Switching between networks

• US 9,380,077 B2
• Filed: 08/08/2013
• Issued: 06/28/2016
• Est. Priority Date: 08/08/2013
• Status: Active Grant

• Current Assignee: iBoss
• Original Assignee: iBoss
• Inventors: Martini, Paul Michael
• Primary Examiner(s): Daftuar, Saket K
• Application Number:
  US13/962,832
• Publication Number:
  US 20150046588A1
• Time in Patent Office: 1,055 Days
• Field of Search: 709/221, 709/222, 709/223, 709/224, 726/1, 726/3, 726/25, 726/26, 726/29, 726/30, 713/154, 713/168, 713/169, 713/191, 717/173, 717/178, 455/405, 455/411
• US Class Current: 1/1
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 65/1013 Network architectures, gateways, control or user entities
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

Methods, systems, and apparatus, including computer programs encoded on computer storage media, for switching between parallel networks. One of the methods includes maintaining a plurality of parallel networks including a first network that precludes access to secure resources, and a second network that provides access both to unsecured resources and secured resources, enabling a user device access to connect to the first network, receiving input from the user device seeking access to one or more secured resources, in response to the received input, installing a device management profile on the user device, and causing the user device to switch from the connection to the first network to a connection to the second network.

Claims

1. A method performed by a data processing apparatus, the method comprising:

maintaining a plurality of networks including a first network that precludes access to secure resources, and a second network that provides access both to unsecure resources and the secure resources;

enabling, by the data processing apparatus, a user device to create a first connection with the first network that precludes access to the secure resources;

receiving, by the data processing apparatus, a request from the user device over the first connection with the first network that precludes access to secure resources seeking access to one or more of the secure resources;

in response to receiving the request from the user device over the first connection with the first network that precludes access to secure resources seeking access to the one or more of the secure resources, sending, by the data processing apparatus, a device management profile to the user device over the first network that precludes access to secure resources, the device management profile configured to be installed on the user device and cause the user device to create a new second connection to the second network that provides access to the secure resources and switch from the first connection to the first network to the new second connection to the second network; and

enabling, by the data processing apparatus, the user device access to the requested one or more of the secure resources over the second network.

2. The method of claim 1, wherein the device management profile comprises a mobile device management profile.

3. The method of claim 1, wherein the device management profile comprises instructions that cause the user device to create the new second connection to the second network and switch from the first connection to the first network to the new second connection to the second network.

4. The method of claim 3, wherein the device management profile comprises one or more network connection settings that enable the user device to create the new second connection with the second network.

5. The method of claim 4, wherein the settings comprise a password for the second network.

6. The method of claim 1, further comprising:

detecting that the device management profile is no longer active on the user device; and

in response to detecting that the device management profile is no longer active on the user device, causing the user device to switch from the second connection to the second network to a third connection to the first network.

7. The method of claim 6, wherein causing the user device to switch from the second connection to the second network to the third connection to the first network comprises creating a new third connection between the first network and the user device.

8. The method of claim 6, wherein detecting that the device management profile is no longer active on the user device comprises detecting that the device management profile is uninstalled from the user device,

the method further comprising automatically removing a profile from the user device wherein the device management profile installed the profile on the user device.

9. The method of claim 1, further comprising:

prior to sending the device management profile to the user device over the first network that precludes access to secure resources, requesting login credentials from the user device;

in response to requesting login credentials from the user device, receiving login credentials from the user device; and

determining whether the received login credentials are valid, wherein the device management profile is sent to the user device based on determining that the received login credentials are valid.

10. The method of claim 1, wherein

a single network connection point broadcasts both the first network and the second network,

enabling the user device to create the first connection with the first network comprises assigning the user device a first internet protocol address from a first range of internet protocol addresses associated with the first network;

and

causing the user device to create the new second connection to the second network and switch from the first connection to the first network to the new second connection to the second network comprises assigning the user device a second internet protocol address from a second range of internet protocol addresses associated with the second network, the first range and the second range being mutually exclusive.

11. A non-transitory computer storage medium encoded with instructions executable by one or more computers that cause the one or more computers to perform operations comprising:

maintaining a plurality of networks including a first network that precludes access to secure resources, and a second network that provides access both to unsecure resources and the secure resources;

enabling, by the one or more computers, a user device to create a first connection with the first network that precludes access to the secure resources;

receiving, by the one or more computers, a request from the user device over the first connection with the first network that precludes access to secure resources seeking access to one or more of the secure resources;

in response to receiving the request from the user device over the first connection with the first network that precludes access to secure resources seeking access to the one or more of the secure resources, sending, by the one or more computers, a device management profile to the user device over the first network that precludes access to secure resources, the device management profile configured to be installed on the user device and cause the user device to create a new second connection to the second network that provides access to the secure resources and switch from the first connection to the first network to the new second connection to the second network; and

enabling, by the one or more computers, the user device access to the requested one or more of the secure resources over the second network.

12. The computer storage medium of claim 11, wherein the device management profile comprises a mobile device management profile.

13. The computer storage medium of claim 11, wherein the device management profile comprises instructions that cause the user device to create the new second connection to the second network and switch from the first connection to the first network to the new second connection to the second network.

14. The computer storage medium of claim 13, wherein the device management profile comprises one or more network connection settings that enable the user device to create the new second connection with the second network.

15. The computer storage medium of claim 14, wherein the settings comprise a password for the second network.

16. The computer storage medium of claim 11, the operations further comprising:

detecting that the device management profile is no longer active on the user device; and

in response to detecting that the device management profile is no longer active on the user device, causing the user device to switch from the second connection to the second network to a third connection to the first network.

17. The computer storage medium of claim 16, wherein causing the user device to switch from the second connection to the second network to the third connection to the first network comprises creating a new third connection between the first network and the user device.

18. The computer storage medium of claim 16, wherein detecting that the device management profile is no longer active on the user device comprises detecting that the device management profile is uninstalled from the user device,

the operations further comprising automatically removing a profile from the user device wherein the device management profile installed the profile on the user device.

19. The computer storage medium of claim 11, the operations further comprising:

prior to sending the device management profile to the user device over the first network that precludes access to secure resources, requesting login credentials from the user device;

in response to requesting login credentials from the user device, receiving login credentials from the user device; and

determining whether the received login credentials are valid, wherein the device management profile is sent to the user device based on determining that the received login credentials are valid.

20. The computer storage medium of claim 11, wherein

a single network connection point broadcasts both the first network and the second network,

enabling the user device to create the first connection with the first network comprises assigning the user device a first internet protocol address from a first range of internet protocol addresses associated with the first network;

and

causing the user device to create the new second connection to the second network and switch from the first connection to the first network to the new second connection to the second network comprises assigning the user device a second internet protocol address from a second range of internet protocol addresses associated with the second network, the first range and the second range being mutually exclusive.

21. A system comprising:

one or more computers and one or more storage devices storing instructions executable by the one or more computers that cause the one or more computers to perform operations comprising;

maintaining a plurality of networks including a first network that precludes access to secure resources, and a second network that provides access both to unsecure resources and the secure resources;

enabling, by the one or more computers, a user device to create a first connection with the first network that precludes access to the secure resources;

receiving, by the one or more computers, a request from the user device over the first connection with the first network that precludes access to secure resources seeking access to one or more of the secure resources;

in response to receiving the request from the user device over the first connection with the first network that precludes access to secure resources seeking access to the one or more of the secure resources, sending, by the one or more computers, a device management profile to the user device over the first network that precludes access to secure resources, the device management profile configured to be installed on the user device and cause the user device to create a new second connection to the second network that provides access to the secure resources and switch from the first connection to the first network to the new second connection to the second network; and

enabling, by the one or more computers, the user device access to the requested one or more of the secure resources over the second network.

22. The system of claim 21, wherein the device management profile comprises a mobile device management profile.

23. The system of claim 21, wherein the device management profile comprises instructions that cause the user device to create the new second connection to the second network and switch from the first connection to the first network to the new second connection to the second network.

24. The system of claim 23, wherein the device management profile comprises one or more network connection settings that enable the user device to create the new second connection with the second network.

25. The system of claim 24, wherein the settings comprise a password for the second network.

26. The system of claim 21, the operations further comprising:

detecting that the device management profile is no longer active on the user device; and

in response to detecting that the device management profile is no longer active on the user device, causing the user device to switch from the second connection to the second network to a third connection to the first network.

27. The system of claim 26, wherein causing the user device to switch from the second connection to the second network to the third connection to the first network comprises creating a new third connection between the first network and the user device.

28. The system of claim 26, wherein detecting that the device management profile is no longer active on the user device comprises detecting that the device management profile is uninstalled from the user device,

the operations further comprising automatically removing a profile from the user device wherein the device management profile installed the profile on the user device.

29. The system of claim 21, the operations further comprising:

prior to sending the device management profile to the user device over the first network that precludes access to secure resources, requesting login credentials from the user device;

in response to requesting login credentials from the user device, receiving login credentials from the user device; and

determining whether the received login credentials are valid, wherein the device management profile is sent to the user device based on determining that the received login credentials are valid.

30. The system of claim 21, wherein

a single network connection point broadcasts both the first network and the second network,

enabling the user device to create the first connection with the first network comprises assigning the user device a first internet protocol address from a first range of internet protocol addresses associated with the first network;

and

causing the user device to create the new second connection to the second network and switch from the first connection to the first network to the new second connection to the second network comprises assigning the user device a second internet protocol address from a second range of internet protocol addresses associated with the second network, the first range and the second range being mutually exclusive.