Apparatus and method for location based wireless client authentication

• US 6,978,023 B2
• Filed: 03/25/2003
• Issued: 12/20/2005
• Est. Priority Date: 03/25/2003
• Status: Expired due to Term

• Current Assignee: Sony Corporation (Sony Group Corp.), Sony Electronics Inc. (Sony Group Corp.)
• Original Assignee: Sony Corporation (Sony Group Corp.), Sony Electronics Inc. (Sony Group Corp.)
• Inventors: Dacosta, Behram Mario
• Primary Examiner(s): Darrow, Justin T.
• Application Number:
  US10/397,934
• Publication Number:
  US 20040190718A1
• Time in Patent Office: 1,001 Days
• Field of Search: 380/258, 380/270, 380/272, 713/168, 713/201, 455/421, 455/422, 455/425, 455/432, 455/433, 455/456.1, 455/456.6, 455/440
• US Class Current: 380/258
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/64 using geofenced areas
• CPC Class Codes: H04W 64/00 Locating users or terminals or network equipment for network management purposes, e.g. mobility management
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

An apparatus and method for location based wireless client authentication is described. The method includes the receipt of an authentication/access request from a wireless client desiring access to a wireless network. Once the request is received, a spatial location of the client is identified. Once the physical location of the client is identified, compliance with the authentication/access request is performed according to the identified spatial location of the device. For example, in one embodiment, when the spatial location of the client falls within predefined wireless network boundaries, the client is generally granted network access. The granted access may include a possible key exchange for unidentified clients, or challenge and response authentication for identified clients. In other words, wireless clients that have gained access to a certain physical location are assumed to have passed through some other form of physical authentication and, hence, are deemed trustable.

Claims

1. A method comprising:

receiving, from a wireless client, a request for access to a wireless network;

identifying, by a wireless network access point, a spatial location of the wireless client; and

authenticating, by the wireless network access point, the wireless client, according to the identified spatial location of the wireless client.

2. The method of claim 1, wherein authenticating the wireless client further comprises:

comparing the identified spatial location of the wireless client with predetermined wireless network boundaries;

when the wireless client is physically located within the predetermined wireless network boundaries, responding to an authentication request received from the wireless client; and

otherwise, disregarding the authentication request.

3. The method of claim 2, responding to the authentication request comprises:

engaging in a challenge and response authentication with the wireless client based on commonly shared keys to authenticate the wireless client; and

granting the wireless client access to the wireless network if the wireless client is authenticated according to the challenge and response authentication.

4. The method of claim 1, wherein the method, prior to receiving the request for access, further comprises:

receiving one or more values identifying wireless network boundaries; and

processing the received values to establish an internal representation of the wireless network boundaries.

5. The method of claim 1, wherein identifying the spatial location of the wireless client further comprises:

determining a signal strength of a received signal used to communicate the authentication request from the wireless client;

calculating multipath and radio frequency (RF) propagation values according to one or more predetermined characteristics of the received signal; and

identifying an approximate spatial location of the wireless client according to the signal strength and the calculated multipath and RF propagation values.

6. The method of claim 1, wherein identifying the spatial location of the wireless client further comprises:

determining coordinates of the spatial location of the wireless client using a geographic positioning system (GPS).

7. The method of claim 1, wherein authenticating the wireless client further comprises:

converting an approximate spatial location of the wireless client into one or more coordinate values;

comparing the one or more coordinate values to an internal representation of wireless network boundaries;

when the one or more coordinate values falls within the internal representation of the wireless network boundaries, authenticating the wireless client; and

otherwise, sending a reply to the wireless client denying access to the wireless network.

8. The method of claim 1, wherein authenticating the wireless client further comprises:

determining whether the wireless client has previously communicated with the network according to an identification value of the wireless client;

when the wireless client is identified as having previously established communication with the wireless network, granting wireless network access to the wireless client if the spatial location of the wireless client is within predetermined wireless network boundaries; and

otherwise, performing a shared key exchange with the wireless client to enable shared key authentication during subsequent authentication requests from the wireless client, and

granting the wireless client access to the wireless network, if the spatial location of the wireless client is within the predetermined wireless network boundaries.

9. The method of claim 1, wherein authenticating the wireless client further comprises:

engaging in a challenge and response authentication of the wireless client when the wireless device is physically located within predetermined wireless network boundaries.

10. The method of claim 1, further comprising:

monitoring a current spatial location of the wireless client when movement of the wireless device is detected; and

terminating communication with the wireless device once the current spatial location of the wireless device is outside predetermined network boundaries.

11. A machine readable medium including software executed by at least one processor, within an electronic device, the software comprising:

an identification module to identify a spatial location of a wireless client if a request for access to a wireless network is received from the wireless client; and

an authentication module to authenticate the wireless client, according to the identified spatial location of the wireless client, wherein the identification module determines a signal strength of a received signal used to communicate the request from the wireless client, calculates multipath and radio frequency (RF) propagation values according to one or more predetermined characteristics of the received signal, and identifies an approximate spatial location of the wireless client according to the signal strength and the calculated multipath and RE propagation values.

12. The machine readable storage medium of claim 11, wherein the authentication module responds to an authentication request received from the wireless client if the wireless client is physically located within predetermined wireless network boundaries, and otherwise, disregards the received authentication request.

13. The machine readable medium of claim 12, wherein the authentication module

engages in a challenge and response authentication with the wireless client based on commonly shared keys to authenticate the wireless client.

14. The machine readable medium of claim 11, wherein the software further comprises:

a network boundary module to process one or more received values identifying wireless network boundaries to establish an internal representation of the wireless network boundaries prior to receiving access requests.

15. The machine readable medium of claim 11, wherein the identification module determines coordinates of the spatial location of the wireless client using a geographic positioning system (GPS).

16. The machine readable storage medium of claim 11, wherein the authentication module converts an approximate spatial location of the wireless client into one or more coordinate values, compares the one or more coordinate values to an internal representation of wireless network boundaries, authenticates the wireless client if the one or more coordinate values falls within the internal representation of the wireless network boundaries, and otherwise, sends a reply to the wireless client denying access to the wireless network.

17. The machine readable storage medium of claim 11, wherein the authentication module grants wireless network access to the wireless client if the spatial location of the wireless client is within predetermined wireless network boundaries and if the wireless client is identified as not having previously established communication with the wireless network, performs a shared key exchange with the wireless device to enable shared key authentication during subsequent authentication requests from the wireless client.

18. The machine readable storage medium of claim 11, wherein the authentication module engages in a challenge and response authentication of the wireless client if the wireless client is physically located within predetermined wireless network boundaries.

19. The machine readable storage medium of claim 11, wherein software further comprises:

a motion detection module to monitor a current spatial location of the wireless client if movement of the wireless client is detected, and terminate communication with the wireless client once the current spatial location of the wireless client is outside predetermined network boundaries.

20. A base station comprising:

a communication interface to receive an authentication request being a request from a wireless client requesting network access; and

circuitry coupled to the communications interface, the circuitry comprising authentication logic to respond to the authentication request when an identified spatial location of the wireless client falls within predetermined network boundaries.

21. The apparatus of claim 20, wherein the authentication logic of the circuitry further comprises:

device location detection logic to identify a relative/spatial location of wireless clients requesting network access.

22. The apparatus of claim 20, wherein the authentication logic of the circuitry further comprises:

network boundary identification logic to generate an internal representation of the network boundaries according to received coordinate values.

23. The apparatus of claim 20, further comprising:

a remote control device to capture coordinate values of network boundaries and provide the coordinate values to boundary identification logic of the authentication logic.

24. The apparatus of claim 21, wherein the device location detection logic of the circuitry includes a geographic positioning system to identify the spatial location of wireless devices requesting network access.

25. A system comprising:

a wireless local area network (WLAN) having predetermined wireless network boundaries; and

a station located within the predetermined wireless network boundaries, the station including authentication logic circuitry to respond to an authentication request being a network access request from a wireless client when an identified spatial location of the wireless client falls within the predetermined wireless network boundaries.

26. The system of claim 25, wherein the authentication logic circuitry further comprises:

device location detection logic to identify a relative/spatial location of wireless devices requesting network access.

27. The system of claim 25, wherein the authentication logic further comprises:

network boundary identification logic to generate an internal representation of the network boundaries according to received coordinate values.

28. The system of claim 25, further comprising:

a remote control device to capture coordinate values of the network boundaries and provide the coordinate values to boundary identification logic of the authentication logic.

29. The system of claim 25, wherein the station further comprises:

a communications interface including an adaptive antenna array to enable directional communication with authenticated wireless clients to reduce communication interception by unauthenticated wireless clients.

34. The system of claim 25, wherein the station comprises an access point of the WLAN.

30. A method comprising:

receiving, from a wireless client, a request for access to a wireless network;

identifying, by a wireless network access point, a spatial location of the wireless client;

authenticating, by the wireless network access point, the wireless client according to the identified spatial location of the wireless client; and

granting, by the wireless network access point, the wireless client according to the wireless client access to the wireless network if the wireless client is authenticated according to the identified spatial location of the wireless client.

31. The method of claim 30, wherein authenticating the wireless further comprises:

engaging in a challenge and response authentication with the wireless client based on commonly shared keys to authenticate the wireless client, if the identified spatial location of the wireless client indicates that the wireless client is located within predetermined wireless network boundaries.

32. The method of claim 30 wherein authenticating the wireless client further comprises:

establishing authentication of the wireless client to grant the request for access to the wireless network if the identified spatial location of the wireless client indicates that the wireless client is physically located within predetermined wireless network boundaries.

33. The method of claim 30 wherein the wireless network is a wireless local area network.