular one or more actions based on a role of an end user logged in to the enterprise network through the mobile device.

23. The system of claim 19, the one or more processors operable to present to an administrator a graphical user interface (GUI), the GUI including a graphical representation of the access zone and displaying the mobile device and the access zone on an interactive map of the enterprise network.

24. The system of claim 23, the access zone further comprising at least one physical characteristic and a first of the logical characteristics comprising one of SSID, BSSID, and ESSID.

25. The system of claim 19, wherein the location comprises a first location and the one or more processors are further operable to:

determine that the mobile device has relocated to a second location; and

automatically redirect the mobile to communicate to a second access point associated with the second location.

26. The system of claim 20, the violation comprising the determined location being inside the access zone.

27. The system of claim 19, the one or more processors further operable to:

identify a firmware version of the mobile device once it enters the particular access zone; and

automatically communicate an updated firmware file to the mobile device for automatic installation.

28. The system of claim 19, the location identification information comprising an expected x,y,z position of the mobile device with a projection onto an x,y-plane.

29. A wireless agent operable to:

automatically identify an access zone for an associated mobile device in a particular wireless network, the access zone comprising at least one logical characteristic;

select one of a plurality of connection policies based on the identified access zone; and

if the connection policy indicates that the access zone is approved, allow the mobile device to communicate with the wireless network.

30. The wireless agent of claim 29, the particular wireless network comprising a network provided by a third party.

31. The wireless agent of claim 29, further operable to automatically download updates to at least one of the connection profiles upon entrance to an enterprise network associated with the mobile device.

32. The wireless agent of claim 29, further operable to:

automatically collect wireless information associated with the mobile device; and

encrypt the collected information for storage on the mobile device.

33. The wireless agent of claim 32, the collected information comprising at least the following types of data:

networks previously visited;

performance metrics;

intrusion attempts; and

indications that an associated user attempted to modify network configuration options.

34. The wireless agent of claim 32, further operable to automatically communicate the collected information to a wireless gateway in an enterprise network once the mobile device enters the enterprise network, the wireless gateway operable to decrypt the collected information and store the decrypted information for subsequent processing.

35. The wireless agent of claim 29, further operable to:

automatically select one of a plurality of security profiles associated with the mobile device based, at least in part, on the identified access zone, each security profile including a plurality of security parameters for accessing the particular wireless network; and

modify at least one of plurality of network configuration options of the mobile device based on the selected security profile prior to allowing the mobile device to communicate with the particular wireless network, at least one of the modified options not available for subsequent modification by an end user of the mobile device.

36. The wireless agent of claim 29, the logical characteristics comprising:

an IP address range;

an SSID identifier; and

a timeframe.

37. The wireless agent of claim 29, the access zone further comprising at least one physical characteristic and a first of the logical characteristics comprising one of SSID, BSSID, and ESSID.