System for device-access policy enforcement

• US 7,631,089 B2
• Filed: 12/31/2002
• Issued: 12/08/2009
• Est. Priority Date: 12/31/2002
• Status: Expired due to Fees

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Knauerhase, Robert C., Robinson, Scott H.
• Primary Examiner(s): Abdullahi; Salad
• Assistant Examiner(s): Burgess; Barbara N
• Application Number:
  US10/335,091
• Publication Number:
  US 20040128394A1
• Time in Patent Office: 2,534 Days
• Field of Search: 709/203, 709/219, 709/223, 709/224, 709/225, 709/227, 709/232, 709/229, 710/303, 718/1, 718/104, 320/107, 455/343.1, 726/17, 726/18
• US Class Current: 709/229
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/30 Profiles
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04L 67/54 Presence management, e.g. monitoring or registration for receipt of user log-on information, or the connection status of the users
• CPC Class Codes: H04L 67/60 Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Embodiments of the invention include an access policy enforcement system for a system that provides services to other devices. As a service-providing device changes environments, or mobile states, access to the device'"'"'s services is automatically and transparently limited or expanded. One aspect of the access policy determines the particular state in which the service-providing device is operating. Another aspect uses the determined state to dictate which services will be available to other devices.

Claims

1. An access policy enforcement system, comprising:

a service providing device, including;

an environment state detector for determining a present environment state from a plurality of predetermined environment states in which a mobile computing device that is structured to provide one or more services to a second device is operating, wherein the environment state detector comprises;

an input for receiving one or more state factors; and

a state selector for determining which of the plurality of predetermined environment states is the present environment state based on the one or more state factors received at the input; and

an access gate structured to prohibit or allow access to selected of the one or more services based on the present environment state; and

wherein the present environment state includes a type of network connectivity, a type of network environment, a type of power source, an amount of power remaining, a location, and presence or absence of trusted peers, and

wherein the access gate is structured to provide a first access level to services provided by the mobile computing device when the mobile computing device is operatively coupled to a public access network, to provide a second access level to services provided by the mobile computing device when the mobile computing device is operatively coupled to a wireless network, and to provide a third access level to services provided by the mobile computing device when the mobile computing device is operatively coupled to a wired network.

2. The access policy enforcement system of claim 1 wherein one of the one or more state factors is a speed of a network to which the mobile computing device is coupled.

3. The access policy enforcement system of claim 1 wherein one of the one or more state factors is a trust level between the mobile computing device and the second device.

4. The access policy enforcement system of claim 1 wherein the environment state detector is structured to initiate requests for the one or more state factors.

5. The access policy enforcement system of claim 1 wherein the access gate comprises a firewall.

6. The access policy enforcement system of claim 1 wherein the access gate comprises a service directory.

7. The access policy enforcement system of claim 1, wherein the first access level is more restrictive than the second access level, and the second access level is more restrictive than the third access level.

8. The access policy enforcement system of claim 1, wherein the public access network comprises one of a second wireless network and a second wired network.

9. A mobile computer system for providing services to a second device, the mobile computer system comprising:

a microprocessor structured to execute instructions that cause services to be provided to the second device;

a main memory coupled to the microprocessor and structured to store data and programs for use by the microprocessor;

a communication module coupled to the microprocessor and to the main memory, the communication module structured to transfer data between the mobile computer system and the second device; and

an access policy enforcement system operable on the mobile computer system, the access policy enforcement system including;

an environment state detector for determining a present environment state from a plurality of predetermined environment states in which the mobile computer system is operating, wherein the environment state detector comprises;

an input for receiving one or more environment factors; and

a state selector for determining which of the plurality of predetermined environment states is the present environment state based on the one or more environment factors received at the input, and

an access gate structured to prohibit or allow access to one or more selected services based on the present environment state; and

wherein the present environment state includes a type of network connectivity, a type of network environment, a type of power source, an amount of power remaining, a location, and presence or absence of trusted peers, and

wherein the access gate is structured to provide a first access level to services provided by the mobile computing system when the mobile computing system is operatively coupled to a public access network, to provide a second access level to services provided by the mobile computing system when the mobile computing device is operatively coupled to a wireless network, and to provide a third access level to services provided by the mobile computing system when the mobile computing device is operatively coupled to a wired network.

10. The mobile computer system of claim 9 wherein the environment state detector is structured to initiate requests for the one or more environment factors.

11. The mobile computer system of claim 9 wherein the environment state detector is structured to periodically acquire one or more environment factors.

12. The mobile computer system of claim 9 wherein the access gate comprises a firewall.

13. The mobile computer system of claim 9 wherein the access policy enforcement system is structured to operate in a first virtual machine on the mobile computer system.

14. The mobile computer system of claim 13, further comprising a second virtual machine that includes a second access policy enforcement system.

15. A method for tailoring services, comprising:

a service providing device determining a present operating environment state of a mobile device, wherein determining the present operating environment state of the mobile device comprises;

accepting one or more environmental factors; and

determining the present operating environment state from the one or more environmental factors;

comparing services presently offered by the mobile device to those services appropriate for the present operating environment state; and

prohibiting or allowing access to the services presently offered by the mobile device to a second device such that services offered by the mobile device to the second device are appropriate for the present operating environment state;

providing a first access level to services provided by the mobile device when the mobile device is operatively coupled to a public access network;

providing a second access level to services provided by the mobile device when the mobile device is operatively coupled to a wireless network; and

providing a third access level to services provided by the mobile device when the mobile device is operatively coupled to a wired network.

wherein the present operating environment state includes a type of network connectivity, a type of network environment, a type of power source, an amount of power remaining, a location, and presence or absence of trusted peers.

16. The method of claim 15 wherein determining the present operating environment comprises matching one of a number of predetermined environments to the one or more environmental factors.

17. The method of claim 15 wherein accepting one or more environmental factors comprises polling one or more components of the mobile device for a present state.

18. The method of claim 15 wherein accepting one or more environmental factors comprises performing an interrupt service routine.

19. The method of claim 15 wherein prohibiting or allowing access to the services presently offered by the mobile device comprises changing states of one or more ports in a firewall.

20. An article comprising a data storage medium having associated data that, when accessed, results in a machine:

determining a present operating environment state of a mobile machine, wherein determining the present operating environment state of the mobile machine comprises;

accepting one or more environmental factors; and

determining the present operating environment state from the one or more environmental factors;

comparing services presently offered by the mobile machine to those services appropriate for the present operating environment state; and

prohibiting or allowing access to the services presently offered by the mobile machine to a second device such that services offered by the mobile machine to the second device are appropriate for the present operating environment state;

providing a first access level to services provided by the mobile machine when the mobile machine is operatively coupled to a public access network;

providing a second access level to services provided by the mobile machine when the mobile machine is operatively coupled to a wireless network; and

providing a third access level to services provided by the mobile machine when the mobile machine is operatively coupled to a wired network,

wherein the present operating environment state includes a type of network connectivity, a type of network environment, a type of power source, an amount of power remaining, a location, and presence or absence of trusted peers.

21. The article of claim 20 wherein prohibiting or allowing access to the services presently offered by the mobile machine comprises changing states of one or more ports in a firewall.