System and method for validating a location of an untrusted device

• US 8,522,020 B2
• Filed: 12/03/2009
• Issued: 08/27/2013
• Est. Priority Date: 12/03/2009
• Status: Active Grant

• Current Assignee: OL Security LLC (Intellectual Ventures LLC)
• Original Assignee: Osocad Remote LLC (Intellectual Ventures LLC)
• Inventors: Gerard, Mark
• Primary Examiner(s): LOUIE, OSCAR A
• Application Number:
  US12/629,948
• Publication Number:
  US 20110138443A1
• Time in Patent Office: 1,363 Days
• Field of Search: None
• US Class Current: 713/168
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals

Abstract

In a system of mobile agents operating in a region of interest, it may be necessary to validate the position of an untrusted device prior to allowing the untrusted device to perform agent functions within the region of interest. Trusted mobile agents within the region of interest may activate wireless access points with randomly generated identifiers. The untrusted device may be instructed to provide a list of identifiers of visible wireless access points to confirm that the untrusted device is within the ROI.

Claims

1. A method, comprising:

identifying a validation requirement for an untrusted device in a region of interest in response to a participation request;

causing activation of at least one wireless access point in response to identifying the validation requirement;

requesting the untrusted device identify the at least one wireless access point in the region of interest;

receiving, from the untrusted device, a list identifying the at least one wireless access point in the region of interest with a corresponding at least one identifier;

validating the at least one wireless access point in response to the at least one identifier; and

deactivating the at least one wireless access point in response to receiving the at least one identifier from the untrusted device.

2. The method according to claim 1, wherein validating the at least one wireless access point comprises establishing the untrusted device as a trusted device based at least in part on the at least one identifier.

3. The method according to claim 2, further comprising sharing at least one agent resource with the untrusted device after establishing the untrusted device as a trusted device.

4. The method according to claim 1, wherein the participation request is configured to request approval for the untrusted device to participate with the trusted device in the region of interest.

5. The method according to claim 4, further comprising determining that the participation request is configured to indicate that the untrusted device is located within the region of interest.

6. The method according to claim 1, further comprising accessing the at least one wireless access point from a mobile device.

7. A method, comprising:

identifying a validation requirement for an untrusted device in a region of interest;

locating a trusted agent within the region of interest in response to identifying the validation requirement;

causing activation of a wireless access point associated with the trusted agent in the region of interest;

requesting the untrusted device identify the at least one wireless access point in the region of interest;

receiving, from the untrusted device, a list identifying the at least one wireless access point in the region of interest with a corresponding at least one identifier; and

validating the at least one wireless access point in response to the at least one identifier.

8. A trusted device, comprising:

a memory device configured to store instructions defining an agent application;

a processing device configured to execute the instructions stored in the memory device to;

identify a validation requirement in response to receiving a request to participate with the trusted device in a region of interest from an untrusted device;

identify a location of the untrusted device in response to receiving the request to participate from the untrusted device;

send an activation command to at least one trusted device within the region of interest causing activation of a corresponding at least one wireless access point in response to the location of the untrusted device being substantially within the region of interest;

request the untrusted device identify the at least one wireless access point;

receive, from the untrusted device, at least one wireless access point identifier configured to identify the at least one wireless access point in response to the request to identify;

determine the at least one wireless access point identifier as corresponding to the at least one wireless access point in the region of interest; and

validate the untrusted device in response to the at least one wireless access point identifier corresponding to the at least one wireless access point in the region of interest.

9. The trusted device according to claim 8, wherein the processing device is further configured to command the untrusted device to identify all wireless access points visible to the untrusted device.

10. A non-transitory computer-readable storage device comprising computer-executable instructions stored thereon that configure a processing device to perform operations comprising:

identifying a validation requirement for an untrusted device in response to receiving a participation request from the untrusted device;

instructing the untrusted device to identify at least one wireless access point visible to the untrusted device;

receiving, from the untrusted device, a list identifying the at least one wireless access point with a corresponding at least one identifier;

validating the untrusted device in response to the at least one identifier corresponding to a wireless access point in a region of interest; and

deactivating the at least one wireless access point in response to receiving the at least one identifier from the untrusted device.

11. The non-transitory computer-readable storage device of claim 10, wherein the processing device is configured to perform operations further comprising establishing the untrusted device as a trusted device in response to the at least one identifier corresponding to the wireless access point in the region of interest.

12. The non-transitory computer-readable storage device of claim 11, wherein the processing device is configured to perform operations further comprising sharing at least one agent resource with the untrusted device after establishing the untrusted device as a trusted device.

13. The non-transitory computer-readable storage device of claim 10, wherein the processing device is configured to perform operations further comprising activating the at least one wireless access point in response to identifying the validation requirement.

14. The non-transitory computer-readable storage device of claim 10, wherein the participation request is configured to request approval for the untrusted device to participate in the region of interest.

15. The non-transitory computer-readable storage device of claim 10, wherein the processing device is configured to perform operations further comprising determining that the participation request is configured to indicate that the untrusted device is located within the region of interest.

16. The non-transitory computer-readable storage device of claim 10, wherein the processing device is configured to perform operations further comprising accessing the at least one wireless access point from a mobile device.

17. A non-transitory computer-readable storage device comprising computer-executable instructions stored thereon that configure a processing device to perform operations comprising:

identifying a validation requirement for an untrusted device in response to receiving a participation request from the untrusted device;

locating each trusted agent within a region of interest in response to identifying the validation requirement;

activating any wireless access point associated with any trusted agent in the region of interest;

instructing the untrusted device to identify at least one wireless access point visible to the untrusted device;

receiving, from the untrusted device, a list identifying the at least one wireless access point with a corresponding at least one identifier; and

validating the untrusted device in response to the at least one identifier corresponding to a wireless access point in the region of interest.

18. A method, comprising:

transmitting a participation request from an untrusted device to a trusted device operating in a first region, wherein the participation request causes deactivation of a plurality of trusted wireless access points corresponding to the trusted device or at least one other trusted device located in the first region;

identifying a wireless access point located in a second region within communicable range of the untrusted device;

transmitting an identifier corresponding to the wireless access point located in the second region within communicable range of the untrusted device from the untrusted device to the trusted device; and

receiving validation from the trusted device in response to the identifier corresponding to at least one of the plurality of trusted wireless access points corresponding to the trusted device or at least one other trusted device operating in the first region;

wherein the trusted device is configured to deactivate the at least one of the plurality of trusted wireless access points in response to receiving the identifier.

19. The method of claim 18, further comprising activating the wireless access point located in the second region within communicable range of the untrusted device.

20. The method of claim 18, further comprising randomly generating the identifier each time the wireless access point located in the second region is activated.

21. The method of claim 18, further comprising transmitting a location of the untrusted device to the trusted device.

22. An untrusted device, comprising:

a memory device configured to store instructions defining an agent application;

a processing device configured to execute the instructions stored in the memory device to;

transmit a participation request from an untrusted device to a trusted device operating in a first region;

identify a wireless access point located in a second region within communicable range of the untrusted device in response to the participation request;

transmit an identifier corresponding to the wireless access point from the untrusted device to the trusted device; and

receive validation from the trusted device in response to the identifier corresponding to at least one of a plurality of wireless access points corresponding to the trusted device or at least another trusted device operating in the first region;

wherein the trusted device causes activation of the plurality of access points in response to receiving the participation request; and

wherein the trusted device is configured to cause deactivation of the plurality of wireless access points in response to receiving the identifier.

23. The untrusted device of claim 22, wherein the processing device is further configured to activate the wireless access point located in the second region using the untrusted device.

24. The untrusted device of claim 22, wherein the processing device is further configured to randomly generate the identifier each time the wireless access point located in the second region is activated.

25. The untrusted device of claim 22, wherein the processing device is further configured to transmit a location of the untrusted device to the trusted device.

26. A non-transitory computer-readable storage device comprising computer-executable instructions stored thereon that configure a processing device to perform operations comprising:

transmitting a participation request from an untrusted device to a trusted device operating in a first region;

identifying a wireless access point located within communicable range of the untrusted device in response to transmitting the participation request;

transmitting an identifier corresponding to the wireless access point from the untrusted device to the trusted device; and

receiving validation from the trusted device in response to the identifier corresponding to at least one of a plurality of wireless access points operating in the first region;

wherein the trusted device causes activation of at least one of the plurality of wireless access points in response to receiving the participation request; and

wherein the trusted device is configured to cause deactivation of the at least one of the plurality of wireless access points in response to receiving the identifier.

27. The non-transitory computer-readable storage device of claim 26, wherein the processing device is configured to perform operations further comprising activating the wireless access point within communicable range of the untrusted device using the untrusted device.

28. The non-transitory computer-readable storage device of claim 26, wherein the processing device is configured to perform operations further comprising executing a bootstrap application using the untrusted device received from the trusted device after the validation.

29. The non-transitory computer-readable storage device of claim 26, wherein the processing device is configured to perform operations further comprising randomly generating the identifier each time the wireless access point within communicable of the untrusted device is activated.

30. The non-transitory computer-readable storage device of claim 26, wherein the processing device is configured to perform operations further comprising transmitting a location of the untrusted device to the trusted device.