System and method for filtering access points presented to a user and locking onto an access point

• US 9,237,514 B2
• Filed: 07/07/2005
• Issued: 01/12/2016
• Est. Priority Date: 02/28/2003
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Beachem, Brent, Nault, Gabe, Rollins, Richard, Wood, Jonathan Brett, Wright, Michael, Boucher, Peter
• Primary Examiner(s): Sivji, Nizar
• Application Number:
  US11/176,999
• Publication Number:
  US 20060094400A1
• Time in Patent Office: 3,841 Days
• Field of Search: 455/566, 455/432.1
• US Class Current: 1/1
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04M 7/121 Details of network access arrangements or protocols
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services
• CPC Class Codes: H04W 48/20 Selecting an access point
• CPC Class Codes: H04W 76/20 Manipulation of established connections
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 92/10 between terminal device and access point, i.e. wireless air interface

Abstract

The present invention filters access points presented to a user and locks onto an access point. The present invention includes an access point filtering unit and an access point locking unit. The access point filtering unit determines the access points that are accessible by a client device and then filters them to present only the access points that are acceptable to under a security policy in force. The access point locking unit has a plurality of operating modes and can lock onto a user selected access point, a security policy prescribed access point, or the access point with the best signal profile. The present invention also includes several methods such as: a method for filtering access points for presentation to the user, a method for locking onto an access point selected by the user, a method for locking onto an access point with the best signal profile, and a method for locking onto an access point prescribed by a security policy for a given location.

Claims

1. A method for connecting to an access point by a mobile computing device, the method comprising:

determining all available access points for a present location of the mobile computing device;

filtering out access points of the all available access points that do not comply with a predetermined security policy;

making available for connection to the mobile computing device only those access points of the determined said all available access points that comply with the predetermined security policy;

determining a signal profile for at least two of the only those access points that comply with the predetermined security policy;

connecting the mobile computing device to one access point selected from the only those access points that said comply with the predetermined security policy and having a most desirable profile of the at least two determined signal profiles;

locking a computing connection between the mobile computing device and the one access point, wherein said locking is performed by changing an appearance of competing access points; and

maintaining the computing connection as the mobile computing device moves from the present location despite another access point having a presently stronger strength of signal.

2. The method of claim 1, wherein said locking is performed until a signal profile between the mobile computing device and the access point falls below a predetermined threshold.

3. The method of claim 2, wherein the signal profile includes one from the group of:

signal strength, communication protocol, encryption type, encryption key length, service set identifier (SSID), media access control (MAC) address, authentication method and other information about the communication channel.

4. The method of claim 1, wherein said locking is performed until a request to perform a clear network environment operation is received, a location change for the mobile computing device is detected, or a request to change location operation is received.

5. The method of claim 1, further including:

of the all available access points, displaying to the user said only those access points that for the present location said comply with the predetermined security policy;

receiving a selected access point selected by the user from the displaying; and

connecting the mobile computing device to the selected access point.

6. The method of claim 1 wherein the signal profile includes one from the group signal strength, communication protocol, encryption type, encryption key length, service set identifier (SSID), media access control (MAC) address, and other information about the communication channel.

7. The method of claim 6, wherein the most desirable signal profile is determined based on encryption type and signal strength.

8. The method of claim 6, wherein the most desirable signal profile is determined based on communication protocol and signal strength.

9. The method of claim 1, wherein the making available further includes providing to a user of the mobile computing device a group of permitted access points for the present location that the mobile computing device may be connected to under the predetermined security policy.

10. A method for connecting to an access point by a mobile computing device, the method comprising:

by a computing device other than the mobile computing device, determining all available access points for a present location of the mobile computing device;

by the computing device other than the mobile computing device, filtering the all available access points for the present location to a subset group of permitted access points for the present location that the mobile computing device may be connected to, wherein the filtering comprises filtering out access points of the all available access points that are not permitted access points;

providing only the subset group of permitted access points from the computing device to the mobile computing device;

determining a signal profile for at least two access points of the subset group of permitted access points;

connecting the mobile computing device to one access point from the subset group of permitted access points having a most desirable profile of the at least two determined signal profiles; and

locking a computing connection between the mobile computing device and the one access point, wherein said locking is performed by changing an appearance of competing access points.

11. The method of claim 10, wherein the filtering further comprises determining which access points of the all available access points comply with a predetermined security policy for the present location of the mobile computing device.

12. The method of claim 10, further comprising locking a

computing connection between the mobile computing device and the one access point from the subset group of permitted access points;

and

maintaining the computing connection as the mobile computing device moves from the present location despite another access point from the subset group of permitted access points having a presently stronger strength of signal.

13. The method of claim 10, further including:

displaying the subset group of permitted access points for the present location to a user;

receiving a selected access point selected by the user from the subset group of permitted access points; and

connecting the mobile computing device to the selected access point.

14. A mobile computing device comprising one or more processors, and a non-transitory computer readable memory operatively connected to each other, the memory storing instructions for the one or more processors for:

determining a present location of the mobile computing device;

determining a security policy for the mobile computing device;

enforcing the security policy on the mobile computing device based on the present location;

determining all accessible access points that are accessible by the mobile computing device;

without a user'"'"'s intervention, filtering out access points of the all accessible access points that do not comply with the security policy for the mobile computing device;

making available to the user for connecting the mobile computing device only those access points of the all accessible access points that comply with the security policy of the mobile computing device;

determining a signal profile for at least two of the only those access points that comply with the security policy;

connecting the mobile computing device to one access point selected from the only those access points that comply with the security policy and having a most desirable profile of the at least two determined signal profiles; and

locking a computing connection between the mobile computing device and the one access point, wherein said locking is performed by changing an appearance of competing access points.

15. The mobile computing device of claim 14, the memory further comprising instructions for:

locking communication between one of the only those access points that said comply with the security policy and the mobile computing device so that as the mobile computing device moves from the present location the mobile computing device will not connect to another access point of the only those access point that said comply with the security policy having a presently stronger signal strength.

16. A mobile computing device comprising one or more processors, and a non-transitory computer readable memory operatively connected to each other, the memory storing instructions for the one or more processors for:

determining a present location of the mobile computing device;

enforcing a predetermined security policy on the mobile computing device based on the present location, wherein enforcing the predetermined security policy comprises filtering out access points that do not comply with the predetermined security policy;

determining a signal profile for at least two of the only available access points complying with the predetermined security policy;

connecting the mobile computing device to one access point selected from the only available access points complying with the predetermined security policy and having a most desirable profile of the at least two determined signal profiles; and

locking communication between the mobile computing device and one access point of only available access points complying with the predetermined security policy so that the mobile computing device will not connect to another access point of the only available access points complying with the predetermined security policy having a presently stronger signal strength, wherein said locking is performed by changing an appearance of competing access points.

17. The mobile computing device of claim 16, wherein the mobile computing device can lock onto the one access point based on a plurality of operating modes, and the one access point can be a user selected access point, a security policy prescribed access point, or an access point of the many available access points with a best signal profile.

18. The mobile computing device of claim 17, wherein the best signal profile refers to a combination of two from the group of:

a protocol used for communication, a type of encryption used, a key length for encryption, an authentication method, and a wireless signal strength.