Virtual machine access control in mobile computing device based on positional range from beacon signal

• US 9,992,204 B2
• Filed: 05/06/2015
• Issued: 06/05/2018
• Est. Priority Date: 05/06/2015
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Dow, Eli M., Rohde, Douglas E.
• Primary Examiner(s): Lee, James J
• Application Number:
  US14/705,465
• Publication Number:
  US 20160328255A1
• Time in Patent Office: 1,126 Days
• CPC Class Codes: G06F 2009/4557 Distribution of virtual machine instances; Migration and load balancing
• CPC Class Codes: G06F 2009/45575 Starting, stopping, suspending or resuming virtual machine instances
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/88 Detecting or preventing theft or loss
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/0816 Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/64 using geofenced areas

Abstract

A system is provided and includes a broadcasting device configured to emit a beacon signal over a predefined range and a mobile computing device. The mobile computing device is configured to run a host operating system at any location. The mobile computing device is further configured to run a virtual machine associated with the beacon signal within the host operating system but only when the computing device is in range of the beacon signal of a predefined strength.

Claims

1. A system, comprising:

a broadcasting device configured to emit a beacon signal to which a virtual machine is associated over a predefined positional range from the broadcasting device; and

a mobile computing device comprising;

a networking unit which is receptive of the beacon signal when the mobile device is within the predefined positional range;

a memory having firmware and computer readable instructions residing on the firmware; and

one or more processors for executing the computer readable instructions, the computer readable instructions being configured to instruct the one or more processors to run a host operating system at any location, determine whether the mobile computing device is within the predefined positional range based on a strength of the beacon signal received by the networking unit being above a predefined strength and run an instance of the virtual machine within the host operating system using a component of the beacon signal only when the mobile computing device is determined to be within the predefined positional range, and

the firmware being configured to terminate the running of the instance of the virtual machine when the mobile computing device is determined to be outside of the predefined positional range based on the strength of the beacon signal received by the networking unit being below the predefined strength.

2. The system according to claim 1, wherein the component of the beacon signal comprises a decryption element by which the running of the instance of the virtual machine is initiated.

3. The system according to claim 1, further comprising a virtual machine or operating system instance provisioning server disposed within the predefined positional range.

4. The system according to claim 3, wherein the mobile computing device comprises firmware on which the operating system and the virtual machine reside.

5. The system according to claim 4, wherein the mobile computing device updates the virtual machine from the virtual machine or operating system instance provisioning server.

6. The system according to claim 4, wherein the mobile computing device installs the virtual machine from the virtual machine or operating system instance provisioning server.

7. The system according to claim 4, wherein the mobile computing device runs the virtual machine on the virtual machine or operating system instance provisioning server.

8. The system according to claim 1, wherein the computer readable instructions are further configured to instruct the one or more processors to:

determine whether the mobile computing device is at a periphery of the predefined positional range from the strength of the beacon signal received by the networking unit being reduced toward the predefined strength; and

alerting a user of the mobile computing device that the user is at the periphery of the predefined positional range.

9. A mobile computing device usable with a broadcasted network, the broadcasted network including a broadcasting device emitting a beacon signal associated with a virtual machine, the mobile computing device comprising:

a networking unit receptive of the beacon signal when the mobile computing device is in a broadcast range of the broadcasting device;

a processing unit coupled to the networking unit;

a memory unit having executable instructions stored thereon, which, when executed, cause the processing unit to run a host operating system, determine whether the mobile computing device is within the broadcast range based on a strength of the beacon signal received by the networking unit being above a predefined strength and run an instance of the virtual machine within the host operating system using a component of the beacon signal only when the mobile computing device is determined to be within the broadcast range; and

firmware on which the operating system and the virtual machine reside, the firmware being configured to terminate the running of the instance of the virtual machine when the mobile computing device is determined to be outside of the broadcast range based on the strength of the beacon signal received by the networking unit being below the predefined strength.

10. The mobile computing device according to claim 9, wherein, when executed, the executable instructions cause the processing unit to install or update the virtual machine on the firmware.

11. The mobile computing device according to claim 9, further comprising data storable remotely from the mobile computing device or on the memory unit to indicate that the mobile computing device is authorized to run the instance of the virtual machine.

12. The mobile computing device according to claim 9, wherein, when executed, the executable instructions cause the processing unit to run the instance of the virtual machine locally or remotely.