Location-Enabled Security Services in Wireless Network

• US 20080209521A1
• Filed: 06/20/2005
• Published: 08/28/2008
• Est. Priority Date: 07/07/2004
• Status: Active Grant

• Current Assignee: Nariste Networks Pty Ltd
• Original Assignee: Nariste Networks Pty Ltd
• Inventors: Malaney, Robert Anderson
• Granted Patent: US 8,707,458 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 12/00 Security arrangements; Authentication; Protecting privacy or anonymity
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles
• CPC Class Codes: H04W 48/18 Selecting a network or a communication service
• CPC Class Codes: H04W 64/00 Locating users or terminals or network equipment for network management purposes, e.g. mobility management

Abstract

A method (300), an apparatus (100), and a computer program product for providing location enabled security services in a wireless network are disclosed. In the method, a network access request from a node requesting access to the wireless network is received (304). A probability level for a position for the requesting node is calculated (310) using position information claimed by the requesting node and position information about the requesting node derived from signal measurements for the requesting node received by at least one existing authorised node in the wireless network. Access for the requesting node to the wireless network is denied (314) if the probability level does not satisfy a specified threshold condition for network security (312). Access for the requesting node to the wireless network is granted (318) if the probability level does satisfy the specified threshold condition (312).

Claims

1. A method of providing location enabled security services in a wireless network, said method comprising the steps of:

receiving a network access request from a node requesting access to said wireless network;

calculating a probability level for a position for said requesting node using position information claimed by said requesting node and position information about said requesting node derived from signal measurements for said requesting node received by at least one existing authorised node in said wireless network; and

denying access for said requesting node to said wireless network if said probability level does not satisfy a specified threshold condition for network security.

2. The method according to claim 1, further comprising the step of granting access for said requesting node to said wireless network if said probability level does satisfy said specified threshold condition.

3. The method according to claim 1, wherein said position information claimed by said requesting node, said position information about said requesting node derived from signal measurements, or both, comprises Global Positioning System (GPS) information about said requesting node.

4. The method according to claim 1, wherein said position information claimed by said requesting node, said position information about said requesting node derived from signal measurements, or both, comprises manually specified data for the respective node.

5. The method according to claim 1, wherein said signal measurements comprise received signal strength (RSS) measurements, time of arrival (TOA) measurements, time-difference of arrival measurements (TDOA), or angle of arrival (AOA) measurements.

6. The method according to claim 1, wherein said wireless network is based on the IEEE 802.11 wireless-network architecture or a 3G wireless network.

7. The method according to claim 1, wherein said specified threshold condition for network security is a weighted value, where the weight w applied is dependent upon a location-based parameter where the requesting node is unable to be located.

8. The method according to claim 1, wherein a node comprises an electronic device capable of wireless communications in the wireless network.

9. The method according to claim 1, further comprising the steps of:

maintaining a position history for said requesting node and each of one or more existing authorized nodes accessing said wireless network; and

determining an updated position of said requesting node using said position information about said requesting node derived from said signal measurements for said requesting node received by said at least one existing authorised node in said wireless network and the position history for at least one of said requesting node and each such existing authorised node.

10. The method according to claim 9, further comprising the step of using the updated position of said requesting node as the actual position of said requesting node.

11. The method according to claim 9, wherein said determining step is carried out using a filter technique.

12. The method according to claim 11, wherein said filter technique is a particle filter.

13. The method according to claim 1, further comprising the step of measuring by at least one access point of said wireless network fingerprint signal measurements about said requesting node.

14. The method according to claim 13, further comprising the step of comparing said measured fingerprint signal measurements against a database of fingerprint signal measurements based on a standard wireless device.

15. The method according to claim 13 or 14, wherein position information about said requesting node is determined based on a difference of fingerprint signal measurements for said requesting node measured by said at least one access point.

16. The method according to claim 13, wherein said measuring step is performed by at least two access points.

41. The apparatus according to claim 13, wherein at least two access points are in said wireless network.

69. The apparatus according to claim 13, wherein at least two access points are in said wireless network.

17. A method of determining a secure routing path through a wireless network, said method comprising the steps of:

determining local propagation parameters;

determining either a standard error ellipse or a nuisance error ellipse at a claimed position of a node requesting access said wireless network;

granting said requesting node and all existing authorised nodes of said wireless network broadcast privileges if a probability level for a position for said requesting node dependent on the error ellipse satisfies a specified threshold condition, said probability level calculated using claimed position information provided by said requesting node and position information about said requesting node derived from signal measurements for said requesting node received by at least one existing authorised node in said wireless network; and

denying broadcast privileges to said requesting node and at least one existing authorized node within a hearing ellipse relative to said requesting node if said probability level for said position for said requesting node fails to satisfy said specified threshold condition.

18. The method according to claim 17, wherein said hearing ellipse is located at a position for said requesting node determined by said wireless network.

19. The method according to claim 17, further comprising the step of setting said specified threshold condition.

20. The method according to claim 17, further comprising the step of determining if said local propagation parameters are reliable.

21. The method of claim 20, wherein said standard error ellipse or said nuisance error ellipse at the claimed position of said requesting node attempting to access said wireless network is dependent upon the determination of the reliability of said local propagation parameters.

22. The method according to claim 17, further comprising the step of calculating said probability level for said position for said requesting node using said determined standard error ellipse or said determined nuisance error ellipse.

23. The method according to claim 17, further comprising the step of recalculating error ellipses centered at a radio position if said probability level for said position for said requesting node fails to satisfy said specified threshold condition.

24. The method according to claim 23, further comprising the step of choosing either a standard error ellipse or a nuisance error ellipse dependent upon the reliability of said local propagation parameters.

25. The method according to claim 24, further comprising the step of establishing said hearing ellipse based on a radio range and the perimeter of said chosen error ellipse.

26. An apparatus for providing location enabled security services in a wireless network, said apparatus comprising:

means for receiving a network access request from a node requesting access to said wireless network;

means for calculating a probability level for a position for said requesting node using position information claimed by said requesting node and position information about said requesting node derived from signal measurements for said requesting node received by at least one existing authorised node in said wireless network; and

means for denying access for said requesting node to said wireless network if said probability level does not satisfy a specified threshold condition for network security.

27. The apparatus according to claim 26, further comprising means for granting access for said requesting node to said wireless network if said probability level does satisfy said specified threshold condition.

28. The apparatus according to claim 26, wherein said position information claimed by said requesting node, said position information about said requesting node derived from signal measurements, or both, comprises Global Positioning System (GPS) information about said requesting node.

29. The apparatus according to claim 26, wherein said position information claimed by said requesting node, said position information about said requesting node derived from signal measurements, or both, comprises manually specified data for the respective node.

30. The apparatus according to claim 26, wherein said signal measurements comprise received signal strength (RSS) measurements, time of arrival (TOA) measurements, time-difference of arrival measurements (TDOA), or angle of arrival (AOA) measurements.

31. The apparatus according to claim 26, wherein said wireless network is based on the IEEE 802.11 wireless-network architecture or a 3G wireless network.

32. The apparatus according to claim 26, wherein said specified threshold condition for network security is a weighted value, where the weight w applied is dependent upon a location-based parameter where the requesting node is unable to be located.

33. The apparatus according to claim 26, wherein a node comprises an electronic device capable of wireless communications in the wireless network.

34. The apparatus according to claim 26, further comprising:

means for maintaining a position history for said requesting node and each of one or more existing authorized nodes accessing said wireless network; and

means for determining an updated position of said requesting node using said position information about said requesting node derived from said signal measurements for said requesting node received by said at least one existing authorised node in said wireless network and the position history for at least one of said requesting node and each such existing authorised node.

35. The apparatus according to claim 34, wherein the updated position of said requesting node is used as the actual position of said requesting node.

36. The apparatus according to claim 34, wherein said determining means uses a filter technique.

37. The apparatus according to claim 36, wherein said filter technique is a particle filter.

38. The apparatus according to claim 26, further comprising at least one access point and means for measuring by said at least one access point of said wireless network fingerprint signal measurements about said requesting node.

39. The apparatus according to claim 26, further comprising means for comparing said measured fingerprint signal measurements against a database of fingerprint signal measurements based on a standard wireless device.

40. The apparatus according to claim 26 or 27, wherein position information about said requesting node is determined based on a difference of fingerprint signal measurements for said requesting node measured by said at least one access point.

42. An apparatus for determining a secure routing path through a wireless network, said apparatus comprising:

means for determining local propagation parameters;

means for determining either a standard error ellipse or a nuisance error ellipse at a claimed position of a node requesting access said wireless network;

means for granting said requesting node and all existing authorised nodes of said wireless network broadcast privileges if a probability level for a position for said requesting node dependent on the error ellipse satisfies a specified threshold condition, said probability level calculated using claimed position information provided by said requesting node and position information about said requesting node derived from signal measurements for said requesting node received by at least one existing authorised node in said wireless network; and

means for denying broadcast privileges to said requesting node and at least one existing authorized node within a hearing ellipse relative to said requesting node if said probability level for said position for said requesting node fails to satisfy said specified threshold condition.

43. The apparatus according to claim 42, wherein said hearing ellipse is located at a position for said requesting node determined by said wireless network.

44. The apparatus according to claim 42, further comprising means for setting said specified threshold condition.

45. The apparatus according to claim 42, further comprising means for determining if said local propagation parameters are reliable.

46. The apparatus of claim 45, wherein said standard error ellipse or said nuisance error ellipse at the claimed position of said requesting node attempting to access said wireless network is dependent upon the determination of the reliability of said local propagation parameters.

47. The apparatus according to claim 42, further comprising means for calculating said probability level for said position for said requesting node using said determined standard error ellipse or said determined nuisance error ellipse.

48. The apparatus according to claim 42, further comprising means for recalculating error ellipses centered at a radio position if said probability level for said position for said requesting node fails to satisfy said specified threshold condition.

49. The apparatus according to claim 48, further comprising means for choosing either a standard error ellipse or a nuisance error ellipse dependent upon the reliability of said local propagation parameters.

50. The apparatus according to claim 49, further comprising means for establishing said hearing ellipse based on a radio range and the perimeter of said chosen error ellipse.

51. A computer program product comprising a computer readable medium having recorded therein a computer program for providing location enabled security services in a wireless network, said computer program product comprising:

computer program code means for receiving a network access request from a node requesting access to said wireless network;

computer program code means for calculating a probability level for a position for said requesting node using position information claimed by said requesting node and position information about said requesting node derived from signal measurements for said requesting node received by at least one existing authorised node in said wireless network; and

computer program code means for denying access for said requesting node to said wireless network if said probability level does not satisfy a specified threshold condition for network security.

52. The computer program product according to claim 51, further comprising computer program code means for granting access for said requesting node to said wireless network if said probability level does satisfy said specified threshold condition.

53. The computer program product according to claim 51, wherein said position information claimed by said requesting node, said position information about said requesting node derived from signal measurements, or both, comprises Global Positioning System (GPS) information about said requesting node.

54. The computer program product according to claim 51, wherein said position information claimed by said requesting node, said position information about said requesting node derived from signal measurements, or both, comprises manually specified data for the respective node.

55. The computer program product according to claim 51, wherein said signal measurements comprise received signal strength (RSS) measurements, time of arrival (TOA) measurements, time-difference of arrival measurements (TDOA), or angle of arrival (AOA) measurements.

56. The computer program product according to claim 51, wherein said wireless network is based on the IEEE 802.11 wireless-network architecture or a 3G wireless network.

57. The computer program product according to claim 51, wherein said specified threshold condition for network security is a weighted value, where the weight w applied is dependent upon a location-based parameter where the requesting node is unable to be located.

58. The computer program product according to claim 51, wherein a node comprises an electronic device capable of wireless communications in the wireless network.

59. The computer program product according to claim 51, further comprising:

computer program code means for maintaining a position history for said requesting node and each of one or more existing authorized nodes accessing said wireless network; and

computer program code means for determining an updated position of said requesting node using said position information about said requesting node derived from said signal measurements for said requesting node received by said at least one existing authorised node in said wireless network and the position history for at least one of said requesting node and each such existing authorised node.

60. The computer program product according to claim 59, wherein the updated position of said requesting node is used as the actual position of said requesting node.

61. The computer program product according to claim 59, wherein said determining means uses a filter technique.

65. The computer program product according to claim 61, wherein said filter technique is a particle filter.

66. The computer program product according to claim 51, further comprising computer program code means for measuring by at least one access point of said wireless network fingerprint signal measurements about said requesting node.

67. The computer program product according to claim 66, further comprising computer program code means for comparing said measured fingerprint signal measurements against a database of fingerprint signal measurements based on a standard wireless device.

68. The computer program product according to claim 66 or 67, wherein position information about said requesting node is determined based on a difference of fingerprint signal measurements for said requesting node measured by said at least one access point.

70. A computer program product comprising a computer readable medium having recorded therein a computer program for determining a secure routing path through a wireless network, said computer program product comprising:

computer program code means for determining local propagation parameters;

computer program code means for determining either a standard error ellipse or a nuisance error ellipse at a claimed position of a node requesting access said wireless network;

computer program code means for granting said requesting node and all existing authorised nodes of said wireless network broadcast privileges if a probability level for a position for said requesting node dependent on the error ellipse satisfies a specified threshold condition, said probability level calculated using claimed position information provided by said requesting node and position information about said requesting node derived from signal measurements for said requesting node received by at least one existing authorised node in said wireless network; and

computer program code means for denying broadcast privileges to said requesting node and at least one existing authorized node within a hearing ellipse relative to said requesting node if said probability level for said position for said requesting node fails to satisfy said specified threshold condition.

71. The computer program product according to claim 70, wherein said hearing ellipse is located at a position for said requesting node determined by said wireless network.

72. The computer program product according to claim 70, further comprising computer program code means for setting said specified threshold condition.

73. The computer program product according to claim 70, further comprising computer program code means for determining if said local propagation parameters are reliable.

74. The computer program product of claim 73, wherein said standard error ellipse or said nuisance error ellipse at the claimed position of said requesting node attempting to access said wireless network is dependent upon the determination of the reliability of said local propagation parameters.

75. The computer program product according to claim 70, further comprising computer program code means for calculating said probability level for said position for said requesting node using said determined standard error ellipse or said determined nuisance error ellipse.

76. The computer program product according to claim 70, further comprising computer program code means for recalculating error ellipses centered at a radio position if said probability level for said position for said requesting node fails to satisfy said specified threshold condition.

77. The computer program product according to claim 76, further comprising computer program code means for choosing either a standard error ellipse or a nuisance error ellipse dependent upon the reliability of said local propagation parameters.

78. The computer program product according to claim 77, further comprising computer program code means for establishing said hearing ellipse based on a radio range and the perimeter of said chosen error ellipse.