Systems and methods for administering policies for physical locations

• US 8,112,785 B1
• Filed: 12/31/2007
• Issued: 02/07/2012
• Est. Priority Date: 12/31/2007
• Status: Active Grant

• Current Assignee: Gen Digital Inc.
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Cooley, Shaun, Powell, Brian
• Primary Examiner(s): Arani, Taghi
• Assistant Examiner(s): LEE, JASON T
• Application Number:
  US11/967,975
• Time in Patent Office: 1,499 Days
• Field of Search: 726/1, 455/456, 455/440, 342/450
• US Class Current: 726/1
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent

Abstract

A method for receiving verification that a source is authorized to provide mobile-computing-device policies for a first physical location. The method may include receiving a first mobile-computing-device policy and identifying the first physical location. The method may also include associating the first mobile-computing-device policy with the first physical location and implementing, based on the verification, the first mobile-computing-device policy at the first physical location. Systems and computer-readable media for verifying that a source is authorized to provide mobile-computing-device policies for a first physical location are also disclosed.

Claims

1. A computer-implemented method for administering policies for physical locations, at least a portion of the computer-implemented method being performed by a computing device comprising at least one processor, the computer-implemented method comprising:

receiving verification that a source is authorized to provide mobile-computing-device policies specific to a first physical location;

receiving a first mobile-computing-device policy specific to the first physical location;

identifying the first physical location, wherein identifying the first physical location comprises at least one of receiving, from the source, a set of geographical coordinates of the first physical location, receiving, from the source, boundaries of the first physical location, and/or receiving, from the source, an address of the first physical location;

associating the first mobile-computing-device policy with the first physical location such that the first mobile-computing-device policy is implemented while a mobile-computing device is located within the first physical location;

determining that the mobile-computing device is located within the first physical location;

implementing the first mobile-computing-device policy at the first physical location in response to the mobile-computing device being located within the first physical location.

2. The computer-implemented method of claim 1, wherein:

the source is a location-policy administrator, the location-policy administrator being authorized to provide the first policy for the first physical location;

receiving the first mobile-computing-device policy comprises identifying that the first mobile-computing-device policy is received from the location-policy administrator.

3. The computer-implemented method of claim 1, wherein receiving verification comprises:

accessing a database that stores information that identifies sources that are authorized to provide policies for a particular location;

searching the database to verify that the source is authorized to provide the first policy specific to the first physical location.

4. The computer-implemented method of claim 1, wherein receiving verification that the source is authorized to provide mobile-computing-device policies specific to the first physical location comprises verifying that the source is authorized by:

contacting an owner of a building;

verifying that the owner of the building is authorized to provide policies specific to the building.

5. The computer-implemented method of claim 1, wherein implementing the first mobile-computing-device policy comprises:

enforcing the first mobile-computing-device policy on at least one of;

a mobile phone;

a laptop;

a personal digital assistant device.

6. The computer-implemented method of claim 1, wherein receiving verification further comprises:

prompting mail to be sent to a physical address associated with the first physical location, the mail comprising information capable of being used by the source to confirm that the source is authorized to provide the first policy specific to the first physical location.

7. The computer-implemented method of claim 1, wherein:

identifying the first physical location comprises;

receiving, through an internet-based interface, a first location identifier that corresponds to the first physical location;

receiving the first mobile-computing-device policy comprises;

receiving, through an internet-based interface, the first mobile-computing-device policy.

8. The computer-implemented method of claim 1, further comprising:

receiving the set of geographical coordinates that corresponds to a sub-region within the first physical location;

receiving a second mobile-computing-device policy;

associating the second mobile-computing-device policy with the sub-region.

9. The computer-implemented method of claim 1, wherein:

identifying the first physical location comprises;

receiving a first set of geographical coordinates that corresponds to a first sub-region within the first physical location;

receiving a second set of geographical coordinates that corresponds to a second sub-region within the first physical location;

associating the first mobile-computing-device policy with the first physical location comprises;

associating the first mobile-computing device policy with the first sub-region;

associating a second mobile-computing device policy with the second sub-region.

10. The computer implemented method of claim 1, wherein receiving verification that the source is authorized to provide mobile-computing-device policies specific to the first physical location comprises verifying that the source is authorized by:

contacting a principal of a school;

verifying that the principal of the school is authorized to provide policies specific to school grounds.

11. The computer-implemented method of claim 1, wherein receiving verification that the source is authorized to provide mobile-computing-device policies specific to the first physical location comprises:

enabling a third party to verify that the source is authorized to provide mobile-computing-device policies specific to the first physical location.

12. A system for administering policies for physical locations, the system comprising:

a verification mechanism configured to verify that a source is authorized to provide mobile-computing-device policies specific to a first physical location, wherein the verification mechanism is configured to perform at least one of receiving, from the source, a set of geographical coordinates of the first physical location, receiving, from the source, boundaries of the first physical location, and/or receiving, from the source, an address of the first physical location;

a policy module configured to receive a first mobile-computing-device policy specific to the first physical location;

a location module configured to identify the first physical location;

a policy-location-information database configured to store policy information;

an implementation module configured to enforce the first mobile-computing-device policy on a mobile-computing device located at the first physical location in response to the mobile-computing device being located within the first physical location;

at least one hardware processor configured to execute the policy module, the location module, and the implementation module.

13. The system of claim 12 further comprising a server, wherein the server comprises the verification mechanism, the policy module, the location module, the policy-location-information database, and the implementation module.

14. The system of claim 12, wherein the implementation module further comprises:

the mobile-computing device being configured to transmit location information;

a device-location mechanism configured to receive location information from the mobile computing device;

a determination module configured to determine whether the location information indicates that the mobile computing device is within the first physical location;

a transmission mechanism configured to send the first mobile-computing-device policy to the mobile computing device;

an enforcement module configured to enforce the first mobile-computing-device policy on the mobile computing device.

15. The system of claim 12, wherein the verification mechanism comprises:

a notification mechanism configured to send a notification to a physical address associated with the first physical location;

a confirmation mechanism configured to receive confirmation from the source.

16. The system of claim 12, wherein the verification mechanism comprises:

an authorization database configured to store source authorization data;

an authorization search module configured to search the authorization database for source authorization data.

17. A non-transitory computer-readable-storage medium comprising one or more computer-executable instructions that, when executed by at least one processor of a mobile-computing device, cause the mobile-computing device to:

receive verification that a source is authorized to provide mobile-computing-device policies specific to a first physical location;

receive a first mobile-computing-device policy specific to the first physical location;

identify the first physical location;

associate the first mobile-computing-device policy with the first physical location such that the first mobile-computing-device policy is implemented while the mobile-computing device is located within the first physical location;

implement the first mobile-computing-device policy at the first physical location in response to the mobile-computing device being located within the first physical location;

receive a set of geographical coordinates that corresponds to a sub-region within the first physical location;

receive a second mobile-computing-device policy;

associate the second mobile-computing-device policy with the sub-region.