Apparatus and method for location-based access control in wireless networks

• US 8,350,666 B2
• Filed: 10/12/2009
• Issued: 01/08/2013
• Est. Priority Date: 10/15/2008
• Status: Active Grant

• Current Assignee: Honeywell International Inc.
• Original Assignee: Honeywell International Inc.
• Inventors: Kore, Vinayak S.
• Primary Examiner(s): MULLEN, THOMAS J
• Application Number:
  US12/577,675
• Publication Number:
  US 20100164720A1
• Time in Patent Office: 1,184 Days
• Field of Search: 340/5.2, 340/10.1, 340/10.5, 455/410, 455/411, 455/421, 370/310, 342/450, 709/225
• US Class Current: 340/5.2
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/021 Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
• CPC Class Codes: H04W 4/026 using orientation information, e.g. compass
• CPC Class Codes: H04W 4/029 Location-based management or tracking services
• CPC Class Codes: H04W 48/04 based on user or terminal location or mobility data, e.g. moving direction, speed
• CPC Class Codes: H04W 64/00 Locating users or terminals or network equipment for network management purposes, e.g. mobility management

Abstract

A method includes receiving wireless signals from a device at a wireless access point associated with a wireless network. The method also includes estimating a location of the device and determining whether the estimated location is within a specified area. In addition, the method includes allowing the device to communicate over the wireless network in response to determining that the estimated location is within the specified area. Estimating the device'"'"'s location could include estimating a direction of the device with respect to the wireless access point and/or estimating a distance of the device from the wireless access point. Estimating the direction of the device could include using a direction of arrival of at least one wireless message received at the wireless access point from the device. Estimating the distance of the device could include transmitting multiple messages to the device at different power levels and receiving one or more responses from the device.

Claims

1. A method comprising:

receiving wireless signals from a device at a wireless access point associated with a wireless network;

estimating a location of the device;

determining whether the estimated location of the device is within a specified area; and

allowing the device to communicate over the wireless network in response to determining that the estimated location of the device is within the specified area;

wherein estimating the location of the device comprises;

estimating a direction of the device with respect to the wireless access point using a direction of arrival of at least one wireless message received at the wireless access point from the device; and

estimating a distance of the device from the wireless access point by transmitting multiple messages to the device at different power levels and receiving one or more responses from the device.

2. The method of claim 1, wherein the multiple messages are transmitted to the device at random times;

and

further comprising disqualifying the device from communicating over the wireless network when the device fails to transmit at least one of the responses to the wireless access point within a specified time period.

3. The method of claim 1, further comprising:

requesting information about the device from a second wireless access point; and

receiving the information about the device from the second wireless access point.

4. The method of claim 3, wherein the information about the device from the second wireless access point comprises an estimated direction of the device with respect to the second wireless access point.

5. The method of claim 1, further comprising:

transmitting a beacon from the wireless access point;

wherein the device transmits at least some of the wireless signals to the wireless access point in response to receiving the beacon.

6. The method of claim 1, further comprising:

displaying the estimated location of the device on a map associated with the specified area; and

receiving information verifying the device based on the displayed estimated location of the device from a user.

7. A method comprising:

receiving wireless signals from a device at a wireless access point associated with a wireless network;

estimating a location of the device;

determining whether the estimated location of the device is within a specified area; and

allowing the device to communicate over the wireless network in response to determining that the estimated location of the device is within the specified area;

wherein allowing the device to communicate over the wireless network comprises;

wirelessly transmitting configuration information to the device using directional beams; and

configuring the device based on the configuration information.

8. A method comprising:

receiving wireless signals from a device at a wireless access point associated with a wireless network, wherein the device comprises a mobile device;

estimating a location of the device;

determining whether the estimated location of the device is within a specified area;

allowing the device to communicate over the wireless network in response to determining that the estimated location of the device is within the specified area;

continuously estimating the location of the mobile device;

determining whether the estimated location of the mobile device is in a restricted area within the specified area; and

when the estimated location of the mobile device is in the restricted area, at least one of;

disabling the mobile device, powering down the mobile device, and notifying security personnel.

9. An apparatus comprising:

a wireless interface configured to receive wireless signals from a device attempting to communicate over a wireless network; and

a controller configured to estimate a location of the device and to allow the device to join the wireless network based on a determination that the estimated location of the device is within a specified area;

wherein the controller is configured to estimate the location of the device by;

estimating a direction of the device with respect to the apparatus using a direction of arrival of at least one wireless message received at the apparatus from the device; and

estimating a distance of the device from the apparatus by initiating transmission of multiple messages to the device at different power levels and analyzing one or more responses received from the device.

10. The apparatus of claim 9, wherein:

the controller is further configured to initiate transmission of a request for information about the device to a wireless access point; and

the wireless interface is configured to receive the information about the device from the wireless access point.

11. The apparatus of claim 10, wherein the information about the device from the wireless access point comprises an estimated direction of the device with respect to the wireless access point.

12. The apparatus of claim 10, wherein the controller is configured to initiate transmission of multiple requests for information about the device to multiple wireless access points at multiple times.

13. The apparatus of claim 9, wherein:

the controller is further configured to initiate transmission of a request for information about the device to one or more established end points;

the wireless interface is configured to receive the information about the device from the one or more established end points, the information determined by the one or more established end points; and

the controller is configured to estimate the location of the device using the information about the device from the one or more established end points.

14. The apparatus of claim 9, wherein:

the apparatus is configured to transmit the multiple messages to the device at random times; and

the controller is further configured to disqualify the device from communicating over the wireless network when the device fails to transmit at least one of the responses to the apparatus within a specified time period.

15. The apparatus of claim 9, wherein the controller is configured to allow the device to communicate over the wireless network by initiating wireless transmission of configuration information to the device using directional beams.

16. The apparatus of claim 9, wherein:

the device comprises a mobile device; and

the controller is further configured to;

continuously estimate the location of the mobile device;

determine whether the estimated location of the mobile device is in a restricted area within the specified area; and

when the estimated location of the mobile device is in the restricted area, at least one of;

disable the mobile device, power down the mobile device, and notify security personnel.

17. An apparatus comprising:

a wireless interface configured to receive wireless signals from a device attempting to communicate over a wireless network; and

a controller configured to estimate a location of the device and to allow the device to join the wireless network based on a determination that the estimated location of the device is within a specified area;

wherein the controller is further configured to repeatedly estimate the location of the device, the device comprising an original device, and to allow a replacement device to access the wireless network in place of the original device only in response to user input indicating that the original device has failed.

18. A non-transitory computer readable medium embodying a computer program, the computer program comprising computer readable program code for:

estimating, at a wireless access point associated with a wireless network, a location of a device attempting to access the wireless network;

determining whether the estimated location of the device is within a specified area; and

allowing the device to communicate over the wireless network in response to determining that the estimated location of the device is within the specified area;

wherein the computer readable program code for estimating the location of the device comprises computer readable program code for;

estimating a direction of the device with respect to the wireless access point using a direction of arrival of at least one wireless message from the device; and

estimating a distance of the device from the wireless access point by initiating transmission of multiple messages to the device at different power levels and analyzing one or more responses received from the device.

19. The computer readable medium of claim 18, wherein:

the computer readable program code for estimating the distance of the device from the wireless access point comprises computer readable program code for initiating transmission of multiple messages to the device at random times; and

the computer program further comprises computer readable program code for disqualifying the device from communicating over the wireless network when the device fails to transmit at least one of the responses to the wireless access point within a specified time period.

20. The computer readable medium of claim 18, wherein:

the device comprises a mobile device; and

the computer program further comprises computer readable program code for;

continuously estimating the location of the mobile device;

determining whether the estimated location of the mobile device is in a restricted area within the specified area; and

when the estimated location of the mobile device is in the restricted area, at least one of;

disabling the mobile device, powering down the mobile device, and notifying security personnel.