Location based access

• US 9,516,503 B2
• Filed: 10/31/2013
• Issued: 12/06/2016
• Est. Priority Date: 10/31/2013
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Aruba Networks Incorporated (Hewlett-Packard Enterprise Company)
• Inventors: Berns, Adam Michael, Cheeniyil, Santhosh, Kidambi, Madhava K., Shah, Varun A.
• Primary Examiner(s): Mehedi, Morshed
• Assistant Examiner(s): Alata, Ayoub
• Application Number:
  US14/069,050
• Publication Number:
  US 20150121465A1
• Time in Patent Office: 1,132 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G07C 2209/63 Comprising locating means for detecting the position of the data carrier, i.e. within the vehicle or within a certain distance from the vehicle
• CPC Class Codes: G07C 9/00 Individual registration on entry or exit
• CPC Class Codes: G07C 9/00174 Electronically operated locks; Circuits therefor; Nonmechanical keys therefor, e.g. passive or active electrical keys or other data carriers without mechanical keys mechanical locks with electric permutation E05B49/00; arrangements for sensing or reading record carriers G06K7/00; electronic switching H03K17/00
• CPC Class Codes: G07C 9/20 involving the use of a pass
• CPC Class Codes: G07C 9/28 the pass enabling tracking or indicating presence
• CPC Class Codes: G07C 9/30 not involving the use of a pass
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/64 using geofenced areas
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/021 Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
• CPC Class Codes: H04W 4/025 using location based information parameters

Abstract

A non-transitory computer readable medium for location based access includes instructions which, when executed by one or more devices, causes performance of operations including identifying a physical location of a client device, determining that the physical location of the client device meets a criterion for allowing access through an entryway, identifying a permission level associated with the client device, determining that the permission level associated with the client device meets a criterion for allowing access through the entryway, and, responsive at least to determining that the criterion have been met, allowing access through the entryway.

Claims

1. A non-transitory computer readable medium comprising instructions which, when executed by one or more devices, causes the one or more devices to:

identify a physical location of a first client device and a second physical location of a second client device;

determine that the physical location of the first client device and the second physical location of the second client device meet a first criterion for allowing access through an entryway;

identify a permission level associated with the first client device and a second permission level associated with the second client device;

determine that the permission level associated with the first client device meets a second criterion for allowing access through the entryway and that the second permission level associated with the second client device does not meet the second criterion;

calculate a distance between the first client device and the second client device;

responsive at least to a determination that the first criterion and the second criterion have been met by the first client device, allow the first client device access through the entryway;

determine based on the calculated distance, that the second client device gained unauthorized access through the entryway due to proximity with the first client device; and

present an alert regarding the unauthorized access through the entryway of the second client device.

2. The non-transitory computer readable medium of claim 1, wherein to determine that the physical location of the first client device meets the first criterion, the instructions are further to cause the one or more devices to determine that a distance between the physical location of the first client device and a location of the entryway is below a threshold value.

3. The non-transitory computer readable medium of claim 1, wherein to determine that the permission level meets the second criterion, the instructions are further to cause the one or more devices to determine that the first client device has successfully connected to a particular WiFi network associated with access for the entryway.

4. The non-transitory computer readable medium of claim 1, wherein to determine that the physical location of the first client device meets the first criterion, the instructions are further to cause the one or more devices to determine that the physical location of the first client device is within a particular zone associated with the entryway.

5. The non-transitory computer readable medium of claim 1, wherein the instructions are further to cause the one or more devices to:

subsequent to allowing access;

responsive to determining that the physical location of the first client device no longer meets the first criterion, block access through the entryway.

6. The non-transitory computer readable medium of claim 1, wherein to allow access, the instructions are further to cause the one or more devices to open a physical lock controlling the access through the entryway.

7. The non-transitory computer readable medium of claim 1, wherein the physical location of the first client device is determined based on one or more WiFi signals transmitted by the first client device and received by one or more access points installed on a ceiling near the entryway.

8. The non-transitory computer readable medium of claim 1, wherein to determine the physical location of the first client device, the instructions are further to cause the one or more devices to:

receive, by a plurality of access points, wireless signals from the first client device;

determine a distance of the first client device from each of the plurality of access points; and

compute a location of the first client device based at least on;

the distance of the first client device from each of the plurality of access points and a location of each of the plurality of access points.

9. The non-transitory computer readable medium of claim 1, wherein to determine the physical location of the first client device, the instructions are further to cause the one or more devices to:

receive, by at least one access point, wireless signals from the first client device;

determine a distance of the first client device from the at least one access point and a direction of the first client device from the at least one access point; and

compute a location of the first client device based at least on;

the distance of the first client device from the at least one access point and the direction of the first client device from the at least one access point.

10. A system comprising:

at least one network device including a hardware processor;

a memory on which is stored instructions that are to cause the hardware processor to;

identify a physical location of a first client device and a second physical location of a second client device;

determine that the physical location of the first client device and the second physical location of the second client device meet a first criterion for allowing access through an entryway;

identify a permission level associated with the first client device and a second permission level associated with the second client device;

determine that the permission level associated with the first client device meets a second criterion for allowing access through the entryway and that the second permission level associated with the second client device does not meet the second criterion for access through the entryway;

calculate a distance between the first client device and the second client device;

responsive at least to a determination that the first criterion and the second criterion have been met by the first client device, allow the first client device access through the entryway;

determine based on the calculated distance, that the second client device gained unauthorized access to the entryway due to proximity with the first client device; and

present an alert regarding the unauthorized access through the entryway of the second client device.

11. The system of claim 10, wherein to determine that the physical location meets the first criteria, the instructions are further to cause the hardware processor to:

determine that a distance between the physical location of the first client device and a location of the entryway is below a threshold value.

12. The system of claim 10, wherein to determine that the permission level meets the second criterion, the instructions are further to cause the hardware processor to:

determine that the first client device has successfully connected to a particular WiFi network associated with access to the entryway.

13. The system of claim 10, wherein to determine that the physical location meets the first criterion, the instructions are further to cause the hardware processor to determine that the physical location of the first client device is within a particular zone associated with the entryway.

14. The system of claim 10, wherein the instructions are further to cause the hardware processor to:

subsequent to allowing access;

responsive to determining that the physical location of the first client device no longer meets the first criterion, block access through the entryway.

15. The system of claim 10, wherein to allow access, the instructions are further to cause the hardware processor to open a physical lock controlling the access through the entryway.

16. The system of claim 10, wherein the physical location of the first client device is determined based on one or more WiFi signals transmitted by the first client device and received by one or more access points installed on a ceiling near the entryway.

17. The system of claim 10, wherein to determine the physical location of the first client device, the instructions are further to cause the hardware processor to:

receive, by a plurality of access points, wireless signals from the first client device;

determine a distance of the first client device from each of the plurality of access points; and

compute a location of the first client device based at least on;

the distance of the first client device from each of the plurality of access points and a location of each of the plurality of access points.

18. The system of claim 10, wherein to determine the physical location of the first client device, the instructions are further to cause the hardware processor to:

receive, by at least one access point, wireless signals from the first client device;

determine a distance of the first client device from the at least one access point and a direction of the first client device from the at least one access point; and

compute a location of the first client device based at least on;

the distance of the first client device from the at least one access point and the direction of the first client device from the at least one access point.

19. A method, comprising:

identifying respective physical locations of a first client device and a second client device;

determining that the respective physical locations of the first client device and the second client device meet a first criterion for access through an entryway;

determining, based on respective permission levels associated with the first client device and the second client devices, that the first client device meets a second criterion for authorized access through the entryway and that the second client device does not meet the second criterion for access through the entryway;

determining, by a hardware processor, based on a distance between the first client device and the second client device, that the second client device is piggybacking onto the first client device for unauthorized access through the entryway; and

transmitting an alert regarding the unauthorized of the second client device to the entryway.