Dynamic defenses to secure a proximity-based communication system of linked wireless-enabled devices

• US 10,028,147 B1
• Filed: 09/27/2017
• Issued: 07/17/2018
• Est. Priority Date: 08/06/2014
• Status: Active Grant

• Current Assignee: Bruce Corporation
• Original Assignee: Bruce Corporation
• Inventors: Coney, Lillie Bruce
• Primary Examiner(s): Bhattacharya, Sam
• Application Number:
  US15/717,715
• Time in Patent Office: 293 Days
• Field of Search: 455410, 455411, 4554561-4563
• CPC Class Codes: G07C 9/20 involving the use of a pass
• CPC Class Codes: G07C 9/22 in combination with an identity check of the pass holder
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/47 using near field communication [NFC] or radio frequency identification [RFID] modules
• CPC Class Codes: H04W 12/64 using geofenced areas
• CPC Class Codes: H04W 4/021 Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences
• CPC Class Codes: H04W 76/10 Connection setup

Abstract

The proliferation of networked, wireless-enabled devices is challenged by the reliance upon password management and user knowledge of privacy and security techniques to maintain control over data that is personal, proprietary or restricted. This disclosure enables a geo-proximity security and privacy system for assuring control and non-repudiation for wireless-enabled devices by relying upon location and trusted network relationships among a set of wireless-enabled devices, where one or more devices may act as a control or master key. Security in a digital society may be benefited by the establishment of digital walls that are as flexible as the world of cyberspace to be erected whenever and wherever wireless-enabled technology is in use. The security protocol may be configured to secure a protected device or the data they contain from loss, theft, abuse or misuse.

Claims

1. A system to provide a physical infrastructure to support secure communications over a proximity-based network, the system comprising:

a central programming device (“

CPD”

); and

a plurality of wireless-enabled devices capable of wireless communication with the CPD;

the CPD including a processing device and a memory device having instructions stored thereon, wherein the instructions, in response to execution by the processing device, cause the CPD to;

identify and enroll the plurality of wireless-enabled devices;

generate a geo-proximity fence that encompasses an area;

assign a relational link among at least two of the enrolled wireless-enabled devices to form a communications network;

establish at least one operating rule and associate the operating rule with the assigned relational link, each operating rule based, at least in part, on current locations of the corresponding enrolled wireless-enabled devices relative to the geo-proximity fence;

store the relational link and the associated operating rules in a database to define parameters for access and operation of the communications network; and

based on the stored relational link and associated operating rules, configure the enrolled devices to communicate with each other so as to realize the communications network; and

wherein the stored instructions, in response to execution by the processing device, further cause the CPD to—

receive a notification from a linked device;

responsive to the notification indicating a violation of one of the associated operating rules, perform predetermined remedial operations;

query the linked device for an updated status report; and

based on the updated status report indicating the rule violation has been rectified, return to normal operation of the system.

2. The system of claim 1 wherein at least one of the enrolled devices is configured to detect an attempted access, query the database based on the attempted access, and respond to the access attempt based on applying an operating rule returned in response to the query.

3. The system of claim 1 wherein the stored instructions, in response to execution by the processing device, further cause the CPD to assign to each of the linked devices a distinct token address, so as to enable identification and communication with the linked device.

4. The system of claim 1 wherein the stored instructions, in response to execution by the processing device, further cause the CPD to—

receive a notification from a linked device;

responsive to the notification indicating a violation of one of the associated operating rules, perform predetermined remedial operations;

query the linked device for an updated status report; and

based on the updated status report indicating the rule violation has been rectified, return to normal operation of the system.

5. The system of claim 1 wherein at least one of the enrolled devices is configured to continuously monitor the digital communication environment to detect attempts to access, query the database based on the attempted access, and respond to the access attempt based on applying an operating rule returned in response to the query.

6. The system of claim 1 wherein the stored instructions, in response to execution by the processing device, further cause the CPD to establish a second operating rule for a relational link, the second operating rule based, at least in part, on a current location of the CPD relative to the geo-proximity fence.

7. The system of claim 1 wherein an operating rule identifies other devices to which one of the enrolled devices should not be linked to prevent communications between them.

8. The system of claim 1 wherein an operating rule identifies other devices to which one of the enrolled devices may be linked to enable communications between them.

9. The system of claim 1 wherein at least one of the enrolled devices is configured to:

detect entry of a new device into the geo-fenced area;

query the database to determine whether the new device was previously enrolled; and

if the new device was not previously enrolled, apply a predetermined operation rule applicable to a non-enrolled device entering the geo-fenced area.

10. The system of claim 1 wherein the stored instructions, in response to execution by the processing device, further cause the CPD to, during initialization, detect all wireless-enabled devices within its communication area and dynamically generate rules based on tracking the locations and operations of the detected devices.

11. A system to provide a physical infrastructure to support secure communications over a proximity-based network, the system comprising:

a central programming device (“

CPD”

); and

a plurality of wireless-enabled devices capable of wireless communication with the CPD;

the CPD including a processing device and a memory device having instructions stored thereon, wherein the instructions, in response to execution by the processing device, cause the CPD to;

identify and enroll the plurality of wireless-enabled devices;

generate a geo-proximity fence that encompasses an area;

assign a relational link among at least two of the enrolled wireless-enabled devices to form a communications network;

establish at least one operating rule and associate the operating rule with the assigned relational link, each operating rule based, at least in part, on current locations of the corresponding enrolled wireless-enabled devices relative to the geo-proximity fence;

store the relational link and the associated operating rules in a database to define parameters for access and operation of the communications network; and

based on the stored relational link and associated operating rules, configure the enrolled devices to communicate with each other so as to realize the communications network; and

wherein the stored instructions, in response to execution by the processing device, further cause the CPD to—

receive a communication from a wireless-enabled device;

determine an identifier based on the received communication;

query the database based on the identifier to obtain a result;

in a case that the result indicates the received communication is from a device not among the group of linked devices, preventing the communication from communicating with the group of linked devices.

12. The system of claim 11 wherein at least one of the enrolled devices is configured to detect an attempted access, query the database based on the attempted access, and respond to the access attempt based on applying an operating rule returned in response to the query.

13. The system of claim 11 wherein the stored instructions, in response to execution by the processing device, further cause the CPD to assign to each of the linked devices a distinct token address, so as to enable identification and communication with the linked device.

14. The system of claim 11 wherein at least one of the enrolled devices is configured to continuously monitor the digital communication environment to detect attempts to access, query the database based on the attempted access, and respond to the access attempt based on applying an operating rule returned in response to the query.

15. The system of claim 11 wherein the stored instructions, in response to execution by the processing device, further cause the CPD to establish a second operating rule for a relational link, the second operating rule based, at least in part, on a current location of the CPD relative to the geo-proximity fence.

16. The system of claim 11 wherein an operating rule identifies other devices to which one of the enrolled devices should not be linked to prevent communications between them.

17. The system of claim 11 wherein an operating rule identifies other devices to which one of the enrolled devices may be linked to enable communications between them.

18. The system of claim 11 wherein at least one of the enrolled devices is configured to:

detect entry of a new device into the geo-fenced area;

query the database to determine whether the new device was previously enrolled; and

if the new device was not previously enrolled, apply a predetermined operation rule applicable to a non-enrolled device entering the geo-fenced area.

19. A method comprising:

providing a programmable, wireless-enabled, central programming device (“

CPD”

);

linking a plurality of wireless-enables devices for communication among each other and with the CPD to form a digital communication network, the linking step including defining a relational link among at least two of the wireless-enables devices;

generating a geo-proximity fence that encompasses an area within wireless communication distance of the linked wireless-enables devices;

establishing at least one operating rule and associating the operating rule with at least one of the relational links, each operating rule based, at least in part, on a current location of the corresponding linked wireless-enabled device relative to the geo-proximity fence;

in each of the linked devices, monitoring communications during operation of the network;

in at least one of the linked devices, detecting a violation of one of the associated operating rules, and transmitting a notification of the detected violation to the CPD;

at the CPD,

receive the notification from a linked device;

responsive to the notification indicating a violation of one of the associated operating rules, perform predetermined remedial operations;

query the linked device for an updated status report; and

based on the updated status report indicating the rule violation has been rectified, return to normal operation of the system.

20. The method of claim 19 wherein analyzing the logs to detect a potential threat includes accessing a digital library of known threats, and comparing the logged communications to the library of known threats.

21. The method of claim 19 including selecting the defensive measure from a set of predetermined countermeasures based on the detected potential threat.

22. The method of claim 19 wherein analyzing the logs to detect a potential threat includes accessing a digital library of known exploits that target one or more of digital devices, computing devices, networked computing devices, files or applications used or stored on computing and/or digital devices or operating systems, or other architecture features of digital system that are intended to provide information on known attempts to breach a computing device or files/records/function resident or under control of digital device(s).

23. The method of claim 19 including:

at the CPD and at each of the linked devices, establishing a digital code to secure communications among each other;

at the CPD and at each of the linked devices, providing information sufficient for decoding the digital code; and

at the CPD and at each of the linked devices, utilizing the digital code to encode communications among them so that the communications cannot be decoded by a device that is not linked as part of the communication network.

24. A system to provide a physical infrastructure to support secure communications over a proximity-based network, the system comprising:

a central programming device (“

CPD”

); and

a plurality of wireless-enabled devices capable of wireless communication with the CPD;

the CPD including a processing device and a memory device having instructions stored thereon, wherein the instructions, in response to execution by the processing device, cause the CPD to;

identify and enroll the plurality of wireless-enabled devices;

generate a geo-proximity fence that encompasses an area;

assign a relational link among at least two of the enrolled wireless-enabled devices to form a communications network;

establish at least one operating rule and associate the operating rule with the assigned relational link, each operating rule based, at least in part, on current locations of the corresponding enrolled wireless-enabled devices relative to the geo-proximity fence;

store the relational link and the associated operating rules in a database to define parameters for access and operation of the communications network; and

based on the stored relational link and associated operating rules, configure the enrolled devices to communicate with each other so as to realize the communications network;

wherein at least one of the enrolled devices is configured to—

detect entry of a new device into the geo-fenced area;

query the database to determine whether the new device was previously enrolled; and

if the new device was not previously enrolled, apply a predetermined operating rule applicable to a non-enrolled device entering the geo-fenced area.

25. The system of claim 24 wherein the predetermined operation rule prohibits or limits communications with the non-enrolled device.

26. The system of claim 24 wherein at least one of the enrolled devices is configured to detect an attempted access, query the database based on the attempted access, and respond to the access attempt based on applying an operating rule returned in response to the query.

27. The system of claim 24 wherein the stored instructions, in response to execution by the processing device, further cause the CPD to assign to each of the linked devices a distinct token address, so as to enable identification and communication with the linked device.

28. The system of claim 24 wherein at least one of the enrolled devices is configured to continuously monitor the digital communication environment to detect attempts to access, query the database based on the attempted access, and respond to the access attempt based on applying an operating rule returned in response to the query.

29. The system of claim 24 wherein the stored instructions, in response to execution by the processing device, further cause the CPD to establish a second operating rule for a relational link, the second operating rule based, at least in part, on a current location of the CPD relative to the geo-proximity fence.

30. The system of claim 24 wherein an operating rule identifies other devices to which one of the enrolled devices should not be linked to prevent communications between them.

31. The system of claim 24 wherein an operating rule identifies other devices to which one of the enrolled devices may be linked to enable communications between them.