Management of access to service in an access point

• US 8,856,878 B2
• Filed: 07/03/2013
• Issued: 10/07/2014
• Est. Priority Date: 10/15/2009
• Status: Active Grant

• Current Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property I LP (AT&T, Inc.)
• Inventors: Wohlert, Randolph, Majmundar, Milap
• Primary Examiner(s): Parthasarathy, Pramila
• Application Number:
  US13/934,644
• Publication Number:
  US 20130295881A1
• Time in Patent Office: 461 Days
• Field of Search: 726/1, 726/3
• US Class Current: 726/3
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 48/16 Discovering, processing access restriction or access information
• CPC Class Codes: H04W 84/045 using private Base Stations, e.g. femto Base Stations, home Node B
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

System(s) and method(s) are provided to configure access rights to wireless resources and telecommunication service(s) supplied through a set of access points (APs). Access to wireless resources is authorized by access attributes in access control list(s) (ACL(s)) while a profile of service attributes linked to the ACL(s) regulate provision of telecommunication service(s). Access and service attributes can be automatically or dynamically configured, at least in part, in response to changes in data that directly or indirectly affects an operation environment in which the set of APs is deployed. Automatic or dynamic configuration of access or service attributes enable control or coordination of wireless service provided through the set of APs; degree of control or coordination is determined at least in part by enablement or disablement of disparate services for disparate devices at disparate access points at disparate times and with disparate service priority.

Claims

1. An access point device, comprising:

a memory to store executable instructions; and

a processor, coupled to the memory, that facilitates execution of the executable instructions to perform operations, comprising;

receiving first access control data from an access management server device via a set of network devices of a network, wherein the first access control data defines a first set of devices authorized to access the set of network devices of the network via the access point device;

storing the first access control data in the memory;

controlling access to the set of network devices based on the first access control data;

receiving second access control data from the access management server device via the set of network devices of the network, wherein the second access control data defines a second set of devices authorized to access the set of network devices via the access point device;

replacing the first access control data with the second access control data in the memory in response to the receiving the second access control data; and

controlling access to the set of network devices based on the second access control data that replaced the first access control data.

2. The access point device of claim 1, wherein the operations further comprise:

validating a credential of a device requesting establishment of attachment signaling with the access point device based on the second access control data;

in response to the credential of the device failing the validating, forwarding the credential of the device to the access point management server device;

receiving, from the access point management server device, validation data representative of an indication of a successful validation of the credential of the mobile device based on third access control data;

updating the second access control data based on the third access control data to generate updated second access control data in response to receiving the third access control data from the access point management server device; and

controlling access to the set of network devices based on the updated second access control data.

3. The access point device of claim 2, wherein the third access control data defines a third set of devices authorized to access the set of network devices via the access point device.

4. The access point device of claim 1, wherein the first access control data further defines first network service parameters for respective devices of the first set of devices and wherein the second access control data further defines second network service parameters for respective devices of the second set of devices.

5. The access point device of claim 1, wherein the second access control data further defines network service parameters for respective devices of the second set of devices.

6. The access point device of claim 5, wherein the network service parameters define levels of service to provide to the respective devices, and wherein at least two of the respective devices are associated with different network service parameters.

7. The access point device of claim 5, wherein the operations further comprise:

receiving a request from a device to access the network via the access point device;

in response to receiving the request, verifying authorization of the device to access the network via the access point device based on the second access control data, and identifying a level of service to provide to the device based on the second access control data; and

in response to the verifying, providing the device access to the network via the access point device based on the level of service.

8. A method, comprising:

determining, by a system comprising a processor, a change has occurred to first access control data based on information stored in an access information data store, wherein the first access control data defines a first set of devices authorized to access a network device of a network via an access point device;

generating, by the system, second access control data based on the change, wherein the second access control data defines a second set of devices authorized to access the network device via the access point device; and

initiating, by the system, transmission of the second access control data to the access point device.

9. The method of claim 8, further comprising:

initiating, by the system, another transmission to the access point device of a request to replace the first access control data with the second access control data in memory associated with the access point device.

10. The method of claim 8, wherein the information stored in the access information data store comprises information defining devices authorized to access the network device via the access point and the information is periodically updated.

11. The method of claim 10, further comprising:

monitoring, by the system, the information of the access information data store to identify the change, wherein the determining comprises periodically comparing the first access information to the information in the access information data store.

12. The method of claim 8, further comprising:

receiving, by the system, a notification regarding the change to the first access control data based on an update to the information stored in the access information data store, wherein the determining comprises determining the change has occurred to the first access control data in response to the receiving the notification.

13. The method of claim 8, further comprising:

receiving, by the system and from the access point device, a credential of a device and a request to connect to the access point device, wherein the device is not identified in the second access control data;

in response to the request, accessing the access information data store and validating authorization of the device to connect to the access point device based on the credential and the information in the access information data store; and

sending verification data to the access point device that validates the authorization of the device to connect to the access point device.

14. The method of claim 8, further comprising:

inferring a modification to the second access control data based on historical data regarding user patterns; and

sending the modification to the second access control data to the access point device.

15. A computer readable storage device comprising executable instructions that, in response to execution, cause an access point device comprising a processor to perform operations, the operations comprising:

receiving first access control data from an access management server device via a set of network devices of a network, wherein the first access control data defines a first set of devices authorized to access the set of network devices of the network via the access point device;

validating a credential of a device requesting establishment of attachment signaling with the access point device based on the first access control data;

in response to the credential of the device failing the validating, forwarding the credential of the device to the access point management server device;

receiving, from the access point management server device, validation data representative of an indication of a successful validation of the credential of the mobile device based on second access control data;

updating the first access control data based on the second access control data to generate updated first access control data in response to receiving the second access control data from the access point management server device; and

controlling access to the set of network devices based on the updated first access control data.

16. The computer readable storage device of claim 15, wherein the updated first access control data adds the device to the first set of devices authorized to access the set of network devices of the network via the access point device.

17. The computer readable storage device of claim 15, wherein the operations further comprise:

receiving third access control data from the access point management server device;

replacing the updated first access control data with the third access control data in response to the receiving the third access control data, wherein the third access control data defines a second set of devices authorized to access the set of network devices via the access point device; and

controlling access to the set of network devices based on the third access control data that replaced the updated first access control data.

18. The computer readable storage device of claim 15, wherein the updated first access control data further defines first network service parameters for respective devices of the first set of devices.

19. The computer readable storage device of claim 18, wherein the network service parameters define levels of service to provide to the respective devices, and wherein at least two of the respective devices are associated with different network service parameters.

20. The computer readable storage device of claim 15, wherein the second access control data further defines a second set of devices authorized to access the set of network devices via the access point device.