Self-managed network access using localized access management

• US 7,574,731 B2
• Filed: 10/07/2003
• Issued: 08/11/2009
• Est. Priority Date: 10/08/2002
• Status: Active Grant

• Current Assignee: KoolSpan, Inc.
• Original Assignee: KoolSpan, Inc.
• Inventors: Fascenda, Anthony C.
• Primary Examiner(s): Sheikh; Ayaz R
• Assistant Examiner(s): CHEN, SHIN HON
• Application Number:
  US10/679,472
• Publication Number:
  US 20040073672A1
• Time in Patent Office: 2,135 Days
• Field of Search: 705 51- 55, 726 4- 9, 726/2
• US Class Current: 726/2
• CPC Class Codes: G06F 2221/2153 Using hardware token as a secondary aspect
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/06 adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals

Abstract

The invention provides a method and system for locally tracking network usage and enforcing usage plans at a client device. In an embodiment of the invention, a unique physical key, or token, is installed at a client device of one or more networks. The key comprises a usage application and one or more access parameters designated the conditions and/or limits of a particular network usage plan. Upon initial connection to the network, the usage application grants or denies access to the network based on an analysis of the current values of the access parameters. Therefore, network usage tracking and enforcement is made simple and automatic without requiring any back-end servers on the network while still providing ultimate flexibility in changing billing plans for any number of users at any time.

Claims

1. A method for managing network access of a computing device, which is capable of communicating via one or more networks, where trusted enforcement of the access occurs at the device, comprising the steps of:

providing software adapted to be installed in the device, the software configured to communicate with a secure tamper-resistant physical token operatively coupled to, local to and removably attachable to the device;

storing a network access parameter in memory of said secure tamper-resistant physical token, said network access parameter being associated with a first network, said secure tamper-resistant physical token comprising a processor configured to execute an application, said application configured to determine if said network access parameter has been met or exceeded; and

granting the device access to the first network if the application determines that the network access parameter has not been met or exceeded.

2. The method of claim 1, wherein said network access parameter is selected from the group consisting of:

maximum number of connections to said first network, time of day, period of time, day in week, date, range of dates, maximum period of time spent connected to said first network, device address, subnet ID, and LAN ID.

3. The method of claim 1, further comprising the step of storing one or more additional network access parameters in said secure token.

4. The method of claim 3, further comprising the steps of:

determining if said one or more additional access parameters have been met or exceeded and

denying access to said first network if any of said network access parameters have been met or exceeded.

5. The method of claim 3, further comprising the steps of:

determining if said one or more additional access parameters have been met and

restricting access to a portion of said first network if any of said network access parameters have been met or exceeded.

6. The method of claim 5, wherein said portion of said first network includes a server and said method further comprising the steps of:

authorizing additional usage of said first network at said server and

modifying said network access parameter.

7. The method of claim 6, wherein said step of authorizing comprises the step of receiving payment for said additional usage of said first network.

8. The method of claim 3, further comprising the step of

determining if said one or more additional access parameters has been met and

allowing access to said first network if all of said network access parameters have not been met.

9. The method of claim 3, wherein at least one of said additional network access parameters is associated with a second network.

10. The method of claim 1, wherein said first network is an 802.11 network.

11. The method of claim 10, wherein said secure token is implemented through a USB adapter.

12. The method of claim 10, wherein current time is received from an access point on said 802.11 network.

13. The method of claim 1, wherein said secure token is unique to said device.

14. The method of claim 1, wherein said secure token comprises authentication information for authenticating said device with said network.

15. The method of claim 1, wherein said network access parameter is pre-stored within said secure token.

16. A system for managing network access of a computing device, which is capable of communicating via one or more networks, where trusted enforcement of the access occurs at the device, the system comprising:

a secure tamper-resistant physical token operatively coupled to, local to and removably attachable to the device; and

software adapted to be installed in the device, the software configured to communicate with said secure tamper-resistant physical token, said physical token comprising;

a communications interface for communicating data to and from said physical token;

a storage including at least one access parameter associated with a first network; and

a processor configured to execute an application, said application configured to determine if said access parameter has been met or exceeded, whereby the device is granted access to the first network if said access parameter has not been met or exceeded.

17. The system of claim 16, wherein said at least one access parameter is part of a first usage plan for said first network.

18. The system of claim 17, wherein said storage further includes a usage application for tracking and enforcing usage of said first network according to said first usage plan.

19. The system of claim 16, further comprising an adapter for connecting said physical token to a device capable of communicating with said first network.

20. The system of claim 16, wherein said storage further includes at least one access parameter associated with a second network.

21. The system of claim 16, wherein said storage further includes authentication information for authenticating said device with said first network.