Verified device locations in a data network

• US 20030217137A1
• Filed: 02/28/2003
• Published: 11/20/2003
• Est. Priority Date: 03/01/2002
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: Enterasys Networks Incorporated (Extreme Networks, Inc.)
• Inventors: Roese, John J., Graham, Richard W., Harrington, David, Frattura, David
• Granted Patent: US 7,606,938 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: G01S 5/02 using radio waves using satellite radio beacon systems for determining position G01S19/00
• CPC Class Codes: H04L 41/0213 Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 61/10 of different types
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04L 67/63 Routing a service request depending on the request content or context
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services
• CPC Class Codes: H04W 4/20 Services signaling; Auxiliary data signalling, i.e. transmitting data via a non-traffic channel
• CPC Class Codes: H04W 4/50 : Service provisioning or reconfiguring
• CPC Class Codes: H04W 64/00 : Locating users or terminals or network equipment for network management purposes, e.g. mobility management
• CPC Class Codes: H04W 8/26 : Network addressing or numbering for mobility support
• CPC Class Codes: Y10S 707/99932 : Access augmentation or optimizing
• CPC Class Codes: Y10S 707/99939 : Privileged access

Abstract

One or more trusted network devices within a data network infrastructure determine a physical location of a client device requesting access to the data network infrastructure. A trusted physical location is generated and associated with the client device. The approach can include determining whether a candidate network device is a trusted network device based on a likelihood that the candidate network device can be modified to provide false physical location data. The approach also can include determining a response for an access request by the client and controlling network resources provided to the client based on the trusted physical location.

Claims

1. A method comprising:

determining, by one or more trusted network devices within a data network infrastructure, a physical location of a client device requesting access to the data network infrastructure to generate a trusted physical location; and

storing an association of the trusted physical location with the client device.

2. The method of claim 1 further comprising determining whether a network device within the data network is a trusted network device according to a likelihood that the network device can be modified to provide false physical location data.

3. The method of claim 1 further comprising limiting physical access to the trusted network devices within the data network.

4. The method of claim 1 wherein the one or more trusted network devices are each associated with a level of trust not less than a threshold.

5. The method of claim 4 wherein the threshold depends on a type of request by the client device.

6. The method of claim 1 wherein the trusted physical location is associated with a level of trust.

7. The method of claim 6 further comprising determining the level of trust of the trusted physical location using levels of trust of the one or more trusted network devices.

8. The method of claim 7 wherein determining the level of trust comprises determining the level of trust based on a method of communication between the one or more trusted network devices and the client device.

9. The method of claim 1 further comprising policing network activities of the client using the trusted physical location.

10. The method of claim 1 further comprising determining a response for an access request by the client using the trusted physical location.

11. The method of claim 1 further comprising controlling network resources provided to the client using the trusted physical location.

12. The method of claim 11 wherein controlling network resources includes restricting access to said network resources.

13. The method of claim 1 further comprising transmitting the trusted physical location to an emergency response authority.

14. The method of claim 1 further comprising providing information to the client using the trusted physical location.

15. The method of claim 14 wherein providing information comprises selecting said information using the trusted physical location.

16. A method comprising:

transmitting first location information from a trusted source within a data network infrastructure;

receiving second location information from a client device requesting access to the network, the second location information using the first location information; and

determining a trusted location using the first and second location information.

17. The method of claim 16 further comprising policing network activities of the client using the trusted physical location.

18. The method of claim 16 further comprising controlling network resources provided to the client using the trusted physical location.

19. A method comprising:

determining a value characterizing a physical location of a device;

determining a level of trust corresponding to the determined value; and

associating the level of trust with the value of the physical location.

20. The method of claim 19 wherein determining a level of trust further comprises determining a level of trust using a precision of a technique used for determining the value of the physical location.

21. The method of claim 19 wherein determining a level of trust further comprises determining a level of trust using a granularity of a range of possible values used for determining the value of the physical location.

22. The method of claim 19 wherein determining a level of trust further comprises determining a level of trust using a probability that determining a value can produce a false value for the physical location.

23. The method of claim 19 wherein determining a level of trust further comprises determining a level of trust using a level of trust of a network device determining the value of the physical location.

24. A system comprising a trusted network device within a data network infrastructure, the network device including a location module configured to determine a trusted physical location of a client device requesting access to the network infrastructure and to associate the trusted physical location with the client device.