LOCATION-BASED NETWORK SECURITY

• US 20160261606A1
• Filed: 05/16/2016
• Published: 09/08/2016
• Est. Priority Date: 12/22/2014
• Status: Abandoned Application

• Current Assignee: Fortinet Inc.
• Original Assignee: Fortinet Inc.
• Inventors: SALVADOR, MARTN HUMBERTO HOZ
• Application Number:
  US15/156,220
• Publication Number:
  US 20160261606A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 2101/69 using geographic information, e.g. room number
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0263 Rule management
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Methods and systems for a location-aware network security device are provided. According to one embodiment, a resource access request is received at a network security device of a protected network from a user device. The resource access request represents a request to access a resource of the protected network. A geographical location of the user device is determined by the network security device. The network security device then determines whether the user device should be allowed access to the resource by evaluating a location-specific security rule defined for the resource and the determined geographical location.

Claims

1. A location-based network security system comprising:

one or more processors; and

a non-transitory storage device coupled to the one or more processors and having embodied therein instructions representing;

a request receive module, which when executed by the one or more processors receives a resource access request from a user device relating to a resource within a protected network that is protected by the location-based network security system;

a location determination module, which when executed by the one or more processors determines a geographical location of the user device;

a request-based rule retrieval module, which when executed by the one or more processors retrieves a location-specific security rule for the resource;

a location-based authorization module, which when executed by the one or more processors authenticates the resource access request based on application of the location-specific security rule to the determined geographical location; and

a resource access module, which when executed by the one or more processors enables access to the resource by the user device based on an affirmative authentication of the resource by the location-based authorization module.

2. The location-based network security system of claim 1, wherein the geographical location of the user device is determined based on a location request sent by the network security device to the user device asking for Global Positioning System (GPS) coordinates of the user device.

3. The location-based network security system of claim 1, wherein the geographical location of the user device is sent by the user device concurrently with the resource access request.

4. The location-based network security system of claim 1, wherein location-specific security rule comprises one or more conditions for allowing access to the resource based on one or a combination of a country from which the resource access request is issued, a state from which the resource access request is issued, a city from which the resource access request is issued, a type of establishment from which the resource access request is issued, a rate of change of location of the user device, a density of people in which the user device is currently located, a distance of a location from which the resource access request is issued from a defined location, and GPS coordinates of the user device.

5. The location-based network security system of claim 1, wherein the geographical location of the user device is determined based on one or a combination of triangulation, GPS, and geo-location mapped Internet Protocol (IP) addresses.

6. The location-based network security system of claim 1, wherein when the geographical location is not determinable, the location-based network security device denies access by the user device to the resource. The location-based network security system of claim 1, wherein the location-specific security rule is configurable to allow one or more user devices to access the resource regardless of their geographical locations.

8. The location-based network security system of claim 1, wherein the geographical location of the user device is provided to the location-based network security device by an application running on the user device.

9. The location-based network security system of claim 8, wherein the application authenticates a user of the user device before providing the geographical location to the location-based network security device.

10. The location-based network security system of claim 1, wherein the user device periodically sends keep-alive messages indicating a current geographical location of the user device to enable continuous reevaluation of the location-specific security rule by the location-based network security device.

11. The location-based network security system of claim 1, wherein the resource access module is further defines parameters of access given to the user device, wherein the parameters comprise one or a combination of privileges assigned to the user device during the access, duration of access, and frequency of keep-alive messages expected.

12. The location-based network security system of claim 1, wherein the location-based network security system comprises a firewall.