Network authentication of a geo-fenced volume

• US 9,882,898 B2
• Filed: 02/26/2016
• Issued: 01/30/2018
• Est. Priority Date: 05/08/2015
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Barillaud, Franck, Cho, Insoo, Christiani, Daniel M., Thill, Mark R., Zhang, David S.
• Primary Examiner(s): SHAIFER HARRIMAN, DANT B
• Application Number:
  US15/055,070
• Publication Number:
  US 20160330626A1
• Time in Patent Office: 704 Days
• Field of Search: 713168
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 41/0813 characterised by the conditions triggering a change of settings
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/088 using filters or firewalls
• CPC Class Codes: H04W 4/021 Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring

Abstract

Provided is a method for managing a software defined network using a software control layer to regulate a geo-fenced volume. The software control layer can use a Global Positioning System (GPS) including a range of latitudes, a range of longitudes and a range of altitudes. A resource within the geo-fenced volume can be assigned a location using the GPS coordinates. The resource can be managed by external applications that are operating through the software control layer. To determine an access of a device to the geo-fenced volume, the GPS coordinates, are gathered as a geographical location of the device. A user profile can be accessed to determine an access path of the user. Depending on the geographical location of the device a first condition can be generated based on the device being within the geo-fenced volume. A network permission can be granted to the device based on the first condition.

Claims

1. A computer implemented method for managing a software defined network by a processor in a wireless access point hardware security device, the method comprising:

defining a first geo-fenced volume of the software defined network using a coordinate system that includes a range of latitudes, a range of longitudes, and a range of altitudes, wherein the range of latitudes, the range of longitudes, and the range of altitudes is included in data received from a Global Positioning System;

determining a geographic location of a device using a latitude, a longitude, and an altitude within the coordinate system, wherein the latitude, the longitude, and the altitude is included in the data received from the Global Positioning System;

accessing a user profile for the device that includes one or more network permissions based on the geographic location of the device relative to the first geo-fenced volume,

wherein the one or more network permissions includes access to resources within the first geo-fenced volume,

wherein the user profile includes the geographic location of the device and security information of a user,

wherein the security information includes at least one of a biometric identity marker scan and an authentication identifier of the user,

wherein the biometric identity markers scan is selected from the group consisting of a retinal scan and a fingerprint scan,

wherein the authentication identifier is selected from the group consisting of badge access and guarded entries;

determining a first condition where the geographic location of the device is within the first geo-fenced volume;

granting the one or more network permissions in response to the first condition wherein the device is within the first geo-fenced volume; and

providing physical access to the user to a second geo-fenced volume of the software defined network through a point of access based on the security information, wherein the point of access includes a locked doorway.

2. The method of claim 1, wherein accessing the user profile includes:

authenticating the software defined network to access the user profile on the device; and

determining one or more resources accessible to the user profile based on the one or more network permissions.

3. The method of claim 2, wherein authenticating the device includes authenticating the user by using biometric identity markers of the user.

4. The method of claim 2, wherein authenticating the device includes authenticating the user by using the authentication identifier of the user.

5. The method of claim 1, further comprising:

defining the second geo-fenced volume of the software defined network;

accessing the user profile for the device that includes the one or more network permissions further based on the geographic location of the device relative to the first geo-fenced volume and the second geo-fenced volume,

wherein the one or more network permissions further includes access to resources within the second geo-fenced volume;

determining whether the geographic location of the device is within the second geo-fenced volume; and

granting the one or more network permissions in response to determining that the device is within the second geo-fenced volume.

6. The method of claim 5, wherein the second geo-fenced volume is contained within the first geo-fenced volume.

7. The method of claim 5, further comprising:

defining the point of access to the second geo-fenced volume from the first geo-fenced volume;

securing the point of access from the first geo-fenced volume to the second geo-fenced volume to prevent users from entering the second geo-fenced volume without authenticating the user to enter the second geo-fenced volume; and

granting an access permission to the device based on the user profile in response to the device being within the second geo-fenced volume.

8. The method of claim 1, further comprising:

reconfiguring the one or more network permissions; and

using the reconfigured one or more network permissions to alter an accessibility of the software defined network.

9. The method of claim 8, wherein the reconfigured one or more network permissions increases the accessibility of the software defined network.

10. The method of claim 8, wherein the reconfigured one or more network permissions decreases the accessibility of the software defined network.