Enforcement of proximity based policies

• US 10,194,266 B2
• Filed: 02/07/2017
• Issued: 01/29/2019
• Est. Priority Date: 12/22/2014
• Status: Active Grant

• Current Assignee: AirWatch LLC (Broadcom, Inc.)
• Original Assignee: AirWatch LLC (Broadcom, Inc.)
• Inventors: Pelkey, Joshua Grey
• Primary Examiner(s): Gelin, Jean A
• Application Number:
  US15/426,322
• Publication Number:
  US 20170155684A1
• Time in Patent Office: 721 Days
• Field of Search: 4554141, 455411, 455417, 455420, 455419, 4554221, 4554041, 4554042, 4554561, 4554562, 4554563
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/065 Continuous authentication
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/023 using mutual or relative location information between multiple location based services [LBS] targets or of distance thresholds
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
• CPC Class Codes: H04W 48/04 based on user or terminal location or mobility data, e.g. moving direction, speed

Abstract

Embodiments of the disclosure are related to enforcing a policy on a computing device, or a companion device, based upon its proximity to another computing device, or an anchor device. In one example, the anchor device and companion device can report their location with respect to one another to a policy server. The policy server can determine whether the anchor device and proximity device are in proximity to one another as well as determine whether a policy should be applied to the companion device based upon whether it is in proximity to the anchor device.

Claims

1. A non-transitory, computer-readable medium including instructions that, when executed by a processor of an anchor device, cause the processor to perform stages for providing a user with access to an anchor device using a companion device, the stages comprising:

receiving a request from the companion device to an application installed on the anchor device;

identifying a policy stored in a data store that associates the anchor device and the companion device, wherein the policy is configured at a user interface generated by a management console;

determining, by the application of the anchor device, whether to grant access to the anchor device based at least in part upon the request from the companion device; and

in response to a determination that the policy is not violated, issuing a command from the application, the command providing a user of the companion device with access to the anchor device.

2. The non-transitory, computer-readable medium of claim 1, wherein the policy specifies access to a capability with respect to launching a particular application on the anchor device by the companion device.

3. The non-transitory, computer-readable medium of claim 2, wherein the particular application comprises a browser application.

4. The non-transitory, computer-readable medium of claim 1, wherein the request from the companion device comprises a first location indication.

5. The non-transitory, computer-readable medium of claim 4, wherein the determination that the policy is not violated is based on a difference between the first location indication and a location of the anchor device.

6. The non-transitory, computer-readable medium of claim 4, wherein the first location indication comprises at least one of a geographic location and a network location.

7. The non-transitory, computer-readable medium of claim 4, wherein the first location indication is communicated by at least one of a Bluetooth interface, a near-field communication (NFC) interface, and a radio-frequency identification (RFID) interface.

8. The non-transitory, computer-readable medium of claim 1, wherein the policy further specifies access to content stored on the anchor device.

9. A method for providing a user with access to an anchor device using a companion device, comprising:

receiving a request from the companion device to an application installed on an anchor device;

identifying a policy stored in a data store that associates the anchor device and the companion device, wherein the policy is configured at a user interface generated by a management console;

determining, by the application of the anchor device, whether to grant access to the anchor device based at least in part upon the request from the companion device; and

in response to a determination that the policy is not violated, issuing a command from the application, the command providing a user of the companion device with access to the anchor device.

10. The method of claim 9, wherein the policy specifies access to a capability with respect to launching a particular application on the anchor device by the companion device.

11. The method of claim 10, wherein the particular application comprises a browser application.

12. The method of claim 9, wherein the request from the companion device comprises a first location indication.

13. The method of claim 12, wherein the determination that the policy is not violated is based on a difference between the first location indication and a location of the anchor device.

14. The method of claim 12, wherein the first location indication comprises at least one a geographic location and a network location.

15. The method of claim 12, wherein the first location indication is communicated by at least one of a Bluetooth interface, a near-field communication (NFC) interface, and a radio-frequency identification (RFID) interface.

16. The method of claim 9, wherein the policy further specifies access to content stored on the anchor device.

17. The method of claim 9, wherein the policy is stored in a policy server that operates as part of a device management system to vary and control the types of authorization required between a plurality of anchor devices and companion devices.

18. An anchor device that allows access to a user based on the user operating a companion device, comprising:

a memory store;

an application installed on the anchor device;

a processor, wherein the processor performs stages including;

receiving a request for access to the anchor device from the companion device;

identifying a policy stored in a data store that associates the anchor device and the companion device, wherein the policy is configured at a user interface generated by a management console;

determining whether to grant access to the anchor device based at least in part upon the request from the companion device; and

in response to a determination that the policy is not violated, issuing a command from the application that provides access to the anchor device.

19. The method of claim 18, wherein the command from the application causes the anchor device to launch a particular application on the anchor device.