System and method for location-based security

• US 9,848,291 B2
• Filed: 09/18/2015
• Issued: 12/19/2017
• Est. Priority Date: 09/18/2014
• Status: Active Grant

• Current Assignee: BOOZ Allen Hamilton Holding Corporation
• Original Assignee: BOOZ Allen Hamilton Holding Corporation
• Inventors: Myers, Gary Jason, Welsh, Matthias, Knight, II, Robert Wayne, Schaefer, Timothy
• Primary Examiner(s): Holloway, III, Edwin
• Application Number:
  US14/858,351
• Publication Number:
  US 20160088432A1
• Time in Patent Office: 823 Days
• Field of Search: 340 52
• CPC Class Codes: G06F 1/1684 Constructional details or arrangements related to integrated I/O peripherals not covered by groups G06F1/1635 - G06F1/1675
• CPC Class Codes: G06F 1/1698 the I/O peripheral being a sending/receiving arrangement to establish a cordless communication link, e.g. radio or infrared link, integrated cellular phone details of antennas disposed inside a computer H01Q1/2266
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: G06K 7/10366 the interrogation device being adapted for miscellaneous applications
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/023 using mutual or relative location information between multiple location based services [LBS] targets or of distance thresholds
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

A mobile computing device, including: a first memory device having first computer-readable instructions tangibly recorded thereon; a first hardware processor configured to execute the first computer-readable instructions recorded on the first memory device; and an RFID component that includes a transceiver configured to receive a proximity signal from at least one RFID reader when the RFID component is within a predetermined range of the at least one RFID reader, and a second memory device configured to store the proximity signal, wherein the first hardware processor is configured to, upon executing the instructions recorded on the first memory device, control at least one operation of the mobile computing device in accordance with the proximity signal received by the transceiver of the RFID component from the at least one RFID reader.

Claims

1. A mobile computing device, comprising:

a first memory device having first computer-readable instructions tangibly recorded thereon;

a first hardware processor configured to execute the first computer-readable instructions recorded on the first memory device; and

an RFID component that includes a transceiver configured to receive a proximity signal from at least one RFID reader when the RFID component is within a predetermined range of the at least one RFID reader, and a second memory device configured to store the proximity signal,

wherein the first hardware processor is configured to, upon executing the instructions recorded on the first memory device, enable access to at least one operation of the mobile computing device in accordance with the proximity signal received by the transceiver of the RFID component from the at least one RFID reader when the transceiver of the RFID component receives the proximity signal while the RFID component is within the predetermined range of the at least one RFID reader, and disable access to the at least one operation of the mobile computing device when the transceiver of the RFID component does not receive the proximity signal while the RFID component is not within the predetermined range of the at least one RFID reader, and

wherein the proximity signal stored in the second memory device of the RFID component includes a control policy identifying the at least one operation of the mobile computing device that the mobile computing device is enabled to access when the RFID component receives the proximity signal while the RFID component is within the predetermined range of the at least one RFID reader, and disabled to access when the RFID component does not receive the proximity signal while the RFID component is not within the predetermined range of the at least one RFID reader.

2. The mobile computing device of claim 1, wherein the first hardware processor is configured to, in enabling or disabling access to the at least one operation of the mobile computing device, at least one of:

control at least one hardware component of the mobile computing device;

control at least one operating system recorded on the first memory device;

control at least one hypervisor recorded on the first memory device; and

control at least one application program executable on the mobile computing device.

3. The mobile computing device of claim 1, wherein the control policy includes identifications of operations of the mobile computing device that are performable, and

wherein the first hardware processor is configured to, based on the control policy, enable or disable access to at least one of an executable application stored in the first memory device, a file stored in the first memory device, at least one operating system of the mobile computing device, and a peripheral hardware component with which the mobile computing device is configured to communicate.

4. A system comprising:

the mobile computing device of claim 1; and

at least one RFID reader configured to communicate wirelessly with the RFID component of the mobile computing device and transmit the proximity signal to the RFID component of the mobile computing device when the RFID component is within the predetermined range.

5. The mobile computing device of claim 1, wherein the predetermined range is at least one meter to approximately 20 meters.

6. The mobile computing device of claim 1, wherein the proximity signal includes location-related data indicating a current physical location of at least one of the RFID component and the at least one RFID reader.

7. The mobile computing device of claim 6, wherein the first memory device has recorded thereon the control policy for the mobile computing device, the control policy including identifications of operations of the mobile computing device which are performable based on the physical location of the mobile computing device, and

wherein the first hardware processor is configured to compare the location-related data with the control policy, and determine which operations of the mobile computing device are permitted to be performed based on the comparison.

8. The mobile computing device of claim 7, wherein, based on the comparison of the location-related data with the control policy, the first hardware processor is configured to control a power state of the mobile computing device.

9. The mobile computing device of claim 7, wherein, based on the comparison of the location-related data with the control policy, the first hardware processor is configured to control access to at least one hardware component of the mobile computing device.

10. The mobile computing device of claim 7, wherein, based on the comparison of the location-related data with the control policy, the first hardware processor is configured to enable or disable access to at least one of an executable application stored in the first memory device, a file stored in the first memory device, at least one operating system of the mobile computing device, and a peripheral hardware component with which the mobile computing device is configured to communicate.

11. The mobile computing device of claim 7, wherein at least one of the control policy and the proximity signal are encrypted using an AES-256 GCM algorithm and signed with an ECDSA Curve P-385 signature.

12. The mobile computing device of claim 7, wherein the transceiver of the RFID component is configured to receive an update signal from the at least one RFID reader, the update signal containing an update to at least one of the identifications included in the control policy recorded on the first memory device, and

wherein the first hardware processor is configured to update the control policy recorded in the first memory device in accordance with the update contained in the update signal.

13. A system comprising:

the mobile computing device of claim 12;

at least one RFID reader configured to communicate wirelessly with the RFID component of the mobile computing device and transmit the proximity signal to the RFID component of the mobile computing device when the RFID component is within the predetermined range; and

at least one server configured to transmit the update signal to the RFID reader for updating the control policy recorded on the first memory device when the mobile computing device is in communicative range with the RFID reader.

14. The mobile computing device of claim 6, wherein the second memory device has recorded thereon second computer-readable instructions and a control policy for the mobile computing device, the control policy including identifications of operations of the mobile computing device which are performable based on the location-related data of the received proximity signal.

15. The mobile computing device of claim 14,

wherein the RFID component includes a second hardware processor configured to execute the second computer-readable instructions recorded on the second memory device, compare the location-related data with the control policy, determine which operations of the mobile computing device are permitted to be performed based on the comparison, and generate an operation signal identifying the operations of the mobile computing device which are determined to be performable,

wherein the RFID component is configured to transmit the operation signal to the first hardware processor of the mobile computing device, and

wherein the first hardware processor is configured to control the at least one operation of the mobile computing device in accordance with the operation signal received from the transceiver of the RFID component.

16. The mobile computing device of claim 15, wherein, based on the operation signal received from the transceiver of the RFID component, the first hardware processor is configured to control a power state of the mobile computing device.

17. The mobile computing device of claim 15, wherein, based on the operation signal received from the transceiver of the RFID component, the first hardware processor is configured to control access to at least one hardware component of the mobile computing device.

18. The mobile computing device of claim 15, wherein, based on the operation signal received from the transceiver of the RFID component, the first hardware processor is configured to enable or disable access to at least one of an executable application stored in the first memory device, a file stored in the first memory device, at least one operating system of the mobile computing device, and a peripheral hardware component with which the mobile computing device is configured to communicate.

19. The mobile computing device of claim 15, wherein the transceiver of the RFID component is configured to receive an update signal from the at least one RFID reader, the update signal containing an update to at least one of the identifications included in the control policy recorded in the second memory device, and

wherein the second hardware processor is configured to update the control policy recorded in the second memory device in accordance with the update contained in the update signal.

20. A system comprising:

the mobile computing device of claim 19;

at least one RFID reader configured to communicate wirelessly with the RFID component of the mobile computing device and transmit the proximity signal to the RFID component of the mobile computing device when the RFID component is within the predetermined range; and

at least one server configured to transmit the update signal to the at least one RFID reader for updating the control policy recorded in the second memory device when the mobile computing device is in communicative range with the at least one RFID reader.

21. A method for controlling at least one operation of a mobile computing device, the method comprising:

receiving, by a transceiver of an RFID component, a proximity signal from at least one RFID reader when the RFID component is within a predetermined range of the at least one RFID reader;

storing the proximity signal in a first memory device of the RFID component; and

executing, by a first hardware processor of the mobile computing device, first computer-readable instructions tangibly recorded on a second memory device of the mobile computing device, the executed instructions enabling access to the at least one operation of the mobile computing device in accordance with the proximity signal received by the transceiver of the RFID component from the at least one RFID reader when the transceiver of the RFID component receives the proximity signal while the RFID component is within the predetermined range of the at least one RFID reader, and disabling access to the at least one operation of the mobile computing device when the transceiver of the RFID component does not receive the proximity signal while the RFID component is not within the predetermined range of the at least one RFID reader,

wherein the proximity signal stored in the first memory device of the RFID component includes a control policy identifying the at least one operation of the mobile computing device that the mobile computing device is enabled to access when the RFID component receives the proximity signal while the RFID component is within the predetermined range of the at least one RFID reader, and disabled to access when the RFID component does not receive the proximity signal while the RFID component is not within the predetermined range of the at least one RFID reader.

22. The method of claim 21, wherein the predetermined range is at least one meter to approximately 20 meters.

23. A non-transitory computer-readable storage medium storing instructions which, when executed by a hardware processor of a mobile computing device, cause the hardware processor to perform a method for controlling at least one operation of the mobile computing device, the method comprising:

receiving a proximity signal from a transceiver of an RFID component communicatively connected to the mobile computing device, the transceiver receiving the proximity signal when the RFID component is within a predetermined range of at least one RFID reader;

storing the received proximity signal in a memory device of the mobile computing device; and

executing, by the hardware processor of the mobile computing device, the instructions stored on the non-transitory computer-readable storage medium of the mobile computing device, the executed instructions enabling the at least one operation of the mobile computing device in accordance with the proximity signal received by the transceiver of the RFID component from the at least one RFID reader when the transceiver of the RFID component receives the proximity signal while the RFID component is within the predetermined range of the at least one RFID reader, and disabling access to the at least one operation of the mobile computing device when the transceiver of the RFID component does not receive the proximity signal while the RFID component is not within the predetermined range of the at least one RFID reader,

wherein the proximity signal stored in the memory device of the RFID component includes a control policy identifying the at least one operation of the mobile computing device that the mobile computing device is enabled to access when the RFID component receives the proximity signal while the RFID component is within the predetermined range of the at least one RFID reader, and disabled to access when the RFID component does not receive the proximity signal while the RFID component is not within the predetermined range of the at least one RFID reader.

24. The non-transitory computer-readable recording medium of claim 23, wherein the predetermined range is at least one meter to approximately 20 meters.

25. A non-transitory computer-readable storage medium storing instructions which, when executed by a hardware processor located in an RFID component communicatively connected to a mobile computing device, cause the hardware processor to perform a method for controlling at least one operation of the mobile computing device, the method comprising:

receiving, by a transceiver of the RFID component, a proximity signal when the RFID component is within a predetermined range of at least one RFID reader;

storing the proximity signal in the non-transitory computer-readable storage medium of the RFID component, the non-transitory computer-readable storage medium of the RFID component having a control policy for the mobile computing device, the control policy including identifications of operations of the mobile computing device which are performable based on the received proximity signal;

comparing the proximity signal to the control policy, determining which operations of the mobile computing device are permitted to be performed based on the comparison, and generating an operation signal identifying the operations of the mobile computing device which are determined to be performable;

transmitting the operation signal, to a second hardware processor of the mobile computing device, to enable access to at least one operation of the mobile computing device in accordance with the operation signal transmitted to the mobile computing device when the transceiver of the RFID component receives the proximity signal while the RFID component is within the predetermined range of the at least one RFID reader; and

disabling access to the at least one operation of the mobile computing device when the transceiver of the RFID component does not receive the proximity signal while the RFID component is not within the predetermined range of the at least one RFID reader.