System and method for filtering access points presented to a user and locking onto an access point

• US 20060094400A1
• Filed: 07/07/2005
• Published: 05/04/2006
• Est. Priority Date: 02/28/2003
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Wright, Michael, Nault, Gabe, Boucher, Peter, Rollins, Richard, Beachem, Brent, Wood, Jonathan Brett
• Granted Patent: US 9,237,514 B2
• Time in Patent Office: Days
• US Class Current: 455/410
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04M 7/121 Details of network access arrangements or protocols
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services
• CPC Class Codes: H04W 48/20 Selecting an access point
• CPC Class Codes: H04W 76/20 Manipulation of established connections
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 92/10 between terminal device and access point, i.e. wireless air interface

Abstract

The present invention filters access points presented to a user and locks onto an access point. The present invention includes an access point filtering unit and an access point locking unit. The access point filtering unit determines the access points that are accessible by a client device and then filters them to present only the access points that are acceptable to under a security policy in force. The access point locking unit has a plurality of operating modes and can lock onto a user selected access point, a security policy prescribed access point, or the access point with the best signal profile. The present invention also includes several methods such as: a method for filtering access points for presentation to the user, a method for locking onto an access point selected by the user, a method for locking onto an access point with the best signal profile, and a method for locking onto an access point prescribed by a security policy for a given location.

Claims

1. A method for connecting to an access point by a mobile computing device, the method comprising the steps of:

determining available access points for a location of the mobile computing device;

connecting the mobile computing device to the access point; and

locking a connection between the mobile computing device to the access point.

2. The method of claim 1, wherein the step of locking is performed until a signal profile between the mobile computing device and the access point falls below a predetermined threshold.

3. The method of claim 2, wherein signal profile includes one from the group of:

signal strength, communication protocol, encryption type, encryption key length, service set identifier (SSID), media access control (MAC) address, authentication method and other information about the communication channel.

4. The method of claim 1, wherein the step of locking is performed until a request to perform a clear network environment operation is received, a location change for the mobile computing device is detected;

or a request to change location operation is received.

5. The method of claim 1, wherein the step of locking is performed by filtering an appearance of competing access points.

6. The method of claim 1, wherein the step of connecting further comprises:

displaying available access points for the location to the user;

receiving a selected access point selected by the user from the displayed available access points; and

connecting the mobile computing device to the selected access point.

7. The method of claim 1, further comprising the step of determining whether a security policy for the location of the mobile computing device allows user selection of the access point.

8. The method of claim 7, wherein if the security policy for the location of the mobile computing device allows user selection of the access point, the step of connecting further comprises:

displaying available access points for the location to the user;

receiving a selected access point selected by the user from the displayed available access points; and

connecting the mobile computing device to the selected access point.

9. The method of claim 1, wherein the step of connecting further comprises a step of determining whether a security policy for the location of the mobile computing device limits access points selectable by a user.

10. The method of claim 9, wherein if the security policy for the location of the mobile computing device limits access points selectable by the user, the step of connecting further comprises:

displaying to the user permitted access points for the location that the mobile computing device may be connected to under the security policy;

receiving a selected access point selected by the user from the permitted access points; and

connecting the mobile computing device to the selected access point.

11. The method of claim 1, wherein the step of connecting further comprises connecting to the access point prescribed by a security policy for the location of the mobile computing device.

12. The method of claim 1, wherein the step of connecting the mobile computing device to the access point further comprises the steps of:

determining a signal profile for two of the available access points; and

selecting the access point with a most desirable profile to connect to the mobile computing device.

13. The method of claim 1, wherein the step of connecting the mobile computing device to the access point further comprises the steps of:

determining a signal profile for each of the available access points; and

selecting the access point with a most desirable profile to connect to the mobile computing device.

14. The method of claim 12, wherein the signal profile includes one from the group signal strength, communication protocol, encryption type, encryption key length, service set identifier (SSID), media access control (MAC) address, and other information about the communication channel.

15. The method of claim 14, wherein the most desirable signal profile is determined based on encryption type and signal strength.

16. The method of claim 14, wherein the most desirable signal profile is determined based on communication protocol and signal strength.

17. The method of claim 12, wherein the step of connecting further comprises a step of determining whether a security policy for the location of the mobile computing device limits access points selectable.

18. The method of claim 17, wherein if the security policy for the location of the mobile computing device limits access points selectable, the step of connecting further comprises:

providing a group of permitted access points for the location that the mobile computing device may be connected to under the security policy; and

wherein the step of determining the signal profile for two of the available access points, selects access points from the group of permitted access points.

19. A method for connecting to an access point by a mobile computing device, the method comprising the steps of:

determining available access points for a location of the mobile computing device;

filtering the available access points for the location to a group of permitted access points for the location that the mobile computing device may be connected to under a security policy; and

connecting the mobile computing device to one from the group of permitted access points.

20. The method of claim 19, wherein the step of connecting further comprises connecting to an access point from the group of permitted access points and prescribed by a security policy for the location of the mobile computing device.

21. The method of claim 19, further comprising the step of determining whether a security policy for the location of the mobile computing device allows user selection of the access point.

22. The method of claim 21, wherein if the security policy for the location of the mobile computing device allows user selection of the access point, the step of connecting further comprises:

displaying the group of permitted access points for the location to a user;

receiving a selected access point selected by the user from the group of permitted access points; and

connecting the mobile computing device to the selected access point.

23. An apparatus for establishing communication between an access point and a mobile computing device, the apparatus comprising:

a location detection module having an input and an output for determining a location of the mobile computing device;

a security policy module having an input and an output and including a security policy for a mobile computing device;

a security enforcement module having an input and an output for enforcing the security policy on the mobile computing device based on location, the security enforcement module coupled to the security policy module and the location detection module; and

an access point filtering unit for determining access points that are accessible by the mobile computing device and filters accessible access points using the security policy, the access point filtering unit coupled to the security enforcement module and the security policy module.

24. The apparatus of claim 23 further comprising an access point locking unit for locking communication between the access point and the mobile computing device so that the mobile computing device will not connect to another access points having stronger signal strength, the access point locking unit coupled to the security enforcement module.

25. An apparatus for establishing communication between an access point and a mobile computing device, the apparatus comprising:

a location detection module having an input and an output for determining a location of the mobile computing device;

a security enforcement module having an input and an output for enforcing the security policy on the mobile computing device based on location, the security enforcement module coupled to the location detection module; and

an access point locking unit for locking communication between the access point and the mobile computing device so that the mobile computing device will not connect to another access points having stronger signal strength, the access point locking unit coupled to the security enforcement module.

26. The apparatus of claim 25 wherein the access point locking unit has a plurality of operating modes and can lock onto a user selected access point, a security policy prescribed access point, or the access point with the best signal profile.

27. The apparatus of claim 26 wherein the signal profile refers to a combination of two from the group of:

a protocol used for communication, a type of encryption used, a key length for encryption, an authentication method, a wireless signal strength or other factors.