System and method for wireless network management

• US 9,900,162 B2
• Filed: 11/11/2015
• Issued: 02/20/2018
• Est. Priority Date: 11/11/2015
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.), AT&T Mobility II LLC (AT&T, Inc.)
• Inventors: Woxland, Morgan D., Davis, Jonathan
• Primary Examiner(s): SHEHNI, GHAZAL B
• Application Number:
  US14/938,706
• Publication Number:
  US 20170134171A1
• Time in Patent Office: 832 Days
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/0471 Key exchange
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 48/04 based on user or terminal location or mobility data, e.g. moving direction, speed

Abstract

A method includes receiving, at an access point of a network, a first message from a wireless device. The method further includes determining a device type of the wireless device. In response to determining that the device type satisfies a criterion, the method includes sending, to the wireless device, a second message granting the wireless device access to the network subject to a first restriction level and sending a network access request to a second device associated with an operator of the access point. The method may further include receiving a response to the network access request from the second device and determining, based on the response, whether to grant the wireless device access to the network subject to a second restriction level.

Claims

1. A method comprising:

receiving, at an access point of a network, a first message from a wireless device via the network;

determining a device type of the wireless device; and

in response to determining that the device type satisfies a criterion;

sending, to the wireless device, a second message granting the wireless device access to the network subject to a first restriction level, wherein the second message includes a first key to grant the wireless device access to the network subject to the first restriction level, wherein the first key is different from a second key sent to a second wireless device granted access to the network subject to a second restriction level, and wherein the second restriction level provides greater access to resources of the network than the first restriction level;

sending a network access request to a second device associated with an operator of the access point;

receiving a response to the network access request from the second device; and

determining, based on the response, whether to grant the wireless device access to the network subject to the second restriction level.

2. The method of claim 1, further comprising determining a threat indicator associated with the wireless device after sending the second message, wherein the network access request includes the threat indicator.

3. The method of claim 2, wherein determining the threat indicator includes monitoring transmissions of the wireless device and comparing the transmissions to stored examples of malicious activity.

4. The method of claim 2, wherein determining the threat indicator includes:

sending a query identifying the wireless device to a threat database; and

receiving the threat indicator from the threat database.

5. The method of claim 1, further comprising, in response to determining to grant the wireless device access to the network subject to the second restriction level, sending a third message to the wireless device, the third message including the second key.

6. The method of claim 1, further comprising:

after granting the wireless device access to the network subject to the second restriction level, determining a threat indicator associated with the wireless device;

based on the threat indicator, disallowing the wireless device access to the network subject to the second restriction level; and

sending a notification to the second device, the notification indicating that access to the network subject to the second restriction level has been disallowed for the wireless device.

7. The method of claim 1, further comprising:

receiving a command from the second device; and

in response to the command, entering a mode, at the access point, in which detected wireless devices are automatically granted access to the network subject to the first restriction level.

8. The method of claim 1, wherein the network access request includes a short message service message.

9. The method of claim 1, wherein the first message includes a service set identifier, and wherein the device type of the wireless device is identified based on the service set identifier.

10. An apparatus comprising:

a processor; and

a memory storing instructions executable by the processor, the instructions executable by the processor to cause the processor to perform operations comprising;

receiving a first message from a wireless device via a network;

determining a device type of the wireless device; and

in response to determining that the device type satisfies a criterion;

causing a second message to be sent to the wireless device, the second message granting the wireless device access to the network subject to a first restriction level, wherein the second message includes a first key to grant the wireless device access to the network subject to the first restriction level, and wherein the first key is different from a second key sent to a second wireless device granted access to the network subject to a second restriction level;

causing a network access request to be sent to a second device;

receiving a response to the network access request from the second device; and

determining, based on the response, whether to grant the wireless device access to the network subject to the second restriction level.

11. The apparatus of claim 10, further comprising a first interface configured to wirelessly transmit the second message.

12. The apparatus of claim 10, further comprising a second interface configured to send the network access request to the second device.

13. The apparatus of claim 10, further comprising an encryption engine configured to encrypt data sent to the wireless device using a first encryption key while access by the wireless device is subject to the first restriction level.

14. The apparatus of claim 13, wherein the encryption engine is further configured to encrypt data sent to the wireless device using a second encryption key while access by the wireless device is subject to the second restriction level.

15. The apparatus of claim 10, further comprising a timer and an encryption engine, wherein the encryption engine is configured to encrypt data sent to the wireless device using an encryption key that is changed periodically based on the timer.

16. The apparatus of claim 10, further comprising a sandbox controller configured to establish a sandbox corresponding to the first restriction level by managing access of the wireless device to resources of the network.

17. The apparatus of claim 10, further comprising a key generator configured to generate at least a portion of an encryption key used to encrypt data exchanged with the wireless device.

18. The apparatus of claim 10, wherein the operations further comprising:

receiving a command from the second device; and

in response to the command, entering a mode in which detected wireless devices are automatically granted access to the network subject to the first restriction level.

19. A computer-readable storage device storing instructions executable by a processor to cause the processor to perform operations comprising:

receiving a first message from a wireless device via a network;

determining a device type of the wireless device; and

in response to determining that the device type satisfies a criterion;

causing a second message to be sent to the wireless device, the second message granting the wireless device access to the network subject to a first restriction level, wherein the second message includes a first key to grant the wireless device access to the network subject to the first restriction level, and wherein the first key is different from a second key sent to a second wireless device granted access to the network subject to a second restriction level;

causing a network access request to be sent to a second device;

receiving a response to the network access request from the second device; and

determining, based on the response, whether to grant the wireless device access to the network subject to the second restriction level.

20. The computer-readable storage device of claim 19, wherein the operations further comprise, in response to determining not to grant the wireless device access to the network subject to the second restriction level, disallowing access to the network subject to the first restriction level.