Wireless manager and method for configuring and securing wireless access to a network

• US 8,180,328 B2
• Filed: 12/07/2011
• Issued: 05/15/2012
• Est. Priority Date: 05/24/2004
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Computer Associates Think Inc. (Broadcom, Inc.)
• Inventors: Van De Groenendaal, Joannes G.
• Primary Examiner(s): Chang, Kent
• Assistant Examiner(s): Siddiqui, Kashif
• Application Number:
  US13/313,363
• Publication Number:
  US 20120079567A1
• Time in Patent Office: 160 Days
• Field of Search: 455406-419, 455/453, 455/456, 709/203, 709/227
• US Class Current: 455/411
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data
• CPC Class Codes: H04M 1/67 by electronic means
• CPC Class Codes: H04M 1/72406 by software upgrading or downloading
• CPC Class Codes: H04M 1/72451 according to schedules, e.g. using calendar applications
• CPC Class Codes: H04M 1/72457 according to geographic location
• CPC Class Codes: H04M 1/72463 to restrict the functionality of the device
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 12/64 using geofenced areas
• CPC Class Codes: H04W 12/73 Access point logical identity
• CPC Class Codes: H04W 4/021 Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
• CPC Class Codes: H04W 48/04 based on user or terminal location or mobility data, e.g. moving direction, speed
• CPC Class Codes: H04W 8/205 Transfer to or from user equipment or user record carrier
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

The disclosure provides a wireless manager operable to receive a request from a mobile device to wirelessly communicate with a network, wherein the request may include information to dynamically identify a location associated with the mobile device. The wireless manager may be further operable to automatically associate the mobile device with an access zone comprising one or more physical or logical characteristics, compare the location associated with the mobile device to the access zone, and authorize the mobile device to wirelessly communicate with the network if the location associated with the mobile device indicates that the mobile device does not violate the access zone.

Claims

1. A processor for executing a wireless manager to configure and secure wireless access to a network, wherein the processor is configured to:

display a graphical user interface that includes a map associated with a location in a network and multiple access points associated with the location in the network;

generate an access zone that identifies a geographic space associated with the location in the network in response to one or more inputs to the graphical user interface, wherein the one or more inputs to the graphical user interface define a polygon region that corresponds to the geographic space associated with the access zone;

triangulate a physical position associated with a client device that requested wireless access to the network relative to the geographic space associated with the access zone, wherein the access zone includes one or more security parameters that control wireless access to the network relative to the geographic space associated with the access zone; and

authorize the client device to wirelessly access the network if the physical position associated with the client device does not violate the one or more security parameters associated with the access zone that control wireless access to the network.

2. The processor recited in claim 1, wherein the processor is further configured to receive one or more signal strength measurements associated with the client device from one or more of the multiple access points associated with the location in the network, wherein the client device connected to the one or more of the multiple access points to request the wireless access to the network.

3. The processor recited in claim 2, wherein the processor is further configured to execute a three-dimensional calculation with a projection onto a two-dimensional x-y plane based on the one or more signal strength measurements to triangulate the physical position associated with the client device based on the projection onto the two-dimensional x-y plane and a z-axis height associated with the one or more of the multiple access points.

4. The processor recited in claim 3, wherein the location in the network includes a building, the z-axis height associated with the one or more of the multiple access points depends on a floor in the building associated with the one or more of the multiple access points, and the triangulated physical position associated with the client device combines the projection onto the two-dimensional x-y plane with a desk height on the floor in the building associated with the one or more of the multiple access points.

5. The processor recited in claim 2, wherein the processor is further configured to use one or more matrix algorithms to calculate an expected x, y, z position associated with the client device with a projection onto a two-dimensional x-y plane based on the one or more signal strength measurements to triangulate the physical position associated with the client device based on the projection onto the two-dimensional x-y plane and sixty-degree sectors associated with the one or more of the multiple access points.

6. The processor recited in claim 2, wherein the processor is further configured to use one or more matrix algorithms to calculate an expected x, y, z position associated with the client device with a projection onto a two-dimensional x-y plane based on the one or more signal strength measurements to triangulate the physical position associated with the client device based on the projection onto the two-dimensional x-y plane and propagation models that address frequencies associated with the one or more of the multiple access points.

7. The processor recited in claim 1, wherein the physical position associated with the client device does not violate the one or more security parameters that control wireless access to the network if the physical position associated with the client device is inside the geographic space associated with the access zone.

8. The processor recited in claim 7, wherein the processor is further configured to cause a wireless agent executing on the client device to disable wireless access to the network if the client device exits the geographic space associated with the access zone.

9. The processor recited in claim 1, wherein the physical position associated with the client device violates the one or more security parameters that control wireless access to the network if the physical position associated with the client device is inside the geographic space associated with the access zone.

10. A method for configuring and securing wireless access to a network, comprising:

displaying a graphical user interface that includes a map associated with a location in a network and multiple access points associated with the location in the network;

generating, by a processor executing a wireless manager, an access zone that identifies a geographic space associated with the location in the network in response to one or more inputs to the graphical user interface that define a polygon region that corresponds to the geographic space associated with the access zone;

triangulating, by the processor executing the wireless manager, a physical position associated with a client device that requested wireless access to the network relative to the geographic space associated with the access zone, wherein the access zone includes one or more security parameters that control wireless access to the network relative to the geographic space associated with the access zone; and

authorizing, by the processor executing the wireless manager, the client device to wirelessly access the network if the physical position associated with the client device does not violate the one or more security parameters associated with the access zone that control wireless access to the network.

11. The method recited in claim 10, further comprising receiving, at the processor executing the wireless manager, one or more signal strength measurements associated with the client device from one or more of the multiple access points associated with the location in the network, wherein the client device connected to the one or more of the multiple access points to request the wireless access to the network.

12. The method recited in claim 11, further comprising executing, on the processor, a three-dimensional calculation with a projection onto a two-dimensional x-y plane based on the one or more signal strength measurements to triangulate the physical position associated with the client device based on the projection onto the two-dimensional x-y plane and a z-axis height associated with the one or more of the multiple access points.

13. The method recited in claim 12, wherein the location in the network includes a building, the z-axis height associated with the one or more of the multiple access points depends on a floor in the building associated with the one or more of the multiple access points, and the triangulated physical position associated with the client device combines the projection onto the two-dimensional x-y plane with a desk height on the floor in the building associated with the one or more of the multiple access points.

14. The method recited in claim 11, further comprising using, by the processor, one or more matrix algorithms to calculate an expected x, y, z position associated with the client device with a projection onto a two-dimensional x-y plane based on the one or more signal strength measurements to triangulate the physical position associated with the client device based on the projection onto the two-dimensional x-y plane and sixty-degree sectors associated with the one or more of the multiple access points.

15. The method recited in claim 11, further comprising using, by the processor, one or more matrix algorithms to calculate an expected x, y, z position associated with the client device with a projection onto a two-dimensional x-y plane based on the one or more signal strength measurements to triangulate the physical position associated with the client device based on the projection onto the two-dimensional x-y plane and propagation models that address frequencies associated with the one or more of the multiple access points.

16. The method recited in claim 10, wherein the physical position associated with the client device does not violate the one or more security parameters that control wireless access to the network if the physical position associated with the client device is inside the geographic space associated with the access zone.

17. The method recited in claim 16, further comprising causing, by the processor, a wireless agent executing on the client device to disable wireless access to the network if the client device exits the geographic space associated with the access zone.

18. The method recited in claim 10, wherein the physical position associated with the client device violates the one or more security parameters that control wireless access to the network if the physical position associated with the client device is inside the geographic space associated with the access zone.