SECURE REMOTE ACCESS USING WIRELESS NETWORK

• US 20150024710A1
• Filed: 07/17/2013
• Published: 01/22/2015
• Est. Priority Date: 07/17/2013
• Status: Active Grant

• Current Assignee: Honeywell International Inc.
• Original Assignee: Honeywell International Inc.
• Inventors: Becker, Robert Charles, Anderson, Bruce W., Cornett, Alan, Steeves, Todd Charles
• Granted Patent: US 9,426,653 B2
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: G07C 9/00 Individual registration on entry or exit
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/64 using geofenced areas
• CPC Class Codes: H04W 12/71 Hardware identity
• CPC Class Codes: H04W 12/72 Subscriber identity
• CPC Class Codes: H04W 84/045 using private Base Stations, e.g. femto Base Stations, home Node B

Abstract

A method includes receiving a request from a mobile device to attach to a private wireless network, determining if a subscriber identifier is in a security database, determining if a mobile device equipment identifier is in the security database, authenticating the phone using the subscriber identifier and the mobile device equipment identifier, granting access to the private wireless network only if the phone is authenticated, and passing data between a computer system and a mobile device to monitor and control a remote monitoring and control system.

Claims

1. A method comprising:

receiving a request from a mobile device to attach to a private wireless network;

determining if a subscriber identifier is in a security database;

determining if a mobile device equipment identifier is in the security database;

authenticating the mobile device using the subscriber identifier and the mobile device equipment identifier;

granting access to the private wireless network only if the mobile device is authenticated;

securely passing data between an isolated computer system and a mobile device to monitor and control a remote monitoring and control system.

2. The method of claim 1 and further comprising:

estimating whether a mobile device is located approximately within a remote monitoring and control system boundary; and

rejecting network access if the mobile device is not located approximately within the boundary.

3. The method of claim 1 and further comprising registering the mobile device with a private branch exchange as on-network if access is granted.

4. The method of claim 1 and further comprising:

determining if the use of the mobile device is authorized to access or manipulate data from a remote monitoring and control system;

determining if the user of the authorized mobile device is authorized to access or manipulate data from a remote monitoring and control system; and

making modifications to data of a remote monitoring and control system.

5. The method of claim 1 and further comprising:

receiving an application request to access information;

validating additional credentials; and

establishing a connection to access the requested information based on the validation of the additional credentials.

7. The method of claim 1 and further comprising:

receiving the subscriber identifier and the equipment identifier at a security access control point via near field communications; and

granting access based on a comparison to information stored in the security database.

8. The method of claim 7 and further comprising:

determining if additional credentials are required prior to granting access;

receiving the additional credentials from a user of the mobile device; and

granting access if the additional information matches information in the security database.

9. The method of claim 8 wherein the additional information comprises a pass code.

10. The method of claim 7 wherein the subscriber identifier and the equipment identifier are received as encrypted values.

6. The method of claim 6 and further comprising:

rejecting requests where invalid additional credentials are provided;

tracking the number of sequential rejected requests; and

determining whether to lock the phone out of the network as a function of an excess number of sequential rejected requests.

11. A computer readable storage device having instructions for causing a computer to perform a method, the method comprising:

receiving a request from a mobile device to attach to a private wireless network;

determining if a subscriber identifier is in a security database;

determining if a mobile device equipment identifier is in the security database;

authenticating the mobile device using the subscriber identifier and the mobile device equipment identifier;

granting access to the private wireless network only if the phone is authenticated; and

passing data between a computer system and a mobile device to monitor and control an isolated remote monitoring and control system.

12. The computer readable storage device of claim 11 wherein the method further comprises:

estimating whether a mobile device is located approximately within a plant boundary; and

rejecting network access if the mobile device is not located approximately within the plant boundary.

13. The computer readable storage device of claim 11 wherein the method further comprises registering the mobile device with a private branch exchange as on-network if access is granted.

14. The computer readable storage device of claim 11 wherein the method further comprises:

determining if the mobile device is authorized to access or manipulate data from an isolated remote monitoring and control system;

determining if the user of the authorized mobile device is authorized to access or manipulate data from an isolated remote monitoring and control system; and

making modifications to data of an isolated remote monitoring and control system.

15. The computer readable storage device of claim 11 wherein the method further comprises:

receiving an application request to access information;

validating additional credentials;

establishing a connection to access the requested information based on the validation of the additional credentials;

rejecting requests where invalid additional credentials are provided;

tracking the number of sequential rejected requests; and

determining whether to lock the phone out of the network as a function of an excess number of sequential rejected requests.

16. The computer readable storage device of claim 11 wherein the method further comprises:

receiving the subscriber identifier and the equipment identifier at a security access control point via near field communications;

granting access based on a comparison to information stored in the security database;

determining if additional information is required prior to granting access;

receiving the additional information from a user of the mobile device; and

granting access if the additional information matches information in the security database.

17. A system comprising:

a security center having a security database to determine if a subscriber identifier and a mobile device equipment identifier provided by a mobile device are in the security database and to authenticate the mobile device;

a process monitor and automation controller to interact with the security center and receive communications from the authenticated mobile device; and

a media server to provide a private wireless network to communication with authenticated mobile devices, the security center, and the process monitor and automation controller, wherein data is passed between the isolated system and a mobile device to remotely monitor and control the process monitor and automation controller.

18. The system of claim 17 wherein the security center is programmed to:

estimate whether a mobile device is located approximately within a plant boundary; and

reject network access if the mobile device is not located approximately within the plant boundary

19. The system of claim 17 wherein the security center:

determines if the mobile device is authorized to access or manipulate data from an isolated remote monitoring and control system;

determines if the user of the authorized mobile device is authorized to access or manipulate data from a remote monitoring and control system; and

makes modifications to data of an isolated remote monitoring and control system.

20. The system of claim 17 wherein the security center:

receives an application request to access information;

validates additional credentials; and

establishes a connection to access the requested information based on the validation of the additional credentials.