US20170034692A1 - System and method for remote device recognition at public hotspots - Google Patents
System and method for remote device recognition at public hotspots Download PDFInfo
- Publication number
- US20170034692A1 US20170034692A1 US15/294,478 US201615294478A US2017034692A1 US 20170034692 A1 US20170034692 A1 US 20170034692A1 US 201615294478 A US201615294478 A US 201615294478A US 2017034692 A1 US2017034692 A1 US 2017034692A1
- Authority
- US
- United States
- Prior art keywords
- user
- remote device
- access
- network
- hotspot
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W8/00—Network data management
- H04W8/22—Processing or transfer of terminal data, e.g. status or physical capabilities
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/95—Retrieval from the web
- G06F16/955—Retrieval from the web using information identifiers, e.g. uniform resource locators [URL]
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/10—Active monitoring, e.g. heartbeat, ping or trace-route
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/14—Session management
- H04L67/141—Setup of application sessions
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/2866—Architectures; Arrangements
- H04L67/30—Profiles
- H04L67/303—Terminal profiles
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/06—Authentication
-
- H04W4/028—
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
- H04W4/02—Services making use of location information
- H04W4/029—Location-based management or tracking services
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W8/00—Network data management
- H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2101/00—Indexing scheme associated with group H04L61/00
- H04L2101/60—Types of network addresses
- H04L2101/618—Details of network addresses
- H04L2101/622—Layer-2 addresses, e.g. medium access control [MAC] addresses
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W8/00—Network data management
- H04W8/005—Discovery of network devices, e.g. terminals
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W84/00—Network topologies
- H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
- H04W84/10—Small scale networks; Flat hierarchical networks
- H04W84/12—WLAN [Wireless Local Area Networks]
Definitions
- the present disclosure relates to wireless networks, and in particular, to a system and method for remote device recognition.
- Wireless devices and systems are currently available for enabling a user of a remote device access to a communication network (e.g. the Internet) via a wireless access point (WAP) and gateway communicatively linked to this communication network, for example, operated at a given location or in a given area commonly known as a hotspot.
- a communication network e.g. the Internet
- WAP wireless access point
- gateway communicatively linked to this communication network, for example, operated at a given location or in a given area commonly known as a hotspot.
- a method for recognizing a wireless device across multiple hotspot locations comprising: detecting at one of the multiple hotspot locations a wireless transmission sent by the wireless device; extracting a unique device identifier of the detected device from said wireless transmission, said unique device identifier automatically embedded within said wireless transmission by the detected device without user input; cross-referencing said extracted device identifier with a network accessible database of stored device profiles, each of said device profiles having a respective stored device identifier associated therewith; and recognizing the detected device upon matching said extracted device identifier with one said stored device identifier; otherwise automatically creating a new device profile in said database as a function of said extracted device identifier such that the device is recognized upon subsequent detection at any of said multiple hotspot locations.
- a system for tracking wireless devices across multiple hotspot locations comprising: a network accessible database having stored therein a plurality of device profiles each identifying a respective wireless device by a stored unique device identifier, each said stored unique device identifier indicative of an inherent characteristic of said respective device; and a network access module at each of said locations and configured to detect at a given location a wireless transmission sent from a given device and having embedded therein a transmitted unique device identifier inherent to said given device; said network access module interfacing with said network accessible database to cross-reference said transmitted unique device identifier with said plurality of device profiles to identify a matching profile and thereby recognize said given device, and otherwise automatically create a new device profile based on said transmitted unique device identifier so to recognize said given device upon subsequent detection at any of said multiple hotspot locations.
- method for automatically characterizing a device visit at a Wi-Fi hotspot location comprising: detecting a first wireless transmission sent by a wireless device; extracting a unique device identifier of the detected device from said wireless transmission, said unique device identifier automatically embedded within said wireless transmission by the detected device without user input; creating a device visit profile and associating said extracted unique device identifier therewith; recording a timestamp of said first wireless transmission in said device visit profile; automatically identifying one or more subsequent wireless transmissions sent by said wireless device while at the Wi-Fi hotspot location by way of identifying data associated with each of said subsequent transmissions directly or indirectly associated with said unique identifier; recording a timestamp of each of said subsequent transmissions in said device visit profile; and characterizing said device visit profile at least as a function of a duration value defined by said recorded timestamp of said first transmission and a recorded timestamp of a last of said subsequent transmissions.
- a method for recognizing a wireless device across multiple Wi-Fi locations comprising: detecting at one of the multiple Wi-Fi locations a wireless transmission sent by the wireless device; extracting a unique device identifier of the detected device from said wireless transmission, said unique device identifier automatically embedded within said wireless transmission by the detected device without user input; cross-referencing said extracted device identifier with a network accessible database of stored device profiles, each of said device profiles having a respective stored device identifier associated therewith; recognizing the detected device upon matching said extracted device identifier with one said stored device identifier; and associating with said device profile of said recognized device said one of the multiple Wi-Fi locations; and centrally compiling from said stored device profiles, visit data for each of said multiple Wi-Fi locations.
- FIG. 1 is a high level diagrammatic representation of a remote service access system, in accordance with embodiments of the invention
- FIG. 2A is a high level diagrammatic representation of an exemplary remote device, in accordance with embodiments of the invention.
- FIG. 2B is a high level diagrammatic representation of a service access module, in accordance with embodiments of the invention.
- FIG. 2C is a high level diagrammatic representation of a network access module, in accordance with embodiments of the invention.
- FIG. 3 is a flow diagram depicting a method of registering a user and a remote device for access to the system of FIG. 1 , in accordance with embodiments of the invention
- FIG. 4 is a flow diagram depicting a process of identifying, authenticating, and authorizing a user with a browser-based or browser challenged mobile or remote device, in accordance with embodiments of the invention
- FIG. 5 is a sequence diagram depicting communications between components of the system of FIG. 1 , for identifying, authenticating, and authorizing a user with a browser-based or browser challenged mobile or remote device, in accordance with embodiments of the invention;
- FIG. 6 is a flow diagram depicting a process of identifying, authenticating, and authorizing a user with a browserless mobile or remote device, in accordance with embodiments of the invention
- FIG. 7 is a sequence diagram depicting communications between components of the system of FIG. 1 , for identifying, authenticating, and authorizing a user with a browserless mobile or remote device, in accordance with embodiments of the invention
- FIG. 8 is a flow diagram depicting a method of accessing wireless services using a browser-based remote device, in accordance with embodiments of the invention.
- FIG. 9 is a flow diagram depicting a method of accessing wireless services using a browser-challenged remote device, in accordance with embodiments of the invention.
- FIG. 10 is a flow diagram depicting a method of accessing wireless services using a browserless remote device, in accordance with embodiments of the invention.
- FIG. 11 is an exemplary screen shot depicting a relational database containing sample data of hotspot access networks, user profiles, and device profiles, in accordance with embodiments of the invention.
- FIG. 12 is a flow diagram depicting an exemplary method for extracting information from a remote device, according to an embodiment of the invention.
- FIG. 13 is a diagram of an exemplary system hardware architecture for device detection and recognition, in accordance with one embodiment of the invention.
- FIG. 14A is a high-level diagram depicting progressively increasing engagement levels between a wireless device and a hotspot, and distinguishing passive and active visitors at this hotspot as a function of their engagement level, in accordance with an embodiment of the invention
- FIG. 14B to 14D are diagrammatic representations of respective visit profiles, in accordance with an embodiment of the invention, in which different device detection and network interaction events are used to characterize each visit.
- FIG. 15 is a diagram of an exemplary process flow for device detection, and recognition, visit data compilation and processing related thereto, and downstream applications associated therewith, in accordance with one embodiment of the invention
- FIG. 16 is an exemplary screenshot of a system reports and analytics site consolidating visit and device-related data accessed over time in respect of a plurality of participating hotspots and/or hotspot operators;
- FIGS. 17A and 17B are exemplary graphical user interfaces providing a real-time dashboard of device and visit-related data in respect of multiple hotspots operated by a common hotspot operator, and in respect of a single hotspot, respectively, in accordance with one embodiment of the invention.
- FIG. 18 is a diagrammatic representation of illustrative downstream applications for a device detection and recognition system, in accordance with one embodiment of the invention.
- the system 10 is configured to provide one or more remote devices 102 access to one or more services 114 via a network 104 .
- the system generally comprises one or more network access modules 106 , adapted for communicating wirelessly with the one or more remote devices 102 , and one or more service access modules as in module 112 , communicatively linked to the network access module(s) 106 and configured to provide to the remote device(s) 102 access to the service(s) 114 via the network access module(s) 106 and network 104 .
- the system 10 may be used to identify different remote devices 102 via the network access module 112 , and in some embodiments, authenticate and authorize access thereto to network and/or Web-based services accessible via the service access module 106 .
- the system 10 allows browser-based, browser-challenged, and/or browserless remote devices to access these services, or a selection thereof, when such remote devices are operated at a public access hotspot supported by the system 10 .
- the network access module 106 may be configured for receiving identifying data from a remote device 102 , and communicating this identifying data to the service access module 112 for authentication and authorization. Once the identifying data is authenticated, the service access module 112 will authorize that the remote device 102 access the network 104 and services 114 provided therethrough.
- the system 10 may be configured to provide full access to each remote device 102 , or again each remote device type, or provide restricted access to selected services 114 based on user information, remote device owner or type information, service provider information, related purchase information, service promotions offered by service provider partnerships or agreements, and/or a combination of the above and other such information available through the system 10 .
- Identifying data may, for example, comprise remote device type data automatically embedded within remote device transmissions and extracted by the system 10 , remote device type data extracted from user preferences available from the remote device, user data input thereby using a user interface (e.g. username and password, etc.), or a combination thereof, to name a few.
- a user interface e.g. username and password, etc.
- user information or data resides or is entered or stored on the remote device and is compared to a user profile stored in a knowledge base operatively coupled to the service access module. In some embodiments, as an aid to authentication, at least a portion of user information is not stored on the remote device but is provided by the user when access is required.
- remote device information or data resides or is stored on the remote device and is compared to a remote device profile stored in a knowledge base operatively coupled to the service access module.
- Remote device information can be indicative of inherent characteristics of the remote device, such as a MAC address, or can be other information stored on the remote device for identification thereof.
- a service profile can associate information about users, remote devices, hotspot providers, hotspot locations, or service providers, or a combination thereof with a collection of allowed or restricted services, resources or applications to be provided.
- the service profile can include information about services which a user has paid for and subscribed to, services usable by a remote device, and/or services offered by a hotspot provider, hotspot location, or service provider.
- the service profile can additionally include information about service offerings provided to specified combinations of user, remote device, hotspot provider, hotspot location, and service provider.
- Service profiles can be stored in a knowledge base, and accessed to determine what access should be given upon initiation of a connection of a remote device at a hotspot.
- the user profile and/or remote device profile are associated with the service profile in the knowledge base.
- user and/or remote device information provided by the remote device is compared with the user profile and/or remote device profile in the knowledge base for validation, and access to services as described by the service profile are granted upon validation.
- authorization constraints can be associated with a service profile and used to directly or indirectly limit or disable specified applications, or to limit or disable network access functionality related to said specified applications.
- Authorization whitelists can also be used, as an alternative to or in conjunction with authorization constraints, to positively define access to services or to provide minimum service level guarantees.
- the system 10 generally provides one or more remote devices 102 access to one or more services 114 via network 104 .
- the system 10 could be used to provide access to digital home services, such as access to digital TV or other forms of home content to access applications such as, but not limited to, Slingbox, Orb, Location Free TV (LFTV), and/or home security features provided by various online home security service providers.
- a user could thus connect to a home access system (e.g. a home media server, networked computer, etc.) to access images, music, videos, files, and the like that are stored on remote devices located in the user's home, business, office, etc.
- a home access system e.g. a home media server, networked computer, etc.
- the system 10 could also be used to access remote media services, for example from another remote device 102 supported by the system 10 , from a Web-enabled media service provider (e.g. music and/or video download, sharing, etc.), or from other such networked services.
- a Web-enabled media service provider e.g. music and/or video download, sharing, etc.
- services 114 could include access to instant messaging services, such as but not limited to, AOLTM Instant Messenger, MicrosoftTM MSN MessengerTM, Yahoo!TM Messenger, ICQ, or GoogleTM Talk, access to various public, private and/or enterprise email services, such as but not limited to, Hotmail, Gmail, Yahoo!TM Mail, AOLTM Mail, MicrosoftTM OutlookTM, as well as access to enterprise business applications such as, but not limited to, collaborative platforms using, for example, MicrosoftTM Unified Communications (e.g. OutlookTM, Messenger, SharepointTM, MicrosoftTM Communications VOIP services, etc.), and the like. Access could also be provided to social networking applications such as FacebookTM, MySpaceTM and YouTubeTM. Access could also be provided to cloud storage systems such as SkyDriveTM and Google DocsTM, or other virtualized computing resources.
- instant messaging services such as but not limited to, AOLTM Instant Messenger, MicrosoftTM MSN MessengerTM, Yahoo!TM Messenger, ICQ, or GoogleTM Talk
- access to various public, private and/or enterprise email services such as but not limited to, Hotmail, G
- services can be characterized at least in part as allowing access to groups of applications, and/or as allowing access to specified network resources at specified levels.
- network resources can include sets of one or more TCP or UDP ports, data transmission or reception capabilities at a specified bandwidth, bandwidth variation, delay, delay variation, communication priority, support for specified sources or destinations, application or removal of packet size restrictions, and the like, as applied to either upstream traffic, downstream traffic, or a combination thereof.
- Specified network protocols for example protocols supporting streaming video or audio, can also be considered network resources.
- services characterized by allowing access to groups of applications and/or specified network resources or levels thereof can be further characterized by other aspects, such as allowing access to specified applications, to specified remote devices or at specified locations, times, or the like.
- network resources such as described above can be selectively allowed or blocked in order to enable or disable access to one or more selected applications. For example, if a customer subscribes to a streaming audio application, access to appropriate TCP ports, streaming audio servers, and network traffic characteristics representative of streaming audio can be allowed such as support the streaming audio application. However, communication with streaming video servers may optionally be blocked unless the customer pays an additional fee.
- Applications and/or groups of applications can be profiled to associate therewith the network resources or characteristics required for access thereto. Service providing access to selected applications can then be enabled by allowing access to the network resources or characteristics associated therewith, for example by looking up the appropriate associations in a knowledge base.
- a user could gain access to the Internet, or similar network structures, on an open access basis, such that this user could browse the Internet, download from the Internet, play online games, etc., in one example, restricted only by possible functional, processing and/or communication capabilities and limitations of the user's remote device 102 .
- access could be limited to services selected or pre-selected for a given user or user remote device, identified and authenticated by the service access module 112 and authorized to access these limited services via the network access module 106 .
- the system 10 may be configured to manage public and/or private network access for a plurality of remote devices 102 , optionally of a plurality of remote device types, configurations and/or functionality, and that, within a variety of venues if necessary.
- identification, authentication and authorization can be implemented for a variety of remote devices and/or users, and optionally, for different services and service access packages and/or restrictions.
- Such packages could, in various embodiments, be defined by the type of remote device used to access the system 10 , e.g. based on remote device capabilities, functionality and/or limitations; the specific user or remote device accessing the system 10 , e.g. based on a user and/or remote device profile listing selected and/or pre-selected services; or a combination thereof, for example.
- access is provided in accordance with a selected or identified service access package wherein access is provided to one or more Value Based Applications (VBAs) selected or offered to a given user and/or remote device.
- VBAs can be offered either at no cost or as part of a paid service.
- Such VBAs may include a number of remotely operable applications or service levels for which an end user may wish to gain access via the present system.
- a VBA could comprise a specific application to which access is provided via a mobile network, managed by remote device and/or network specific functionality, and priced according to the value delivered by the specific application to a specific market segment.
- a VBA could comprise enabling a combination of capabilities and/or service quality levels that are desired for effectively using a specific application or class of applications, priced according to the value delivered thereby. Pricing can include monetary payment, but can also be affected by other factors such as purchases of related products, services or service contracts, association with a selected service provider, or the pre-existence of other related products, services or service contracts.
- Enabling VBAs may thus provide access and cost flexibility to the end user through specifically defined service profiles. These service profiles can be packaged into a monetized service based on a specific functionality, for example, gaming, home connect, etc., and tied to the remote devices that support such functionality. Furthermore, an embodiment can be configured to enable the identification of a remote device 102 as a browser-based, browser challenged, or browserless remote device, and optionally configured to combine such remote device identification with user identification. Embodiments can allow for access to the network 104 and services 114 using a service-based accounting, which permits users with browserless remote devices to access these networks 104 , and can also facilitate service-oriented network access at hotspots and other such locations.
- a user can select and pre-pay for a service profile based on price and desired functionality.
- Options to upgrade a service profile can be provided, triggered by a user's attempt to access a service other than described in their service profile, or to access a service in a manner other than described in their service profile (for example but not limited to: beyond a predetermined time limitation, outside of authorized hotspots, outside of a predetermined geographic area, using an unauthorized remote device or remote device type, accessing an unauthorized application, simultaneously using more remote devices than is authorized, or using resources beyond a predetermined bandwidth cap or bit cap). It will be understood that a variety of pre-paid or pay-as-you-go service plans can be implemented in some embodiments.
- a user may be willing to pay a fraction of the traditional hotspot access price for a specific function or application, for example, offering, at a discounted price, to only connect a given user to their home computer, watch TV from their home digital cable box, access a social application such as FacebookTM, or keep a son or daughter entertained at the airport during a 3-hour layover with a hand-held gaming remote device connected to other players on the Internet.
- the system 10 can be configured to manage user accounts and apply customized authorization rules, such as whitelists or constraints (e.g. firewall rules via gateway 110 of the network access module 106 of FIG.
- An upsell feature may also be implemented through the system 10 such that a user may choose to upgrade their service profile to gain access to further services 114 .
- quality of service can also be affected by a service profile.
- the service profile can be influenced by user and remote device profile information, or service provider information. For example, a user may be willing to pay a premium for improved levels of service through adjustment of the service profile, selected remote devices or remote devices associated with selected service providers can be automatically given improved levels of service through adjustment of the service profile, or a combination of such factors can influence adjustment of the service profile.
- service levels as specified by a service profile can also be dependent on other factors, such as remote device, remote device type, location, application, and/or the like.
- a service profile influencing access to predetermined functions or applications can be determined according to marketing and sales strategies. For example, access can be linked to a purchase at a hotspot providing network access services. Such an offering could be free access to one or more applications when a coffee is purchased using a stored-value card. As another example, a frequent user at a hotspot could be given a preferred pricing rate, extended time allowances or enhanced access to applications based on previous history of purchases at the hotspot or selected affiliates. Influencing service profiles, for example by a service provider or hotspot location, can be performed on a permanent or trial basis, for example for market or technical research purposes.
- VBAs providing access to one or more VBAs
- types and configurations of VBAs be combined or provided exclusively in the context of a predefined or custom service package.
- upsell mechanisms and opportunities may be provided within the present context to provide a user access to additional services, either as a supplement to an existing subscription package, a one-time trial or limited subscription, or the like, for example.
- Service profiles, service provider partnerships, and the like can be combined to offer access to services such as communication resources, internet, email or social applications, based on one or more factors such as location, time of day, remote device type, remote device service provider, hotspot service provider, and the like.
- network 104 may comprise a combination of networks conducive to provide a user access to a diversity of services 114 .
- network access may be provided to Sling MediaTM, which allows a user to connect to their home SlingboxTM device from a remote location; SonyTM Location Free TV, which allows a user to connect to their home Location-Free TV (LFTV) from a remote location; and/or Orb NetworksTM, which allows a user to connect to their home OrbTM server and retrieve content from their home server from a remote location.
- Sling MediaTM which allows a user to connect to their home SlingboxTM device from a remote location
- SonyTM Location Free TV which allows a user to connect to their home Location-Free TV (LFTV) from a remote location
- Orb NetworksTM which allows a user to connect to their home OrbTM server and retrieve content from their home server from a remote location.
- Access to other Internet, Web-enabled and/or network services may also be contemplated, including, but not limited to email and messaging services, media
- the system 10 comprises a single-cell hotspot wireless network, generally comprising a local area network (LAN) or the like limited to a relatively small spatial area such as a room, a single building, a ship, or an aircraft, otherwise commonly referred to as a single location network.
- LAN local area network
- the system 10 comprises a wide area network, such as, but not limited to a muni-Wi-Fi network or the like, and is implemented using one or more of a variety of technologies such as a strand-mounted network, a mesh network, and the like.
- a wide area network could comprise, for example, a metropolitan area network (MAN) that connects two or more LANs together but typically does not extend beyond the boundaries of the immediate town, city, or metropolitan area.
- MAN metropolitan area network
- Multiple routers, switches, and/or hubs can be connected to create a MAN usable in the present context.
- the system 10 comprises a wide area network (WAN), such as, but not limited to a WiMAX Network or the like.
- WAN wide area network
- a WAN could comprise, for example, a data communications network that covers a relatively broad geographic area using transmission facilities provided by common carriers, such as telephone companies, internet companies, and other such communication service providers.
- a remote device 102 such as a wireless remote device, is a device having the ability to communicate with other devices without having physical contact with them.
- a remote device can be an electronic device operable as a wireless interface between a user or another electronic device and a network or wireless access point, such as provided at a hotspot or within a wireless network coverage area.
- a remote device may include, but is not limited to, laptops, Personal Digital Assistants (PDA), Smart phones (e.g.
- a remote device may incorporate several functionalities such as those listed above.
- a remote device can be capable of communicating using one or more different communication modes, such as a combination Wi-Fi and/or cellular device.
- the remote device 102 generally comprises a computer-readable medium or media 208 for storing statements and instructions for the operation of the remote device, and optionally for storing various forms of data useful in the implementation of remote device functions and/or accessible to the user of the remote device as needed; a communication means such as a communication device and/or interface 202 for interfacing with the network access module 106 and optionally, for direct communication with other similarly configured remote devices; one or more processors 206 for processing received and sent information and for implementing statements and instructions stored on the one or more computer-readable media 208 ; and a user interface (UI) 204 , such as a graphical user interface (GUI), keyboard, keypad, game pad, mouse, scroll ball, touch screens, motion sensing user interface, speech recognition system, or the like for receiving input from the user directed to the operation of the remote device 102 .
- GUI graphical user interface
- remote device elements and/or components may also be considered herein without departing from the general scope and nature of the present disclosure.
- various hardware, firmware and/or software may be integrated or operationally associated with a given remote device 102 to achieve various functions and interface with the user and/or various services accessed thereby over the network 104 .
- various peripheral devices such as supplemental user interfaces, data input and/or output means (e.g. printers, scanners, removable storage media, etc.), and the like may also be considered herein.
- the remote devices 102 may include browser-based remote devices, wherein such remote devices comprise a browser-based user interface 204 , such as a Web browser or the like.
- browser-based remote devices may include, but are not limited to laptops, PDAs, and the like.
- the remote devices 102 may include browser-challenged remote devices, wherein such remote devices comprise a browser-challenged user interface 204 , such as for example, a microbrowser or the like, and/or comprise a substandard keypad (i.e. non-QWERTY keypad).
- a microbrowser is defined as a Web browser specially designed for a hand-held remote device and embedded within the software and/or firmware of this remote device.
- the microbrowser is generally optimized so as to display Internet content most effectively for small screens on portable remote devices and have small file sizes to accommodate the low memory capacity and low-bandwidth of such handheld remote devices.
- browser-challenged remote devices may include, but are not limited to, a SonyTM PSPTM, a Smartphone (e.g. AppleTM iPhoneTM, HTC S261, etc.), a BlackberryTM, and the like.
- Content providers may, in some instances, be configured to provide pre-formatted content specifically for some or all browser challenged remote devices.
- the remote devices 102 may include browserless remote devices, wherein such remote devices comprise a browserless user interface 204 , for instance comprising a display and the ability to accept user inputs (e.g. keypad(s), scroll ball(s), etc.) but not encompassing the functionality common to browsers and microbrowsers.
- browserless remote devices may include, but are not limited to, a Nintendo DSTM, a Wi-Fi camera, and the like.
- the network access module 106 of the system 10 comprises a wireless access point (WAP) 108 and a gateway 110 .
- WAP 108 comprises a device configured to connect different wireless communication devices together to form a wireless network, and further connect to one or more wired or wireless networks (e.g. network 104 ), namely via gateway 110 , to relay data between remote device(s) 102 and downstream wired and/or wireless devices.
- the WAP 108 reacts substantially immediately when a remote device 102 scans for an available network.
- the WAP 108 reacts to the remote device scan by communicating to the remote device 102 that there is an available network connection through the network access module 106 .
- the gateway 110 can be used to communicate between a remote network and another network, which, in the present context, may provide access to the service access module 112 .
- the gateway 110 comprises a device configured to communicate between two or more networks which may, for example, use different network protocols (e.g. wireless network protocols, wired network protocols, etc.).
- Examples of gateways 110 operable within the context of system 10 may include, but are not limited to, Colubris Controllers (e.g. MSC-3200), CiscoTM WLAN Controllers (e.g. CiscoTM 2000, 4100 WLAN Access Controller), and MikrotikTM RouterOS, to name a few.
- the gateway 110 may intercept the request to access the network 104 and redirect the request back to the remote device 102 through a web browser for the user to input user information.
- the information requested can be for example, but not limited to, a username and password.
- the user information can be associated with a user profile for identification, authentication and authorization.
- Specific remote device information may also be extracted by the Service Access Module 112 (described below) from data communicated through the gateway 110 for the purposes of identifying and/or authenticating the remote device being used to access the network.
- Such remote device information may include, but is not limited to, the Media Access Control (MAC) address of the remote device 102 , traffic type (e.g.
- This and related remote device information can be associated with a remote device profile for identification, authentication and authorization.
- the gateway 110 receives the user and/or remote device information through the access point 108 and communicates the identifying information to the service access module 112 for authentication and authorization. Once authorized, network access is implemented, either as wide open access, or as restricted access based on a number of access authorization criteria, which may depend on the remote device type, the remote device configuration, the specific remote device, the specific user, and/or other criteria, or combinations thereof.
- the remote device profile and the user profile can be configured to indicate that network access is to be implemented without further interaction from the user, such as entering a user name and password.
- Authorization substantially without user interaction for example based on user profile information and remote device profile information which is automatically transmitted by the remote device, is referred to herein as Express Authentication.
- Express Authentication can further include expedited user interaction, for example, by requiring only a “one-click” or “one-action” connection confirmation from the user or requiring only a password or other convenient user data, such as biometric data, to connect.
- information used for authentication can include user provided information, remote device or remote device type information, and/or other information such as one or more of: user credit card information, prepaid service card information or PIN, user or remote device subscription information, access information or access history, prepaid or stored value card or smart card information for a hotspot or associated product or service provider, PIN distributed for promotional purposes, location information, usage time, date or time of day information, or other information as would be understood by a worker skilled in the art.
- authentication can be performed using information readily accessible. Additionally, if the information initially available for authentication is insufficient for making an authentication decision with a predetermined level of certainty, additional information can be obtained. For example, authentication can be initially based on device information transmitted during an initial connection request, with an option to request a user name and/or password if said transmitted device information cannot be used to uniquely identify the remote device. As another example, information resulting from a transaction related to the remote device can be used to support authentication. For example, if a user pays for a service or associated product or service with a prepaid or stored value card such as a smart card at the hot spot, information resulting from the transaction can be used to support authentication.
- contextual information such as time of day or location information can be used to support authentication. For example, usage time and location patterns of a remote device can be tracked, and if a remote device requests an atypical service or requests service in an atypical location, time of day information may be used to determine whether it is more likely that the user's information or remote device has been stolen or whether the user or remote device is associated with an atypical purpose for that user (such as vacation or leisure time instead of work time).
- user and remote device profiles are managed, for example by a security management module and/or access management module, to reduce or deal with potential fraud, remote device theft, password theft, or other misuse, and to improve user experience and access control.
- information or suspicious activity can be logged, tracked and reported to assist in managing fraud, theft or other misuse.
- Security management can include automated or semi-automated management, or management by one or more service providers on behalf of the service providers themselves, other service providers, or users.
- Management can include applications or services enabling tracking and analysis of remote device or user activity, management of services, service contracts, manual or automated payment options, and the like.
- security is managed by one or more of requiring users to provide username and/or password information; restricting access parameters such as session time limits, concurrent usage by the same user, geographic location, and/or the like; and other methods such as Express Authentication, Advanced Device Profiling, multi-factor authentication, authentication using an SMS messaging system, and fraud detection, or other methods as would be understood by a worker skilled in the art.
- the gateway 110 detects the remote device request for network access and forwards it to the service access module 112 (described below) where remote device information may be extracted from remote device communications, as described above.
- the gateway 110 receives the user and remote device information through the access point 108 and communicates this information to the service access module 112 for authentication and authorization.
- network access is implemented, either as wide open access, or as restricted access based on a number of access authorization criteria. Said network access can be implemented based on the application of authentication constraints.
- an optional request for user information and/or confirmation may be communicated to a distinct remote device of the registered user for confirmation.
- a confirmation message could be sent to a user's cellular phone, or other such device, via a Short Message Service (SMS), wherein the user may then confirm via this distinct device that they are in fact attempting to access the system via their browserless remote device.
- SMS Short Message Service
- Other multi-factor or strong authentication systems can be implemented in conjunction with some embodiments. For example RSATM SecurIDTM, PhonefactorTM or similar services can be implemented during authentication.
- location of a customer's cellular phone may be determined by cell tower association or GPS to determine the likelihood that the customer is indeed at the location where authentication is being requested.
- the system can be configured to give the appearance that authentication has succeeded for the purposes of tracking or apprehending potentially fraudulent use.
- the gateway 110 may be configured to forward remote device communications to the service access module 112 where identifying data may be extracted from remote device transmissions only, wherein such identifying data may comprise remote device type information, specific remote device information, remote device configuration information and the like.
- identifying data may comprise remote device type information, specific remote device information, remote device configuration information and the like.
- remote device identification data only to connect can be described as a form of Express Authentication.
- Using remote device identification data only enables the system 10 to authorize different remote devices access to wide open services or a selection thereof based only on remote device data, and not on inputted user data. This feature may be particularly useful in an example wherein a browserless remote device seeks access to the network but wherein such browserless remote device does not include functionality of a conventional type-in user interface allowing for the input of a username and password, for example.
- Express Authentication can also include automatically transmitted user information, either automatically requested of and provided by the user during authentication or stored on the remote device, or a combination thereof.
- user information can include information stored on a cookie, or input by the user via interface with the remote device.
- the system 10 comprises one or more service access module(s) 112 configured to communicate with the network access module(s) 106 to operatively identify, authenticate and authorize one or more remote devices 102 access to one or more services 114 .
- the service access module 112 generally comprises a computer-readable medium or media 218 for storing statements and instructions for the operation of the module 112 , and for storing various forms of data useful in the implementation of module functions and management of the service access module 112 ; a communication means such as a communication device and/or interface 212 for interfacing with the network access module 106 through the network 104 and optionally, for direct communication with providers of the one or more services 114 ; one or more processors 216 for processing received and sent information and for implementing statements and instructions stored on the one or more computer-readable media 218 ; and an optional management interface 214 , such as a graphical user interface (GUI), keyboard, keypad, mouse, scroll ball or the like for receiving input from a system manager directed to the management of the service access module 112 .
- GUI graphical user interface
- service access module elements and/or components may also be considered herein without departing from the general scope and nature of the present disclosure.
- various hardware, firmware and/or software may be integrated or operationally associated with the service access module 112 to achieve various functions and interface with the remote device(s) 102 , the network access module 106 and/or various services 114 accessed thereby over the network 104 .
- various peripheral devices such as supplemental user interfaces, data input and/or output means (e.g. printers, scanners, removable storage media, etc.), and the like may also be considered herein.
- the service access module 112 may be implemented centrally, in a distributed architecture, or in a combination thereof to achieve a desired functionality and level of complexity.
- the computer readable medium 218 of the service access module 112 comprises an access management module 220 and a knowledge base 210 , wherein the latter can be defined as a structured collection of records or data that is stored on the computer readable media 218 .
- the network access module 106 e.g. the gateway 110 of FIG. 2C
- Information retrieved and stored may include such information as, but not limited to, user name, user password, account number, number of remote devices, remote device types, MAC Addresses, browser information, remote device configuration, service packages and/or user, remote device and service profiles, and the like.
- the database may also contain information regarding the hotspot access point (e.g. the specific network access module 106 implemented), for example, but not limited to, the hotspot access configuration and location information.
- remote device information such as remote device types, MAC Addresses, browser information, remote device configuration, clock or crystal oscillator information, serial numbers, and the like
- ADP Advanced Device Profile
- the ADP can be used to identify, track, manage, and report on remote devices by remote device type, remote device model, or specific instance of a remote device.
- a copy of the advanced remote device profile can be stored for access by the service access module, for comparison with characteristics of remote devices attempting to connect to services through the network access module for identification, authentication and authorization purposes.
- User or remote device access can be configured based on the ADP to allow access to be tailored toward the remote device, or to package access privileges with ownership of selected remote devices or subscription to selected service providers, for example.
- the ADP can also be used to enable Express Authentication, wherein user and/or remote device authentication can proceed with reduced or no input from the user.
- remote device information is captured during negotiation of a connection between the remote device and the network access module.
- a remote device may send a request to initiate a wireless connection with the network access module through an application such as a web browser.
- the request can contain different information, or be configured in different ways as would be understood by a worker skilled in the art.
- a connection request can include specifically configured fields in HTTP headers, configurations of portions of a query string in a URL, MAC address, or other configurable aspects of the connection request as would be understood by a worker skilled in the art.
- This configuration information can be indicative of the remote device or remote device type, since connection requests by different remote devices or device types can be configured differently. For example, different types of connections can be requested in different ways by different remote devices such as laptops, PDAs, gaming devices, or the like.
- the information related to the connection request can be forwarded by the network access module to the service access module, the service access module configured to extract and analyze the information to obtain further information about the remote device or remote device type, for example by comparing the configuration of connection request information against one or more ADPs which relate predetermined profiles or configurations of information to one or more remote devices or remote device types typically having said profile.
- the further information obtained from this analysis can subsequently be used for authorization or authentication purposes.
- information about the remote device can be obtained by running a script or query on the remote device.
- the service access module in response to a connection request by the remote device, can transmit a script to the remote device (via the network access module), or remotely trigger execution of a script already on the remote device.
- the script can be configured to extract and communicate identifying data to the service access module (again via the network access module).
- a script could obtain and transmit configuration information about the web browser application, application version, host operating system, host hardware platform, language, screen size, and the like.
- This configuration information can be stored and accessed in ways known to a worker skilled in the art and can be indicative of the remote device or remote device type, since different remote devices can be configured differently. For example, different remote devices such as laptops, PDAs, gaming devices, or the like are typically configured differently with different hardware and software. In addition, some configuration information may not exist on some remote devices, resulting in an error when such configuration information is searched for. These errors can also be indicative of the remote device or remote device type, since it can be used to explicitly eliminate possible remote device configurations which would not typically have resulted in such errors.
- the information obtained and communicated by the query or script can be analyzed by the service access module to obtain information about the remote device or remote device type, optionally in conjunction with other information, for example by comparing the information against one or more ADPs which relate predetermined profiles or configurations of information to one or more remote devices or remote device types typically having said profile.
- the information obtained from this analysis can subsequently be used for authorization or authentication purposes.
- FIG. 12 illustrates an example of extracting information from a remote device according to an embodiment of the invention.
- a network connection is requested, for example in response to a user opening a browser on the remote device.
- the system can respond, in step 1220 , by forwarding the connection request from the network access module to the service access module, where information related to the connection request can be extracted as described above.
- the network access module and service access module can also respond concurrently in other ways, for example by redirecting a browser to an intercept page, and executing processes related to said intercept page to obtain user information.
- a response to the network connection request is sent from the service access module to the remote device via the network access module.
- a script such as a javascript or mobile software agent, or trigger for a script existing on the remote device, is sent with the response.
- the script executes on the remote device to extract information about the remote device as described above.
- Information obtained by the script is transmitted back to the service access module via the network access module.
- Information extracted from the connection request and information transmitted by the script can then be used for authentication or authorization, for example by comparing said information to one or more ADPs to identify the remote device or remote device type, and to authenticate or authorize said remote device or remote device type accordingly.
- Express Authentication can be implemented, wherein user input is substantially reduced or eliminated during the identification, authentication and authorization process.
- Express Authentication includes automatic profiling and authentication and certification of remote devices, for example by uniquely identifying a remote device based on matching selected remote device information to information stored in a knowledge base, the information being associated with a unique remote device described in the knowledge base, or by detecting mismatches between selected remote device information and information stored in a knowledge base, in order to deny authentication of a remote device. For example, if substantially all of the remote device information reported by a remote device matches a predetermined selection of remote device information stored in a remote device profile stored in the knowledge base and associated with a valid or authorized user profile stored thereon, Express Authentication can be allowed. As another example, if one or more predetermined portions of the remote device information reported by a remote device do not match corresponding remote device information stored in a remote device profile stored in the knowledge base and associated with an authorized user profile, Express Authentication can be denied.
- the number and type of attributes of remote device information checked against the database can vary randomly or deterministically, and in conjunction with previous history of authentication attempts, to provide efficient and convenient service while maintaining security and integrity of the authentication and authorization procedures. For example, additional authentication challenges, including multi-factor authentication challenges, can be issued or more detailed remote device information attribute analysis can be performed at random, with probability escalating with the perceived risk of fraudulent or unauthorized remote device usage. In some embodiments, Express Authentication can be satisfied by the same user or remote device in different manners, potentially resulting in different access to services.
- the knowledge base 210 is a relational database.
- a relational database refers to a type of database wherein a table stored in the database comprises rows and columns that are populated with information retrieved from the network access module 106 (e.g. access point 108 and gateway 110 ).
- the network access module 106 e.g. access point 108 and gateway 110 .
- FIG. 11 provides an exemplary screen shot of such a database, namely a Microsoft AccessTM database comprising sample hotspot, account, and remote device information stored in separate tables with a relationship connection to the other tables in the database.
- a Microsoft AccessTM database comprising sample hotspot, account, and remote device information stored in separate tables with a relationship connection to the other tables in the database.
- This illustration is meant to provide an example of sample information that could be stored in a database in the context of the present disclosure, wherein various types of information could be retrieved and stored. It will be apparent to the person of skill in the art that other types of database systems and structures, such as Microsoft SQL Servers or the like, could be considered herein without departing from the general scope and nature of the present disclosure.
- remote device information is stored in the knowledge base 210 in the form of a remote device profile, generally comprising an account variable that refers to characteristics of a remote device that allows for recognition and identification of a specific remote device, which may include, but is not limited to, known requirements of that remote device for connecting to the Internet, for example.
- remote device information is collected when a user attempts to access the network via a given network access module 106 , or when a user registers for a remote device account, as described below, and is stored in the knowledge base 210 for use in the authentication of the user and/or remote device when accessing the system 10 .
- FIG. 11 provides an example of a remote device profile 1106 , in accordance with an illustrative embodiment of the invention.
- user information is stored in the knowledge base 210 in the form of a user profile, generally comprising an account variable that refers to information about the user retrieved from the user, including for example, but not limited to, the user's name, a created username and password, contact information, user type, preferred payment method and/or means, and the like.
- user information is collected when a user attempts to access the network via a given network access module 106 , or when a user registers for an account, as described below, and is stored in a database for use in the authentication of the user and/or remote device when accessing the system 10 .
- FIG. 11 provides an example of a user profile 1104 , in accordance with an illustrative embodiment of the invention.
- a service profile is stored in the knowledge base 210 , generally comprising an account variable created by a combination of one or more of a remote device profile, a user profile, an account type, and associated devices.
- service profiles are generally defined as subscription packages that enable subscribed users access to certain network-based functions and services, such as, but not limited to, Live TVTM from a home location or online gaming packages, as further elaborated and described above.
- network-based functions and services such as, but not limited to, Live TVTM from a home location or online gaming packages, as further elaborated and described above.
- a user may be given options of services available for each type of remote device functionality.
- the service options can be used to limit a user's access to the Internet and/or other networks once the user chooses an option, or to expressly define, disable or enable certain access parameters, for example in accordance with aspects of relevant service profiles. Consequently, the user can then pay a predetermined price for the services selected, or have access to predetermined capabilities for free in conjunction with predetermined purchases.
- a user can choose different packages for different registered remote devices, or may select one package that allows access to all the networks with any remote device registered.
- a service profile is associated with a group of authorization constraints, authorization whitelist attributes, or a combination thereof.
- the authorization constraints can specifically deny or block predetermined services or aspects thereof, while authorization whitelist attributes can specifically allow or enable predetermined services or aspects thereof.
- access to selected functions and services may be extended to all users of a given remote device type, or to all users of a given group or adhering to a same promotional package or the like, without registration and/or subscription by the user. For example, all users or remote devices falling within a given category could be entitled to access one or more selected functions and/or services attributed to this category without prior subscription or registration by these users.
- a service profile is defined for a user of a laptop, a Sony PSPTM, and a Windows MobileTM PDA, who also occasionally uses a second laptop, e.g. borrowed from the user's work or elsewhere.
- the user of the present example could also have a Location Free TV (LFTV) at home, as well as OrbTM on a desktop system. Accordingly, the user would be able to use any of these remote devices on a supported network although there may be restrictions on concurrent usage, for example, wherein only one of each type of remote device can be connected at any time per account.
- LFTV Location Free TV
- the user can be able to access LFTV on his laptop and PSPTM, or using the OrbTM device, access files from the user's home computer on his laptop, etc. while at a hotspot access location.
- an upsell feature may also be provided such that a user of a given remote device is provided the option to upgrade their current service package to include additional and/or upgraded services.
- various upsell mechanisms and opportunities may be provided within the present context to provide a user access to additional services, either as a supplement to an existing subscription package, as a one-time trial or limited subscription, and the like.
- Such upsell mechanisms may be configured to market new or supplemental services at various instances during use, for example upon access to the system, periodically during use, etc., or again provide such opportunity in response to specific user actions.
- this traffic may be redirected to an interactive interface providing the user the option of upgrading or enhancing their service profile, for example, for an additional fee.
- an intercept page may be accessed instead proving the user of this remote device the option to upgrade their service profile to enable access to Web surfing functions.
- the service access module includes a Service Authentication and Authorization Manager (SAAM), which can be configured to securely provision and manage users and remote devices on networks such as Wi-Fi networks.
- SAAM can be configured to authenticate and authorize users, remote devices, or combinations thereof, based on user profiles, remote device profiles, and service profiles stored in a knowledge base accessible to the SAAM.
- the SAAM can further be configured to authenticate and authorize users, remote devices, or combinations thereof based on service provider information, such as promotional use information, location information, time information, or other information as would be understood by a worker skilled in the art.
- authentication can be based on information obtained through use of a stored value card for product or service purchases, by associating user information related to the stored value card with user profile information for authentication.
- user information related to the stored value card can be acquired from a third party managing the stored value card.
- User information related to the stored value card can include cash balance information and information on history of card use, such as date and location of previous uses.
- the SAAM can be configured to enable Express Authentication, wherein user input is substantially reduced or eliminated during the identification, authentication and authorization process.
- Express Authentication can enable instant or one-click secure authentication based on stored and automatically transmitted user and remote device profile data.
- the SAAM can be configured to collect, authorize, and authenticate a user and/or remote device based on the automatically transmitted data.
- the SAAM is configured to collect identification data, for example automatically transmitted user and remote device profile data, without requiring a client application to be installed or configured on the remote device being identified, authenticated, and authorized.
- identification data can be collected on the basis of availability.
- hardware information, system settings, and information embedded in applications such as WindowsTM Update, iTunesTM, the YouTubeTM application for iPodTM, or other applications residing on the remote device can all be sources of remote device information for providing to the SAAM or other authentication or authorization module.
- information can be extracted from standard communications with the remote device, or requested through a web browser, SMS service or other native application, or supplied using a second device carried by the user.
- remote device and/or user information is not automatically transmitted from the remote device, but is transmitted in response to a request or query.
- a program, software agent, or mobile software agent such as a Java aglet can be transmitted to and/or initiated on the remote device during identification, which, during execution, gathers and transmits user and/or remote device information to the network access module, service access module, or SAAM.
- a javascript application can be used to gather and transmit remote device information in this manner.
- Service profile parameters can be dependent on other factors such as date, time of day, remote device type or remote device class, location, hotspot or business operators or venues, service profiles, simultaneous usage of remote devices by a user, session idle time or timeouts, time from expiration of prepaid or introductory service, customer loyalty, payment history, and other factors that would be understood by a worker skilled in the art. For example, frequent or preferred customers, or customers who are the focus of a marketing campaign or promotional partnership agreement, may be given temporarily enhanced service for business purposes.
- a service profile may be created or updated to include additional services for promotional purposes for remote devices associated with particular service providers, when users of the remote device purchase a product (such as a coffee) in particular hotspot locations.
- the service profile may indicate for example that selected services can only be used on the day of purchase at the particular hotspot location where the purchase was made, and then only until expiry of a predetermined time period.
- Access to the features and services considered for in the implementation of the system 10 is generally provided via the identification, authentication and authorization of a user and/or remote device based on identifying data accessed by the service access module 112 via network access module 106 .
- a user may access the system 10 once the user, or a remote device used thereby, is registered to access the system.
- a user may register themselves, or one or more remote devices that they intend to use with the system 10 , via a pre-registration process implemented online, in person, over the phone, or in another manner wherein information relating to the user and/or one or more remote devices are provided to a system administrator enabling registration of such identifying information for future use in an authentication and authorization process.
- registration may be performed upon first access, or attempted access to the system 10 by a user, or by a remote device thereof.
- Other registration strategies, or combinations of pre-registrations, registration confirmations, direct registrations and/or updated (e.g. service upgrade or downgrade) registrations should be apparent to the person skilled in the art and as such, are not considered to depart from the general scope and nature of the present disclosure.
- the network access module 106 may intercept the request to access the network 104 and redirect the request back to the remote device 102 through a web browser for the user to input user information.
- the information requested can be for example, but not limited to, a username and password.
- the gateway 110 may also forward the request and subsequent communications, if any, to the service access module 112 , where specific remote device information may be extracted from such communications for the purposes of identifying the remote device being used to access the network 104 .
- Such remote device information may include, but is not limited to, the Media Access Control (MAC) address of the remote device 102 , traffic type (e.g. communication port, data type, communication protocol, traffic headers, etc.), browser type (e.g. full browser, microbrowser, browser origin and/or configuration, etc.), and/or some other unique identifier (e.g. remote device configuration, serial number, signature related to a remote device clock or crystal oscillator, etc.).
- MAC Media Access Control
- the gateway 110 forwards the user and/or remote device identifying information (user profile, remote device profile) from the access point 108 to the service access module 112 , for example, from where it can be authenticated, for example via a Remote Authentication Dial In User Service (RADIUS) protocol or other public and/or proprietary protocols, to determine whether the user and remote device 102 are registered to access the network.
- RADIUS Remote Authentication Dial In User Service
- the gateway 110 detects the remote device request for network access, requests user information to be input via a Short Message Service (SMS), and optionally forwards the request and/or subsequent communications, if any, to the service access module 112 where specific remote device information may be extracted from such communications for the purposes of identifying the remote device being used to access the network 104 . Identifying information is then used by the service access module 112 for authentication to determine whether the user and remote device 102 are registered to access the network.
- SMS Short Message Service
- the gateway 110 detects the remote device request for network access and forwards the request and/or subsequent communications, if any, to the service access module 112 where specific remote device information may be extracted from such communications for the purposes of identifying the remote device being used to access the network 104 .
- the identifying information is then used by the service access module 112 for authentication to determine whether the remote device 102 is registered to access the network.
- remote device identifying data may be extracted by one or more components of the system 10 , namely the network access module 106 , the service access module 112 , and/or any component thereof, with proper software, firmware and/or hardware configurations, without departing from the general scope and nature of the present disclosure.
- registration to access the system 10 comprise two components: user registration and remote device registration.
- User registration can occur during the same session as the remote device registration, user registration can occur independently of remote device registration, either outside the hotspot network through a registration website, or while accessing the hotspot network.
- registration of a user can result in creation of a user profile stored in a knowledge base
- registration of a remote device can result in creation of a remote device profile stored in a knowledge base.
- Registration of either a user or a remote device can also result in creation of a service profile stored in a knowledge base.
- User, remote device and service profiles within the knowledge base are preferably linked for retrieval and association of information contained therein.
- a user when a user registers outside the hotspot network as determined at step 302 , registration occurs through a web browser interface.
- a user enters the website to register for an account.
- information about the remote device being used is stored at step 322 .
- the website is programmed to reformat the page depending on the type of remote device used and the type of browser available at step 323 .
- a laptop can use a full browser, whereas a PSP uses a microbrowser.
- the user selects whether to login or create a new account at step 324 , depending on whether the user has previously set up an account.
- the user selects the option to create a new account, and the browser is redirected to the new account homepage at step 330 , which displays the service options, prices, and procedures available to the user.
- the user enters information into a form on the website and the website sends the information to be stored in a database at steps 332 to 342 .
- the user enters contact information and selects the services to which access is desired at steps 332 and 336 .
- the user can register more than one remote device to be used.
- the user has the option of paying for the services selected, which creates a new paid account in a database, or the user can select to use a free trial, and the payment or free trial option information is stored in the database at steps 338 to 342 .
- the browser is redirected to the user homepage at step 318 , where the user's service summary is displayed, their account verification is requested, and the user can select to register more remote devices, or choose to upgrade their services and select payment options.
- the user has the option to logout or connect to the network at step 320 , however, since the user is not at a hotspot access point, the user generally chooses to logout.
- the network access module 106 when a user registers while accessing the hotspot network, determined at step 302 , through a browser-based or browser-challenged remote device 102 , the network access module 106 , or access point 108 thereof, ( FIG. 2C ) recognizes that the remote device 102 is scanning for a network connection, the access point 108 redirects all unauthenticated remote devices to an intercept page for authentication.
- An intercept page is a webpage that receives user login input.
- the network access module 106 , or the gateway 110 thereof While the user attempts to access the network by logging in using the intercept page, the network access module 106 , or the gateway 110 thereof ( FIG. 2C ) stores information from the user and the remote device being used, for example, but not limited to, user name, password, MAC address, browser type, cookie information, etc. at step 304 .
- an SNMP Trap such as but not limited to the KIWI SNMP Trap, that allows the browserless remote device user to register.
- the SNMP protocol is used by network management systems to monitor network-attached remote devices for conditions that warrant administrative attention.
- the gateway 110 detects what type of remote device is being used through key unique attributes of the remote device, for example, MAC address (including manufacturer prefix), host IP address, and other properties that can be obtained remotely through special features in the network access module 106 , at step 306 .
- UTStarcomTM smartphones generally include HTTP headers such as “UA-pixels: 240.times.0.320” or “x-wap-profile:http://www.htcmms.com.tw/gen/apache-2.0.xml”.
- the website will automatically reformat to suit the type of remote device and/or browser being used, at step 308 .
- the system 10 will recognize the user and remote device and proceed to a login session at step 310 .
- the browser automatically proceeds to the user's home page at step 312 , which displays the user's remote device registration, service summary, and account verification 318 .
- the user can choose to connect to the available services or logout of the system at step 320 .
- the browser proceeds to the login or register new account option at step 324 . If the user has previously registered for an account but has not registered the particular remote device being used, the user chooses to login at step 324 , and proceeds to allow the remote device information to be extracted and stored in a database at step 326 . The user can choose to save the remote device details to their account, and access the network using that remote device, or the user can choose not to save the remote device, and is sent directly back to the user home page at steps 326 and 328 .
- the user is sent to the New Account Home Page, and is required to input contact information, select service options, and select payment options to create an account, at steps 330 to 342 , providing the browserless remote device supports such functionality. Otherwise, access is not provided and registration is required via external means, such as described above.
- the user may be required to register themselves and a specific remote device 102 in order to purchase a connection and/or receive full benefit of the service.
- the difference is based mainly on whether the remote device to be registered is browser-based, browser challenged, or browserless.
- Remote device registration is meant to be as comprehensive as possible, and some portion of the registration process may vary from remote device to remote device.
- the user has the option to edit their profile immediately after logging on to the system through a browser-based or browser challenged remote device, for example, the user may add another remote device to their profile.
- Browserless remote devices are generally more limited in what applications and information they may be provided access to, based for example, on their user interfacing capabilities.
- the access point 108 when a user enters a hotspot area with a browser-based or browser-challenged remote device 102 , after the user has created a registered account in the system 10 , as described above, the access point 108 sends an intercept page requiring the user to input their user name and password, or only their password, or other information that can be used to identify the user. Once the user has input their information into the browser form, the information is sent through the network 104 to be compared with valid user information stored in the service access module 112 .
- the access point 108 uses a SNMP Trap to collect the user information and send it through the network 104 to be compared with valid user information stored in the service access module 112 .
- an optional request for user information and/or confirmation may be communicated to a distinct remote device of the registered user for confirmation.
- a confirmation message could be sent to a user's cellular phone, or other such device, via a Short Message Service (SMS), wherein the user may then confirm via this distinct device that they are in fact attempting to access the system via their browserless remote device.
- SMS Short Message Service
- the gateway 110 retrieves specific remote device information from the remote device and sends that information through the network 104 to be compared with valid remote device information stored in the service access module 112 .
- the remote devices 102 there are many different remote devices 102 that may be used with the system 10 . To accurately identify a remote device there may be a number of different pieces of information needed to be retrieved from the remote device.
- the MAC address of the remote device is an example of one piece of information that can help identify a remote device, however, it may not be sufficiently robust, as spoofing is possible and quite simple on some platforms with the proper tools. Depending on the security levels expected from implementation of the system 10 , using simple remote device identification methods such as using the MAC address may be sufficient.
- MAC address including manufacturer prefix
- browser characteristics including manufacturer prefix
- operating system characteristics including manufacturer prefix
- host IP address including manufacturer prefix
- traffic headers including clock or crystal oscillator characteristics
- serial numbers including serial numbers
- the service access module 112 Using identifying data provided by the user, and/or provided automatically by the user's remote device, the service access module 112 proceeds to the authentication of the user and/or remote device.
- authentication is intended to be user-centric, for example, a user with a valid account should be able to connect to the network 104 and access those services for which he has subscribed (which may include all services available in a wide open access system), on whichever remote device 102 he happens to be carrying at that moment, or alternatively, for which remote device registration has been implemented.
- the characteristics of the remote device 102 and/or application attempting to connect to the network 104 can factor into the mechanics of the authentication process, and as such, the system 10 can be configured to address these factors.
- authentication is intended to be device-centric, for example a remote device which is associated with a valid account should automatically or semi-automatically connect to the network through a hotspot once it becomes available.
- Express Authentication can be used to connect a registered remote device, possibly including prompting a user to confirm said connection.
- a RADIUS is used as an authentication, authorization, and accounting (AAA) protocol.
- AAA authentication, authorization, and accounting
- Such a protocol is commonly known in the art and used for applications such as network access or IP mobility.
- the information input into the remote device web browser or retrieved by the SNMP Trap, depending on what remote device is being used is passed through the network access module 106 (e.g. the access point 108 and gateway 110 of FIG. 2C ), to a RADIUS server operatively coupled to or integrated within the context of the service access module 112 , over the RADIUS protocol.
- NOC Network Operations Center
- the RADIUS server checks that the information is correct using authentication schemes such as Password Authentication Protocol (PAP), Challenge-Handshake Authentication Protocol (CHAP), or Extensible Authentication Protocol (EAP). If accepted, the server will then authorize access to the ISP system and select an IP address. If the username and password are correct, RADIUS will return the length of time remaining for the account and the name of the access list to use. If the account has time remaining and is not disabled, the remote device is authenticated and the access list is enforced by the access point 108 . In one embodiment, the access list is what defines what a remote device can or cannot do while connected to the access point 108 . The individual definitions are stored in RADIUS but loaded to the access point daily, for example, the RADIUS server will also be notified if and when the session starts and stops, so that the user can be billed accordingly.
- PAP Password Authentication Protocol
- CHAP Challenge-Handshake Authentication Protocol
- EAP Extensible Authentication Protocol
- a RADIUS database may be used by the service access module 112 to provide the same programmatic potential as a proprietary local knowledge base could.
- the RADIUS database can contain access lists associated to the different service packages provided as described above.
- the advanced authentication methods can allow differentiated authorization based on identification and authentication data, as well as other factors. For example, different users, remote devices, remote device types or remote device classes can be offered different services or different aspects of a service profile can be applied based on information about the remote device, location, time of day, service providers, payment, purchase of related products, service contracts, and other information as would be understood by a worker skilled in the art.
- the access point 108 is configured to send an ‘Association Success’ trap to a remote Simple Network Management Protocol (SNMP) client allowing for authentication of remote devices 102 that do not invoke an intercept page, for example, browserless remote devices.
- SNMP is used by network management systems to monitor network-attached remote devices for conditions that warrant administrative attention.
- SNMP is used to collect interface information from remote devices 102 .
- a person with ordinary skill in the art would recognize how SNMP traps are used to collect information from remote devices 102 and connected to a network 104 through an access point 108 .
- the remote device interface information can be passed through the gateway 110 to the RADIUS database, as described above, to acquire authentication.
- the access point 108 is also configured to receive a request, for example, a Hypertext Transfer Protocol using Simple Object Access Protocol (HTTP SOAP) call, to retrieve the remote device IP address assigned by the access point 108 .
- HTTP SOAP Hypertext Transfer Protocol using Simple Object Access Protocol
- An HTTP SOAP call is an HTTP message that complies with SOAP encoding rules.
- the IP address of the remote device 102 can, for example, be associated with the remote device MAC address for enhanced authentication.
- multiple SNMP clients are used, as described above, to provide scalability for concurrent remote device authentication and can be extended to support a global solution where high latency is required by the access point 108 during authentication.
- a Kiwi SNMP client may be used to filter and/or parse messages and take actions using script.
- a scripting language such as, but not limited to, JavaScript
- a script file can be created to parse a SNMP message to extract information passed from the remote device 102 through the access point 108 via the SNMP trap, remote device information such as, but not limited to, the MAC address, the remote device IP address, or the server IP address. Once extracted, the information can be sent for authentication. In one embodiment, this process may be done asynchronously to avoid bottlenecks of SNMP messages in the SNMP client(s).
- a webservice is used to communicate, for example, SNMP messages from one remote device to another through a network.
- a webservice is an application programming interface (API) that allows information to pass through one or more networks that may be using different communication protocols.
- API application programming interface
- An example of an Authentication Webservice API could be designed to include the following elements: a AccessPointInformation function, AuthenticateDevice function which Encapsulates the HTTP request made for NOC authentication, a ConnectionInformation function, a DeauthenticateDevice function which Encapsulates the HTTP request made for NOC deauthentication, a DeviceAssociated function which provides remote device identification and validation prior to authentication, and a DeviceDisassociated function which provides remote device identification and validation prior to deauthentication.
- a DeviceAssociated method is called from the SNMP client.
- the request is first added to a queue to wait for processing. This may be beneficial if multiple SNMP clients attempt to authenticate the same remote device association, and can reduce the number of NOC authentication attempts to the access point 108 . Upon a successful authentication the duplicate authentication requests are removed from the queue.
- a lookup is done in the service access module 112 that stores the user and/or remote device information, to locate the account that the remote device belongs to where the account can contain the RADIUS credentials, for example, the username and password, required for NOC authentication.
- the NOC authentication to the access point 108 is performed.
- the NOC authentication can be performed using, for example, an HTTPS call to the access point 108 with the required parameters, and the result is returned as a pass, fail, or error value. Access to selected services can be based on the result. For example, if the result is returned as a pass, access can be granted, whereas if the result is a fail or error value, access is not granted, and optionally the authentication procedure can be retried.
- the Advanced Device Profile (ADP) is stored in a knowledge base and used for authentication purposes.
- Express Authentication can be implemented using information stored in a knowledge base.
- a tracing webservice allows trace information to be sent unobtrusively as authentication moves through the process.
- a webservice because of its interoperable characteristics and wide programmatic support among technologies, is one possible way to track the system process.
- authorization occurs once the remote device 102 and/or user have been authenticated, as described above.
- the system 10 via the network access module 106 , or gateway 110 thereof ( FIG. 2C ), restricts the user and remote device to actions determined by the remote device's capabilities and/or the service package purchased by the user, as described in more detail below, by setting up firewalls, allowing or blocking specified TCP or UDP ports, filtering or restricting network traffic based on type, packet headers, content, flow characteristics such as rate, delay and variation thereof, source, destination and/or other access limitation rules to be implemented by the system 10 . If the user selects the wide-open Internet access option, the user will have full access to the Internet, for example.
- Authorization can also operate by expressly allowing a user and/or remote device to carry out predetermined actions or connect to predetermined services, instead of specifying what actions are not allowed.
- the sets of allowed or restricted actions are described by a service profile, including for example authorization constraints or authorization whitelists.
- service profiles are dependent on factors such as the amount of time a user is accessing an application, the type or content of the application, rate and volume of data downloaded or uploaded, or other factors related to application usage. These factors can be in addition to other factors, such as allowing access to specified applications, to specified remote devices or remote device types, or at specified locations, times, or the like.
- service profiles can be configured to enable or disable selected applications or groups of applications, either directly according to application name or type, or indirectly by setting minimum or maximum service levels for selected services such as bandwidth, delay, enabled or disabled TCP or UDP port numbers, firewall settings, and the like, where said service levels are required for certain degrees of performance of selected applications, to which a value may be associated.
- minimum or maximum service levels for selected services such as bandwidth, delay, enabled or disabled TCP or UDP port numbers, firewall settings, and the like, where said service levels are required for certain degrees of performance of selected applications, to which a value may be associated.
- different applications or services can be profiled.
- the type and level of communication resources associated with usage of said application or group of applications is determined, such as TCP or UDP port usage, bandwidth, packet size, traffic characteristics, and the like. This association can be performed through controlled experimentation or monitoring of customer activity.
- the association between applications and type and level of communication resources is then stored in an application profile in a knowledge base.
- the application profile can subsequently be used to substantially monitor and/or restrict users to predetermined applications or groups of applications by monitoring and/or restricting access or usage to the associated types and levels of communication resources.
- Profiling of applications can be performed automatically according to an adaptive or automated procedure, or by a network administrator, or by a combination thereof.
- the system 10 uses a value based application (VBA) which provides limited access to an exclusive application, service, or remote device connection, or a combination thereof, that is packaged, marketed, and sold at a hotspot at a price representative of its perceived value, which is discounted from wide-open Internet access that is currently provided.
- VBA value based application
- the system 10 can be configured to identify incoming traffic substantially without user input, recognize returning users and remote devices by type, connect users with a single click, or no clicks, such as by Express Authentication, and apply rules post-authentication to allow only that type of remote device, or a service on that remote device, to connect.
- VBA service profiling the system 10 can be configured to identify incoming traffic substantially without user input, recognize returning users and remote devices by type, connect users with a single click, or no clicks, such as by Express Authentication, and apply rules post-authentication to allow only that type of remote device, or a service on that remote device, to connect.
- VBA service profiling the system 10 can be configured to identify incoming traffic substantially without user input, recognize returning users and remote devices by type, connect users with a single click, or no clicks, such as by Express Authentication, and apply rules post-authentication to allow only that type of remote device, or a service on that remote device, to connect.
- users can obtain some services for free, or obtain services at no charge or at
- service profiles can be applied to determine what services to connect a user to, and the conditions required for each service.
- Service profiles can restrict, allow, or otherwise configure access to applications based on various factors.
- service profile parameters can pertain to date and time ranges, remote devices, remote device types or remote device classes, for example as indicated in remote device profiles, geographic locations, hotspot or business entity identification, types of VBA services available, number of users accessing services, available bandwidth, concurrent use of multiple remote devices by a user or group of users, session idle time or timeouts, or other parameters affecting access to services, applications or VBAs as would be understood by a worker skilled in the art.
- service offerings can be related to providing access to one or more applications under predetermined time, quality, or other restrictions.
- Service offerings need not be identified with a particular application, but can be defined by potential combinations of service profile parameters such as authorization constraints or authorization whitelists.
- a communications service provider A and an internal access service provider and product vendor B could devise a product whereby users of remote devices affiliated with A, who also purchase a product or service from B using a stored-value card, could get 1-hour free open Internet access through B at selected vendor locations on the day they make the purchase.
- Another communications service provider C could offer users of remote devices affiliated with C free access (or access for a nominal charge, or free access with another purchase) at selected hotspots to their Facebook account, provided the users have purchased a qualifying service plan.
- the user can have the option to, among other functions, add remote devices.
- the user Upon selecting a remote device, the user enters information required to register that particular remote device into their account. Once registered, the user selects the service package that suits his needs, and selects a payment option, and then the user can use the remote device at any hotspot access supported by system 10 .
- the VBA constructions define specific gateway firewall requirements for each product.
- the servers, transports, or ports used by the remote devices and services supported by the system 10 which may include for example, but are not limited to computing devices, games, streaming video products, collaborative business applications, social applications, etc.
- ACLs Access Control Lists
- These restrictions may occur at the gateway 110 level, for example, using firewalls to limit access to certain Internet and other network capabilities.
- the restriction of network access may occur through funneling all user traffic through a central proxy server.
- This method of limiting network access according to a VBA would allow for more control, for example, of the authorization process.
- VBAs in order to create limited-access VBA profiles, as described above, Internet access requirements for each of the applications to be supported including servers, ports, protocols, etc. which could be used by a remote device during the execution of a certain application are identified. For example, a game on the Nintendo DSTM may require access to a NintendoTM server, over TCP, using port 1025 outbound and 1030 inbound.
- An inventory for each application's connectivity requirements is used in order for the applications to be combined into product packages, the VBAs, and their requirements combined. The amalgam of the requirements for each package form the basis for firewall rules for a specific VBA.
- These application profiles contain information about various characteristics of each application or remote device which describe not only how the application behaves on the Internet, but unique characteristics of the remote devices which would allow instant and automatic detection of the remote device type and link a specific remote device to a unique user.
- These application profiles can comprise a dynamic database. For example, with new applications and remote devices being introduced, constant updating may be implemented to support new remote devices, and to ensure that users do not have problems with a new software program or application on older remote devices.
- firewall rules can be established based on transport protocols (e.g. TCP, UDP, ICMP, etc.), destination server (e.g. IP or DNS name), port number, traffic protocol (e.g. SMTP, FTP, HTTP, etc.), header information, etc.
- transport protocols e.g. TCP, UDP, ICMP, etc.
- destination server e.g. IP or DNS name
- port number e.g. SMTP, FTP, HTTP, etc.
- header information e.g. SMTP, FTP, HTTP, etc.
- manipulation of the functionality of the gateway 110 is desirable.
- some manipulation of the “access-list” attribute which is a vendor-specific attribute used by the ColubrisTM Multi-Service controllers (MSC-3200), could be used. Allowed and disallowed IP address and port combinations can make up an access-list definition which is associated to an account/remote device combination and enforced by the access point 108 .
- the remote device profiles for each service package can be stored in a database (e.g. knowledge base 210 of FIG. 2B ), and combined with one or more user profiles, a list of associated remote devices, a list of service subscriptions, or a combination thereof, to form a service profile for that user or remote device, as described above.
- a database e.g. knowledge base 210 of FIG. 2B
- the system 10 is able to look up the service profile for that user and/or remote device, determine the appropriate level of access, and apply the profile to the current connection by configuring the appropriate firewall rules at the gateway 110 following authentication.
- system 10 may further comprise a reporting module used by network access providers, and other partners, for reporting data related to system usage analysis and billing purposes. Reports may include information regarding, for example, usage by user, location and vendor; usage by remote device type; payment type; and other such information, as would be apparent to the person skilled in the art.
- a flowchart providing a process for identifying, authenticating, and authorizing a user utilizing a browser-based or a browser challenged remote device 102 to access a network 104 .
- the remote device 102 scans the area for an available network connection.
- the user invokes a web browser via which a given Internet resource may be requested at step 402 .
- the gateway 110 intercepts the request and redirects it to the network interface at step 404 .
- the gateway 110 also sends through the network the remote device characteristics that it has extracted from the remote device 102 at step 404 .
- the network interface receives the request to access the network and the remote device information and sends the request on to an Access Management Module (e.g. of service access module 112 of FIG. 2B ) at step 406 .
- the Access Management Module captures the remote device and user information and analyzes the remote device characteristics to determine what information the gateway extracted at step 408 .
- the remote device information is cross-referenced with the database containing user, remote device, and service profiles at step 410 .
- the Access Management Module determines what type of remote device is being used to access the network and reformats the User Interface (UI) to suit the remote device's capabilities at step 412 .
- UI User Interface
- the process determines whether the user is known.
- the Access Management Module sends that information to the database to retrieve the user's account details at step 420 . If the user information was not sent with the request, the intercept page is sent to the remote device so the user can input their user information at step 416 . The user's information is sent back to the Access Management Module at step 418 and the information is cross-referenced with the account details in the database to verify the user has an account at step 420 .
- the database determines what service profile the user has access to through the current remote device the user is using at step 422 .
- the process sends the available service options to the remote device through an appropriate UI at step 424 , and the user selects which services to allow at step 426 .
- the process selects the appropriate service credentials and restrictions at step 428 , and sends that information through the network interface at step 430 , to the gateway to enforce those restrictions at step 432 .
- the user is granted access to the network limited to the service profile the user subscribed to at step 434 .
- a sequence diagram providing a process for identifying, authenticating, and authorizing a user to access a network interface 508 using a browser-based or browser challenged remote device 502 .
- the user via the remote device 502 , sends a URL request to access the network (step 514 ), the gateway intercepts the request and redirects the request back to the user via an intercept page (step 516 ).
- the user inputs user information through the form provided on the intercept page, and this information is sent to the Service Access Module, whereby remote device characteristics may be further extracted from remote device communications, for use by the Access Management Module 510 (step 518 ).
- the Access Management Module 510 first looks up the remote device characteristics in the database 512 (step 520 ) for a matching remote device profile stored in the database 512 .
- the database 512 sends the remote device profile back to the Access Management Module 510 (step 522 ).
- the Access Management Module 510 looks for an account profile that matches the remote device profile to compare user information (step 526 ). Once an account profile is found, the process formats the User Interface (UI) to suit the remote device being used (step 528 ) and sends a web page displaying available service options for that user and remote device to the user so the user can select the required services.
- UI User Interface
- the user selects the required services and selects payment options, and that information is sent back to the Access Management Module 510 (step 530 ) to be cross-referenced with the service profiles stored in the database 512 (step 532 ).
- a service profile is selected and the service profile rules are sent to the Access Management Module (step 534 ).
- the user's credentials in the RADIUS database are updated, and the rules of the service profile are associated with the credentials (step 536 ).
- the remote device information is sent back to the gateway 504 to initiate authentication of the remote device 502 for the services selected (step 538 ).
- the gateway 504 makes a RADIUS request to authenticate the remote device for the services selected (step 540 ).
- the RADIUS server checks the credentials and retrieves the associated service profile restrictions (step 542 ).
- the RADIUS sends an “accept” message back to the gateway 504 (step 544 ), accompanied by the service profile restrictions to be enforced by the gateway 504 .
- a network session is created (step 546 ) and the user can establish a connection to the network 508 (step 548 ).
- the remote device 102 scans for an available network connection at step 602 .
- the gateway 110 detects the remote device scanning for a network at step 604 , and forwards the remote device information to the Access Management Module to be extracted thereby.
- the Access Management Module captures and analyzes the remote device characteristics to determine which remote device is being used to access the network at step 606 .
- the remote device characteristics are cross-referenced with remote device profiles stored in a database at step 608 .
- the database is also searched for the user account profile, if one exists, at step 610 , and it is determined whether the user has previously programmed the account profile to auto-authenticate when the user accesses the network at step 612 . If the user has not selected to auto-authenticate, the authentication service requests confirmation from the user at step 614 .
- the user provides user information to confirm user account information using Short Message Services (SMS) which are text messages that can be sent using devices, such as but not limited to, cell phones and pocket PCs, at step 616 .
- SMS Short Message Services
- the user information received from the user and remote device 102 is cross-referenced with service profiles established for the account and remote device profiles which are stored in a database 112 to determine the appropriate services to make available at step 618 .
- the Access Management Module determines the credentials and restrictions of the selected service profile and sends those to the authentication service at step 620 .
- the authentication service verifies the user account, remote device, and service profiles and grants network access to the user at step 622 .
- the gateway provides the enforcement of the service profile to allow the user to only access services provided for the remote device they are using at step 624 .
- the user is provided restricted access to the network in accordance with the services the user has provided payment for at step 626 .
- FIG. 7 there is shown a sequence diagram providing a process for identifying, authenticating, and authorizing a user utilizing a browserless remote device 102 to access a network 104 .
- a user 702 at a hotspot access location turns on a browserless remote device 704 , for example, but not limiting to, a mobile phone (step 716 ).
- the remote device attempts to make a radio access network (RAN) connection to the available network (step 718 ).
- the gateway 706 creates a SNMP trap to extract remote device information from the remote device (step 720 ).
- the SNMP “device associated” notification is sent from the SNMP Server 710 to the Access Management Module 712 (step 722 ).
- the Access Management Module 712 cross-references the remote device characteristics with the remote device profiles stored in the database 714 (step 724 ). Once a remote device profile is established, the Access Management Module 712 looks in the database to see if there is an account profile associated with the remote device profile (step 728 ). The account profile details are sent from the database 714 to the user 702 requesting the user to confirm the account details (step 732 ). The user provides user information to confirm the account details through SMS, for example, and the information is sent back to the Access Management Module 712 (step 734 ). The Access Management Module 712 looks in the database 714 to acquire the appropriate service profile for the user and remote device (step 736 ).
- the appropriate service profile is selected from the database 714 , and the service rules are sent to the Access Management Module (step 738 ).
- the user's credentials in the RADIUS database are updated, and the rules of the service profile are associated with the credentials (step 740 ).
- the remote device information is sent back to the gateway 706 to initiate authentication of the remote device 704 for the services selected (step 742 ).
- the gateway 706 makes a RADIUS request to authenticate the remote device for the services selected (step 744 ) while a connection is established with the remote device (step 746 ).
- the RADIUS server checks the credentials and retrieves the associated service profile restrictions (step 748 ).
- the RADIUS sends an “accept” message back to the gateway 706 (step 750 ), accompanied by the service profile restrictions to be enforced by the gateway 706 .
- the gateway 706 then initiates a session (step 752 ) feeding back to the access management module (step 752 ).
- a flowchart of steps taken when a user attempts to access a network at a hotspot location, using a browser-based remote device The user enters the hotspot location, and turns on the remote device, the remote device scans for available networks, and the user opens a web browser at step 802 . The user selects whether to have full access to the network or to have a service package option, at step 804 . If the user chooses to have full access to the network, the user selects the connect options provided by a carrier at step 806 . The gateway initiates authentication of the user through the use of RADIUS at step 808 .
- the gateway confirms whether the user is a valid user at step 810 , if the user is authenticated, the user is given options to connect additional remote devices to the network at step 812 , which would then forward them to the service package options provided at step 834 . If the user chooses not to connect additional remote devices to the network, the user is connected to the Internet with wide open access at step 814 .
- the system attempts to recognize the remote device being used to access the network at step 816 , if the remote device is recognized, the user is prompted through the web browser to input user information or the user can select to auto-authenticate, at step 818 . If the user is a valid subscriber, as determined at step 820 , the user profile is passed to the hotspot network access at step 822 .
- the gateway initiates the authentication of the user, remote device, and service profiles at step 824 , and allows the user to have access to the network for the services selected in the service package at step 826 .
- the remote device being used is not recognized at step 816 , the user is prompted to login or create a new account using the web browser at step 828 . If the user has previously registered an account, the user logs on, and the remote device characteristics are then stored in a remote device profile associated with that user at step 830 .
- the user is a new user, they are required to create a new account at step 832 .
- the user selects the type of service package, and payment option from the list displayed at step 834 , and the account is created, and updated at step 836 , and the remote device being used can then be connected to the network at step 838 .
- the account information is sent to the hotspot network access at step 822 , and the gateway initiates the authentication of the user, remote device, and service profiles at step 824 , and allows the user to have access to the network for the services selected in the service package at step 826 .
- a flowchart of steps taken when a user attempts to access a network at a hotspot location, using a browser challenged remote device The user enters the hotspot location, and turns on the remote device, the remote device scans for available networks, and the user invokes a web browser at step 902 .
- the service access module extracts information from the remote device to determine whether it is a registered remote device, at step 904 . If the remote device is not a registered remote device, the gateway receives information from the user to determine if the user has a valid account at step 906 . The user's information is sent to be authenticated at step 908 .
- the remote device information is then stored as an associated remote device at step 910 . If the user's service package already provides sufficient access to the network for that particular remote device, the user can connect to the network, or the user has to select service options from a list displayed on the web browser at step 912 .
- the account information is sent to the hotspot network access at step 914 , and the gateway initiates the authentication of the user, remote device, and service profiles at step 916 , and allows the user to have access to the network for the services selected in the service package at step 918 .
- the user inputs user information at step 920 If the user information is valid, the user can select to auto-connect at step 922 , or require the system to ask the user whether they wish to connect at step 912 .
- the account information is sent to the hotspot network access at step 914 , and the gateway initiates the authentication of the user, remote device, and service profiles at step 916 , and allows the user to have access to the network for the services selected in the service package at step 918 .
- the user creates a new account at step 924 .
- the remote device is registered to the user's remote device profile at step 926 , and the list of service options is displayed at step 928 .
- the account information is sent to the hotspot network access at step 914 , and the gateway initiates the authentication of the user, remote device, and service profiles at step 916 , and allows the user to have access to the network for the services selected in the service package at step 918 .
- a flowchart of steps taken when a user attempts to access a network at a hotspot location, using a browserless remote device The user enters the hotspot location, and turns on the remote device, the remote device scans for available networks, and the user begins a text message session and uses a radio access network to connect to the network, at step 1002 .
- the gateway determines whether the user is a recognized user at step 1004 . If the user is recognized, it is determined whether the user has a registered account at step 1006 . If the user has a registered account, it is determined whether the user has a valid service subscription for the remote device being used at step 1008 .
- the account information is sent to the hotspot network access at step 1010 , and the gateway initiates the authentication of the user, remote device, and service profiles at step 1012 , and allows the user to have access to the network for the services selected in the service package at step 1014 .
- the system checks if the connection available to the remote device is time limited at step 1016 , if it is time limited, the system checks if the remote device being used has time available at step 1018 . If the remote device has no time available, the user will not be allowed to connect to the network (step 1020 ). If the connection available is time limited, and the remote device has time available, the limited remote device profile is sent to the hotspot network access at step 1026 , and the gateway initiates the authentication of the remote device at step 1028 , and allows the user to have access to the network for the limited device-specific services at step 1030 .
- the open access to the device-specific network connection is sent to the hotspot network access at step 1032 , and the gateway initiates the authentication of the remote device at step 1034 , and allows the user to have open access to the network for the device-specific services for an unlimited amount of time, at step 1036 .
- the remote device characteristics are extracted and stored as a remote device profile in a database at step 1022 .
- the remote device attempts to connect to the available network for device-specific access, at step 1024 if the connection available has a time limit the limited remote device profile is sent to the hotspot network access at step 1026 , and the gateway initiates the authentication of the remote device at step 1028 , and allows the user to have access to the network for the limited device-specific services at step 1030 .
- the open access to the device-specific network connection is sent to the hotspot network access at step 1032 , and the gateway initiates the authentication of the remote device at step 1034 , and allows the user to have open access to the network for the device-specific services for an unlimited amount of time, at step 1036 .
- devices interfacing with a network access module 106 or WAP 108 at a given hotspot may, in some embodiments, be automatically identified and recognized by the system 10 . Namely, a unique device identifier is automatically embedded within a device transmission without user input and thus communicated by the device to this WAP 108 .
- a match can be made and the device ultimately recognized.
- a new device profile may be created from the unique device identifier extracted from communications received from this unrecognized device, thus allowing for subsequent recognition, and thus optionally tracking, of this particular device. From these compiled device profiles, device usage patterns (usage time, location, etc.) can be logged and reported, for example.
- a given device can be recognized as a returning device when subsequently identified at a same location, thus indirectly identifying the user of this device as a potentially frequent or loyal customer.
- a given device may be recognized upon identification at one of multiple hotspot locations having common access to the network accessible knowledge base.
- frequent or loyal customers (or at least their device), can be recognized across multiple hotspot locations, for example grouped or otherwise associated with a common operator, brand, business entity, or the like.
- Various applications such as the tracking and reporting on repeat devices, the provision of improved services or offerings to such repeat devices, and other such applications as exemplified below, may be derived from the ability to identify and recognize devices across multiple hotspot locations, in some embodiments, without user input, that is in some cases, unbeknownst to the user of the device.
- FIG. 13 provides another example of a system 1300 generally configured to provide remote devices 1302 access to network services, such as the Internet, from a public hotspot 1306 or the like.
- the system 1300 is configured to authorize full access privileges to authenticated users, though it will be appreciated that restricted access or access to only some services may also be considered, as described above, within the context of this example.
- the device recognition and tracking features of the above-described embodiments are further exemplified.
- the system 1300 is generally subdivided into a detection component 1320 , whereby remote devices 1302 in the vicinity of a given hotspot 1306 may be detected and automatically identified by way of a unique device identifier automatically embedded within a device transmission, and a data engine component 1322 for processing device identities, optionally in combination with time and location data, to provide for device recognition, tracking and other such features, as introduced above and as further exemplified below.
- the detection component 1320 comprises a hotspot radio receiver 1306 , such as a WAP or other such wireless sensor, which receives wireless transmissions from the devices 1302 in its vicinity and communicates these transmissions to a centralized controller 1310 (e.g. via a gateway).
- the controller 1310 (an example of which may include, but is not limited, to an Aruba 3200 Controller) is generally configured to relay raw transmissions received by different hotspot sensors 1306 to a listener 1312 , which generally comprises one or more dedicated software modules that extract one or more unique device identifiers from these transmissions for use downstream in identifying and recognizing devices during subsequent visits at a same or other hotspot associated with system 1300 .
- the listener 1312 is generally characterized as a packet listener (e.g. implemented in the context of packet capture—PCAP), but may also be characterized as a Real Time Tracking System (RTLS) processor in which an RTLS data stream is processed to extract similar data, and optionally, provide access to signal strength data in further characterizing proximity of an identified device.
- RTLS Real Time Tracking System
- Other such listeners currently available or that may evolve in the field to provide similar functionality will be understood to fall within the general scope and nature of the present disclosure.
- the unique device identifier comprises a value representative of an inherent characteristic of the device, such as a MAC address, that is automatically embedded within device transmissions without user input, and in most cases, unbeknownst to the user.
- the unique identifier extracted by the system 1300 is generally specific to the device itself and not pre-designated for the purpose of wireless network access or user identification, but rather integral to the device itself in identifying this device, for example, in allowing for the addressing of wireless communications thereto by nearby or associated devices.
- the hotspot 1306 is programmed to listen for probe requests transmitted by devices actively scanning for available networks. These types of packets are periodically broadcast by Wi-Fi client devices (part of the IEEE 802.11 standard) in seeking to identify available network connections. Contained in such probe requests is a value that uniquely identifies each device (its MAC address) so that replies can be addressed specifically to that device.
- the hotspot sensor 1306 forwards identified probe requests to a centralized controller 1310 (e.g. delivered in its raw form to a remote server) for processing by listener 1312 .
- the packet listener 1312 listens for incoming packets and extracts the MAC address of the client device 1302 that originally issued the probe request, the IP address of the access point (sensor) 1306 that detected the packet, and the timestamp of the packet, for example.
- extraction of the MAC address allows for unique identification of the device 1302 at the hotspot 1306
- extraction of the IP address and time stamp allows, in some embodiments, for the identification of the hotspot location and thus the identified device's location, and the time to be associated therewith.
- the IP address can be cross-referenced with a database of known access points to determine which location it corresponds to.
- the extracted device identifier can be cross-referenced with stored device profiles such that repeat visitors can be recognized upon subsequent visits to the same or related locations, or again at unrelated locations for the purpose of expanding the device profile database across multiple operators (device profile sharing rules between entities may be set in place to protect user privacy and the like, as will be readily appreciated by the person of ordinary skill in the art). Combination of the device ID, location ID, and timestamp thus provide an indication that a particular device 1302 was present at a particular location at a particular time.
- the extracted data can be used to recognize and thus track devices over time at different locations, and can also be used to generate and maintain an in-memory map of where each recognised device is, and optionally how long it has been there.
- the data can be sent, for example at regular intervals, to an M2M service module 1314 that aggregates packet capture data, optionally with other forms of presence information, to create a high-level picture of which devices are present at which locations, and for how long.
- This information can be stored in a knowledge base (KB) database 1316 from where it can be used for various purposes such as reporting, business analytics, and diagnostics, to name a few.
- the M2M module 1314 may also be used to pass events to external subscribers for real-time notification and/or reporting, for example.
- device identification and recognition, device profiling, and as will be described in greater detail below, device visit profiling may be implemented internally by a given entity operating a local, regional or global hotspot locations (e.g. at a single location, at any of a group of commonly operated regional locations, and/or globally across multiple locations), or again implemented by a third party hotspot operator, which may service multiple hotspot operating entities in providing each one with respective and customized data in respect of devices identified/recognized at their service locations and/or across the entire serviceable network of hotspots.
- a local, regional or global hotspot locations e.g. at a single location, at any of a group of commonly operated regional locations, and/or globally across multiple locations
- a third party hotspot operator may service multiple hotspot operating entities in providing each one with respective and customized data in respect of devices identified/recognized at their service locations and/or across the entire serviceable network of hotspots.
- third party operations may thus share resources between commonly operated hotspot locations, or again between distinct customers, by centrally processing packet captures and/or other detection events (e.g. RTLS), or again by centrally processing event data in compiling respective visit profiles, managing device profiles across multiple customer platforms, and managing respective rules engines (e.g. see FIG. 15 ) for different consumers in delivering customized data, as appropriate.
- privacy regulations may be implemented to limit exchange of data between consumers, for example where different levels of engagement have been recorded for a given device from consumer to consumer (e.g. an opt-in device may authorize access to personal information in respect of a particular hotspot operator, but may be set to operate anonymously in respect of another).
- third party resources may be used exclusively for the provision of hotspot network access and device data acquisition and processing, leaving downstream application implementation to the consumer, other embodiments may redirect consumer actions back through the third party system for direct interaction with user devices.
- different privacy protocols may be implemented to reduce direct user device exposure to the consumer, thereby protecting a user's privacy and anonymity, particularly where a user's device's interactions have been limited to unsolicited packet captures, or the like.
- a MAC address automatically extracted from anonymous device transmissions may still be used to compile activity data, and optionally provided for downstream use via a hashing protocol, thereby avoiding direct disclosure of the anonymous MAC address to the consumer.
- device identification and recognition may be implemented via packet capture of probe requests
- other packet captures and/or logging/tracking techniques may also or alternatively be used in conjunction therewith to automatically access a greater representation of user activity.
- multiple data exchanges may be tracked between the device and a hotspot access point while negotiating and ultimately accessing the hotspot network.
- one or more radios may be used at the hotspot location to identify and tracking visiting devices.
- multiple radios may be used at a same location to promote greater proximity data acquisition (e.g. multiple RTLS radios) and thus increase accuracy of the downstream analytics relying on such data.
- FIG. 14 schematically illustrates hotspot engagement levels for characterizing a device visit at or near a given hotspot location.
- passive visitors 1402 may carry devices that are, at the highest level, merely detected as being present within the vicinity of the hotspot.
- passive device detection may occur at first level via a probe request packet capture or an RTLS detection, as discussed above, thereby directly identifying the device at or near the hotspot.
- device communications may be intercepted via a third party receiver (e.g. a receiver in the area of the hotspot in question but not necessarily associated with the hotspot itself, that is, potentially operated by un unrelated entity and/or not readily accessible by the common knowledge base).
- a third party receiver e.g. a receiver in the area of the hotspot in question but not necessarily associated with the hotspot itself, that is, potentially operated by un unrelated entity and/or not readily accessible by the common knowledge base.
- a third party receiver e.g. a receiver in the area of the hotspot in question but not necessarily associated with the hotspot itself, that is, potentially operated by un unrelated entity and/or not readily accessible by the common knowledge base.
- a particular device may be out of range for a particular hotspot receiver to detect it, but may still communicate with another unrelated Wi-Fi transceiver, which unrelated transceiver is itself within range of the particular hotspot receiver. This example is shown schematically in FIG.
- unrelated hotspot 1307 in range of one of the system's hotspots 1306 , exchanges data with a wireless device 1303 that is not within range of this system's hotspot 1306 , for example, in processing a request for network access, exchanging authentication information, or managing an active network connection with the device 1303 .
- transmissions emanating from the device in question 1303 may not be captured by the particular hotspot receiver 1306 of interest, communications emanating from the unrelated transceiver 1307 and intended for the device in question may themselves be captured by the hotspot receiver 1306 and thus identify the presence of the device 1303 within the area of the hotspot 1306 .
- communications emanating from the unrelated transceiver 1307 will necessarily include reference to a specific transceiver identifier (i.e. an access point MAC distinct from the access point MAC of the hotspot location 1306 of interest)
- the system may be configured to automatically distinguish local (direct) from foreign (indirect) visitors, and, possibly, to perform comprehensive analytics as to the number of visitors associated with nearby locations as compared to those present at their own location (i.e. competitor intelligence could be compiled).
- the device may still be recognized from a previous visit at the same or another hotspot location populated in the device's stored device profile, or identified as a new device and recorded in the creation of a new device profile.
- the system 1300 may further or alternatively comprise or be configured to interface with a set of Wi-Fi radio locations 1309 operatively disposed in different locations to, much as in the context of the hotspots 1306 , allow the system 1300 to identify and recognize remote devices 1302 when in their general vicinity.
- a set of Wi-Fi radio locations 1309 operatively disposed in different locations to, much as in the context of the hotspots 1306 , allow the system 1300 to identify and recognize remote devices 1302 when in their general vicinity.
- radios 1309 while not operated to provide devices with wireless access to a network connection, may nonetheless operate to capture local transmissions sent by these devices and extract therefrom a unique device identifier (e.g.
- MAC address via packet capture or RTLS to be cross-referenced with the knowledge base and, where a match is made, allow recognition of the device as being present at the given location, and otherwise allow for the creation of a new device profile.
- device visits would be characterized as passive visits.
- valuable market data may still be compiled with respect to the devices identified at each location, as can device visit profiles be created and stored, as will be described in greater detail below.
- devices recognized at a given location that have opted-in for or authorized (directly or indirectly) the system to communicate directly therewith upon detection, may be targeted upon satisfying certain criteria, such as upon qualifying as a repeat or loyal visitor, a new visitor at a particular location, meeting certain target demographics, etc.
- Active visitors 1404 may be progressively characterized as hotspot associated, whereby the device's radio has identified the hotspot access point and is attempting to connect; hotspot active/intercepted, in which the device is actively connected to the network but not yet authenticated for access to the Internet, for example (e.g. may yet to enter authentication credentials, temporary password, network access key, or the like); and/or hotspot authenticated, whereby a device has been authenticated for network access at the hotspot.
- hotspot associated whereby the device's radio has identified the hotspot access point and is attempting to connect
- hotspot active/intercepted in which the device is actively connected to the network but not yet authenticated for access to the Internet, for example (e.g. may yet to enter authentication credentials, temporary password, network access key, or the like)
- hotspot authenticated whereby a device has been authenticated for network access at the hotspot.
- Such opt-in or service access conditions may include express authorization by the user for designated system access privileges to the device and/or to user data stored thereon, or include the volunteering of user data by way of user action on the device for system storage and use.
- each level of interaction provides an increasing or at least continuing ability to extract information from the device and/or to characterize the device's activity via recognizable network communications, further information can be gathered in respect of the device's user by tracking not only device identification and recognition, but also an engagement level and visit duration.
- each engagement level provides the system access to recognizable device transmissions, which, in one embodiment, may include an access point MAC address (e.g. for cross-referencing hotspot location) and a device MAC address (e.g. for device recognition), and further include for association and authentication level events, an event start/stop value. Each event may also have associated with it a date/time stamp, for example.
- a signal strength of the device may also be captured, thereby allowing for further characterization of the visit, namely, as a function of user proximity to the hotspot location (e.g. internal or external to the establishment providing network access), which proximity may also be logged as a component of the device visit.
- the hotspot location e.g. internal or external to the establishment providing network access
- the system may be configured to wirelessly transmit an engagement offer to the device that requires user action on the device for implementation and that ultimately results in the system gaining enhanced communicative access to the device.
- the system may be configured to use this enhanced communicative access to automatically engage a user of the device (e.g. without user input).
- the requested user action results in the transmission of user contact information to be associated with the device profile in the knowledge base (e.g. automatically extracted from the device or directly or indirectly input by the user).
- the contact information can be accessed from the knowledge base and used to communicate a message to the device.
- the requested user action may rather or also result in the download of an application (e.g. app) associated with the hotspot location, or a designated group of hotspot locations, to be operated on the device.
- an application e.g. app
- a unique application identifier may be stored in relation to the device's profile and used to communicate directly with the downloaded application operating on the device when the device is subsequently identified and recognized at one of these hotspots (or related sensor locations).
- a particular device visit is compiled as a series of events over time captured and logged by the system, from initial detection in one example by way of MAC address packet capture upon the device scanning for available network connections, followed by network association, interception and/or authentication upon the user gaining access to the hotspot network (which may last anywhere between a few minutes to a few hours), to termination upon the user breaking the connection, upon the system logging a final packet capture event, or again upon the user turning off the device (e.g. a laptop may be shut down before leaving the location, whereby a finalizing packet capture is not available to mark the device leaving the location, as may otherwise be available from a smartphone device or the like that remains activated as the device leaves the location).
- the network disconnection event may therefore act as a visit closing point as the last detected action of the device at the hotspot.
- a comprehensive visit profile can be compiled from a combination of passive and active detection mechanisms to enrich the data collected as it pertains to a particular visit.
- FIGS. 14B to 14D provide examples of visit profiles for a given location that may be compiled using the above considerations, which profiles may then be used to gain market intelligence on the location's clientele, to gear marketing and/or promotional efforts, to allocate resources and/or project product or service demands, and/or to target selected clients or client groups, for example.
- An optional visit proximity profile is overlaid on the visit timeline profile, for example rendered via proximity data extracted from an RTLS data stream, in further characterizing a device visit.
- a visit proximity profile may be used independently to produce usable results, as will be further illustrated by the below-described examples.
- packet capture detection is considered in the below examples for device detection, an RTLS data stream may otherwise be used to provide similar effects, the added option of further capturing signal strength data to further characterize device proximity.
- a uniquely identifiable device is first detected by way of packet capture (or RTLS).
- the device is then associated with the hotspot and later authenticated for wireless network access.
- Packet capture again identifies the device before the authenticated session is closed.
- the visit is characterized by the time lapse from first detection to authenticated assess termination. Based on the duration of the visit (e.g. upon the visit duration exceeding a preset threshold), and the level of engagement recorded (e.g. authenticated access generally associated with an engaged patron), the visit is classified as an active walk-in, and thus as a likely profitable patron that may be likely to return given his lasting use of available network resources.
- proximity data may be used in conjunction with the engagement timeline to further characterize the visit. For instance, in this example, signal strength data is processed to indicate proximity of the device as exceeding a preset proximity threshold 1450 , thereby indicating a high likelihood that the device is in fact located within the hotspot operator's premises or establishment, thus confirming the visit's status as an active walk-in. Should proximity data indicate otherwise, the system could question whether the detected device is in fact making use of hotspot services without necessarily supporting the hotspot operator, and take appropriate action or log the visit accordingly. In any event, and as noted above, upon cross-referencing the device's unique identifier (e.g.
- the visitor may further be characterized as a returning customer (e.g. if previously identified at this location or at one of several associated locations), or as a potentially new customer (e.g. if never before detected at this or related locations, but potentially previously identified and logged at an unrelated location).
- the visit may be recorded in the stored profile, or in a newly created device profile in the context of a new visitor heretofore never detected by the system, for recognition upon subsequent detection at this or another location.
- a device is briefly detected (e.g. via packet capture or RTLS), thus defining a visit more likely associated with a walk-by, namely an individual that did not necessarily patron the hotspot location. Tracking these visitors may, as will be described in greater detail below, provide information useful in drawing in such walk-by visitors, thus effectively seeking to convert them to walk-ins.
- proximity data may again be used in combination with event timing/visit duration data to further characterize user activity.
- a short duration visit may be characterized as a walk-by where no further data is available, but may otherwise be characterized as a short walk-in where proximity data indicates that the device did in fact enter the premises of the hotspot operator (e.g. where proximity exceeds a preset threshold 1452 ).
- proximity data indicates that the device did in fact enter the premises of the hotspot operator (e.g. where proximity exceeds a preset threshold 1452 ).
- a patron could come in and out of the coffee shop within a few minutes, but nonetheless warrant characterization of the visit as a walk-in. Accordingly, engagement level, visit duration and proximity data may be combined, when available, to refine characterization of a device visit.
- a repeat visitor is identified for a same location (or different locations tracked as part of a same group).
- a first visit may include a simple passive walk-in visit (e.g. in the coffee shop example, a visitor may be stopping in to pick-up a coffee to go without intentionally engaging the hotspot network), wherein the device is first detected but never further engaged before a final detection takes place a few minutes later.
- proximity data again illustratively shown in this example as a y-axis increasing with proximity to the hotspot (i.e. increasing signal strength) the system can better distinguish between a true passive walk-in event (e.g.
- a proximity threshold 1454 is met
- an event in which the device, while close enough to be detected by the system may in fact have been located outside or next door to the premises in question, or again detected via third-party communications picked-up by the hotspot radio, thereby still potentially logging-in a visit of sufficient duration to qualify as a walk-in, but in fact representing a “close” walk-by.
- the same device may be detected and recognized, this time further engaging the system via authenticated network access and direct engagement, characterizing the visit as an engaged repeat walk-in visit.
- engagement may be introduced via a product or promotional offering, whereby a user may elect to “opt-in” for a particular service via a network landing page or the like, thus exchanging further information with the system to enable or activate the opt-in service.
- the user could select to download a free iTunesTM song in exchange for filling-in a customer loyalty form, providing their e-mail address for a chance to win a free gift or service, or again downloading a free location-specific or related app for implementation on their device, which app then readily accessible by the hotspot operator for subsequent interaction with the visitor.
- a visitor accessing a hotspot location at an airport may be offered a flight status app or the like to be implemented on their device, which app may later be accessible by the hotspot or related operator to promote airport shopping or services upon detecting and recognizing the device during a subsequent visit (e.g. send a scanable coupon via the app to promote a certain shop or restaurant).
- Other examples may include, but are not limited to, the exchange of SMS messages, device and/or user association with the hotspot operator via a social network or the like (e.g. FacebookTM “like” status, twitter account following, etc.), etc.
- further information relating to the user(s) of the device, or the device itself may be extracted, either directly as input by the user, or indirectly upon the user accepting certain terms and conditions required in receiving the opt-in service (or again required upon requesting free network access privileges).
- acquisition of such further information can be stored and associated with the device profile, and used downstream to enhance the user's experience and promote further patronage, for example. For instance, as noted above, a repeat ‘opted-in’ visitor may be automatically identified and recognized upon detection, and automatically prompted by the system.
- an opted-in visitor having provided his e-mail address may receive an automated greetings from the system, which may include a promotional incentive for the visitor to further enhance patronage of the hotspot or related location.
- an automated greetings from the system, which may include a promotional incentive for the visitor to further enhance patronage of the hotspot or related location.
- the system 1300 may be configured to compile data in respect of each device visit to a particular hotspot, whereby visit data gathered and compiled in respect of each detected device, and optionally at different locations, may be combined to provide market intelligence as to the type of users frequenting a particular location and/or type of establishment, the amount of time spent at each location, the level of engagement with the system while at each location, and so on.
- Proximity data may also be used to characterize spatial movements of recognized device and further distinguish hotspot patrons from non-patron visitors.
- a device 1502 is again first identified at a hotspot or similar access point 1506 via packet capture (PCAP), for example via a PCAP listener 1512 as introduced above.
- PCAP packet capture
- the PCAP event may provide a first detection instance in a particular visit, but may also provide subsequent detection instances, for example at regular intervals as per the normal operation of the device, which may periodically probe its environment for available network connections.
- Other event sources such as a syslog in the context of authenticated network access, interaction with an opt-in service or application implemented on the remote device, and the like, can also be used to enrich visit data, each such event generally handled by the M2M module 1514 by respective event listeners/handlers 1522 .
- a visit creation and aggregation module 1524 is operatively associated with the event handlers 1522 to aggregate and store in knowledge base 1526 a visit profile for each uniquely identified device.
- each visit is queued by a visit queue 1528 and processed by a data engine 1530 configured to receive, qualify and act upon compiled visit profiles, e.g. to isolate, filter and/or consolidate visits satisfying designated rules for further processing, reporting and/or action.
- a particular visit profile may be pulled from the queue 1528 and processed through a rules engine 1532 .
- the visit profile can be identified to an action engine 1536 with a particular action to be performed identified by the matching rule set, for output to the downstream consumer 1538 at step 1540 .
- An exemplary action may include an HTTP Push Notification to the consumer, or other such reporting functions as will be illustrated in greater detail below.
- Different illustrative rules may include, but are not limited to, rules for characterizing a selected visit as a function of preset conditions, such as duration and/or proximity (e.g. walk-in vs. walk-by), level of engagement (e.g. passive vs. active), type of engagement (e.g. detected vs. authenticated vs. opt-in device), opt-in status, etc.; rules for identifying visitors (e.g. opted-in visitors, return visitors, new visitors, long duration visitors) to whom targeted content may be pushed and/or with whom direct interaction should be promoted; reporting rules based on one or more visit qualifiers set as being of particular interest to the downstream consumer; etc.
- rules for characterizing a selected visit as a function of preset conditions such as duration and/or proximity (e.g. walk-in vs. walk-by), level of engagement (e.g. passive vs. active), type of engagement (e.g. detected vs. authenticated vs. opt-in device), opt-
- rules may be set as a function of preset thresholds (e.g. proximity threshold or range, duration threshold or range, visit frequency and/or range, etc.), whereby cross-referencing of real-time and/or device/visit profile data with such thresholds may allow for adequate characterization of the device, its user, and their visit at the hotspot or similar location.
- preset thresholds e.g. proximity threshold or range, duration threshold or range, visit frequency and/or range, etc.
- a consolidated management interface can be provided to consolidate device identification and recognition data, report and analyse device activity and visit patterns, and so on.
- data is isolated for all operators 1602 and locations 1604 of a selected Brand 1606 , such as StarbucksTM, for example, and that, for a selected date range 1608 .
- aggregated data will be consolidated to present average activity data for all participating locations of this particular Brand, in this particular example, formatted to represent a visit dashboard (e.g. a selected subset of “at-a-glance” visit analytics for the selected period).
- a chart 1610 is provided tracking visits per hour during the course of a day, and comparing average visits over the selected data range (30 day trend) to current data (real-time tracking), thus visually identifying a current above-average number of visits per hour across all locations.
- a pie chart 1612 is also provided breaking down percentage total visits by day.
- a bar graph 1614 shows a percentage distribution of visits as a function of visit duration, showing a significant fraction of visits lasting approximately 15 minutes.
- a breakdown of visits per most-visited locations 1616 is also provided, distinguishing Total Visits 1618 from Unique Visitors 1620 (i.e. collapsing repeat visitors).
- Other features and applications are also made available in the illustrated interface, including options for consolidating data on: Visit duration analytics; Unique location visit analytics; New visitor analytics; Day by day hourly visit analytics; Daily visits analytics; and Customer engagement analytics, to name a few.
- regional and location-specific dashboards are respectively represented.
- data is compiled and displayed in respect of 5 designated locations in a given area.
- Selected data windows include the total number of visits for the day further subdivided as walk-bys (visits lasting less than 5 minutes in one example, thus suggestive that the user of the device may not have actually entered the premises, or again optionally further characterized by a visit during which device identification events were combined with proximity data to confirm that the device never entered the premises.), and walk-ins (visits lasting more than 5 minutes).
- Another selected window includes the total number of unique visits for the day (i.e.
- Another selected window classify recent walk-ins (e.g. visits detected to last more than 5 minutes) as loyal, casual or new visitors (e.g. based on preset loyalty rules). For example, devices recognized to attend one of the regional locations at least twice a week may be categorized as a loyal visitor, as compared to one recognised to attend only twice a month and thus characterized as casual. Similarly, recent walk-bys may also be characterized as such.
- Respective windows are also provided in this example to show a number of walk-ins within the last hour and an comparative indicia identifying a percent change in this value as compared to the previous hour; a number of walk-bys within the last hour and an comparative indicia identifying a percent change in this value as compared to the previous hour; and a pie chart tracking walk-in visit durations for the day in progress.
- data is compiled and displayed in respect of a singular location.
- Selected data windows in this example are similar to those depicted in the embodiment of FIG. 17A , with data necessarily representative of visitor traffic and activity within a single location.
- a hotspot operator may proceed to make educated decisions as to how to market or promote their services, namely in seeking to attract further clientele (e.g. investigate options for drawing in walk-bys, and particularly repeat walk-bys that may, for instance, be predicted to frequent a competing establishment in the area), and/or to better service existing clientele and encourage further engagement.
- Using real-time and/or regular data updates a local or regional operator may track immediate results to different marketing or promotional campaigns aimed at improving patronage.
- a local coffee house hotspot operator may observe that walk-ins drop significantly during certain periods of the day or again on certain days, and investigate potential reasons therefore, which may lead to creative solutions to draw in greater patronage at those times or on those days.
- peak walk-by periods may suggest the use of a more aggressive sidewalk promotion strategy around those periods to draw these visitors in.
- Other considerations may rely on acquired device profile data to plan for services and demand on given days, or during certain periods of the day. For example, while sales receipts may allow tracking of variable demand patterns, visit duration data may allow for greater insight as to physical space allowances, visitor comfort (i.e. would increasing visitor comfort or improving visitor environment help prolong visit durations and boost sales, or hinder flow through of new walk-ins.).
- immediate reporting or push notifications may be dispatched to the location in question to incite immediate action.
- a location manager may immediately evaluate conditions that may have led to such decrease (e.g. overcrowded space or limited seating, shortage on certain menu items for a coffee shop or restaurant, loud or unpopular background music, disturbingly loud group of patrons, etc.). Access to such immediate observations on patronage and engagement may thus lead to faster identification and remediation of perceived issues, or again to noting particular characteristics or settings seemingly conducive to an increase in patronage (e.g. live music, effective sidewalk advertising, personal greeter at the door, etc.).
- the immediate identification and recognition of repeat patrons may trigger a more receptive or dedicated service, as can recognition of “opt-in” devices at a given location be used to push instant notifications to those devices or again to service providers/sales representatives at the location to encourage provision of enhanced services, communicate a “usual” order to the cashier before an order is actually made, or simply allow for a personal greeting to a “regular” who may otherwise expect to be personally recognized by location.
- the compilation of such data may allow for direct or indirect reporting of business intelligence metrics and/or analytics which may be utilised to adjust or refine business practices and/or offerings and to observe immediate, short and/or long term effects of such refinements on the business's clientele and performance.
- reports may be rendered “at-a-glance” in the form of comprehensive and/or customizable dashboards, as instant notifications, or alternatively rendered as detailed business intelligence reports for detailed analysis.
- Reporting can also take different forms depending on the intended analysis to be performed and intended outcome and application of such analyses.
- data may be compiled to provide location segmentation reporting, such as to determine and illustrate a mix of devices recognized at a given location or group of locations (e.g. number of loyal/regular/occasional/new customers at a given time or during a given period).
- Data may also or alternatively be compiled to provide device segmentation reporting, such as to qualify the visit patterns of a particular device (e.g. Loyal/Regular/Occasional/etc.).
- a device has been opted-in to a particular service offering in exchange for the rights to disseminate, exchange and/or use the device's user's personal data (e.g.
- reports may also, or alternatively include specifics extracted from the device and/or user indicative of the user's gender, age, past purchase history, visit profiles, social status, etc.
- reports may also, or alternatively include specifics extracted from the device and/or user indicative of the user's gender, age, past purchase history, visit profiles, social status, etc.
- other types of reports may be considered herein, as can different permutations and combinations thereof, without departing from the general scope and nature of the present disclosure.
- the above also provides a few illustrative examples as to different applications to device identification, recognition, and tracking. Other such applications are clearly intended to fall within the general scope and nature of the present disclosure, as will be further detailed below.
- wireless devices 1802 at a given hotspot or similar location 1806 may be detected and respective device profiles 1808 created and/or populated in knowledge base 1810 to track and report on device activity at this location.
- a respective location state 1812 is generally associated with each device profile instance, along with a timestamp or the like, as noted above, to ultimately characterize device presence/activity, location and timelines (e.g. visits) for further processing.
- knowledge base data is made accessible to a consumer through a retailer API 1820 , or the like, so to update store (location) states 1822 and provide visitor presence notifications 1824 , for example.
- store state updates 1822 may include, but are not limited to, the push or pull of global, regional and/or local visitor dashboard updates, or the like, so to allow for the substantially real-time processing of visitor activity data in extracting immediate or near immediate market intelligence.
- immediate action may be initiated as a function of store updates, such as the application of instantaneous promotions, service upgrades, or again, in increasing network access coverage and/or capacity where visitor updates are indicative of an increased demand for network access, for example.
- Long term projections and analytics may also or alternatively be compiled based on updated data compiled over time.
- the retailer API 1820 communicates with one or more retailer applications 1826 , which may also access retailer CRM data and content 1828 to supplement interactions with visitors at the hotspot location(s).
- retailer applications 1826 may be configured to provide targeted Wi-Fi hotspot content 1830 to visitors, namely visitors actively engaged via network authentication or opt-in visitors readily accessible, for example, by way of contact data or information volunteered by the visitor during the opt-in process (e.g. social network interface/account-related content, web content or pop-up advertising, foreground inset content, background content, etc.).
- targeted content may be pushed via retailer app integration 1832 on the visiting device, for example once downloaded upon opting-in for related services.
- Other examples of pushed or targeted content may include the sending of an e-mail or SMS message, for example, where such contact information has been volunteered or extracted and used under approval by the user of the device, again, possibly in the context of network engagement at a given hotspot.
- a device may opt-in to receive promotional information form an airline and its affiliates upon using the airline's network access services in their first class waiting lounge.
- the airline may be affiliated with a hotel chain such that, upon the user's device being detected at the airport lounge prior to leaving for a flight, the device owner's flight information may be retrieved by cross-referencing the user's e-mail as provided during the opt-in process for receiving promotional information, with an e-mail contact field associated with the user's flight ticket.
- the user's destination for that day may also be identified, allowing for targeted content associated with this destination (e.g. hotel chain location at the user's destination) to be pushed to the user.
- a targeted message could be sent to the device welcoming the user and offering one or more promotional incentives, such as a room upgrade, complimentary breakfast, or the like.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Databases & Information Systems (AREA)
- Computer Security & Cryptography (AREA)
- General Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- Power Engineering (AREA)
- Data Mining & Analysis (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Health & Medical Sciences (AREA)
- Cardiology (AREA)
- General Health & Medical Sciences (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
Description
- This application is a continuation-in-part of U.S. patent application Ser. No. 12/451,909, filed on Jan. 7, 2010, which is a U.S. National Phase of International Application No. PCT/CA2008/001060, filed on Jun. 6, 2008, which claims priority to a U.S. Provisional Patent Application No. 60/942,409, filed on Jun. 6, 2007. The disclosures of these prior applications are incorporated by reference in their entirety and should be considered a part of this specification.
- The present disclosure relates to wireless networks, and in particular, to a system and method for remote device recognition.
- Wireless devices and systems are currently available for enabling a user of a remote device access to a communication network (e.g. the Internet) via a wireless access point (WAP) and gateway communicatively linked to this communication network, for example, operated at a given location or in a given area commonly known as a hotspot.
- There remains a need for a new system and method for remote device recognition that overcomes some of the drawbacks of known techniques, or at least, provides the public with a useful alternative.
- This background information is provided to reveal information believed by the applicant to be of possible relevance. No admission is necessarily intended, nor should be construed, that any of the preceding information constitutes prior art.
- Some aspects of this disclosure provide a system and method for remote device recognition. In accordance with one embodiment of the invention, there is provided a method for recognizing a wireless device across multiple hotspot locations, the method comprising: detecting at one of the multiple hotspot locations a wireless transmission sent by the wireless device; extracting a unique device identifier of the detected device from said wireless transmission, said unique device identifier automatically embedded within said wireless transmission by the detected device without user input; cross-referencing said extracted device identifier with a network accessible database of stored device profiles, each of said device profiles having a respective stored device identifier associated therewith; and recognizing the detected device upon matching said extracted device identifier with one said stored device identifier; otherwise automatically creating a new device profile in said database as a function of said extracted device identifier such that the device is recognized upon subsequent detection at any of said multiple hotspot locations.
- In accordance with another embodiment, there is provided a system for tracking wireless devices across multiple hotspot locations, the system comprising: a network accessible database having stored therein a plurality of device profiles each identifying a respective wireless device by a stored unique device identifier, each said stored unique device identifier indicative of an inherent characteristic of said respective device; and a network access module at each of said locations and configured to detect at a given location a wireless transmission sent from a given device and having embedded therein a transmitted unique device identifier inherent to said given device; said network access module interfacing with said network accessible database to cross-reference said transmitted unique device identifier with said plurality of device profiles to identify a matching profile and thereby recognize said given device, and otherwise automatically create a new device profile based on said transmitted unique device identifier so to recognize said given device upon subsequent detection at any of said multiple hotspot locations.
- In accordance with another embodiment, there is provided method for automatically characterizing a device visit at a Wi-Fi hotspot location, comprising: detecting a first wireless transmission sent by a wireless device; extracting a unique device identifier of the detected device from said wireless transmission, said unique device identifier automatically embedded within said wireless transmission by the detected device without user input; creating a device visit profile and associating said extracted unique device identifier therewith; recording a timestamp of said first wireless transmission in said device visit profile; automatically identifying one or more subsequent wireless transmissions sent by said wireless device while at the Wi-Fi hotspot location by way of identifying data associated with each of said subsequent transmissions directly or indirectly associated with said unique identifier; recording a timestamp of each of said subsequent transmissions in said device visit profile; and characterizing said device visit profile at least as a function of a duration value defined by said recorded timestamp of said first transmission and a recorded timestamp of a last of said subsequent transmissions.
- In accordance with another embodiment, there is provided a method for recognizing a wireless device across multiple Wi-Fi locations, the method comprising: detecting at one of the multiple Wi-Fi locations a wireless transmission sent by the wireless device; extracting a unique device identifier of the detected device from said wireless transmission, said unique device identifier automatically embedded within said wireless transmission by the detected device without user input; cross-referencing said extracted device identifier with a network accessible database of stored device profiles, each of said device profiles having a respective stored device identifier associated therewith; recognizing the detected device upon matching said extracted device identifier with one said stored device identifier; and associating with said device profile of said recognized device said one of the multiple Wi-Fi locations; and centrally compiling from said stored device profiles, visit data for each of said multiple Wi-Fi locations.
- Other aims, objects, advantages and features will become more apparent upon reading of the following non-restrictive description of specific embodiments thereof, given by way of example only with reference to the accompanying drawings.
- Several embodiments of the present disclosure will be provided, by way of examples only, with reference to the appended drawings, wherein:
-
FIG. 1 is a high level diagrammatic representation of a remote service access system, in accordance with embodiments of the invention; -
FIG. 2A is a high level diagrammatic representation of an exemplary remote device, in accordance with embodiments of the invention; -
FIG. 2B is a high level diagrammatic representation of a service access module, in accordance with embodiments of the invention; -
FIG. 2C is a high level diagrammatic representation of a network access module, in accordance with embodiments of the invention; -
FIG. 3 is a flow diagram depicting a method of registering a user and a remote device for access to the system ofFIG. 1 , in accordance with embodiments of the invention; -
FIG. 4 is a flow diagram depicting a process of identifying, authenticating, and authorizing a user with a browser-based or browser challenged mobile or remote device, in accordance with embodiments of the invention; -
FIG. 5 is a sequence diagram depicting communications between components of the system ofFIG. 1 , for identifying, authenticating, and authorizing a user with a browser-based or browser challenged mobile or remote device, in accordance with embodiments of the invention; -
FIG. 6 is a flow diagram depicting a process of identifying, authenticating, and authorizing a user with a browserless mobile or remote device, in accordance with embodiments of the invention; -
FIG. 7 is a sequence diagram depicting communications between components of the system ofFIG. 1 , for identifying, authenticating, and authorizing a user with a browserless mobile or remote device, in accordance with embodiments of the invention; -
FIG. 8 is a flow diagram depicting a method of accessing wireless services using a browser-based remote device, in accordance with embodiments of the invention; -
FIG. 9 is a flow diagram depicting a method of accessing wireless services using a browser-challenged remote device, in accordance with embodiments of the invention; -
FIG. 10 is a flow diagram depicting a method of accessing wireless services using a browserless remote device, in accordance with embodiments of the invention; -
FIG. 11 is an exemplary screen shot depicting a relational database containing sample data of hotspot access networks, user profiles, and device profiles, in accordance with embodiments of the invention; -
FIG. 12 is a flow diagram depicting an exemplary method for extracting information from a remote device, according to an embodiment of the invention; -
FIG. 13 is a diagram of an exemplary system hardware architecture for device detection and recognition, in accordance with one embodiment of the invention; -
FIG. 14A is a high-level diagram depicting progressively increasing engagement levels between a wireless device and a hotspot, and distinguishing passive and active visitors at this hotspot as a function of their engagement level, in accordance with an embodiment of the invention; -
FIG. 14B to 14D are diagrammatic representations of respective visit profiles, in accordance with an embodiment of the invention, in which different device detection and network interaction events are used to characterize each visit. -
FIG. 15 is a diagram of an exemplary process flow for device detection, and recognition, visit data compilation and processing related thereto, and downstream applications associated therewith, in accordance with one embodiment of the invention; -
FIG. 16 is an exemplary screenshot of a system reports and analytics site consolidating visit and device-related data accessed over time in respect of a plurality of participating hotspots and/or hotspot operators; -
FIGS. 17A and 17B are exemplary graphical user interfaces providing a real-time dashboard of device and visit-related data in respect of multiple hotspots operated by a common hotspot operator, and in respect of a single hotspot, respectively, in accordance with one embodiment of the invention; and -
FIG. 18 is a diagrammatic representation of illustrative downstream applications for a device detection and recognition system, in accordance with one embodiment of the invention. - With reference to
FIG. 1 , and in accordance with one embodiment, a public network access system will now be described. Thesystem 10 is configured to provide one or moreremote devices 102 access to one ormore services 114 via anetwork 104. In the embodiment depicted inFIG. 1 , the system generally comprises one or morenetwork access modules 106, adapted for communicating wirelessly with the one or moreremote devices 102, and one or more service access modules as inmodule 112, communicatively linked to the network access module(s) 106 and configured to provide to the remote device(s) 102 access to the service(s) 114 via the network access module(s) 106 andnetwork 104. - In general, the
system 10 may be used to identify differentremote devices 102 via thenetwork access module 112, and in some embodiments, authenticate and authorize access thereto to network and/or Web-based services accessible via theservice access module 106. In some embodiments, thesystem 10 allows browser-based, browser-challenged, and/or browserless remote devices to access these services, or a selection thereof, when such remote devices are operated at a public access hotspot supported by thesystem 10. - For example, the
network access module 106 may be configured for receiving identifying data from aremote device 102, and communicating this identifying data to theservice access module 112 for authentication and authorization. Once the identifying data is authenticated, theservice access module 112 will authorize that theremote device 102 access thenetwork 104 andservices 114 provided therethrough. In some embodiments of the invention, thesystem 10 may be configured to provide full access to eachremote device 102, or again each remote device type, or provide restricted access to selectedservices 114 based on user information, remote device owner or type information, service provider information, related purchase information, service promotions offered by service provider partnerships or agreements, and/or a combination of the above and other such information available through thesystem 10. Identifying data may, for example, comprise remote device type data automatically embedded within remote device transmissions and extracted by thesystem 10, remote device type data extracted from user preferences available from the remote device, user data input thereby using a user interface (e.g. username and password, etc.), or a combination thereof, to name a few. - In some embodiments, user information or data resides or is entered or stored on the remote device and is compared to a user profile stored in a knowledge base operatively coupled to the service access module. In some embodiments, as an aid to authentication, at least a portion of user information is not stored on the remote device but is provided by the user when access is required. Similarly, in some embodiments, remote device information or data resides or is stored on the remote device and is compared to a remote device profile stored in a knowledge base operatively coupled to the service access module. Remote device information can be indicative of inherent characteristics of the remote device, such as a MAC address, or can be other information stored on the remote device for identification thereof.
- Authorization or restriction of access to selected services can be enabled by establishing one or more service profiles. A service profile can associate information about users, remote devices, hotspot providers, hotspot locations, or service providers, or a combination thereof with a collection of allowed or restricted services, resources or applications to be provided. For example, the service profile can include information about services which a user has paid for and subscribed to, services usable by a remote device, and/or services offered by a hotspot provider, hotspot location, or service provider. As another example, the service profile can additionally include information about service offerings provided to specified combinations of user, remote device, hotspot provider, hotspot location, and service provider. Service profiles can be stored in a knowledge base, and accessed to determine what access should be given upon initiation of a connection of a remote device at a hotspot.
- In some embodiments, the user profile and/or remote device profile are associated with the service profile in the knowledge base. During authentication and authorization, user and/or remote device information provided by the remote device is compared with the user profile and/or remote device profile in the knowledge base for validation, and access to services as described by the service profile are granted upon validation.
- In one embodiment, authorization constraints can be associated with a service profile and used to directly or indirectly limit or disable specified applications, or to limit or disable network access functionality related to said specified applications. Authorization whitelists can also be used, as an alternative to or in conjunction with authorization constraints, to positively define access to services or to provide minimum service level guarantees.
- The
system 10 generally provides one or moreremote devices 102 access to one ormore services 114 vianetwork 104. For example, thesystem 10 could be used to provide access to digital home services, such as access to digital TV or other forms of home content to access applications such as, but not limited to, Slingbox, Orb, Location Free TV (LFTV), and/or home security features provided by various online home security service providers. A user could thus connect to a home access system (e.g. a home media server, networked computer, etc.) to access images, music, videos, files, and the like that are stored on remote devices located in the user's home, business, office, etc. Thesystem 10 could also be used to access remote media services, for example from anotherremote device 102 supported by thesystem 10, from a Web-enabled media service provider (e.g. music and/or video download, sharing, etc.), or from other such networked services. - Other examples of
services 114 could include access to instant messaging services, such as but not limited to, AOL™ Instant Messenger, Microsoft™ MSN Messenger™, Yahoo!™ Messenger, ICQ, or Google™ Talk, access to various public, private and/or enterprise email services, such as but not limited to, Hotmail, Gmail, Yahoo!™ Mail, AOL™ Mail, Microsoft™ Outlook™, as well as access to enterprise business applications such as, but not limited to, collaborative platforms using, for example, Microsoft™ Unified Communications (e.g. Outlook™, Messenger, Sharepoint™, Microsoft™ Communications VOIP services, etc.), and the like. Access could also be provided to social networking applications such as Facebook™, MySpace™ and YouTube™. Access could also be provided to cloud storage systems such as SkyDrive™ and Google Docs™, or other virtualized computing resources. - Furthermore, access to various gaming services, such as OGSi, GamePal™, PlayStation™ Network, Xbox™ Live™, Nintendo™ Wi-Fi, and the like, could also be implemented via
system 10. - In some embodiments, services can be characterized at least in part as allowing access to groups of applications, and/or as allowing access to specified network resources at specified levels. For example, network resources can include sets of one or more TCP or UDP ports, data transmission or reception capabilities at a specified bandwidth, bandwidth variation, delay, delay variation, communication priority, support for specified sources or destinations, application or removal of packet size restrictions, and the like, as applied to either upstream traffic, downstream traffic, or a combination thereof. Specified network protocols, for example protocols supporting streaming video or audio, can also be considered network resources.
- In some embodiments, services characterized by allowing access to groups of applications and/or specified network resources or levels thereof can be further characterized by other aspects, such as allowing access to specified applications, to specified remote devices or at specified locations, times, or the like.
- In some embodiments, network resources such as described above can be selectively allowed or blocked in order to enable or disable access to one or more selected applications. For example, if a customer subscribes to a streaming audio application, access to appropriate TCP ports, streaming audio servers, and network traffic characteristics representative of streaming audio can be allowed such as support the streaming audio application. However, communication with streaming video servers may optionally be blocked unless the customer pays an additional fee. Applications and/or groups of applications can be profiled to associate therewith the network resources or characteristics required for access thereto. Service providing access to selected applications can then be enabled by allowing access to the network resources or characteristics associated therewith, for example by looking up the appropriate associations in a knowledge base.
- It will be appreciated by the person skilled in the art that access to any one, or combination of the above, and other such services may be provided to a user of the
system 10, without departing form the general scope and nature of the present disclosure. For example, a user could gain access to the Internet, or similar network structures, on an open access basis, such that this user could browse the Internet, download from the Internet, play online games, etc., in one example, restricted only by possible functional, processing and/or communication capabilities and limitations of the user'sremote device 102. Alternatively, access could be limited to services selected or pre-selected for a given user or user remote device, identified and authenticated by theservice access module 112 and authorized to access these limited services via thenetwork access module 106. - As introduced above, in accordance with some embodiments of the invention, the
system 10 may be configured to manage public and/or private network access for a plurality ofremote devices 102, optionally of a plurality of remote device types, configurations and/or functionality, and that, within a variety of venues if necessary. In this embodiment, identification, authentication and authorization can be implemented for a variety of remote devices and/or users, and optionally, for different services and service access packages and/or restrictions. Such packages could, in various embodiments, be defined by the type of remote device used to access thesystem 10, e.g. based on remote device capabilities, functionality and/or limitations; the specific user or remote device accessing thesystem 10, e.g. based on a user and/or remote device profile listing selected and/or pre-selected services; or a combination thereof, for example. - For instance, in one embodiment, access is provided in accordance with a selected or identified service access package wherein access is provided to one or more Value Based Applications (VBAs) selected or offered to a given user and/or remote device. For example, VBAs can be offered either at no cost or as part of a paid service. Such VBAs may include a number of remotely operable applications or service levels for which an end user may wish to gain access via the present system. For example, a VBA could comprise a specific application to which access is provided via a mobile network, managed by remote device and/or network specific functionality, and priced according to the value delivered by the specific application to a specific market segment. As another example, a VBA could comprise enabling a combination of capabilities and/or service quality levels that are desired for effectively using a specific application or class of applications, priced according to the value delivered thereby. Pricing can include monetary payment, but can also be affected by other factors such as purchases of related products, services or service contracts, association with a selected service provider, or the pre-existence of other related products, services or service contracts.
- Enabling VBAs may thus provide access and cost flexibility to the end user through specifically defined service profiles. These service profiles can be packaged into a monetized service based on a specific functionality, for example, gaming, home connect, etc., and tied to the remote devices that support such functionality. Furthermore, an embodiment can be configured to enable the identification of a
remote device 102 as a browser-based, browser challenged, or browserless remote device, and optionally configured to combine such remote device identification with user identification. Embodiments can allow for access to thenetwork 104 andservices 114 using a service-based accounting, which permits users with browserless remote devices to access thesenetworks 104, and can also facilitate service-oriented network access at hotspots and other such locations. - In some embodiments, a user can select and pre-pay for a service profile based on price and desired functionality. Options to upgrade a service profile can be provided, triggered by a user's attempt to access a service other than described in their service profile, or to access a service in a manner other than described in their service profile (for example but not limited to: beyond a predetermined time limitation, outside of authorized hotspots, outside of a predetermined geographic area, using an unauthorized remote device or remote device type, accessing an unauthorized application, simultaneously using more remote devices than is authorized, or using resources beyond a predetermined bandwidth cap or bit cap). It will be understood that a variety of pre-paid or pay-as-you-go service plans can be implemented in some embodiments.
- As examples of enabling restricted access to selected VBAs, a user may be willing to pay a fraction of the traditional hotspot access price for a specific function or application, for example, offering, at a discounted price, to only connect a given user to their home computer, watch TV from their home digital cable box, access a social application such as Facebook™, or keep a son or daughter entertained at the airport during a 3-hour layover with a hand-held gaming remote device connected to other players on the Internet. In an embodiment where such authorization packages are selected, the
system 10 can be configured to manage user accounts and apply customized authorization rules, such as whitelists or constraints (e.g. firewall rules viagateway 110 of thenetwork access module 106 ofFIG. 2C ) such that a user may selectonly services 114 they wish to pay for, or free services provided at their location, which for example could be in conjunction with the purchase of another product at the location or a service partnership or agreement, and be restricted thereto. An upsell feature may also be implemented through thesystem 10 such that a user may choose to upgrade their service profile to gain access tofurther services 114. - As another example, quality of service, packet priority, bandwidth, traffic shaping, and the like, can also be affected by a service profile. The service profile can be influenced by user and remote device profile information, or service provider information. For example, a user may be willing to pay a premium for improved levels of service through adjustment of the service profile, selected remote devices or remote devices associated with selected service providers can be automatically given improved levels of service through adjustment of the service profile, or a combination of such factors can influence adjustment of the service profile. In some embodiments, service levels as specified by a service profile can also be dependent on other factors, such as remote device, remote device type, location, application, and/or the like.
- As another example, a service profile influencing access to predetermined functions or applications can be determined according to marketing and sales strategies. For example, access can be linked to a purchase at a hotspot providing network access services. Such an offering could be free access to one or more applications when a coffee is purchased using a stored-value card. As another example, a frequent user at a hotspot could be given a preferred pricing rate, extended time allowances or enhanced access to applications based on previous history of purchases at the hotspot or selected affiliates. Influencing service profiles, for example by a service provider or hotspot location, can be performed on a permanent or trial basis, for example for market or technical research purposes.
- It will be appreciated that various service packages providing access to one or more VBAs may be contemplated in the present context without departing from the general scope and nature of the present disclosure, as can various examples, types and configurations of VBAs be combined or provided exclusively in the context of a predefined or custom service package. Furthermore, as will be described in greater detail below, various upsell mechanisms and opportunities may be provided within the present context to provide a user access to additional services, either as a supplement to an existing subscription package, a one-time trial or limited subscription, or the like, for example. Service profiles, service provider partnerships, and the like can be combined to offer access to services such as communication resources, internet, email or social applications, based on one or more factors such as location, time of day, remote device type, remote device service provider, hotspot service provider, and the like.
- With reference to
FIG. 1 , thesystem 10 may be implemented over various different types and combinations ofnetworks 104 providing for the communicative interfacing of a givenremote device 102,network access module 106 andservice access module 112. For example,network 104 may comprise a combination of networks conducive to provide a user access to a diversity ofservices 114. For example, network access may be provided to Sling Media™, which allows a user to connect to their home Slingbox™ device from a remote location; Sony™ Location Free TV, which allows a user to connect to their home Location-Free TV (LFTV) from a remote location; and/or Orb Networks™, which allows a user to connect to their home Orb™ server and retrieve content from their home server from a remote location. Access to other Internet, Web-enabled and/or network services may also be contemplated, including, but not limited to email and messaging services, media access services, gaming services, business collaboration software, social applications, and the like. - In one embodiment, the
system 10 comprises a single-cell hotspot wireless network, generally comprising a local area network (LAN) or the like limited to a relatively small spatial area such as a room, a single building, a ship, or an aircraft, otherwise commonly referred to as a single location network. - In another embodiment, the
system 10 comprises a wide area network, such as, but not limited to a muni-Wi-Fi network or the like, and is implemented using one or more of a variety of technologies such as a strand-mounted network, a mesh network, and the like. A wide area network could comprise, for example, a metropolitan area network (MAN) that connects two or more LANs together but typically does not extend beyond the boundaries of the immediate town, city, or metropolitan area. Multiple routers, switches, and/or hubs can be connected to create a MAN usable in the present context. - In another embodiment, the
system 10 comprises a wide area network (WAN), such as, but not limited to a WiMAX Network or the like. A WAN could comprise, for example, a data communications network that covers a relatively broad geographic area using transmission facilities provided by common carriers, such as telephone companies, internet companies, and other such communication service providers. - It will be understood by the person skilled in the art that various other types and combinations of networks, either currently implemented or developed in the future to facilitate communications over diverse geographical areas, may be considered herein without departing from the general scope and nature of the present disclosure.
- With reference to
FIG. 1 , and in accordance with some embodiments of the invention, aremote device 102, such as a wireless remote device, is a device having the ability to communicate with other devices without having physical contact with them. A remote device can be an electronic device operable as a wireless interface between a user or another electronic device and a network or wireless access point, such as provided at a hotspot or within a wireless network coverage area. A remote device may include, but is not limited to, laptops, Personal Digital Assistants (PDA), Smart phones (e.g. Apple™ iPhone™, HTC S261, RIM Blackberry™ BOLD, etc.), wireless gaming devices such as the Nintendo DS™, the Sony PSP™, the Sony Mylo™, Wi-Fi Cameras, portable entertainment devices (e.g. Apple™ iPod™, iPod™ Touch) and other such devices currently available on the market, in development, or upcoming and based on similar communication platforms and technologies. A remote device may incorporate several functionalities such as those listed above. A remote device can be capable of communicating using one or more different communication modes, such as a combination Wi-Fi and/or cellular device. The person skilled in the art will appreciate that thesystem 10, as disclosed herein, is readily adaptable to new and upcoming devices, and as such, is considered to include such devices within the context of the present disclosure. - With reference to
FIG. 2A , and in accordance with some embodiments of the invention, aremote device 102 is depicted. In this embodiment, theremote device 102 generally comprises a computer-readable medium ormedia 208 for storing statements and instructions for the operation of the remote device, and optionally for storing various forms of data useful in the implementation of remote device functions and/or accessible to the user of the remote device as needed; a communication means such as a communication device and/orinterface 202 for interfacing with thenetwork access module 106 and optionally, for direct communication with other similarly configured remote devices; one ormore processors 206 for processing received and sent information and for implementing statements and instructions stored on the one or more computer-readable media 208; and a user interface (UI) 204, such as a graphical user interface (GUI), keyboard, keypad, game pad, mouse, scroll ball, touch screens, motion sensing user interface, speech recognition system, or the like for receiving input from the user directed to the operation of theremote device 102. Other remote device elements and/or components, as would be readily apparent to the person skilled in the art, may also be considered herein without departing from the general scope and nature of the present disclosure. For instance, various hardware, firmware and/or software may be integrated or operationally associated with a givenremote device 102 to achieve various functions and interface with the user and/or various services accessed thereby over thenetwork 104. Also, various peripheral devices, such as supplemental user interfaces, data input and/or output means (e.g. printers, scanners, removable storage media, etc.), and the like may also be considered herein. - In one embodiment, the
remote devices 102 may include browser-based remote devices, wherein such remote devices comprise a browser-baseduser interface 204, such as a Web browser or the like. Examples of browser-based remote devices may include, but are not limited to laptops, PDAs, and the like. - In another embodiment, the
remote devices 102 may include browser-challenged remote devices, wherein such remote devices comprise a browser-challengeduser interface 204, such as for example, a microbrowser or the like, and/or comprise a substandard keypad (i.e. non-QWERTY keypad). In one example, a microbrowser is defined as a Web browser specially designed for a hand-held remote device and embedded within the software and/or firmware of this remote device. In this example, the microbrowser is generally optimized so as to display Internet content most effectively for small screens on portable remote devices and have small file sizes to accommodate the low memory capacity and low-bandwidth of such handheld remote devices. Examples of browser-challenged remote devices may include, but are not limited to, a Sony™ PSP™, a Smartphone (e.g. Apple™ iPhone™, HTC S261, etc.), a Blackberry™, and the like. Content providers may, in some instances, be configured to provide pre-formatted content specifically for some or all browser challenged remote devices. - In another embodiment, the
remote devices 102 may include browserless remote devices, wherein such remote devices comprise abrowserless user interface 204, for instance comprising a display and the ability to accept user inputs (e.g. keypad(s), scroll ball(s), etc.) but not encompassing the functionality common to browsers and microbrowsers. Examples of browserless remote devices may include, but are not limited to, a Nintendo DS™, a Wi-Fi camera, and the like. - The person of ordinary skill in the art will appreciate that other browser-based, browser-challenged and browserless remote devices may be considered herein without departing from the general scope and nature of the present disclosure. This person will further appreciate that, although the above examples have been described with reference to three distinct categories, other categories may also be contemplated based on each remote device's functionality, operability and user interface characteristics. Furthermore, it will be understood that certain remote devices may be best described as falling between any of the above categories, and that such remote devices are considered within the context of the disclosed
system 10. - With reference to
FIGS. 1 and 2C , and in accordance with some embodiments of the invention, thenetwork access module 106 of thesystem 10 comprises a wireless access point (WAP) 108 and agateway 110. In this embodiment, theWAP 108 comprises a device configured to connect different wireless communication devices together to form a wireless network, and further connect to one or more wired or wireless networks (e.g. network 104), namely viagateway 110, to relay data between remote device(s) 102 and downstream wired and/or wireless devices. - In one embodiment of the invention, the
WAP 108 reacts substantially immediately when aremote device 102 scans for an available network. TheWAP 108 reacts to the remote device scan by communicating to theremote device 102 that there is an available network connection through thenetwork access module 106. - The
gateway 110 can be used to communicate between a remote network and another network, which, in the present context, may provide access to theservice access module 112. In this embodiment, thegateway 110 comprises a device configured to communicate between two or more networks which may, for example, use different network protocols (e.g. wireless network protocols, wired network protocols, etc.). Examples ofgateways 110 operable within the context ofsystem 10 may include, but are not limited to, Colubris Controllers (e.g. MSC-3200), Cisco™ WLAN Controllers (e.g.Cisco™ 2000, 4100 WLAN Access Controller), and Mikrotik™ RouterOS, to name a few. - In one embodiment of the invention in which a browser-based or browser challenged remote device is being used to access a network, the
gateway 110 may intercept the request to access thenetwork 104 and redirect the request back to theremote device 102 through a web browser for the user to input user information. The information requested can be for example, but not limited to, a username and password. The user information can be associated with a user profile for identification, authentication and authorization. Specific remote device information may also be extracted by the Service Access Module 112 (described below) from data communicated through thegateway 110 for the purposes of identifying and/or authenticating the remote device being used to access the network. Such remote device information may include, but is not limited to, the Media Access Control (MAC) address of theremote device 102, traffic type (e.g. communication port, data type, communication protocol, traffic headers, etc.), browser type (e.g. full browser, microbrowser, browser origin and/or configuration, etc.), and/or some other unique identifier (e.g. remote device configuration, serial number, signature related to a remote device clock or crystal oscillator, etc.). This and related remote device information can be associated with a remote device profile for identification, authentication and authorization. Thegateway 110 receives the user and/or remote device information through theaccess point 108 and communicates the identifying information to theservice access module 112 for authentication and authorization. Once authorized, network access is implemented, either as wide open access, or as restricted access based on a number of access authorization criteria, which may depend on the remote device type, the remote device configuration, the specific remote device, the specific user, and/or other criteria, or combinations thereof. - In one embodiment, the remote device profile and the user profile can be configured to indicate that network access is to be implemented without further interaction from the user, such as entering a user name and password. Authorization substantially without user interaction, for example based on user profile information and remote device profile information which is automatically transmitted by the remote device, is referred to herein as Express Authentication. In one embodiment, Express Authentication can further include expedited user interaction, for example, by requiring only a “one-click” or “one-action” connection confirmation from the user or requiring only a password or other convenient user data, such as biometric data, to connect.
- In some embodiments, information used for authentication can include user provided information, remote device or remote device type information, and/or other information such as one or more of: user credit card information, prepaid service card information or PIN, user or remote device subscription information, access information or access history, prepaid or stored value card or smart card information for a hotspot or associated product or service provider, PIN distributed for promotional purposes, location information, usage time, date or time of day information, or other information as would be understood by a worker skilled in the art.
- In some embodiments, authentication can be performed using information readily accessible. Additionally, if the information initially available for authentication is insufficient for making an authentication decision with a predetermined level of certainty, additional information can be obtained. For example, authentication can be initially based on device information transmitted during an initial connection request, with an option to request a user name and/or password if said transmitted device information cannot be used to uniquely identify the remote device. As another example, information resulting from a transaction related to the remote device can be used to support authentication. For example, if a user pays for a service or associated product or service with a prepaid or stored value card such as a smart card at the hot spot, information resulting from the transaction can be used to support authentication. This may require correlating said transaction with the remote device, for example by entering a PIN on the remote device that is printed on the transaction receipt. As another example, contextual information such as time of day or location information can be used to support authentication. For example, usage time and location patterns of a remote device can be tracked, and if a remote device requests an atypical service or requests service in an atypical location, time of day information may be used to determine whether it is more likely that the user's information or remote device has been stolen or whether the user or remote device is associated with an atypical purpose for that user (such as vacation or leisure time instead of work time).
- In some embodiments, user and remote device profiles are managed, for example by a security management module and/or access management module, to reduce or deal with potential fraud, remote device theft, password theft, or other misuse, and to improve user experience and access control. For example, information or suspicious activity can be logged, tracked and reported to assist in managing fraud, theft or other misuse. Security management can include automated or semi-automated management, or management by one or more service providers on behalf of the service providers themselves, other service providers, or users. Management can include applications or services enabling tracking and analysis of remote device or user activity, management of services, service contracts, manual or automated payment options, and the like.
- In some embodiments, security is managed by one or more of requiring users to provide username and/or password information; restricting access parameters such as session time limits, concurrent usage by the same user, geographic location, and/or the like; and other methods such as Express Authentication, Advanced Device Profiling, multi-factor authentication, authentication using an SMS messaging system, and fraud detection, or other methods as would be understood by a worker skilled in the art.
- In some embodiments of the invention in which a browserless remote device is used to access a network, the
gateway 110 detects the remote device request for network access and forwards it to the service access module 112 (described below) where remote device information may be extracted from remote device communications, as described above. In general, thegateway 110 receives the user and remote device information through theaccess point 108 and communicates this information to theservice access module 112 for authentication and authorization. Once authorized, network access is implemented, either as wide open access, or as restricted access based on a number of access authorization criteria. Said network access can be implemented based on the application of authentication constraints. In addition, depending on remote device and/or user registration settings, an optional request for user information and/or confirmation may be communicated to a distinct remote device of the registered user for confirmation. For example, a confirmation message could be sent to a user's cellular phone, or other such device, via a Short Message Service (SMS), wherein the user may then confirm via this distinct device that they are in fact attempting to access the system via their browserless remote device. In this scenario, this would allow a user to identify an event where access to the system is being erroneously and/or fraudulently attempted using their remote device and/or remote device identity. It is contemplated that other multi-factor or strong authentication systems can be implemented in conjunction with some embodiments. For example RSA™ SecurID™, Phonefactor™ or similar services can be implemented during authentication. For example, location of a customer's cellular phone may be determined by cell tower association or GPS to determine the likelihood that the customer is indeed at the location where authentication is being requested. In addition, if authentication fails, the system can be configured to give the appearance that authentication has succeeded for the purposes of tracking or apprehending potentially fraudulent use. - In one embodiment, the
gateway 110 may be configured to forward remote device communications to theservice access module 112 where identifying data may be extracted from remote device transmissions only, wherein such identifying data may comprise remote device type information, specific remote device information, remote device configuration information and the like. Using remote device identification data only to connect can be described as a form of Express Authentication. Using remote device identification data only enables thesystem 10 to authorize different remote devices access to wide open services or a selection thereof based only on remote device data, and not on inputted user data. This feature may be particularly useful in an example wherein a browserless remote device seeks access to the network but wherein such browserless remote device does not include functionality of a conventional type-in user interface allowing for the input of a username and password, for example. This feature is also applicable to browser-enabled or browser-challenged remote devices, to provide more user-friendly and faster connection to network applications. In another embodiment, Express Authentication can also include automatically transmitted user information, either automatically requested of and provided by the user during authentication or stored on the remote device, or a combination thereof. For example, user information can include information stored on a cookie, or input by the user via interface with the remote device. - It will be appreciated by a person skilled in the art that the functions implemented by the network access module may be provided by a combination of a
WAP 108 andgateway 110, or applied using other device architectures, known or developed, to provide such functionality. Furthermore, though the above examples contemplate forwarding remote device communications to theservice access module 112 for identifying data extraction, it will be appreciated that the network access module may also be configured and adapted to extract such information from remote device communications and forward this information to the service access module, or to other modules of the system for manipulation, without departing from the general scope and nature of the present disclosure. - With reference to
FIGS. 1 and 2B , and in accordance with some embodiments of the invention, thesystem 10 comprises one or more service access module(s) 112 configured to communicate with the network access module(s) 106 to operatively identify, authenticate and authorize one or moreremote devices 102 access to one ormore services 114. - In the example illustrated in
FIG. 2B , theservice access module 112 generally comprises a computer-readable medium ormedia 218 for storing statements and instructions for the operation of themodule 112, and for storing various forms of data useful in the implementation of module functions and management of theservice access module 112; a communication means such as a communication device and/orinterface 212 for interfacing with thenetwork access module 106 through thenetwork 104 and optionally, for direct communication with providers of the one ormore services 114; one ormore processors 216 for processing received and sent information and for implementing statements and instructions stored on the one or more computer-readable media 218; and anoptional management interface 214, such as a graphical user interface (GUI), keyboard, keypad, mouse, scroll ball or the like for receiving input from a system manager directed to the management of theservice access module 112. - It will be appreciated that other service access module elements and/or components, as would be readily apparent to the person skilled in the art, may also be considered herein without departing from the general scope and nature of the present disclosure. For instance, various hardware, firmware and/or software may be integrated or operationally associated with the
service access module 112 to achieve various functions and interface with the remote device(s) 102, thenetwork access module 106 and/orvarious services 114 accessed thereby over thenetwork 104. Also, various peripheral devices, such as supplemental user interfaces, data input and/or output means (e.g. printers, scanners, removable storage media, etc.), and the like may also be considered herein. It will be further appreciated that theservice access module 112 may be implemented centrally, in a distributed architecture, or in a combination thereof to achieve a desired functionality and level of complexity. - In the embodiment depicted in
FIG. 2B , the computerreadable medium 218 of theservice access module 112 comprises anaccess management module 220 and aknowledge base 210, wherein the latter can be defined as a structured collection of records or data that is stored on the computerreadable media 218. As will be described below, when a user attempts to register for an account, the network access module 106 (e.g. thegateway 110 ofFIG. 2C ) accesses information from the user and/or the user'sremote device 102 and sends it overnetwork 104, where it can be stored by theservice access module 112, for example in aknowledge base 210. Information retrieved and stored may include such information as, but not limited to, user name, user password, account number, number of remote devices, remote device types, MAC Addresses, browser information, remote device configuration, service packages and/or user, remote device and service profiles, and the like. The database may also contain information regarding the hotspot access point (e.g. the specificnetwork access module 106 implemented), for example, but not limited to, the hotspot access configuration and location information. - In some embodiments of the invention, remote device information such as remote device types, MAC Addresses, browser information, remote device configuration, clock or crystal oscillator information, serial numbers, and the like, is used to create an Advanced Device Profile (ADP) for authentication purposes. The ADP can be used to identify, track, manage, and report on remote devices by remote device type, remote device model, or specific instance of a remote device. In some embodiments, for registered remote device, remote device type, or remote device class, a copy of the advanced remote device profile can be stored for access by the service access module, for comparison with characteristics of remote devices attempting to connect to services through the network access module for identification, authentication and authorization purposes. User or remote device access can be configured based on the ADP to allow access to be tailored toward the remote device, or to package access privileges with ownership of selected remote devices or subscription to selected service providers, for example. The ADP can also be used to enable Express Authentication, wherein user and/or remote device authentication can proceed with reduced or no input from the user.
- In some embodiments, remote device information, for example as can be used to create or verify against an ADP, is captured during negotiation of a connection between the remote device and the network access module. For example, in one embodiment, a remote device may send a request to initiate a wireless connection with the network access module through an application such as a web browser. Depending on the remote device or remote device type, the request can contain different information, or be configured in different ways as would be understood by a worker skilled in the art. For example, a connection request can include specifically configured fields in HTTP headers, configurations of portions of a query string in a URL, MAC address, or other configurable aspects of the connection request as would be understood by a worker skilled in the art. This configuration information can be indicative of the remote device or remote device type, since connection requests by different remote devices or device types can be configured differently. For example, different types of connections can be requested in different ways by different remote devices such as laptops, PDAs, gaming devices, or the like. The information related to the connection request can be forwarded by the network access module to the service access module, the service access module configured to extract and analyze the information to obtain further information about the remote device or remote device type, for example by comparing the configuration of connection request information against one or more ADPs which relate predetermined profiles or configurations of information to one or more remote devices or remote device types typically having said profile. The further information obtained from this analysis can subsequently be used for authorization or authentication purposes.
- Furthermore, as an alternative to or in addition to configuration information obtained during the initial request as described above, information about the remote device can be obtained by running a script or query on the remote device. For example, in response to a connection request by the remote device, the service access module can transmit a script to the remote device (via the network access module), or remotely trigger execution of a script already on the remote device. The script can be configured to extract and communicate identifying data to the service access module (again via the network access module). For example, a script could obtain and transmit configuration information about the web browser application, application version, host operating system, host hardware platform, language, screen size, and the like. This configuration information can be stored and accessed in ways known to a worker skilled in the art and can be indicative of the remote device or remote device type, since different remote devices can be configured differently. For example, different remote devices such as laptops, PDAs, gaming devices, or the like are typically configured differently with different hardware and software. In addition, some configuration information may not exist on some remote devices, resulting in an error when such configuration information is searched for. These errors can also be indicative of the remote device or remote device type, since it can be used to explicitly eliminate possible remote device configurations which would not typically have resulted in such errors. The information obtained and communicated by the query or script can be analyzed by the service access module to obtain information about the remote device or remote device type, optionally in conjunction with other information, for example by comparing the information against one or more ADPs which relate predetermined profiles or configurations of information to one or more remote devices or remote device types typically having said profile. The information obtained from this analysis can subsequently be used for authorization or authentication purposes.
-
FIG. 12 illustrates an example of extracting information from a remote device according to an embodiment of the invention. Instep 1210, a network connection is requested, for example in response to a user opening a browser on the remote device. The system can respond, instep 1220, by forwarding the connection request from the network access module to the service access module, where information related to the connection request can be extracted as described above. The network access module and service access module can also respond concurrently in other ways, for example by redirecting a browser to an intercept page, and executing processes related to said intercept page to obtain user information. Instep 1230, a response to the network connection request is sent from the service access module to the remote device via the network access module. A script, such as a javascript or mobile software agent, or trigger for a script existing on the remote device, is sent with the response. Instep 1240, the script executes on the remote device to extract information about the remote device as described above. Information obtained by the script is transmitted back to the service access module via the network access module. Information extracted from the connection request and information transmitted by the script can then be used for authentication or authorization, for example by comparing said information to one or more ADPs to identify the remote device or remote device type, and to authenticate or authorize said remote device or remote device type accordingly. - In one embodiment, Express Authentication can be implemented, wherein user input is substantially reduced or eliminated during the identification, authentication and authorization process. In one embodiment, Express Authentication includes automatic profiling and authentication and certification of remote devices, for example by uniquely identifying a remote device based on matching selected remote device information to information stored in a knowledge base, the information being associated with a unique remote device described in the knowledge base, or by detecting mismatches between selected remote device information and information stored in a knowledge base, in order to deny authentication of a remote device. For example, if substantially all of the remote device information reported by a remote device matches a predetermined selection of remote device information stored in a remote device profile stored in the knowledge base and associated with a valid or authorized user profile stored thereon, Express Authentication can be allowed. As another example, if one or more predetermined portions of the remote device information reported by a remote device do not match corresponding remote device information stored in a remote device profile stored in the knowledge base and associated with an authorized user profile, Express Authentication can be denied.
- In some embodiments of the invention, the number and type of attributes of remote device information checked against the database can vary randomly or deterministically, and in conjunction with previous history of authentication attempts, to provide efficient and convenient service while maintaining security and integrity of the authentication and authorization procedures. For example, additional authentication challenges, including multi-factor authentication challenges, can be issued or more detailed remote device information attribute analysis can be performed at random, with probability escalating with the perceived risk of fraudulent or unauthorized remote device usage. In some embodiments, Express Authentication can be satisfied by the same user or remote device in different manners, potentially resulting in different access to services.
- In some embodiments of the invention, the
knowledge base 210 is a relational database. A relational database refers to a type of database wherein a table stored in the database comprises rows and columns that are populated with information retrieved from the network access module 106 (e.g. access point 108 and gateway 110). In a relational database, there are one or more tables containing stored information, which may be interrelated through one or more qualified connecting values so that information can be shared between tables. -
FIG. 11 provides an exemplary screen shot of such a database, namely a Microsoft Access™ database comprising sample hotspot, account, and remote device information stored in separate tables with a relationship connection to the other tables in the database. This illustration is meant to provide an example of sample information that could be stored in a database in the context of the present disclosure, wherein various types of information could be retrieved and stored. It will be apparent to the person of skill in the art that other types of database systems and structures, such as Microsoft SQL Servers or the like, could be considered herein without departing from the general scope and nature of the present disclosure. - In some embodiments, remote device information is stored in the
knowledge base 210 in the form of a remote device profile, generally comprising an account variable that refers to characteristics of a remote device that allows for recognition and identification of a specific remote device, which may include, but is not limited to, known requirements of that remote device for connecting to the Internet, for example. In one or more embodiments, remote device information is collected when a user attempts to access the network via a givennetwork access module 106, or when a user registers for a remote device account, as described below, and is stored in theknowledge base 210 for use in the authentication of the user and/or remote device when accessing thesystem 10.FIG. 11 provides an example of aremote device profile 1106, in accordance with an illustrative embodiment of the invention. - In some embodiments, user information is stored in the
knowledge base 210 in the form of a user profile, generally comprising an account variable that refers to information about the user retrieved from the user, including for example, but not limited to, the user's name, a created username and password, contact information, user type, preferred payment method and/or means, and the like. In one embodiment, user information is collected when a user attempts to access the network via a givennetwork access module 106, or when a user registers for an account, as described below, and is stored in a database for use in the authentication of the user and/or remote device when accessing thesystem 10.FIG. 11 provides an example of a user profile 1104, in accordance with an illustrative embodiment of the invention. - In some embodiments, a service profile is stored in the
knowledge base 210, generally comprising an account variable created by a combination of one or more of a remote device profile, a user profile, an account type, and associated devices. In one example, service profiles are generally defined as subscription packages that enable subscribed users access to certain network-based functions and services, such as, but not limited to, Live TV™ from a home location or online gaming packages, as further elaborated and described above. During a registration process, defined in greater detail below, a user may be given options of services available for each type of remote device functionality. The service options can be used to limit a user's access to the Internet and/or other networks once the user chooses an option, or to expressly define, disable or enable certain access parameters, for example in accordance with aspects of relevant service profiles. Consequently, the user can then pay a predetermined price for the services selected, or have access to predetermined capabilities for free in conjunction with predetermined purchases. In one embodiment, a user can choose different packages for different registered remote devices, or may select one package that allows access to all the networks with any remote device registered. - In some embodiments, a service profile is associated with a group of authorization constraints, authorization whitelist attributes, or a combination thereof. The authorization constraints can specifically deny or block predetermined services or aspects thereof, while authorization whitelist attributes can specifically allow or enable predetermined services or aspects thereof.
- In some embodiments, access to selected functions and services may be extended to all users of a given remote device type, or to all users of a given group or adhering to a same promotional package or the like, without registration and/or subscription by the user. For example, all users or remote devices falling within a given category could be entitled to access one or more selected functions and/or services attributed to this category without prior subscription or registration by these users.
- In one example, a service profile is defined for a user of a laptop, a Sony PSP™, and a Windows Mobile™ PDA, who also occasionally uses a second laptop, e.g. borrowed from the user's work or elsewhere. The user of the present example could also have a Location Free TV (LFTV) at home, as well as Orb™ on a desktop system. Accordingly, the user would be able to use any of these remote devices on a supported network although there may be restrictions on concurrent usage, for example, wherein only one of each type of remote device can be connected at any time per account. By registering all the above remote devices and selecting an appropriate service package, the user can be able to access LFTV on his laptop and PSP™, or using the Orb™ device, access files from the user's home computer on his laptop, etc. while at a hotspot access location.
- Furthermore, in some embodiments, an upsell feature may also be provided such that a user of a given remote device is provided the option to upgrade their current service package to include additional and/or upgraded services. For example, various upsell mechanisms and opportunities may be provided within the present context to provide a user access to additional services, either as a supplement to an existing subscription package, as a one-time trial or limited subscription, and the like. Such upsell mechanisms may be configured to market new or supplemental services at various instances during use, for example upon access to the system, periodically during use, etc., or again provide such opportunity in response to specific user actions.
- For instance, in some embodiments, when a user of a given remote device having restrictive access to the system attempts to access a resource not currently permitted by the user's current service profile, for example as defined by a service profile applied to the user or the user's remote device, this traffic may be redirected to an interactive interface providing the user the option of upgrading or enhancing their service profile, for example, for an additional fee. For example, when a user or remote device registered only for gaming services attempts to surf the Web, an intercept page may be accessed instead proving the user of this remote device the option to upgrade their service profile to enable access to Web surfing functions. Other such examples should be apparent to the person skilled in the art and are thus not meant to depart from the general scope and nature of the present disclosure.
- In some embodiments of the invention, the service access module includes a Service Authentication and Authorization Manager (SAAM), which can be configured to securely provision and manage users and remote devices on networks such as Wi-Fi networks. The SAAM can be configured to authenticate and authorize users, remote devices, or combinations thereof, based on user profiles, remote device profiles, and service profiles stored in a knowledge base accessible to the SAAM. The SAAM can further be configured to authenticate and authorize users, remote devices, or combinations thereof based on service provider information, such as promotional use information, location information, time information, or other information as would be understood by a worker skilled in the art.
- As an example, authentication can be based on information obtained through use of a stored value card for product or service purchases, by associating user information related to the stored value card with user profile information for authentication. For example, user information related to the stored value card can be acquired from a third party managing the stored value card. User information related to the stored value card can include cash balance information and information on history of card use, such as date and location of previous uses.
- In some embodiments, the SAAM can be configured to enable Express Authentication, wherein user input is substantially reduced or eliminated during the identification, authentication and authorization process. For example, Express Authentication can enable instant or one-click secure authentication based on stored and automatically transmitted user and remote device profile data. In this embodiment, the SAAM can be configured to collect, authorize, and authenticate a user and/or remote device based on the automatically transmitted data.
- In some embodiments, the SAAM is configured to collect identification data, for example automatically transmitted user and remote device profile data, without requiring a client application to be installed or configured on the remote device being identified, authenticated, and authorized. In one embodiment, instead of requiring a specialized application operating on the remote device, identification data can be collected on the basis of availability. For example, hardware information, system settings, and information embedded in applications such as Windows™ Update, iTunes™, the YouTube™ application for iPod™, or other applications residing on the remote device can all be sources of remote device information for providing to the SAAM or other authentication or authorization module. As another example, information can be extracted from standard communications with the remote device, or requested through a web browser, SMS service or other native application, or supplied using a second device carried by the user.
- In some embodiments, remote device and/or user information is not automatically transmitted from the remote device, but is transmitted in response to a request or query. For example, a program, software agent, or mobile software agent such as a Java aglet can be transmitted to and/or initiated on the remote device during identification, which, during execution, gathers and transmits user and/or remote device information to the network access module, service access module, or SAAM. For example, a javascript application can be used to gather and transmit remote device information in this manner.
- Service profile parameters can be dependent on other factors such as date, time of day, remote device type or remote device class, location, hotspot or business operators or venues, service profiles, simultaneous usage of remote devices by a user, session idle time or timeouts, time from expiration of prepaid or introductory service, customer loyalty, payment history, and other factors that would be understood by a worker skilled in the art. For example, frequent or preferred customers, or customers who are the focus of a marketing campaign or promotional partnership agreement, may be given temporarily enhanced service for business purposes. For example, a service profile may be created or updated to include additional services for promotional purposes for remote devices associated with particular service providers, when users of the remote device purchase a product (such as a coffee) in particular hotspot locations. The service profile may indicate for example that selected services can only be used on the day of purchase at the particular hotspot location where the purchase was made, and then only until expiry of a predetermined time period.
- It will be apparent that a variety of service packages and upsell mechanisms and strategies may be considered herein without departing from the general scope and nature of the present disclosure. As any user may use anywhere from one to plural remote devices, and that, of one or more different types of remote devices, the combinations of services, remote device type service access requirements and adaptable service restrictions for each or all combination of remote devices can be implemented using the disclosed
system 10 and operational embodiments thereof. - Access to the features and services considered for in the implementation of the
system 10 is generally provided via the identification, authentication and authorization of a user and/or remote device based on identifying data accessed by theservice access module 112 vianetwork access module 106. - In general, a user may access the
system 10 once the user, or a remote device used thereby, is registered to access the system. In one embodiment, a user may register themselves, or one or more remote devices that they intend to use with thesystem 10, via a pre-registration process implemented online, in person, over the phone, or in another manner wherein information relating to the user and/or one or more remote devices are provided to a system administrator enabling registration of such identifying information for future use in an authentication and authorization process. In some embodiments, registration may be performed upon first access, or attempted access to thesystem 10 by a user, or by a remote device thereof. Other registration strategies, or combinations of pre-registrations, registration confirmations, direct registrations and/or updated (e.g. service upgrade or downgrade) registrations should be apparent to the person skilled in the art and as such, are not considered to depart from the general scope and nature of the present disclosure. - In some embodiments of the invention in which a browser-based or browser challenged remote device is being used to access a network, the
network access module 106, orgateway 110 thereof in the embodiment ofFIG. 2C , may intercept the request to access thenetwork 104 and redirect the request back to theremote device 102 through a web browser for the user to input user information. The information requested can be for example, but not limited to, a username and password. Thegateway 110 may also forward the request and subsequent communications, if any, to theservice access module 112, where specific remote device information may be extracted from such communications for the purposes of identifying the remote device being used to access thenetwork 104. Such remote device information, for example forming part of the remote device profile, may include, but is not limited to, the Media Access Control (MAC) address of theremote device 102, traffic type (e.g. communication port, data type, communication protocol, traffic headers, etc.), browser type (e.g. full browser, microbrowser, browser origin and/or configuration, etc.), and/or some other unique identifier (e.g. remote device configuration, serial number, signature related to a remote device clock or crystal oscillator, etc.). Thegateway 110 forwards the user and/or remote device identifying information (user profile, remote device profile) from theaccess point 108 to theservice access module 112, for example, from where it can be authenticated, for example via a Remote Authentication Dial In User Service (RADIUS) protocol or other public and/or proprietary protocols, to determine whether the user andremote device 102 are registered to access the network. - In some embodiments of the invention in which a browserless remote device is used to access a network, the
gateway 110 detects the remote device request for network access, requests user information to be input via a Short Message Service (SMS), and optionally forwards the request and/or subsequent communications, if any, to theservice access module 112 where specific remote device information may be extracted from such communications for the purposes of identifying the remote device being used to access thenetwork 104. Identifying information is then used by theservice access module 112 for authentication to determine whether the user andremote device 102 are registered to access the network. - In some embodiments of the invention in which a browser-based, browser-challenged or browserless remote device is used to access the network, the
gateway 110 detects the remote device request for network access and forwards the request and/or subsequent communications, if any, to theservice access module 112 where specific remote device information may be extracted from such communications for the purposes of identifying the remote device being used to access thenetwork 104. The identifying information is then used by theservice access module 112 for authentication to determine whether theremote device 102 is registered to access the network. - It will be appreciated that remote device identifying data may be extracted by one or more components of the
system 10, namely thenetwork access module 106, theservice access module 112, and/or any component thereof, with proper software, firmware and/or hardware configurations, without departing from the general scope and nature of the present disclosure. - In one embodiment of the invention, registration to access the
system 10 comprise two components: user registration and remote device registration. User registration can occur during the same session as the remote device registration, user registration can occur independently of remote device registration, either outside the hotspot network through a registration website, or while accessing the hotspot network. - In one embodiment, registration of a user can result in creation of a user profile stored in a knowledge base, whereas registration of a remote device can result in creation of a remote device profile stored in a knowledge base. Registration of either a user or a remote device can also result in creation of a service profile stored in a knowledge base. User, remote device and service profiles within the knowledge base are preferably linked for retrieval and association of information contained therein.
- With reference to
FIG. 3 , and in accordance with some embodiments of the invention, when a user registers outside the hotspot network as determined atstep 302, registration occurs through a web browser interface. A user enters the website to register for an account. As the user enters the website, information about the remote device being used is stored atstep 322. The website is programmed to reformat the page depending on the type of remote device used and the type of browser available atstep 323. For example, but not as a limitation to the type of remote device that can be used, a laptop can use a full browser, whereas a PSP uses a microbrowser. The user selects whether to login or create a new account atstep 324, depending on whether the user has previously set up an account. If the user has not previously created an account, the user selects the option to create a new account, and the browser is redirected to the new account homepage atstep 330, which displays the service options, prices, and procedures available to the user. The user enters information into a form on the website and the website sends the information to be stored in a database atsteps 332 to 342. The user enters contact information and selects the services to which access is desired atsteps steps 338 to 342. Once the account creation is complete, the browser is redirected to the user homepage atstep 318, where the user's service summary is displayed, their account verification is requested, and the user can select to register more remote devices, or choose to upgrade their services and select payment options. The user has the option to logout or connect to the network atstep 320, however, since the user is not at a hotspot access point, the user generally chooses to logout. - In some embodiments of the invention, when a user registers while accessing the hotspot network, determined at
step 302, through a browser-based or browser-challengedremote device 102, thenetwork access module 106, oraccess point 108 thereof, (FIG. 2C ) recognizes that theremote device 102 is scanning for a network connection, theaccess point 108 redirects all unauthenticated remote devices to an intercept page for authentication. An intercept page is a webpage that receives user login input. While the user attempts to access the network by logging in using the intercept page, thenetwork access module 106, or thegateway 110 thereof (FIG. 2C ) stores information from the user and the remote device being used, for example, but not limited to, user name, password, MAC address, browser type, cookie information, etc. atstep 304. - In some embodiments of the invention, when a user registers while accessing the hotspot network through a browserless
remote device 102, there is provided an SNMP Trap, such as but not limited to the KIWI SNMP Trap, that allows the browserless remote device user to register. The SNMP protocol is used by network management systems to monitor network-attached remote devices for conditions that warrant administrative attention. Thegateway 110 detects what type of remote device is being used through key unique attributes of the remote device, for example, MAC address (including manufacturer prefix), host IP address, and other properties that can be obtained remotely through special features in thenetwork access module 106, atstep 306. For example, UTStarcom™ smartphones generally include HTTP headers such as “UA-pixels: 240.times.0.320” or “x-wap-profile:http://www.htcmms.com.tw/gen/apache-2.0.xml”. - Depending on what type of remote device is detected and/or what type of browser is being used, as explained above, the website will automatically reformat to suit the type of remote device and/or browser being used, at
step 308. If the user has already registered for an account, and has registered that particular remote device as well, thesystem 10 will recognize the user and remote device and proceed to a login session atstep 310. If the user has previously programmed his account to automatically login (for example in accordance with portions of Express Authentication), the browser automatically proceeds to the user's home page atstep 312, which displays the user's remote device registration, service summary, andaccount verification 318. The user can choose to connect to the available services or logout of the system atstep 320. - If, however, the user has not registered for an account, or has not previously registered that particular remote device, the browser proceeds to the login or register new account option at
step 324. If the user has previously registered for an account but has not registered the particular remote device being used, the user chooses to login atstep 324, and proceeds to allow the remote device information to be extracted and stored in a database atstep 326. The user can choose to save the remote device details to their account, and access the network using that remote device, or the user can choose not to save the remote device, and is sent directly back to the user home page atsteps steps 330 to 342, providing the browserless remote device supports such functionality. Otherwise, access is not provided and registration is required via external means, such as described above. - Depending on the service and remote device in use, the user may be required to register themselves and a specific
remote device 102 in order to purchase a connection and/or receive full benefit of the service. The difference is based mainly on whether the remote device to be registered is browser-based, browser challenged, or browserless. - Remote device registration is meant to be as comprehensive as possible, and some portion of the registration process may vary from remote device to remote device. The user has the option to edit their profile immediately after logging on to the system through a browser-based or browser challenged remote device, for example, the user may add another remote device to their profile. Browserless remote devices, however, are generally more limited in what applications and information they may be provided access to, based for example, on their user interfacing capabilities.
- In some embodiments of the invention, when a user enters a hotspot area with a browser-based or browser-challenged
remote device 102, after the user has created a registered account in thesystem 10, as described above, theaccess point 108 sends an intercept page requiring the user to input their user name and password, or only their password, or other information that can be used to identify the user. Once the user has input their information into the browser form, the information is sent through thenetwork 104 to be compared with valid user information stored in theservice access module 112. - In some embodiments of the invention, when a user enters a hotspot area with a browserless
remote device 102, after the user has created a registered account in thesystem 10, as described above, theaccess point 108 uses a SNMP Trap to collect the user information and send it through thenetwork 104 to be compared with valid user information stored in theservice access module 112. In addition, depending on remote device and/or user registration settings, an optional request for user information and/or confirmation may be communicated to a distinct remote device of the registered user for confirmation. For example, a confirmation message could be sent to a user's cellular phone, or other such device, via a Short Message Service (SMS), wherein the user may then confirm via this distinct device that they are in fact attempting to access the system via their browserless remote device. In this scenario, this would allow a user to identify an event where access to the system is being erroneously and/or fraudulently attempted using their remote device and/or remote device identity. - In some embodiments of the invention, when a user enters a hotspot area with a browser-based, browser-challenged, or browserless
remote device 102, after the user has created a registered account in thesystem 10, as described above, thegateway 110 retrieves specific remote device information from the remote device and sends that information through thenetwork 104 to be compared with valid remote device information stored in theservice access module 112. - There are many different
remote devices 102 that may be used with thesystem 10. To accurately identify a remote device there may be a number of different pieces of information needed to be retrieved from the remote device. The MAC address of the remote device is an example of one piece of information that can help identify a remote device, however, it may not be sufficiently robust, as spoofing is possible and quite simple on some platforms with the proper tools. Depending on the security levels expected from implementation of thesystem 10, using simple remote device identification methods such as using the MAC address may be sufficient. - In an embodiment where one seeks to reduce or avoid MAC address spoofing problems, other pieces of information may be available to help identify a remote device and can be retrieved by the
gateway 110 while the remote device is attempting to access thenetwork 104 through theaccess point 108. For example, some of the information that can be retrieved from a remote device that can help uniquely identify it include, but are not limited to the following: MAC address (including manufacturer prefix), browser characteristics, operating system characteristics, host IP address, traffic headers, clock or crystal oscillator characteristics, serial numbers, and other properties that can be obtained remotely through special features in thenetwork access module 106. - Using identifying data provided by the user, and/or provided automatically by the user's remote device, the
service access module 112 proceeds to the authentication of the user and/or remote device. In some embodiments, authentication is intended to be user-centric, for example, a user with a valid account should be able to connect to thenetwork 104 and access those services for which he has subscribed (which may include all services available in a wide open access system), on whicheverremote device 102 he happens to be carrying at that moment, or alternatively, for which remote device registration has been implemented. The characteristics of theremote device 102 and/or application attempting to connect to thenetwork 104 can factor into the mechanics of the authentication process, and as such, thesystem 10 can be configured to address these factors. - In one embodiment of the invention, authentication is intended to be device-centric, for example a remote device which is associated with a valid account should automatically or semi-automatically connect to the network through a hotspot once it becomes available. For example, Express Authentication can be used to connect a registered remote device, possibly including prompting a user to confirm said connection.
- In one embodiment, a RADIUS is used as an authentication, authorization, and accounting (AAA) protocol. Such a protocol is commonly known in the art and used for applications such as network access or IP mobility. For access to a network to be granted, the information input into the remote device web browser or retrieved by the SNMP Trap, depending on what remote device is being used, is passed through the network access module 106 (e.g. the
access point 108 andgateway 110 ofFIG. 2C ), to a RADIUS server operatively coupled to or integrated within the context of theservice access module 112, over the RADIUS protocol. For example, a Network Operations Center (NOC) authentication request can cause an access-request to the RADIUS database which will return an access-accept or access-reject status. In general, the RADIUS server checks that the information is correct using authentication schemes such as Password Authentication Protocol (PAP), Challenge-Handshake Authentication Protocol (CHAP), or Extensible Authentication Protocol (EAP). If accepted, the server will then authorize access to the ISP system and select an IP address. If the username and password are correct, RADIUS will return the length of time remaining for the account and the name of the access list to use. If the account has time remaining and is not disabled, the remote device is authenticated and the access list is enforced by theaccess point 108. In one embodiment, the access list is what defines what a remote device can or cannot do while connected to theaccess point 108. The individual definitions are stored in RADIUS but loaded to the access point daily, for example, the RADIUS server will also be notified if and when the session starts and stops, so that the user can be billed accordingly. - In order to have control and flexibility over authentication and authorization, a RADIUS database may be used by the
service access module 112 to provide the same programmatic potential as a proprietary local knowledge base could. The RADIUS database can contain access lists associated to the different service packages provided as described above. These advanced authentication methods allow authentication through means that extend beyond the traditional client or browser-based methods, allowing more remote devices, for example, browser challenged or browserless remote devices to connect and reconnect at public hotspots. - In some embodiments, the advanced authentication methods can allow differentiated authorization based on identification and authentication data, as well as other factors. For example, different users, remote devices, remote device types or remote device classes can be offered different services or different aspects of a service profile can be applied based on information about the remote device, location, time of day, service providers, payment, purchase of related products, service contracts, and other information as would be understood by a worker skilled in the art.
- In some embodiments of the invention, the
access point 108 is configured to send an ‘Association Success’ trap to a remote Simple Network Management Protocol (SNMP) client allowing for authentication ofremote devices 102 that do not invoke an intercept page, for example, browserless remote devices. SNMP is used by network management systems to monitor network-attached remote devices for conditions that warrant administrative attention. SNMP is used to collect interface information fromremote devices 102. A person with ordinary skill in the art would recognize how SNMP traps are used to collect information fromremote devices 102 and connected to anetwork 104 through anaccess point 108. For example, the remote device interface information can be passed through thegateway 110 to the RADIUS database, as described above, to acquire authentication. - In one embodiment of the invention, the
access point 108 is also configured to receive a request, for example, a Hypertext Transfer Protocol using Simple Object Access Protocol (HTTP SOAP) call, to retrieve the remote device IP address assigned by theaccess point 108. An HTTP SOAP call is an HTTP message that complies with SOAP encoding rules. A person of ordinary skill in the art would recognize that the HTTP SOAP call is only an example of a way of sending and receiving information over a network. The IP address of theremote device 102 can, for example, be associated with the remote device MAC address for enhanced authentication. - In one embodiment of the invention, multiple SNMP clients are used, as described above, to provide scalability for concurrent remote device authentication and can be extended to support a global solution where high latency is required by the
access point 108 during authentication. For example, a Kiwi SNMP client may be used to filter and/or parse messages and take actions using script. Using a scripting language, such as, but not limited to, JavaScript, a script file can be created to parse a SNMP message to extract information passed from theremote device 102 through theaccess point 108 via the SNMP trap, remote device information such as, but not limited to, the MAC address, the remote device IP address, or the server IP address. Once extracted, the information can be sent for authentication. In one embodiment, this process may be done asynchronously to avoid bottlenecks of SNMP messages in the SNMP client(s). - In one embodiment of the invention, a webservice is used to communicate, for example, SNMP messages from one remote device to another through a network. A webservice is an application programming interface (API) that allows information to pass through one or more networks that may be using different communication protocols.
- An example of an Authentication Webservice API could be designed to include the following elements: a AccessPointInformation function, AuthenticateDevice function which Encapsulates the HTTP request made for NOC authentication, a ConnectionInformation function, a DeauthenticateDevice function which Encapsulates the HTTP request made for NOC deauthentication, a DeviceAssociated function which provides remote device identification and validation prior to authentication, and a DeviceDisassociated function which provides remote device identification and validation prior to deauthentication.
- In this example, a DeviceAssociated method is called from the SNMP client. The request is first added to a queue to wait for processing. This may be beneficial if multiple SNMP clients attempt to authenticate the same remote device association, and can reduce the number of NOC authentication attempts to the
access point 108. Upon a successful authentication the duplicate authentication requests are removed from the queue. - Continuing with the above example, after queuing individual requests, the parameters are then verified and corrected if necessary. The following process checks are done:
-
- 1. Is the gateway using a Virtual Private Network (VPN)? This is determined through a lookup in a VPN database. The VPN database is populated through a custom built script that is invoked for all connects and disconnects to the VPN.
- 2. Is the remote device IP address available? As discussed above, if the remote device IP address is not available through the SNMP trap used, then a HTTP SOAP call can be done to the
access point 108 using the MAC address to retrieve the remote device's assigned IP address.
- 3. Is the remote device registered? Using the MAC address, a lookup is done in the
service access module 112 that stores the user and/or remote device information, to locate the account that the remote device belongs to where the account can contain the RADIUS credentials, for example, the username and password, required for NOC authentication. - With regard to this example, once all parameters are verified and complete, the NOC authentication to the
access point 108 is performed. The NOC authentication can be performed using, for example, an HTTPS call to theaccess point 108 with the required parameters, and the result is returned as a pass, fail, or error value. Access to selected services can be based on the result. For example, if the result is returned as a pass, access can be granted, whereas if the result is a fail or error value, access is not granted, and optionally the authentication procedure can be retried. - In one embodiment of the invention, the Advanced Device Profile (ADP) is stored in a knowledge base and used for authentication purposes.
- In one embodiment, Express Authentication can be implemented using information stored in a knowledge base.
- With an authentication system including multiple components, encompassing many different technologies, and spreading across multiple geographical locations, it may be effective to have a single and simple means to trace processing sequentially across all components for debugging and analytical purposes. A tracing webservice allows trace information to be sent unobtrusively as authentication moves through the process. A webservice, because of its interoperable characteristics and wide programmatic support among technologies, is one possible way to track the system process.
- According to embodiments of the invention, authorization occurs once the
remote device 102 and/or user have been authenticated, as described above. Thesystem 10, via thenetwork access module 106, orgateway 110 thereof (FIG. 2C ), restricts the user and remote device to actions determined by the remote device's capabilities and/or the service package purchased by the user, as described in more detail below, by setting up firewalls, allowing or blocking specified TCP or UDP ports, filtering or restricting network traffic based on type, packet headers, content, flow characteristics such as rate, delay and variation thereof, source, destination and/or other access limitation rules to be implemented by thesystem 10. If the user selects the wide-open Internet access option, the user will have full access to the Internet, for example. Authorization can also operate by expressly allowing a user and/or remote device to carry out predetermined actions or connect to predetermined services, instead of specifying what actions are not allowed. The sets of allowed or restricted actions are described by a service profile, including for example authorization constraints or authorization whitelists. - In one embodiment, service profiles are dependent on factors such as the amount of time a user is accessing an application, the type or content of the application, rate and volume of data downloaded or uploaded, or other factors related to application usage. These factors can be in addition to other factors, such as allowing access to specified applications, to specified remote devices or remote device types, or at specified locations, times, or the like.
- In another embodiment, service profiles can be configured to enable or disable selected applications or groups of applications, either directly according to application name or type, or indirectly by setting minimum or maximum service levels for selected services such as bandwidth, delay, enabled or disabled TCP or UDP port numbers, firewall settings, and the like, where said service levels are required for certain degrees of performance of selected applications, to which a value may be associated. These factors can be in addition to other factors, such as allowing access to specified applications, to specified remote devices or device types, or at specified locations, times, or the like.
- In one embodiment, in order to influence or control access to prespecified applications or services, different applications or services can be profiled. To profile an application or group of applications, the type and level of communication resources associated with usage of said application or group of applications is determined, such as TCP or UDP port usage, bandwidth, packet size, traffic characteristics, and the like. This association can be performed through controlled experimentation or monitoring of customer activity. The association between applications and type and level of communication resources is then stored in an application profile in a knowledge base. The application profile can subsequently be used to substantially monitor and/or restrict users to predetermined applications or groups of applications by monitoring and/or restricting access or usage to the associated types and levels of communication resources. Profiling of applications can be performed automatically according to an adaptive or automated procedure, or by a network administrator, or by a combination thereof.
- In an optional embodiment of the invention, the
system 10 uses a value based application (VBA) which provides limited access to an exclusive application, service, or remote device connection, or a combination thereof, that is packaged, marketed, and sold at a hotspot at a price representative of its perceived value, which is discounted from wide-open Internet access that is currently provided. - Using VBA service profiling, the
system 10 can be configured to identify incoming traffic substantially without user input, recognize returning users and remote devices by type, connect users with a single click, or no clicks, such as by Express Authentication, and apply rules post-authentication to allow only that type of remote device, or a service on that remote device, to connect. By possessing this functionality it is possible to assemble creative packages of service offerings which allow users to pay for only the services they will use. Alternatively, users can obtain some services for free, or obtain services at no charge or at a reduced price when another good or service is purchased. In this way, targeted marketing can also be performed in conjunction with user services in embodiments of the invention. - In one embodiment, service profiles can be applied to determine what services to connect a user to, and the conditions required for each service. Service profiles can restrict, allow, or otherwise configure access to applications based on various factors. For example, service profile parameters can pertain to date and time ranges, remote devices, remote device types or remote device classes, for example as indicated in remote device profiles, geographic locations, hotspot or business entity identification, types of VBA services available, number of users accessing services, available bandwidth, concurrent use of multiple remote devices by a user or group of users, session idle time or timeouts, or other parameters affecting access to services, applications or VBAs as would be understood by a worker skilled in the art.
- In one embodiment, service offerings can be related to providing access to one or more applications under predetermined time, quality, or other restrictions. Service offerings need not be identified with a particular application, but can be defined by potential combinations of service profile parameters such as authorization constraints or authorization whitelists. For example, a communications service provider A and an internal access service provider and product vendor B could devise a product whereby users of remote devices affiliated with A, who also purchase a product or service from B using a stored-value card, could get 1-hour free open Internet access through B at selected vendor locations on the day they make the purchase. Another communications service provider C could offer users of remote devices affiliated with C free access (or access for a nominal charge, or free access with another purchase) at selected hotspots to their Facebook account, provided the users have purchased a qualifying service plan.
- Once logged into a profile, for example through an access management module, the user can have the option to, among other functions, add remote devices. Upon selecting a remote device, the user enters information required to register that particular remote device into their account. Once registered, the user selects the service package that suits his needs, and selects a payment option, and then the user can use the remote device at any hotspot access supported by
system 10. - In one example, the VBA constructions define specific gateway firewall requirements for each product. By identifying settings of the servers, transports, or ports used by the remote devices and services supported by the
system 10, which may include for example, but are not limited to computing devices, games, streaming video products, collaborative business applications, social applications, etc. In one embodiment, there are created Access Control Lists (ACLs) that provide proper access support for each VBA, while restricting access to other common services for which the user has not paid. These restrictions may occur at thegateway 110 level, for example, using firewalls to limit access to certain Internet and other network capabilities. - In another embodiment of the invention, the restriction of network access may occur through funneling all user traffic through a central proxy server. This method of limiting network access according to a VBA would allow for more control, for example, of the authorization process.
- In one embodiment, in order to create limited-access VBA profiles, as described above, Internet access requirements for each of the applications to be supported including servers, ports, protocols, etc. which could be used by a remote device during the execution of a certain application are identified. For example, a game on the Nintendo DS™ may require access to a Nintendo™ server, over TCP, using port 1025 outbound and 1030 inbound. An inventory for each application's connectivity requirements is used in order for the applications to be combined into product packages, the VBAs, and their requirements combined. The amalgam of the requirements for each package form the basis for firewall rules for a specific VBA. These application profiles contain information about various characteristics of each application or remote device which describe not only how the application behaves on the Internet, but unique characteristics of the remote devices which would allow instant and automatic detection of the remote device type and link a specific remote device to a unique user. These application profiles can comprise a dynamic database. For example, with new applications and remote devices being introduced, constant updating may be implemented to support new remote devices, and to ensure that users do not have problems with a new software program or application on older remote devices.
- To restrict and/or prohibit access to all other available services the user did not select, for example, a user who pays for online gaming should not be able to browse the Internet or send email, requires a proper set of firewall rules for any VBA, by permitting everything required for that VBA to function, and blocking access to everything else. These firewall rules can be established based on transport protocols (e.g. TCP, UDP, ICMP, etc.), destination server (e.g. IP or DNS name), port number, traffic protocol (e.g. SMTP, FTP, HTTP, etc.), header information, etc. By combining a set of permitted servers, ports, protocols, and the like and restricting others, the firewall configuration for any one VBA can be determined.
- In one embodiment of the invention, to facilitate the post-authentication user restrictions at a hotspot, manipulation of the functionality of the
gateway 110 provided is desirable. For example, some manipulation of the “access-list” attribute, which is a vendor-specific attribute used by the Colubris™ Multi-Service controllers (MSC-3200), could be used. Allowed and disallowed IP address and port combinations can make up an access-list definition which is associated to an account/remote device combination and enforced by theaccess point 108. - An example of such manipulation of an “access-list” attribute is described in the following steps:
-
- (1) determining in advance a selection of packaged VBAs, and the firewall rules needed to operate them;
- (2) establishing those rules in the start-up profile of the network access module 106 (e.g. gateway 110) in the form of an “access-list” such that each time the unit connects to the Internet, or at a given refresh rate (e.g. once per day), it would download instructions for “DS Gaming”, “PSP”, etc.; these instructions could be read into memory by the
gateway 110, but not applied, for example, until called by a user connection; and - (3) upon login, programmatically determining the subscribed VBA for that user; and 61] (4) calling the appropriate access-list profile for that user and activating it at the
gateway 110 for that session.
- The remote device profiles for each service package can be stored in a database (
e.g. knowledge base 210 ofFIG. 2B ), and combined with one or more user profiles, a list of associated remote devices, a list of service subscriptions, or a combination thereof, to form a service profile for that user or remote device, as described above. When a user logs in, or aremote device 102 is recognized at the time of connection, thesystem 10 is able to look up the service profile for that user and/or remote device, determine the appropriate level of access, and apply the profile to the current connection by configuring the appropriate firewall rules at thegateway 110 following authentication. - As will be appreciated by the person of skill in the art, the
system 10 may further comprise a reporting module used by network access providers, and other partners, for reporting data related to system usage analysis and billing purposes. Reports may include information regarding, for example, usage by user, location and vendor; usage by remote device type; payment type; and other such information, as would be apparent to the person skilled in the art. - It will be further appreciated that various upsell mechanisms, as described above, may be implemented so to actively upgrade a user's, or a remote device's service access package while interfacing with the system.
- With reference to
FIG. 4 , and in accordance with one embodiment of the invention, there is shown a flowchart providing a process for identifying, authenticating, and authorizing a user utilizing a browser-based or a browser challengedremote device 102 to access anetwork 104. In this example, theremote device 102 scans the area for an available network connection. The user invokes a web browser via which a given Internet resource may be requested atstep 402. Thegateway 110 intercepts the request and redirects it to the network interface atstep 404. Thegateway 110 also sends through the network the remote device characteristics that it has extracted from theremote device 102 atstep 404. The network interface receives the request to access the network and the remote device information and sends the request on to an Access Management Module (e.g. ofservice access module 112 ofFIG. 2B ) atstep 406. The Access Management Module captures the remote device and user information and analyzes the remote device characteristics to determine what information the gateway extracted atstep 408. The remote device information is cross-referenced with the database containing user, remote device, and service profiles atstep 410. The Access Management Module determines what type of remote device is being used to access the network and reformats the User Interface (UI) to suit the remote device's capabilities atstep 412. Atstep 414, the process determines whether the user is known. If the user information was sent with the request, the Access Management Module sends that information to the database to retrieve the user's account details atstep 420. If the user information was not sent with the request, the intercept page is sent to the remote device so the user can input their user information atstep 416. The user's information is sent back to the Access Management Module atstep 418 and the information is cross-referenced with the account details in the database to verify the user has an account atstep 420. The database determines what service profile the user has access to through the current remote device the user is using atstep 422. The process sends the available service options to the remote device through an appropriate UI atstep 424, and the user selects which services to allow atstep 426. The process selects the appropriate service credentials and restrictions atstep 428, and sends that information through the network interface atstep 430, to the gateway to enforce those restrictions atstep 432. The user is granted access to the network limited to the service profile the user subscribed to atstep 434. - With reference to
FIG. 5 , and in accordance with one embodiment of the invention, there is provided a sequence diagram providing a process for identifying, authenticating, and authorizing a user to access anetwork interface 508 using a browser-based or browser challengedremote device 502. The user, via theremote device 502, sends a URL request to access the network (step 514), the gateway intercepts the request and redirects the request back to the user via an intercept page (step 516). The user inputs user information through the form provided on the intercept page, and this information is sent to the Service Access Module, whereby remote device characteristics may be further extracted from remote device communications, for use by the Access Management Module 510 (step 518). TheAccess Management Module 510 first looks up the remote device characteristics in the database 512 (step 520) for a matching remote device profile stored in thedatabase 512. Thedatabase 512 sends the remote device profile back to the Access Management Module 510 (step 522). TheAccess Management Module 510 then looks for an account profile that matches the remote device profile to compare user information (step 526). Once an account profile is found, the process formats the User Interface (UI) to suit the remote device being used (step 528) and sends a web page displaying available service options for that user and remote device to the user so the user can select the required services. The user selects the required services and selects payment options, and that information is sent back to the Access Management Module 510 (step 530) to be cross-referenced with the service profiles stored in the database 512 (step 532). A service profile is selected and the service profile rules are sent to the Access Management Module (step 534). The user's credentials in the RADIUS database are updated, and the rules of the service profile are associated with the credentials (step 536). The remote device information is sent back to thegateway 504 to initiate authentication of theremote device 502 for the services selected (step 538). Thegateway 504 makes a RADIUS request to authenticate the remote device for the services selected (step 540). The RADIUS server checks the credentials and retrieves the associated service profile restrictions (step 542). The RADIUS sends an “accept” message back to the gateway 504 (step 544), accompanied by the service profile restrictions to be enforced by thegateway 504. A network session is created (step 546) and the user can establish a connection to the network 508 (step 548). - With reference to
FIG. 6 , and in accordance with one embodiment of the invention there is shown a flowchart providing a process for identifying, authenticating, and authorizing a user utilizing a browserlessremote device 102 to access anetwork 104. Theremote device 102 scans for an available network connection atstep 602. Thegateway 110 detects the remote device scanning for a network atstep 604, and forwards the remote device information to the Access Management Module to be extracted thereby. The Access Management Module captures and analyzes the remote device characteristics to determine which remote device is being used to access the network atstep 606. The remote device characteristics are cross-referenced with remote device profiles stored in a database atstep 608. The database is also searched for the user account profile, if one exists, atstep 610, and it is determined whether the user has previously programmed the account profile to auto-authenticate when the user accesses the network atstep 612. If the user has not selected to auto-authenticate, the authentication service requests confirmation from the user atstep 614. The user provides user information to confirm user account information using Short Message Services (SMS) which are text messages that can be sent using devices, such as but not limited to, cell phones and pocket PCs, atstep 616. The user information received from the user andremote device 102 is cross-referenced with service profiles established for the account and remote device profiles which are stored in adatabase 112 to determine the appropriate services to make available atstep 618. The Access Management Module determines the credentials and restrictions of the selected service profile and sends those to the authentication service atstep 620. The authentication service verifies the user account, remote device, and service profiles and grants network access to the user atstep 622. The gateway provides the enforcement of the service profile to allow the user to only access services provided for the remote device they are using atstep 624. The user is provided restricted access to the network in accordance with the services the user has provided payment for atstep 626. - With reference to
FIG. 7 , and in accordance with one embodiment of the invention, there is shown a sequence diagram providing a process for identifying, authenticating, and authorizing a user utilizing a browserlessremote device 102 to access anetwork 104. Auser 702 at a hotspot access location turns on a browserlessremote device 704, for example, but not limiting to, a mobile phone (step 716). The remote device attempts to make a radio access network (RAN) connection to the available network (step 718). Thegateway 706 creates a SNMP trap to extract remote device information from the remote device (step 720). The SNMP “device associated” notification is sent from theSNMP Server 710 to the Access Management Module 712 (step 722). TheAccess Management Module 712 cross-references the remote device characteristics with the remote device profiles stored in the database 714 (step 724). Once a remote device profile is established, theAccess Management Module 712 looks in the database to see if there is an account profile associated with the remote device profile (step 728). The account profile details are sent from thedatabase 714 to theuser 702 requesting the user to confirm the account details (step 732). The user provides user information to confirm the account details through SMS, for example, and the information is sent back to the Access Management Module 712 (step 734). TheAccess Management Module 712 looks in thedatabase 714 to acquire the appropriate service profile for the user and remote device (step 736). The appropriate service profile is selected from thedatabase 714, and the service rules are sent to the Access Management Module (step 738). The user's credentials in the RADIUS database are updated, and the rules of the service profile are associated with the credentials (step 740). The remote device information is sent back to thegateway 706 to initiate authentication of theremote device 704 for the services selected (step 742). Thegateway 706 makes a RADIUS request to authenticate the remote device for the services selected (step 744) while a connection is established with the remote device (step 746). The RADIUS server checks the credentials and retrieves the associated service profile restrictions (step 748). The RADIUS sends an “accept” message back to the gateway 706 (step 750), accompanied by the service profile restrictions to be enforced by thegateway 706. Thegateway 706 then initiates a session (step 752) feeding back to the access management module (step 752). - With reference to
FIG. 8 , and in accordance with one embodiment, there is provided a flowchart of steps taken when a user attempts to access a network at a hotspot location, using a browser-based remote device. The user enters the hotspot location, and turns on the remote device, the remote device scans for available networks, and the user opens a web browser atstep 802. The user selects whether to have full access to the network or to have a service package option, atstep 804. If the user chooses to have full access to the network, the user selects the connect options provided by a carrier atstep 806. The gateway initiates authentication of the user through the use of RADIUS atstep 808. The gateway confirms whether the user is a valid user atstep 810, if the user is authenticated, the user is given options to connect additional remote devices to the network atstep 812, which would then forward them to the service package options provided atstep 834. If the user chooses not to connect additional remote devices to the network, the user is connected to the Internet with wide open access atstep 814. - If, at
step 804, the user chooses to have access to the network based on a service package, the system attempts to recognize the remote device being used to access the network atstep 816, if the remote device is recognized, the user is prompted through the web browser to input user information or the user can select to auto-authenticate, atstep 818. If the user is a valid subscriber, as determined atstep 820, the user profile is passed to the hotspot network access atstep 822. The gateway initiates the authentication of the user, remote device, and service profiles atstep 824, and allows the user to have access to the network for the services selected in the service package atstep 826. If the remote device being used is not recognized atstep 816, the user is prompted to login or create a new account using the web browser atstep 828. If the user has previously registered an account, the user logs on, and the remote device characteristics are then stored in a remote device profile associated with that user atstep 830. - If the user is a new user, they are required to create a new account at
step 832. The user selects the type of service package, and payment option from the list displayed atstep 834, and the account is created, and updated atstep 836, and the remote device being used can then be connected to the network atstep 838. The account information is sent to the hotspot network access atstep 822, and the gateway initiates the authentication of the user, remote device, and service profiles atstep 824, and allows the user to have access to the network for the services selected in the service package atstep 826. - With reference to
FIG. 9 , and in accordance with one embodiment of the invention there is provided a flowchart of steps taken when a user attempts to access a network at a hotspot location, using a browser challenged remote device. The user enters the hotspot location, and turns on the remote device, the remote device scans for available networks, and the user invokes a web browser atstep 902. The service access module extracts information from the remote device to determine whether it is a registered remote device, atstep 904. If the remote device is not a registered remote device, the gateway receives information from the user to determine if the user has a valid account atstep 906. The user's information is sent to be authenticated atstep 908. If the user is verified as a valid user, the remote device information is then stored as an associated remote device atstep 910. If the user's service package already provides sufficient access to the network for that particular remote device, the user can connect to the network, or the user has to select service options from a list displayed on the web browser atstep 912. The account information is sent to the hotspot network access atstep 914, and the gateway initiates the authentication of the user, remote device, and service profiles atstep 916, and allows the user to have access to the network for the services selected in the service package atstep 918. - If the remote device is already registered to an account as determined at
step 904, the user inputs user information atstep 920 If the user information is valid, the user can select to auto-connect atstep 922, or require the system to ask the user whether they wish to connect atstep 912. The account information is sent to the hotspot network access atstep 914, and the gateway initiates the authentication of the user, remote device, and service profiles atstep 916, and allows the user to have access to the network for the services selected in the service package atstep 918. - If it is determined at
step 906 that the user does not have a valid user account, the user creates a new account atstep 924. The remote device is registered to the user's remote device profile atstep 926, and the list of service options is displayed atstep 928. - The account information is sent to the hotspot network access at
step 914, and the gateway initiates the authentication of the user, remote device, and service profiles atstep 916, and allows the user to have access to the network for the services selected in the service package atstep 918. - With reference to
FIG. 10 , and in accordance with one embodiment of the invention, there is provided a flowchart of steps taken when a user attempts to access a network at a hotspot location, using a browserless remote device. The user enters the hotspot location, and turns on the remote device, the remote device scans for available networks, and the user begins a text message session and uses a radio access network to connect to the network, atstep 1002. The gateway determines whether the user is a recognized user atstep 1004. If the user is recognized, it is determined whether the user has a registered account atstep 1006. If the user has a registered account, it is determined whether the user has a valid service subscription for the remote device being used atstep 1008. If the user has a valid subscription for the remote device being used, the account information is sent to the hotspot network access atstep 1010, and the gateway initiates the authentication of the user, remote device, and service profiles atstep 1012, and allows the user to have access to the network for the services selected in the service package atstep 1014. - If it is determined at
step 1006 that the user is not a registered user, the system checks if the connection available to the remote device is time limited atstep 1016, if it is time limited, the system checks if the remote device being used has time available atstep 1018. If the remote device has no time available, the user will not be allowed to connect to the network (step 1020). If the connection available is time limited, and the remote device has time available, the limited remote device profile is sent to the hotspot network access atstep 1026, and the gateway initiates the authentication of the remote device atstep 1028, and allows the user to have access to the network for the limited device-specific services atstep 1030. If the connection available is not time limited atstep 1016, the open access to the device-specific network connection is sent to the hotspot network access atstep 1032, and the gateway initiates the authentication of the remote device atstep 1034, and allows the user to have open access to the network for the device-specific services for an unlimited amount of time, atstep 1036. - If it is determined at
step 1004 that the user is not a recognized user, the remote device characteristics are extracted and stored as a remote device profile in a database atstep 1022. The remote device attempts to connect to the available network for device-specific access, atstep 1024 if the connection available has a time limit the limited remote device profile is sent to the hotspot network access atstep 1026, and the gateway initiates the authentication of the remote device atstep 1028, and allows the user to have access to the network for the limited device-specific services atstep 1030. If the connection available is not time limited atstep 1024, the open access to the device-specific network connection is sent to the hotspot network access atstep 1032, and the gateway initiates the authentication of the remote device atstep 1034, and allows the user to have open access to the network for the device-specific services for an unlimited amount of time, atstep 1036. - The above provides for different examples in which device-identifying data can be used to not only manage wireless network access at different hotspot locations by remote devices at such locations, but also to uniquely recognize and optionally track and report on device activity by way of the creation and management of a device profile uniquely associated with such devices and stored in a network accessible knowledge base. Accordingly, and as described above within the context of
system 10, devices interfacing with anetwork access module 106 orWAP 108 at a given hotspot may, in some embodiments, be automatically identified and recognized by thesystem 10. Namely, a unique device identifier is automatically embedded within a device transmission without user input and thus communicated by the device to thisWAP 108. Upon cross-referencing this device identifier with device profiles stored at acommon knowledge base 210, a match can be made and the device ultimately recognized. Upon identifying an unrecognized device, a new device profile may be created from the unique device identifier extracted from communications received from this unrecognized device, thus allowing for subsequent recognition, and thus optionally tracking, of this particular device. From these compiled device profiles, device usage patterns (usage time, location, etc.) can be logged and reported, for example. - Within this context, a given device can be recognized as a returning device when subsequently identified at a same location, thus indirectly identifying the user of this device as a potentially frequent or loyal customer. Similarly, a given device may be recognized upon identification at one of multiple hotspot locations having common access to the network accessible knowledge base. In one such embodiment, frequent or loyal customers (or at least their device), can be recognized across multiple hotspot locations, for example grouped or otherwise associated with a common operator, brand, business entity, or the like. Various applications, such as the tracking and reporting on repeat devices, the provision of improved services or offerings to such repeat devices, and other such applications as exemplified below, may be derived from the ability to identify and recognize devices across multiple hotspot locations, in some embodiments, without user input, that is in some cases, unbeknownst to the user of the device.
-
FIG. 13 provides another example of asystem 1300 generally configured to provideremote devices 1302 access to network services, such as the Internet, from apublic hotspot 1306 or the like. In this particular example, thesystem 1300 is configured to authorize full access privileges to authenticated users, though it will be appreciated that restricted access or access to only some services may also be considered, as described above, within the context of this example. - In this particular example, the device recognition and tracking features of the above-described embodiments are further exemplified. Namely, the
system 1300 is generally subdivided into adetection component 1320, wherebyremote devices 1302 in the vicinity of a givenhotspot 1306 may be detected and automatically identified by way of a unique device identifier automatically embedded within a device transmission, and adata engine component 1322 for processing device identities, optionally in combination with time and location data, to provide for device recognition, tracking and other such features, as introduced above and as further exemplified below. In this particular example, thedetection component 1320 comprises ahotspot radio receiver 1306, such as a WAP or other such wireless sensor, which receives wireless transmissions from thedevices 1302 in its vicinity and communicates these transmissions to a centralized controller 1310 (e.g. via a gateway). The controller 1310 (an example of which may include, but is not limited, to an Aruba 3200 Controller) is generally configured to relay raw transmissions received bydifferent hotspot sensors 1306 to alistener 1312, which generally comprises one or more dedicated software modules that extract one or more unique device identifiers from these transmissions for use downstream in identifying and recognizing devices during subsequent visits at a same or other hotspot associated withsystem 1300. In this particular embodiment, thelistener 1312 is generally characterized as a packet listener (e.g. implemented in the context of packet capture—PCAP), but may also be characterized as a Real Time Tracking System (RTLS) processor in which an RTLS data stream is processed to extract similar data, and optionally, provide access to signal strength data in further characterizing proximity of an identified device. Other such listeners currently available or that may evolve in the field to provide similar functionality will be understood to fall within the general scope and nature of the present disclosure. In some embodiments, the unique device identifier comprises a value representative of an inherent characteristic of the device, such as a MAC address, that is automatically embedded within device transmissions without user input, and in most cases, unbeknownst to the user. Namely, the unique identifier extracted by thesystem 1300 is generally specific to the device itself and not pre-designated for the purpose of wireless network access or user identification, but rather integral to the device itself in identifying this device, for example, in allowing for the addressing of wireless communications thereto by nearby or associated devices. - In one such embodiment, the
hotspot 1306 is programmed to listen for probe requests transmitted by devices actively scanning for available networks. These types of packets are periodically broadcast by Wi-Fi client devices (part of the IEEE 802.11 standard) in seeking to identify available network connections. Contained in such probe requests is a value that uniquely identifies each device (its MAC address) so that replies can be addressed specifically to that device. In this particular embodiment, thehotspot sensor 1306 forwards identified probe requests to a centralized controller 1310 (e.g. delivered in its raw form to a remote server) for processing bylistener 1312. - In this particular embodiment, the
packet listener 1312 listens for incoming packets and extracts the MAC address of theclient device 1302 that originally issued the probe request, the IP address of the access point (sensor) 1306 that detected the packet, and the timestamp of the packet, for example. As introduced above, extraction of the MAC address allows for unique identification of thedevice 1302 at thehotspot 1306, and extraction of the IP address and time stamp allows, in some embodiments, for the identification of the hotspot location and thus the identified device's location, and the time to be associated therewith. For instance, the IP address can be cross-referenced with a database of known access points to determine which location it corresponds to. Similarly, the extracted device identifier can be cross-referenced with stored device profiles such that repeat visitors can be recognized upon subsequent visits to the same or related locations, or again at unrelated locations for the purpose of expanding the device profile database across multiple operators (device profile sharing rules between entities may be set in place to protect user privacy and the like, as will be readily appreciated by the person of ordinary skill in the art). Combination of the device ID, location ID, and timestamp thus provide an indication that aparticular device 1302 was present at a particular location at a particular time. - In one embodiment, the extracted data can be used to recognize and thus track devices over time at different locations, and can also be used to generate and maintain an in-memory map of where each recognised device is, and optionally how long it has been there. From this point, the data can be sent, for example at regular intervals, to an
M2M service module 1314 that aggregates packet capture data, optionally with other forms of presence information, to create a high-level picture of which devices are present at which locations, and for how long. This information can be stored in a knowledge base (KB)database 1316 from where it can be used for various purposes such as reporting, business analytics, and diagnostics, to name a few. TheM2M module 1314 may also be used to pass events to external subscribers for real-time notification and/or reporting, for example. - In some embodiments, device identification and recognition, device profiling, and as will be described in greater detail below, device visit profiling, may be implemented internally by a given entity operating a local, regional or global hotspot locations (e.g. at a single location, at any of a group of commonly operated regional locations, and/or globally across multiple locations), or again implemented by a third party hotspot operator, which may service multiple hotspot operating entities in providing each one with respective and customized data in respect of devices identified/recognized at their service locations and/or across the entire serviceable network of hotspots.
- In the context of
FIG. 13 , third party operations may thus share resources between commonly operated hotspot locations, or again between distinct customers, by centrally processing packet captures and/or other detection events (e.g. RTLS), or again by centrally processing event data in compiling respective visit profiles, managing device profiles across multiple customer platforms, and managing respective rules engines (e.g. seeFIG. 15 ) for different consumers in delivering customized data, as appropriate. In such embodiments, again, privacy regulations may be implemented to limit exchange of data between consumers, for example where different levels of engagement have been recorded for a given device from consumer to consumer (e.g. an opt-in device may authorize access to personal information in respect of a particular hotspot operator, but may be set to operate anonymously in respect of another). - Similarly, while third party resources may be used exclusively for the provision of hotspot network access and device data acquisition and processing, leaving downstream application implementation to the consumer, other embodiments may redirect consumer actions back through the third party system for direct interaction with user devices. Either way, different privacy protocols may be implemented to reduce direct user device exposure to the consumer, thereby protecting a user's privacy and anonymity, particularly where a user's device's interactions have been limited to unsolicited packet captures, or the like. In such examples, a MAC address automatically extracted from anonymous device transmissions may still be used to compile activity data, and optionally provided for downstream use via a hashing protocol, thereby avoiding direct disclosure of the anonymous MAC address to the consumer. These and other such privacy settings will be readily apparent to the person of ordinary skill in the art and are likely to vary from area to area based on evolving local privacy regulations and the like.
- As introduced above, other techniques may also be used, in conjunction with basic device detection and recognition, to supplement device tracking and further develop the knowledge base. For example, while device identification and recognition may be implemented via packet capture of probe requests, as noted above, other packet captures and/or logging/tracking techniques may also or alternatively be used in conjunction therewith to automatically access a greater representation of user activity. For example, multiple data exchanges may be tracked between the device and a hotspot access point while negotiating and ultimately accessing the hotspot network. Similarly, one or more radios may be used at the hotspot location to identify and tracking visiting devices. For example, multiple radios may be used at a same location to promote greater proximity data acquisition (e.g. multiple RTLS radios) and thus increase accuracy of the downstream analytics relying on such data.
-
FIG. 14 schematically illustrates hotspot engagement levels for characterizing a device visit at or near a given hotspot location. Namely,passive visitors 1402 may carry devices that are, at the highest level, merely detected as being present within the vicinity of the hotspot. In one example, passive device detection may occur at first level via a probe request packet capture or an RTLS detection, as discussed above, thereby directly identifying the device at or near the hotspot. - In a similar fashion, device communications may be intercepted via a third party receiver (e.g. a receiver in the area of the hotspot in question but not necessarily associated with the hotspot itself, that is, potentially operated by un unrelated entity and/or not readily accessible by the common knowledge base). For instance, a particular device may be out of range for a particular hotspot receiver to detect it, but may still communicate with another unrelated Wi-Fi transceiver, which unrelated transceiver is itself within range of the particular hotspot receiver. This example is shown schematically in
FIG. 13 , whereinunrelated hotspot 1307, in range of one of the system'shotspots 1306, exchanges data with awireless device 1303 that is not within range of this system'shotspot 1306, for example, in processing a request for network access, exchanging authentication information, or managing an active network connection with thedevice 1303. Accordingly, while transmissions emanating from the device inquestion 1303 may not be captured by theparticular hotspot receiver 1306 of interest, communications emanating from theunrelated transceiver 1307 and intended for the device in question may themselves be captured by thehotspot receiver 1306 and thus identify the presence of thedevice 1303 within the area of thehotspot 1306. Clearly, such communications would again reflect the presence of a passive visitor, but such information may nonetheless be of interest in compiling visitor analytics in respect of the hotspot location ofinterest 1306. Furthermore, since communications emanating from theunrelated transceiver 1307 will necessarily include reference to a specific transceiver identifier (i.e. an access point MAC distinct from the access point MAC of thehotspot location 1306 of interest), the system may be configured to automatically distinguish local (direct) from foreign (indirect) visitors, and, possibly, to perform comprehensive analytics as to the number of visitors associated with nearby locations as compared to those present at their own location (i.e. competitor intelligence could be compiled). In any event, the device may still be recognized from a previous visit at the same or another hotspot location populated in the device's stored device profile, or identified as a new device and recorded in the creation of a new device profile. - Again with reference to
FIG. 13 , in one illustrative embodiment, thesystem 1300 may further or alternatively comprise or be configured to interface with a set of Wi-Fi radio locations 1309 operatively disposed in different locations to, much as in the context of thehotspots 1306, allow thesystem 1300 to identify and recognizeremote devices 1302 when in their general vicinity. For example,such radios 1309, while not operated to provide devices with wireless access to a network connection, may nonetheless operate to capture local transmissions sent by these devices and extract therefrom a unique device identifier (e.g. MAC address via packet capture or RTLS) to be cross-referenced with the knowledge base and, where a match is made, allow recognition of the device as being present at the given location, and otherwise allow for the creation of a new device profile. Again, given the passive nature of the intercepted wireless transmissions, such device visits would be characterized as passive visits. Regardless, valuable market data may still be compiled with respect to the devices identified at each location, as can device visit profiles be created and stored, as will be described in greater detail below. Much like device identification and recognition at an active hotspot, devices recognized at a given location that have opted-in for or authorized (directly or indirectly) the system to communicate directly therewith upon detection, may be targeted upon satisfying certain criteria, such as upon qualifying as a repeat or loyal visitor, a new visitor at a particular location, meeting certain target demographics, etc. -
Active visitors 1404, on the other hand, may be progressively characterized as hotspot associated, whereby the device's radio has identified the hotspot access point and is attempting to connect; hotspot active/intercepted, in which the device is actively connected to the network but not yet authenticated for access to the Internet, for example (e.g. may yet to enter authentication credentials, temporary password, network access key, or the like); and/or hotspot authenticated, whereby a device has been authenticated for network access at the hotspot. Further engagement may also be provided, as will be described in greater detail below, by way of a user opting-in for services, promotions, applications and/or packages, for example, or merely by accepting terms and conditions laid out in exchange for free open access to the hotspot network connection, for example. Such opt-in or service access conditions may include express authorization by the user for designated system access privileges to the device and/or to user data stored thereon, or include the volunteering of user data by way of user action on the device for system storage and use. As each level of interaction provides an increasing or at least continuing ability to extract information from the device and/or to characterize the device's activity via recognizable network communications, further information can be gathered in respect of the device's user by tracking not only device identification and recognition, but also an engagement level and visit duration. Conversely, it will be appreciated that fewer and fewer visitors will be identified with increasing levels of engagement. Based on the acquired data, it may be that a given hotspot operator may attempt to increase engagement by visitors, for example by way of “network access” or “opt-in” incentives, so to increase its access to device and/or user data and thus enhance device profile analytics and applications. Irrespective, each engagement level provides the system access to recognizable device transmissions, which, in one embodiment, may include an access point MAC address (e.g. for cross-referencing hotspot location) and a device MAC address (e.g. for device recognition), and further include for association and authentication level events, an event start/stop value. Each event may also have associated with it a date/time stamp, for example. Where an RTLS module, for example, is also or alternatively used, a signal strength of the device may also be captured, thereby allowing for further characterization of the visit, namely, as a function of user proximity to the hotspot location (e.g. internal or external to the establishment providing network access), which proximity may also be logged as a component of the device visit. - In one example, and as will be further exemplified below, the system may be configured to wirelessly transmit an engagement offer to the device that requires user action on the device for implementation and that ultimately results in the system gaining enhanced communicative access to the device. Upon subsequently detecting and recognizing the device, the system may be configured to use this enhanced communicative access to automatically engage a user of the device (e.g. without user input). For example, in one embodiment, the requested user action results in the transmission of user contact information to be associated with the device profile in the knowledge base (e.g. automatically extracted from the device or directly or indirectly input by the user). Upon subsequent detection and recognition of the device at the hotspot or a related hotspot (or again at one or more passive system sensor locations, such as
sensors 1309 ofFIG. 13 ), the contact information can be accessed from the knowledge base and used to communicate a message to the device. - Similarly, the requested user action may rather or also result in the download of an application (e.g. app) associated with the hotspot location, or a designated group of hotspot locations, to be operated on the device. In doing so, a unique application identifier may be stored in relation to the device's profile and used to communicate directly with the downloaded application operating on the device when the device is subsequently identified and recognized at one of these hotspots (or related sensor locations).
- In one example, a particular device visit is compiled as a series of events over time captured and logged by the system, from initial detection in one example by way of MAC address packet capture upon the device scanning for available network connections, followed by network association, interception and/or authentication upon the user gaining access to the hotspot network (which may last anywhere between a few minutes to a few hours), to termination upon the user breaking the connection, upon the system logging a final packet capture event, or again upon the user turning off the device (e.g. a laptop may be shut down before leaving the location, whereby a finalizing packet capture is not available to mark the device leaving the location, as may otherwise be available from a smartphone device or the like that remains activated as the device leaves the location). The network disconnection event, much like a final packet capture event, may therefore act as a visit closing point as the last detected action of the device at the hotspot. In this scenario, a comprehensive visit profile can be compiled from a combination of passive and active detection mechanisms to enrich the data collected as it pertains to a particular visit.
-
FIGS. 14B to 14D provide examples of visit profiles for a given location that may be compiled using the above considerations, which profiles may then be used to gain market intelligence on the location's clientele, to gear marketing and/or promotional efforts, to allocate resources and/or project product or service demands, and/or to target selected clients or client groups, for example. An optional visit proximity profile is overlaid on the visit timeline profile, for example rendered via proximity data extracted from an RTLS data stream, in further characterizing a device visit. Clearly, a visit proximity profile may be used independently to produce usable results, as will be further illustrated by the below-described examples. Further, while packet capture detection is considered in the below examples for device detection, an RTLS data stream may otherwise be used to provide similar effects, the added option of further capturing signal strength data to further characterize device proximity. - In the example of
FIG. 14B , a uniquely identifiable device is first detected by way of packet capture (or RTLS). The device is then associated with the hotspot and later authenticated for wireless network access. Packet capture again identifies the device before the authenticated session is closed. As no further detection events take place after network disconnection, the visit is characterized by the time lapse from first detection to authenticated assess termination. Based on the duration of the visit (e.g. upon the visit duration exceeding a preset threshold), and the level of engagement recorded (e.g. authenticated access generally associated with an engaged patron), the visit is classified as an active walk-in, and thus as a likely profitable patron that may be likely to return given his lasting use of available network resources. Note that proximity data may be used in conjunction with the engagement timeline to further characterize the visit. For instance, in this example, signal strength data is processed to indicate proximity of the device as exceeding apreset proximity threshold 1450, thereby indicating a high likelihood that the device is in fact located within the hotspot operator's premises or establishment, thus confirming the visit's status as an active walk-in. Should proximity data indicate otherwise, the system could question whether the detected device is in fact making use of hotspot services without necessarily supporting the hotspot operator, and take appropriate action or log the visit accordingly. In any event, and as noted above, upon cross-referencing the device's unique identifier (e.g. the MAC address extracted upon initial detection, possibly enriched by recognizable attributes associated therewith in the device profile and associated with network access authentication) with a database of known device profiles, the visitor may further be characterized as a returning customer (e.g. if previously identified at this location or at one of several associated locations), or as a potentially new customer (e.g. if never before detected at this or related locations, but potentially previously identified and logged at an unrelated location). In any event, the visit may be recorded in the stored profile, or in a newly created device profile in the context of a new visitor heretofore never detected by the system, for recognition upon subsequent detection at this or another location. - In
FIG. 14C , on the other hand, a device is briefly detected (e.g. via packet capture or RTLS), thus defining a visit more likely associated with a walk-by, namely an individual that did not necessarily patron the hotspot location. Tracking these visitors may, as will be described in greater detail below, provide information useful in drawing in such walk-by visitors, thus effectively seeking to convert them to walk-ins. In the context of this example, and where RTLS is used, proximity data may again be used in combination with event timing/visit duration data to further characterize user activity. For example, a short duration visit may be characterized as a walk-by where no further data is available, but may otherwise be characterized as a short walk-in where proximity data indicates that the device did in fact enter the premises of the hotspot operator (e.g. where proximity exceeds a preset threshold 1452). In the coffee shop example, a patron could come in and out of the coffee shop within a few minutes, but nonetheless warrant characterization of the visit as a walk-in. Accordingly, engagement level, visit duration and proximity data may be combined, when available, to refine characterization of a device visit. - In
FIG. 14D , a repeat visitor is identified for a same location (or different locations tracked as part of a same group). For instance, a first visit may include a simple passive walk-in visit (e.g. in the coffee shop example, a visitor may be stopping in to pick-up a coffee to go without intentionally engaging the hotspot network), wherein the device is first detected but never further engaged before a final detection takes place a few minutes later. Combining identification event data with proximity data, again illustratively shown in this example as a y-axis increasing with proximity to the hotspot (i.e. increasing signal strength) the system can better distinguish between a true passive walk-in event (e.g. where aproximity threshold 1454 is met) and an event in which the device, while close enough to be detected by the system, may in fact have been located outside or next door to the premises in question, or again detected via third-party communications picked-up by the hotspot radio, thereby still potentially logging-in a visit of sufficient duration to qualify as a walk-in, but in fact representing a “close” walk-by. In any event, later that day, the same device may be detected and recognized, this time further engaging the system via authenticated network access and direct engagement, characterizing the visit as an engaged repeat walk-in visit. Following from the above coffee shop example, engagement may be introduced via a product or promotional offering, whereby a user may elect to “opt-in” for a particular service via a network landing page or the like, thus exchanging further information with the system to enable or activate the opt-in service. For example, the user could select to download a free iTunes™ song in exchange for filling-in a customer loyalty form, providing their e-mail address for a chance to win a free gift or service, or again downloading a free location-specific or related app for implementation on their device, which app then readily accessible by the hotspot operator for subsequent interaction with the visitor. In this last example, a visitor accessing a hotspot location at an airport may be offered a flight status app or the like to be implemented on their device, which app may later be accessible by the hotspot or related operator to promote airport shopping or services upon detecting and recognizing the device during a subsequent visit (e.g. send a scanable coupon via the app to promote a certain shop or restaurant). Other examples may include, but are not limited to, the exchange of SMS messages, device and/or user association with the hotspot operator via a social network or the like (e.g. Facebook™ “like” status, twitter account following, etc.), etc. - Upon such engagement, not only can the system track engagement of this particular device, further information relating to the user(s) of the device, or the device itself, may be extracted, either directly as input by the user, or indirectly upon the user accepting certain terms and conditions required in receiving the opt-in service (or again required upon requesting free network access privileges). As will be described in greater detail below, acquisition of such further information can be stored and associated with the device profile, and used downstream to enhance the user's experience and promote further patronage, for example. For instance, as noted above, a repeat ‘opted-in’ visitor may be automatically identified and recognized upon detection, and automatically prompted by the system. Following the above-example, an opted-in visitor having provided his e-mail address may receive an automated greetings from the system, which may include a promotional incentive for the visitor to further enhance patronage of the hotspot or related location. Other examples will be provided below in respect of the embodiment described with reference to
FIG. 18 . - Accordingly, the
system 1300, and its equivalents, may be configured to compile data in respect of each device visit to a particular hotspot, whereby visit data gathered and compiled in respect of each detected device, and optionally at different locations, may be combined to provide market intelligence as to the type of users frequenting a particular location and/or type of establishment, the amount of time spent at each location, the level of engagement with the system while at each location, and so on. Proximity data may also be used to characterize spatial movements of recognized device and further distinguish hotspot patrons from non-patron visitors. Further, through device recognition and visit profiling, evolution as to a particular device's engagement with a given hotspot location, or group of hotspots, may be tracked/monitored to evaluate the general effectiveness of measures implemented for drawing-in further patronage, for example. Data may be used specifically to evaluate engagement, and indirectly patronage by the user(s) of a particular device, or used in combination with data compiled for a select group of recognizable devices, or globally for all recognizable devices identified in respect of a particular hotspot location of group, thus drawing on averaged performance measures to systematically increasing patronage, engagement and/or exposure. Clearly, different visit profiles and characterizations may be considered within the present context without departing from the general scope and nature of the present disclosure, as can different analytics, reports, applications and features applied as a function of such profiles, as will be further described below. - With reference to
FIG. 15 , and in accordance with one embodiment, a detailed diagram of the various processes implemented in not only identifying and optionally recognizing a device at a hotspot, but also in characterizing a device visit and, as appropriate, outputting a related notification or report to an interested party (e.g. hotspot operator) will now be described. In this example, adevice 1502 is again first identified at a hotspot orsimilar access point 1506 via packet capture (PCAP), for example via aPCAP listener 1512 as introduced above. It will be appreciated that while this embodiment considers the use of PCAP for device recognition, other means such as provided via an RTLS data stream may also or alternatively be used to provide similar effect, with the potential added benefit of leveraging signal strength data available via RTLS and its equivalents. The PCAP event may provide a first detection instance in a particular visit, but may also provide subsequent detection instances, for example at regular intervals as per the normal operation of the device, which may periodically probe its environment for available network connections. Other event sources, such as a syslog in the context of authenticated network access, interaction with an opt-in service or application implemented on the remote device, and the like, can also be used to enrich visit data, each such event generally handled by theM2M module 1514 by respective event listeners/handlers 1522. A visit creation andaggregation module 1524 is operatively associated with theevent handlers 1522 to aggregate and store in knowledge base 1526 a visit profile for each uniquely identified device. In this particular embodiment, each visit is queued by avisit queue 1528 and processed by adata engine 1530 configured to receive, qualify and act upon compiled visit profiles, e.g. to isolate, filter and/or consolidate visits satisfying designated rules for further processing, reporting and/or action. For example, a particular visit profile may be pulled from thequeue 1528 and processed through arules engine 1532. Upon the visit profile matching a particular rule set atstep 1534, the visit profile can be identified to anaction engine 1536 with a particular action to be performed identified by the matching rule set, for output to thedownstream consumer 1538 atstep 1540. An exemplary action may include an HTTP Push Notification to the consumer, or other such reporting functions as will be illustrated in greater detail below. - Different illustrative rules may include, but are not limited to, rules for characterizing a selected visit as a function of preset conditions, such as duration and/or proximity (e.g. walk-in vs. walk-by), level of engagement (e.g. passive vs. active), type of engagement (e.g. detected vs. authenticated vs. opt-in device), opt-in status, etc.; rules for identifying visitors (e.g. opted-in visitors, return visitors, new visitors, long duration visitors) to whom targeted content may be pushed and/or with whom direct interaction should be promoted; reporting rules based on one or more visit qualifiers set as being of particular interest to the downstream consumer; etc. As will be appreciated by the skilled artisan, and as introduced above, rules may be set as a function of preset thresholds (e.g. proximity threshold or range, duration threshold or range, visit frequency and/or range, etc.), whereby cross-referencing of real-time and/or device/visit profile data with such thresholds may allow for adequate characterization of the device, its user, and their visit at the hotspot or similar location.
- With reference to
FIG. 16 , and in accordance with one embodiment, an illustrativedata management interface 1600 will now be described. In this example, a consolidated management interface can be provided to consolidate device identification and recognition data, report and analyse device activity and visit patterns, and so on. In this particular example, data is isolated for alloperators 1602 andlocations 1604 of a selectedBrand 1606, such as Starbucks™, for example, and that, for a selecteddate range 1608. Accordingly, aggregated data will be consolidated to present average activity data for all participating locations of this particular Brand, in this particular example, formatted to represent a visit dashboard (e.g. a selected subset of “at-a-glance” visit analytics for the selected period). - In the selected view, a
chart 1610 is provided tracking visits per hour during the course of a day, and comparing average visits over the selected data range (30 day trend) to current data (real-time tracking), thus visually identifying a current above-average number of visits per hour across all locations. Apie chart 1612 is also provided breaking down percentage total visits by day. Abar graph 1614 shows a percentage distribution of visits as a function of visit duration, showing a significant fraction of visits lasting approximately 15 minutes. A breakdown of visits per most-visitedlocations 1616 is also provided, distinguishingTotal Visits 1618 from Unique Visitors 1620 (i.e. collapsing repeat visitors). Other features and applications are also made available in the illustrated interface, including options for consolidating data on: Visit duration analytics; Unique location visit analytics; New visitor analytics; Day by day hourly visit analytics; Daily visits analytics; and Customer engagement analytics, to name a few. - With reference to
FIGS. 17A and 17B , regional and location-specific dashboards are respectively represented. In the regional dashboard ofFIG. 17A , data is compiled and displayed in respect of 5 designated locations in a given area. Selected data windows include the total number of visits for the day further subdivided as walk-bys (visits lasting less than 5 minutes in one example, thus suggestive that the user of the device may not have actually entered the premises, or again optionally further characterized by a visit during which device identification events were combined with proximity data to confirm that the device never entered the premises.), and walk-ins (visits lasting more than 5 minutes). Another selected window includes the total number of unique visits for the day (i.e. taking into account those making multiple visits, which may include those walking by repeatedly and thus being detected and recognized as such), again subdivided in to walk-ins and walk-bys. Another selected window classify recent walk-ins (e.g. visits detected to last more than 5 minutes) as loyal, casual or new visitors (e.g. based on preset loyalty rules). For example, devices recognized to attend one of the regional locations at least twice a week may be categorized as a loyal visitor, as compared to one recognised to attend only twice a month and thus characterized as casual. Similarly, recent walk-bys may also be characterized as such. Respective windows are also provided in this example to show a number of walk-ins within the last hour and an comparative indicia identifying a percent change in this value as compared to the previous hour; a number of walk-bys within the last hour and an comparative indicia identifying a percent change in this value as compared to the previous hour; and a pie chart tracking walk-in visit durations for the day in progress. - In the location-specific dashboard of
FIG. 17B , data is compiled and displayed in respect of a singular location. Selected data windows in this example are similar to those depicted in the embodiment ofFIG. 17A , with data necessarily representative of visitor traffic and activity within a single location. - Using substantially real-time data, as illustrated in
FIGS. 17A and 17B , and at a higher level inFIG. 16 , a hotspot operator may proceed to make educated decisions as to how to market or promote their services, namely in seeking to attract further clientele (e.g. investigate options for drawing in walk-bys, and particularly repeat walk-bys that may, for instance, be predicted to frequent a competing establishment in the area), and/or to better service existing clientele and encourage further engagement. Using real-time and/or regular data updates a local or regional operator may track immediate results to different marketing or promotional campaigns aimed at improving patronage. For example, a local coffee house hotspot operator may observe that walk-ins drop significantly during certain periods of the day or again on certain days, and investigate potential reasons therefore, which may lead to creative solutions to draw in greater patronage at those times or on those days. Similarly, peak walk-by periods may suggest the use of a more aggressive sidewalk promotion strategy around those periods to draw these visitors in. Other considerations may rely on acquired device profile data to plan for services and demand on given days, or during certain periods of the day. For example, while sales receipts may allow tracking of variable demand patterns, visit duration data may allow for greater insight as to physical space allowances, visitor comfort (i.e. would increasing visitor comfort or improving visitor environment help prolong visit durations and boost sales, or hinder flow through of new walk-ins.). - Similarly, given the potential real-time nature of the acquired data, immediate reporting or push notifications may be dispatched to the location in question to incite immediate action. For example, where walk-in rates show a significant drop over the course of the last hour, a location manager may immediately evaluate conditions that may have led to such decrease (e.g. overcrowded space or limited seating, shortage on certain menu items for a coffee shop or restaurant, loud or unpopular background music, disturbingly loud group of patrons, etc.). Access to such immediate observations on patronage and engagement may thus lead to faster identification and remediation of perceived issues, or again to noting particular characteristics or settings seemingly conducive to an increase in patronage (e.g. live music, effective sidewalk advertising, personal greeter at the door, etc.).
- Similarly, the immediate identification and recognition of repeat patrons may trigger a more receptive or dedicated service, as can recognition of “opt-in” devices at a given location be used to push instant notifications to those devices or again to service providers/sales representatives at the location to encourage provision of enhanced services, communicate a “usual” order to the cashier before an order is actually made, or simply allow for a personal greeting to a “regular” who may otherwise expect to be personally recognized by location.
- Accordingly, the compilation of such data may allow for direct or indirect reporting of business intelligence metrics and/or analytics which may be utilised to adjust or refine business practices and/or offerings and to observe immediate, short and/or long term effects of such refinements on the business's clientele and performance. As noted above, reports may be rendered “at-a-glance” in the form of comprehensive and/or customizable dashboards, as instant notifications, or alternatively rendered as detailed business intelligence reports for detailed analysis.
- Reporting can also take different forms depending on the intended analysis to be performed and intended outcome and application of such analyses. For example, data may be compiled to provide location segmentation reporting, such as to determine and illustrate a mix of devices recognized at a given location or group of locations (e.g. number of loyal/regular/occasional/new customers at a given time or during a given period). Data may also or alternatively be compiled to provide device segmentation reporting, such as to qualify the visit patterns of a particular device (e.g. Loyal/Regular/Occasional/etc.). Where a device has been opted-in to a particular service offering in exchange for the rights to disseminate, exchange and/or use the device's user's personal data (e.g. demographics) and/or communication streams (e.g. e-mail, SMS, social network, etc.), reports may also, or alternatively include specifics extracted from the device and/or user indicative of the user's gender, age, past purchase history, visit profiles, social status, etc. On the latter, further details and examples as to the various manners by which social data may be extracted, combined and bound with a user's device profile can be found in Applicant's co-pending United States Patent Application No. 2012/0192258, the contents of which are hereby incorporated herein by reference in their entirety. It will be appreciated that other types of reports may be considered herein, as can different permutations and combinations thereof, without departing from the general scope and nature of the present disclosure. The above also provides a few illustrative examples as to different applications to device identification, recognition, and tracking. Other such applications are clearly intended to fall within the general scope and nature of the present disclosure, as will be further detailed below.
- With reference now to
FIG. 18 , and in accordance with some embodiments, illustrative downstream applications for a device detection and recognition system will now be described. In this example,wireless devices 1802 at a given hotspot orsimilar location 1806 may be detected andrespective device profiles 1808 created and/or populated inknowledge base 1810 to track and report on device activity at this location. Arespective location state 1812 is generally associated with each device profile instance, along with a timestamp or the like, as noted above, to ultimately characterize device presence/activity, location and timelines (e.g. visits) for further processing. In this embodiment, knowledge base data is made accessible to a consumer through aretailer API 1820, or the like, so to update store (location) states 1822 and providevisitor presence notifications 1824, for example. For instance,store state updates 1822 may include, but are not limited to, the push or pull of global, regional and/or local visitor dashboard updates, or the like, so to allow for the substantially real-time processing of visitor activity data in extracting immediate or near immediate market intelligence. In some embodiments, immediate action may be initiated as a function of store updates, such as the application of instantaneous promotions, service upgrades, or again, in increasing network access coverage and/or capacity where visitor updates are indicative of an increased demand for network access, for example. Long term projections and analytics may also or alternatively be compiled based on updated data compiled over time. - In this example, the
retailer API 1820 communicates with one ormore retailer applications 1826, which may also access retailer CRM data andcontent 1828 to supplement interactions with visitors at the hotspot location(s). For example,retailer applications 1826 may be configured to provide targeted Wi-Fi hotspot content 1830 to visitors, namely visitors actively engaged via network authentication or opt-in visitors readily accessible, for example, by way of contact data or information volunteered by the visitor during the opt-in process (e.g. social network interface/account-related content, web content or pop-up advertising, foreground inset content, background content, etc.). Additionally, or alternatively, targeted content may be pushed viaretailer app integration 1832 on the visiting device, for example once downloaded upon opting-in for related services. Other examples of pushed or targeted content may include the sending of an e-mail or SMS message, for example, where such contact information has been volunteered or extracted and used under approval by the user of the device, again, possibly in the context of network engagement at a given hotspot. - For example, a device may opt-in to receive promotional information form an airline and its affiliates upon using the airline's network access services in their first class waiting lounge. Following from this example, the airline may be affiliated with a hotel chain such that, upon the user's device being detected at the airport lounge prior to leaving for a flight, the device owner's flight information may be retrieved by cross-referencing the user's e-mail as provided during the opt-in process for receiving promotional information, with an e-mail contact field associated with the user's flight ticket. Accordingly, the user's destination for that day may also be identified, allowing for targeted content associated with this destination (e.g. hotel chain location at the user's destination) to be pushed to the user. In a similar manner, upon the user's device being detected and recognized in the lobby at a given hotel chain location associated with the opt-in airline, a targeted message could be sent to the device welcoming the user and offering one or more promotional incentives, such as a room upgrade, complimentary breakfast, or the like.
- As will be appreciated by the skilled artisan, from implementation of device location and recognition at different hotspot or similar locations within a given network as described above, and further by optionally tracking device engagement levels, visit profiles, and opt-in statuses and the like, myriad applications may be implemented to leverage the information gathered, tracked and compiled in real-time and/or over time to enhance network user experience, customer targeting, promotional efforts, operational projections, cross-partnership or affiliation advertising, to name a few.
- While the present disclosure describes various exemplary embodiments, the disclosure is not so limited. To the contrary, the disclosure is intended to cover various modifications and equivalent arrangements included within the general spirit and scope of the present disclosure.
Claims (21)
Priority Applications (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US15/294,478 US20170034692A1 (en) | 2007-06-06 | 2016-10-14 | System and method for remote device recognition at public hotspots |
US16/773,735 US20200162890A1 (en) | 2007-06-06 | 2020-01-27 | System and method for wireless device detection, recognition and visit profiling |
US17/661,666 US12028935B2 (en) | 2007-06-06 | 2022-05-02 | System and method for wireless device detection, recognition and visit profiling |
Applications Claiming Priority (7)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US94240907P | 2007-06-06 | 2007-06-06 | |
PCT/CA2008/001060 WO2008148191A2 (en) | 2007-06-06 | 2008-06-06 | Remote service access system and method |
US45190910A | 2010-01-07 | 2010-01-07 | |
US13/666,784 US9003488B2 (en) | 2007-06-06 | 2012-11-01 | System and method for remote device recognition at public hotspots |
US14/638,484 US9203840B2 (en) | 2007-06-06 | 2015-03-04 | System and method for remote device recognition at public hotspots |
US14/942,154 US20160073252A1 (en) | 2007-06-06 | 2015-11-16 | System and method for remote device recognition at public hotspots |
US15/294,478 US20170034692A1 (en) | 2007-06-06 | 2016-10-14 | System and method for remote device recognition at public hotspots |
Related Parent Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/942,154 Continuation US20160073252A1 (en) | 2007-06-06 | 2015-11-16 | System and method for remote device recognition at public hotspots |
US14/942,154 Continuation-In-Part US20160073252A1 (en) | 2007-06-06 | 2015-11-16 | System and method for remote device recognition at public hotspots |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US16/773,735 Continuation-In-Part US20200162890A1 (en) | 2007-06-06 | 2020-01-27 | System and method for wireless device detection, recognition and visit profiling |
Publications (1)
Publication Number | Publication Date |
---|---|
US20170034692A1 true US20170034692A1 (en) | 2017-02-02 |
Family
ID=48655891
Family Applications (4)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/666,784 Active 2029-04-29 US9003488B2 (en) | 2007-06-06 | 2012-11-01 | System and method for remote device recognition at public hotspots |
US14/638,484 Active US9203840B2 (en) | 2007-06-06 | 2015-03-04 | System and method for remote device recognition at public hotspots |
US14/942,154 Abandoned US20160073252A1 (en) | 2007-06-06 | 2015-11-16 | System and method for remote device recognition at public hotspots |
US15/294,478 Abandoned US20170034692A1 (en) | 2007-06-06 | 2016-10-14 | System and method for remote device recognition at public hotspots |
Family Applications Before (3)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/666,784 Active 2029-04-29 US9003488B2 (en) | 2007-06-06 | 2012-11-01 | System and method for remote device recognition at public hotspots |
US14/638,484 Active US9203840B2 (en) | 2007-06-06 | 2015-03-04 | System and method for remote device recognition at public hotspots |
US14/942,154 Abandoned US20160073252A1 (en) | 2007-06-06 | 2015-11-16 | System and method for remote device recognition at public hotspots |
Country Status (1)
Country | Link |
---|---|
US (4) | US9003488B2 (en) |
Cited By (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US9900742B1 (en) | 2017-03-17 | 2018-02-20 | SCRRD, Inc. | Wireless device detection, tracking, and authentication platform and techniques |
US10085118B1 (en) | 2017-03-17 | 2018-09-25 | SCRRD, Inc. | Wireless device detection, tracking, and authentication platform and techniques |
CN109951520A (en) * | 2019-01-24 | 2019-06-28 | 深圳中兴网信科技有限公司 | A kind of data transmission method, air monitering equipment and storage medium |
US10341814B2 (en) | 2017-03-17 | 2019-07-02 | SCRRD, Inc. | Wireless device detection, tracking, and authentication platform and techniques |
WO2021076187A1 (en) * | 2019-10-15 | 2021-04-22 | Google Llc | Privacy enhanced personalization on public connections |
US11297688B2 (en) | 2018-03-22 | 2022-04-05 | goTenna Inc. | Mesh network deployment kit |
WO2023279027A1 (en) * | 2021-06-29 | 2023-01-05 | Juniper Networks, Inc. | Network access anomaly detection and mitigation |
US12028935B2 (en) | 2007-06-06 | 2024-07-02 | Datavalet Technologies | System and method for wireless device detection, recognition and visit profiling |
Families Citing this family (179)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20060266157A1 (en) * | 2003-09-05 | 2006-11-30 | Dai Nippon Toryo Co., Ltd. | Metal fine particles, composition containing the same, and production method for producing metal fine particles |
US20140355592A1 (en) | 2012-11-01 | 2014-12-04 | Datavalet Technologies | System and method for wireless device detection, recognition and visit profiling |
US8682960B2 (en) * | 2008-03-14 | 2014-03-25 | Nokia Corporation | Methods, apparatuses, and computer program products for providing filtered services and content based on user context |
US8489732B1 (en) * | 2009-08-07 | 2013-07-16 | Google Inc. | System and method of using spatial and temporal signals to identify and prevent attacks |
US8776214B1 (en) | 2009-08-12 | 2014-07-08 | Amazon Technologies, Inc. | Authentication manager |
US9071634B2 (en) * | 2009-10-30 | 2015-06-30 | Ncr Corporation | Network management system, software and method |
US8811942B2 (en) * | 2009-11-15 | 2014-08-19 | Nokia Corporation | Method and apparatus for the activation of services |
CN102131197B (en) * | 2010-01-20 | 2015-09-16 | 中兴通讯股份有限公司 | A kind of method and system of access network on common equipment |
CN102130887B (en) * | 2010-01-20 | 2019-03-12 | 中兴通讯股份有限公司 | A kind of method and system accessing network on common equipment |
US9417691B2 (en) * | 2010-03-26 | 2016-08-16 | Nokia Technologies Oy | Method and apparatus for ad-hoc peer-to-peer augmented reality environment |
JP5016713B2 (en) * | 2010-09-28 | 2012-09-05 | 株式会社エヌ・ティ・ティ・ドコモ | Wireless communication apparatus and wireless communication method |
US9767262B1 (en) | 2011-07-29 | 2017-09-19 | Amazon Technologies, Inc. | Managing security credentials |
US11444936B2 (en) | 2011-07-29 | 2022-09-13 | Amazon Technologies, Inc. | Managing security credentials |
US10362019B2 (en) | 2011-07-29 | 2019-07-23 | Amazon Technologies, Inc. | Managing security credentials |
CN104067587B (en) * | 2011-09-08 | 2017-10-20 | 英特尔公司 | Method and apparatus for device configuration file in wireless network |
US20130067081A1 (en) * | 2011-09-12 | 2013-03-14 | Qualcomm Incorporated | Mobile Device Authentication and Access to a Social Network |
US9058573B2 (en) * | 2011-11-21 | 2015-06-16 | Facebook, Inc. | Network traffic-analysis-based suggestion generation |
US8863250B2 (en) | 2012-02-01 | 2014-10-14 | Amazon Technologies, Inc. | Logout from multiple network sites |
US8955065B2 (en) | 2012-02-01 | 2015-02-10 | Amazon Technologies, Inc. | Recovery of managed security credentials |
US10503888B2 (en) * | 2012-03-16 | 2019-12-10 | Traitware, Inc. | Authentication system |
JP5983730B2 (en) * | 2012-03-16 | 2016-09-06 | ソニー株式会社 | Information processing apparatus, wireless communication apparatus, and information processing method |
US20150113039A1 (en) * | 2012-04-27 | 2015-04-23 | P2S Media Group Oy | Method and apparatus for defining hot spot based task for multimedia data |
US10075471B2 (en) | 2012-06-07 | 2018-09-11 | Amazon Technologies, Inc. | Data loss prevention techniques |
US10084818B1 (en) | 2012-06-07 | 2018-09-25 | Amazon Technologies, Inc. | Flexibly configurable data modification services |
US9286491B2 (en) | 2012-06-07 | 2016-03-15 | Amazon Technologies, Inc. | Virtual service provider zones |
MY179999A (en) * | 2012-07-31 | 2020-11-19 | Telekom Malaysia Berhad | A system for the management of access points |
US9619017B2 (en) * | 2012-11-07 | 2017-04-11 | Qualcomm Incorporated | Techniques for utilizing a computer input device with multiple computers |
JP5674751B2 (en) * | 2012-12-04 | 2015-02-25 | ヤフー株式会社 | Member registration system, member registration device and member registration method |
US9306754B2 (en) | 2012-12-28 | 2016-04-05 | Nok Nok Labs, Inc. | System and method for implementing transaction signing within an authentication framework |
US9172687B2 (en) * | 2012-12-28 | 2015-10-27 | Nok Nok Labs, Inc. | Query system and method to determine authentication capabilities |
US9219732B2 (en) | 2012-12-28 | 2015-12-22 | Nok Nok Labs, Inc. | System and method for processing random challenges within an authentication framework |
US9083689B2 (en) | 2012-12-28 | 2015-07-14 | Nok Nok Labs, Inc. | System and method for implementing privacy classes within an authentication framework |
US9015482B2 (en) | 2012-12-28 | 2015-04-21 | Nok Nok Labs, Inc. | System and method for efficiently enrolling, registering, and authenticating with multiple authentication devices |
US20140207847A1 (en) * | 2013-01-22 | 2014-07-24 | Karma Mobility Inc. | Portable bandwidth server |
US9282098B1 (en) | 2013-03-11 | 2016-03-08 | Amazon Technologies, Inc. | Proxy server-based network site account management |
US9628414B1 (en) * | 2013-03-15 | 2017-04-18 | Google Inc. | User state based engagement |
US20140280560A1 (en) * | 2013-03-15 | 2014-09-18 | Facebook, Inc. | Capturing User Information In An Online System Based On Real-World Actions |
US10296487B2 (en) | 2013-03-15 | 2019-05-21 | The Directv Group, Inc. | Method and system for operating user receiving devices with user profiles |
US10063924B2 (en) | 2013-03-15 | 2018-08-28 | The Directv Group, Inc. | Method and system for transferring user settings to another user receiving device using a mobile user device |
AU2014232422A1 (en) * | 2013-03-15 | 2015-09-24 | Adt Us Holdings, Inc. | Security system access profiles |
US9351040B2 (en) * | 2013-03-15 | 2016-05-24 | The Directv Group, Inc. | Method and system for transferring user settings to another user receiving device |
US9838481B2 (en) * | 2013-03-22 | 2017-12-05 | Verizon Patent And Licensing Inc. | Provisioning of network communication parameters based on device type |
US9887983B2 (en) | 2013-10-29 | 2018-02-06 | Nok Nok Labs, Inc. | Apparatus and method for implementing composite authenticators |
US10270748B2 (en) | 2013-03-22 | 2019-04-23 | Nok Nok Labs, Inc. | Advanced authentication techniques and applications |
US9305298B2 (en) | 2013-03-22 | 2016-04-05 | Nok Nok Labs, Inc. | System and method for location-based authentication |
US20160007161A1 (en) * | 2013-03-30 | 2016-01-07 | Qatar University Qstp-B | System and method for detection and tracking of wireless enabled objects |
US10467629B2 (en) * | 2015-05-01 | 2019-11-05 | Veeva Systems Inc. | System and method for creating a new account in CRM |
US9961077B2 (en) | 2013-05-30 | 2018-05-01 | Nok Nok Labs, Inc. | System and method for biometric authentication with device attestation |
CN104219081B (en) * | 2013-06-05 | 2018-11-30 | 富泰华工业(深圳)有限公司 | Network connection management equipment and network connection management method |
US9590884B2 (en) * | 2013-07-03 | 2017-03-07 | Facebook, Inc. | Native application hotspot |
TWI492647B (en) * | 2013-08-20 | 2015-07-11 | D Link Corp | Quickly access hotspot selection method |
US9445259B2 (en) * | 2013-09-24 | 2016-09-13 | Alcatel Lucent | Service provider certified device policy management |
US9178889B2 (en) * | 2013-09-27 | 2015-11-03 | Paypal, Inc. | Systems and methods for pairing a credential to a device identifier |
US9473940B2 (en) * | 2015-02-20 | 2016-10-18 | Roku, Inc. | Authenticating a browser-less data streaming device to a network with an external browser |
US9313646B2 (en) | 2013-10-17 | 2016-04-12 | At&T Intellectual Property I, Lp | Method and apparatus for adjusting device persona |
US20160285949A1 (en) * | 2013-10-30 | 2016-09-29 | Le Shi Zhi Xin Electronic Technology (Tianjin) Limited | Wireless login-based remote control method and device |
US9544331B2 (en) * | 2013-10-31 | 2017-01-10 | Aruba Networks, Inc. | Method and system for controlling access to shared devices |
US10134098B2 (en) * | 2013-11-11 | 2018-11-20 | Nomadix, Inc. | Traveler tracking system |
US10311482B2 (en) | 2013-11-11 | 2019-06-04 | At&T Intellectual Property I, Lp | Method and apparatus for adjusting a digital assistant persona |
US10475018B1 (en) | 2013-11-29 | 2019-11-12 | Amazon Technologies, Inc. | Updating account data for multiple account providers |
MY169876A (en) * | 2013-12-04 | 2019-05-28 | Infostandard Sdn Bhd | System and method for transferring electronic information |
US9560158B2 (en) | 2013-12-12 | 2017-01-31 | Hassen Damon Alhandy | Social networking using local area networks |
US10171577B2 (en) | 2013-12-12 | 2019-01-01 | Wififace Llc | Local area networking system |
US10367827B2 (en) | 2013-12-19 | 2019-07-30 | Splunk Inc. | Using network locations obtained from multiple threat lists to evaluate network data or machine data |
KR101621400B1 (en) | 2013-12-20 | 2016-05-16 | 주식회사 쏠리드 | An optical repeating system and a method of setting up identification information of a remote device therein |
IN2013CH05960A (en) * | 2013-12-20 | 2015-06-26 | Samsung R & D Inst India Bangalore Private Ltd | |
KR102052607B1 (en) * | 2014-01-24 | 2020-01-08 | 한국전자통신연구원 | Smart device having thing searching browser and thing mashup method using the smart device |
GB2537553B (en) * | 2014-01-28 | 2018-09-12 | Imagination Tech Ltd | Proximity detection |
EP2903209B1 (en) * | 2014-01-30 | 2018-11-14 | Siemens Aktiengesellschaft | Method for updating message filter rules of a network access control unit of an industrial communication network, address management unit and converter unit |
WO2015126744A1 (en) * | 2014-02-18 | 2015-08-27 | Secureauth Corporation | Fingerprint based authentication for single sign on |
US9467815B2 (en) * | 2014-03-20 | 2016-10-11 | Google Inc. | Systems and methods for generating a user location history |
US20150302483A1 (en) * | 2014-04-17 | 2015-10-22 | The Captiveyes Group Inc. | Customized landing page system and method |
KR102216049B1 (en) * | 2014-04-21 | 2021-02-15 | 삼성전자주식회사 | System and method for semantic labeling |
US9654469B1 (en) | 2014-05-02 | 2017-05-16 | Nok Nok Labs, Inc. | Web-based user authentication techniques and applications |
US9577999B1 (en) | 2014-05-02 | 2017-02-21 | Nok Nok Labs, Inc. | Enhanced security for registration of authentication devices |
US9836594B2 (en) * | 2014-05-19 | 2017-12-05 | Bank Of America Corporation | Service channel authentication token |
US9277018B2 (en) * | 2014-06-11 | 2016-03-01 | Verizon Patent And Licensing Inc. | Mobile device detection of wireless beacons and automatic performance of actions |
KR101519301B1 (en) * | 2014-06-26 | 2015-05-11 | 황영만 | The user authentication device based on one time password generation and the method |
US9356914B2 (en) | 2014-07-30 | 2016-05-31 | Gracenote, Inc. | Content-based association of device to user |
US10148630B2 (en) | 2014-07-31 | 2018-12-04 | Nok Nok Labs, Inc. | System and method for implementing a hosted authentication service |
US9875347B2 (en) | 2014-07-31 | 2018-01-23 | Nok Nok Labs, Inc. | System and method for performing authentication using data analytics |
US9749131B2 (en) | 2014-07-31 | 2017-08-29 | Nok Nok Labs, Inc. | System and method for implementing a one-time-password using asymmetric cryptography |
US9374664B2 (en) * | 2014-08-28 | 2016-06-21 | Google Inc. | Venue-specific wi-fi connectivity notifications |
US9736154B2 (en) | 2014-09-16 | 2017-08-15 | Nok Nok Labs, Inc. | System and method for integrating an authentication service within a network architecture |
US20160092532A1 (en) * | 2014-09-29 | 2016-03-31 | Facebook, Inc. | Load-balancing inbound real-time data updates for a social networking system |
US9245409B1 (en) * | 2014-10-04 | 2016-01-26 | Joingo, LLC. | System and method for communicating a gaming machine notification to a mobile device |
CN105516071B (en) * | 2014-10-13 | 2019-01-18 | 阿里巴巴集团控股有限公司 | Verify method, apparatus, terminal and the server of business operation safety |
GB2549643B (en) * | 2014-10-13 | 2021-12-29 | Pismo Labs Technology Ltd | Methods and systems for configuring electronic devices |
US10021108B2 (en) * | 2014-10-16 | 2018-07-10 | Ca, Inc. | Anomaly detection for access control events |
US10586240B2 (en) * | 2014-10-22 | 2020-03-10 | Mastercard International Incorporated | Methods and systems for estimating visitor traffic at a real property location |
US9692838B2 (en) * | 2014-12-09 | 2017-06-27 | Facebook, Inc. | Generating business insights using beacons on online social networks |
CN105763594B (en) * | 2014-12-19 | 2021-05-25 | 阿里巴巴集团控股有限公司 | Information pushing method and device |
US9628477B2 (en) * | 2014-12-23 | 2017-04-18 | Intel Corporation | User profile selection using contextual authentication |
WO2016117500A1 (en) * | 2015-01-19 | 2016-07-28 | 日本電気株式会社 | Authentication apparatus, method, system and program, and server apparatus |
US10334085B2 (en) * | 2015-01-29 | 2019-06-25 | Splunk Inc. | Facilitating custom content extraction from network packets |
US10623502B2 (en) * | 2015-02-04 | 2020-04-14 | Blackberry Limited | Link indication referring to content for presenting at a mobile device |
US10116601B2 (en) * | 2015-02-06 | 2018-10-30 | Jamdeo Canada Ltd. | Methods and devices for display device notifications |
DE102015202485B4 (en) * | 2015-02-12 | 2018-08-02 | Sap Se | Telecommunication method for authenticating a user |
US9405813B1 (en) * | 2015-02-19 | 2016-08-02 | Vuclip | Media device knowledge base |
US10582468B2 (en) * | 2015-02-19 | 2020-03-03 | Time Warner Cable Enterprises Llc | Registration of devices for use of one or more services |
US9621736B2 (en) * | 2015-02-24 | 2017-04-11 | Broadview Communications, Llc | Method and system for sponsoring location based mobile data services |
US11373204B2 (en) * | 2015-03-11 | 2022-06-28 | Meta Platforms, Inc. | User interface tool for applying universal action tags |
JP6533085B2 (en) | 2015-03-31 | 2019-06-19 | Line株式会社 | Terminal, information processing method, and program |
US10225795B2 (en) | 2015-04-07 | 2019-03-05 | At&T Intellectual Property I, L.P. | Resource-sensitive token-based access point selection |
US10404532B2 (en) * | 2015-04-10 | 2019-09-03 | Comcast Cable Commnications, LLC | Virtual gateway control and management |
US10298563B2 (en) | 2015-04-29 | 2019-05-21 | Hewlett Packard Enterprise Development Lp | Multi-factor authorization for IEEE 802.1x-enabled networks |
US10057172B2 (en) * | 2015-05-17 | 2018-08-21 | At&T Intellectual Property I, L.P. | Optimized routing in connected environments |
US20160343029A1 (en) * | 2015-05-20 | 2016-11-24 | Fortinet, Inc. | Content presentation based on access point location |
CN106330844B (en) * | 2015-07-02 | 2020-08-04 | 阿里巴巴集团控股有限公司 | Cross-terminal login-free method and device |
JP6008412B1 (en) * | 2015-07-07 | 2016-10-19 | Necプラットフォームズ株式会社 | COMMUNICATION CONTROL DEVICE, CALL CONTROL METHOD, AND CALL CONTROL PROGRAM |
US10068027B2 (en) | 2015-07-22 | 2018-09-04 | Google Llc | Systems and methods for selecting content based on linked devices |
US11533584B2 (en) * | 2015-09-16 | 2022-12-20 | Ivani, LLC | Blockchain systems and methods for confirming presence |
US10382893B1 (en) | 2015-09-16 | 2019-08-13 | Ivani, LLC | Building system control utilizing building occupancy |
US10665284B2 (en) | 2015-09-16 | 2020-05-26 | Ivani, LLC | Detecting location within a network |
US9674735B2 (en) * | 2015-09-22 | 2017-06-06 | Veniam, Inc. | Systems and methods for managing connectivity in a network of moving things |
CN106686151B (en) * | 2015-11-11 | 2020-05-15 | 阿里巴巴集团控股有限公司 | IP address obtaining method and device |
WO2017084051A1 (en) * | 2015-11-18 | 2017-05-26 | 深圳市大疆创新科技有限公司 | External device management method, apparatus and system, memory, and unmanned aerial vehicle |
US10200288B2 (en) * | 2015-12-18 | 2019-02-05 | Xerox Corporation | Shaping data traffic within a local area network |
US9571980B1 (en) * | 2015-12-28 | 2017-02-14 | Cisco Technology, Inc. | Augmenting Wi-Fi localization with auxiliary sensor information |
US10817593B1 (en) * | 2015-12-29 | 2020-10-27 | Wells Fargo Bank, N.A. | User information gathering and distribution system |
US10356164B2 (en) * | 2015-12-29 | 2019-07-16 | International Business Machines Corporation | Load balancing for points of interest |
US11354683B1 (en) | 2015-12-30 | 2022-06-07 | Videomining Corporation | Method and system for creating anonymous shopper panel using multi-modal sensor fusion |
US10262331B1 (en) | 2016-01-29 | 2019-04-16 | Videomining Corporation | Cross-channel in-store shopper behavior analysis |
US10963893B1 (en) | 2016-02-23 | 2021-03-30 | Videomining Corporation | Personalized decision tree based on in-store behavior analysis |
US10334062B2 (en) * | 2016-02-25 | 2019-06-25 | InAuth, Inc. | Systems and methods for recognizing a device |
US20170257353A1 (en) * | 2016-03-07 | 2017-09-07 | Ricoh Company, Ltd. | System For Using Login Information And Historical Data To Determine Processing For Data Received From Various Data Sources |
US10084679B2 (en) * | 2016-03-22 | 2018-09-25 | Qualcomm Incorporated | Standalone network probing using available network connections |
WO2017176263A1 (en) * | 2016-04-06 | 2017-10-12 | Hewlett-Packard Development Company, L.P. | Portable device identifiers determination |
US9977915B2 (en) * | 2016-04-19 | 2018-05-22 | Bank Of America Corporation | System for controlling database security and access |
US10387896B1 (en) | 2016-04-27 | 2019-08-20 | Videomining Corporation | At-shelf brand strength tracking and decision analytics |
US10122725B2 (en) * | 2016-05-19 | 2018-11-06 | Centurylink Intellectual Property Llc | System and method for implementing community wireless communications service |
US10354262B1 (en) | 2016-06-02 | 2019-07-16 | Videomining Corporation | Brand-switching analysis using longitudinal tracking of at-shelf shopper behavior |
US20170353353A1 (en) * | 2016-06-03 | 2017-12-07 | Uptake Technologies, Inc. | Provisioning a Local Analytics Device |
US10769635B2 (en) | 2016-08-05 | 2020-09-08 | Nok Nok Labs, Inc. | Authentication techniques including speech and/or lip movement analysis |
US10637853B2 (en) | 2016-08-05 | 2020-04-28 | Nok Nok Labs, Inc. | Authentication techniques including speech and/or lip movement analysis |
US10178093B2 (en) * | 2016-08-12 | 2019-01-08 | Sears Brands, L.L.C. | Systems and methods for online fraud detection |
US10367784B2 (en) | 2016-09-30 | 2019-07-30 | Palo Alto Networks, Inc. | Detection of compromised credentials as a network service |
US10701049B2 (en) | 2016-09-30 | 2020-06-30 | Palo Alto Networks, Inc. | Time-based network authentication challenges |
EP3840333A1 (en) * | 2016-09-30 | 2021-06-23 | Palo Alto Networks, Inc. | Multifactor authentication as a network service |
US10547600B2 (en) | 2016-09-30 | 2020-01-28 | Palo Alto Networks, Inc. | Multifactor authentication as a network service |
US9877153B1 (en) * | 2016-10-18 | 2018-01-23 | International Business Machines Corporation | Mobile device path and user association |
US10091195B2 (en) | 2016-12-31 | 2018-10-02 | Nok Nok Labs, Inc. | System and method for bootstrapping a user binding |
US10237070B2 (en) | 2016-12-31 | 2019-03-19 | Nok Nok Labs, Inc. | System and method for sharing keys across authenticators |
CN107800678B (en) * | 2017-02-16 | 2020-04-03 | 平安科技(深圳)有限公司 | Method and device for detecting abnormal registration of terminal |
EP3596951A4 (en) | 2017-04-20 | 2020-11-25 | Hewlett-Packard Development Company, L.P. | Data connection switching |
US10805377B2 (en) * | 2017-05-18 | 2020-10-13 | Cisco Technology, Inc. | Client device tracking |
US10614122B2 (en) | 2017-06-09 | 2020-04-07 | Google Llc | Balance modifications of audio-based computer program output using a placeholder field based on content |
US10600409B2 (en) | 2017-06-09 | 2020-03-24 | Google Llc | Balance modifications of audio-based computer program output including a chatbot selected based on semantic processing of audio |
US10657173B2 (en) | 2017-06-09 | 2020-05-19 | Google Llc | Validate modification of audio-based computer program output |
US10652170B2 (en) | 2017-06-09 | 2020-05-12 | Google Llc | Modification of audio-based computer program output |
US11070513B2 (en) | 2017-06-26 | 2021-07-20 | Zedly, Inc. | DNS-based method of transmitting data |
US11868995B2 (en) | 2017-11-27 | 2024-01-09 | Nok Nok Labs, Inc. | Extending a secure key storage for transaction confirmation and cryptocurrency |
WO2019134920A1 (en) * | 2018-01-02 | 2019-07-11 | Laterpay Ag | Methods for access point systems and payment systems therefor |
US11831409B2 (en) | 2018-01-12 | 2023-11-28 | Nok Nok Labs, Inc. | System and method for binding verifiable claims |
CN110099393B (en) | 2018-01-30 | 2022-06-21 | 阿里巴巴集团控股有限公司 | Method, device and system for monitoring network access state of distribution network equipment |
US10878051B1 (en) * | 2018-03-30 | 2020-12-29 | Palantir Technologies Inc. | Mapping device identifiers |
US11481837B1 (en) | 2018-04-12 | 2022-10-25 | Wells Fargo Bank, N.A. | Authentication circle management |
US11386412B1 (en) | 2018-04-12 | 2022-07-12 | Wells Fargo Bank, N.A. | Authentication circle management |
US10965672B2 (en) * | 2018-04-13 | 2021-03-30 | At&T Intellectual Property I, L.P. | Network service control for access to wireless radio networks |
US10943308B1 (en) | 2018-05-03 | 2021-03-09 | Wells Fargo Bank, N.A. | Systems and methods for pervasive advisor for major expenditures |
US10878218B2 (en) * | 2018-06-18 | 2020-12-29 | Salesforce.Com, Inc. | Device fingerprinting, tracking, and management |
US10993110B2 (en) * | 2018-07-13 | 2021-04-27 | Nvidia Corp. | Connectionless fast method for configuring Wi-Fi on displayless Wi-Fi IoT device |
CN108600280B (en) * | 2018-08-06 | 2020-11-03 | 连尚(新昌)网络科技有限公司 | Network connection method, equipment and storage medium |
US11847196B2 (en) | 2018-11-01 | 2023-12-19 | 3M Innovative Properties Company | Device, user, or server registration and verification |
US10805690B2 (en) | 2018-12-04 | 2020-10-13 | The Nielsen Company (Us), Llc | Methods and apparatus to identify media presentations by analyzing network traffic |
US11171956B2 (en) | 2019-01-31 | 2021-11-09 | At&T Intellectual Property I, L.P. | Systems and methods for initiating network access according to automatic authentication utilizing a mobile device |
US12041039B2 (en) | 2019-02-28 | 2024-07-16 | Nok Nok Labs, Inc. | System and method for endorsing a new authenticator |
US11792024B2 (en) | 2019-03-29 | 2023-10-17 | Nok Nok Labs, Inc. | System and method for efficient challenge-response authentication |
US10778681B1 (en) * | 2019-04-12 | 2020-09-15 | Capital One Services, Llc | Using common identifiers related to location to link fraud across mobile devices |
US11201958B2 (en) * | 2020-01-20 | 2021-12-14 | Ppip, Llc | Alternative transport in data communication for mobile device |
US11751261B2 (en) * | 2020-03-06 | 2023-09-05 | Qualcomm Incorporated | Smart link management (link pooling) |
CN113596898B (en) * | 2020-04-30 | 2024-07-23 | 华为技术有限公司 | Method, device, equipment, storage medium and system for determining terminal portrait |
CN115812316A (en) * | 2020-05-13 | 2023-03-17 | 缪国往 | Method and system for automatic authentication and ownership management |
US11681669B2 (en) | 2020-06-22 | 2023-06-20 | HCL Technologies Italy S.p.A. | Method and system for correlating multiple device entries within domain |
TWI811603B (en) * | 2020-12-29 | 2023-08-11 | 司圖科技股份有限公司 | Poi tracking analysis system and people flow system |
KR102369960B1 (en) * | 2021-07-30 | 2022-03-04 | 쿠팡 주식회사 | Electronic apparatus for providing information based on existence of a user account and method thereof |
US11570279B1 (en) * | 2022-02-25 | 2023-01-31 | International Business Machines Corporation | Automated port configuration management in a service mesh |
CN114827080B (en) * | 2022-06-06 | 2022-09-23 | 武汉四通信息服务有限公司 | IP switching method and system |
CN115150217A (en) * | 2022-06-30 | 2022-10-04 | 青岛海信移动通信技术股份有限公司 | Network distribution method, device and equipment for intelligent household equipment |
Citations (33)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20020116266A1 (en) * | 2001-01-12 | 2002-08-22 | Thaddeus Marshall | Method and system for tracking and providing incentives for time and attention of persons and for timing of performance of tasks |
US20020176579A1 (en) * | 2001-05-24 | 2002-11-28 | Deshpande Nikhil M. | Location-based services using wireless hotspot technology |
US20030031154A1 (en) * | 2001-08-08 | 2003-02-13 | Takero Kobayashi | Network connection apparatus and network connection control method |
US20030115288A1 (en) * | 2001-12-14 | 2003-06-19 | Ljubicich Philip A. | Technique for effective management of information and communications using a mobile device |
US20030233458A1 (en) * | 2002-02-19 | 2003-12-18 | Hwang-Sub Kwon | System and method for providing service in wireless network environment using customer relation management |
US20040181692A1 (en) * | 2003-01-13 | 2004-09-16 | Johanna Wild | Method and apparatus for providing network service information to a mobile station by a wireless local area network |
US20040235455A1 (en) * | 2003-02-18 | 2004-11-25 | Jiang Yue Jun | Integrating GSM and WiFi service in mobile communication devices |
US20050021781A1 (en) * | 2003-06-05 | 2005-01-27 | Singam Sunder | Method and system of providing access point data associated with a network access point |
US20050038744A1 (en) * | 2001-11-29 | 2005-02-17 | Viijoen Niel Eben | Method and system for operating a banking service |
US20050053296A1 (en) * | 2003-09-07 | 2005-03-10 | Microsoft Corporation | Bitplane coding for macroblock field/frame coding type information |
US20050060456A1 (en) * | 2003-09-16 | 2005-03-17 | Denali Software, Inc. | Method and apparatus for multi-port memory controller |
US20050242928A1 (en) * | 2004-04-29 | 2005-11-03 | International Business Machines Corporation | Method and apparatus for responding to medical alerts |
US20060073788A1 (en) * | 2004-10-01 | 2006-04-06 | Vesa Halkka | Context based connectivity for mobile devices |
US20060182045A1 (en) * | 2005-02-14 | 2006-08-17 | Eric Anderson | Group interaction modes for mobile devices |
US20060236105A1 (en) * | 2005-03-31 | 2006-10-19 | Jacco Brok | Authenticating a user of a communication device to a wireless network to which the user is not associated with |
US20070113269A1 (en) * | 2003-07-29 | 2007-05-17 | Junbiao Zhang | Controlling access to a network using redirection |
US20070156537A1 (en) * | 2005-12-29 | 2007-07-05 | Sap Ag | Methods and systems for determining the user's interests |
US20070204027A1 (en) * | 2006-02-24 | 2007-08-30 | Ming-Shan Shih | Method for displaying a real-time message on a mobile communication device |
US20080039102A1 (en) * | 2004-09-08 | 2008-02-14 | Pat Sewall | Hotspot Communication Limiter |
US20080119276A1 (en) * | 2006-11-16 | 2008-05-22 | Alderucci Dean P | Using a first device to verify whether a second device is communicating with a server |
US20080152099A1 (en) * | 2006-12-22 | 2008-06-26 | Mobileaxept As | Efficient authentication of a user for conduct of a transaction initiated via mobile telephone |
US20090064283A1 (en) * | 2005-03-21 | 2009-03-05 | Matsushita Electric Industrial Co., Ltd. | System and method for automatic security authentication in wireless networks |
US20090070859A1 (en) * | 2005-04-22 | 2009-03-12 | Thomson Licensing | Method and Apparatuses for Secure, Anonymous Wireless Lan (WLAN) Acess |
US20090081992A1 (en) * | 2005-11-14 | 2009-03-26 | Sk Telecom. Co., Ltd. | Authentication for service server in wireless internet and settlement using the same |
US7546276B2 (en) * | 2006-01-23 | 2009-06-09 | Randle William M | Common authentication service for network connected applications, devices, users, and web services |
US20090249458A1 (en) * | 2005-09-16 | 2009-10-01 | Jasminder Banga | Systems and methods of network operation and information processing, including user engagement and profiling features |
US7610049B2 (en) * | 2003-11-28 | 2009-10-27 | Hitachi Communication Technologies, Ltd. | Wireless communication system, server and mobile station therefor |
US20100107225A1 (en) * | 2007-06-06 | 2010-04-29 | Boldstreet Inc. | Remote service access system and method |
US7974946B2 (en) * | 2006-03-28 | 2011-07-05 | Alps Electric (North America), Inc. | System and method for synchronizing personal data among a plurality of devices storing such data |
US8024567B2 (en) * | 2002-03-30 | 2011-09-20 | Momocash Inc. | Instant log-in method for authentificating a user and settling bills by using two different communication channels and a system thereof |
US8151319B2 (en) * | 2006-05-05 | 2012-04-03 | Nxp B.V. | Authentication of devices in a wireless network |
US8166524B2 (en) * | 2003-11-07 | 2012-04-24 | Telecom Italia S.P.A. | Method and system for the authentication of a user of a data processing system |
US20150113621A1 (en) * | 2013-10-23 | 2015-04-23 | Qualcomm Incorporated | Peer based authentication |
Family Cites Families (14)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20020103801A1 (en) | 2001-01-31 | 2002-08-01 | Lyons Martha L. | Centralized clearinghouse for community identity information |
US20020173981A1 (en) | 2001-05-18 | 2002-11-21 | Stewart Brett B. | Domain place registration system and method for registering for geographic based services |
WO2003077572A1 (en) | 2002-03-13 | 2003-09-18 | Adjungo Networks Ltd. | Accessing cellular networks from non-native local networks |
DE60314871T2 (en) | 2002-05-24 | 2008-03-13 | Telefonaktiebolaget Lm Ericsson (Publ) | METHOD FOR AUTHENTICATING A USER IN ACCESS TO A SERVICE PROVIDER'S SERVICE |
WO2004102858A2 (en) | 2003-05-13 | 2004-11-25 | Cohen Hunter C | Deriving contact information from emails |
WO2005089286A2 (en) | 2004-03-15 | 2005-09-29 | America Online, Inc. | Sharing social network information |
EP1886224A4 (en) | 2005-05-12 | 2010-02-03 | Feeva Technology Inc | Directed media based on user preferences |
US7540022B2 (en) | 2005-06-30 | 2009-05-26 | Nokia Corporation | Using one-time passwords with single sign-on authentication |
US7801542B1 (en) | 2005-12-19 | 2010-09-21 | Stewart Brett B | Automatic management of geographic information pertaining to social networks, groups of users, or assets |
US20140355592A1 (en) | 2012-11-01 | 2014-12-04 | Datavalet Technologies | System and method for wireless device detection, recognition and visit profiling |
EP2156384A4 (en) | 2007-06-12 | 2011-08-03 | Facebook Inc | Personalized social networking application content |
US20100241652A1 (en) | 2009-03-13 | 2010-09-23 | Humera Fasihuddin | System and method for synchronizing password-protected information across an arbitrary set of networks |
US8224727B2 (en) | 2009-05-27 | 2012-07-17 | Boku, Inc. | Systems and methods to process transactions based on social networking |
CA2768417C (en) | 2009-07-17 | 2018-04-24 | Boldstreet Inc. | Hotspot network access system and method |
-
2012
- 2012-11-01 US US13/666,784 patent/US9003488B2/en active Active
-
2015
- 2015-03-04 US US14/638,484 patent/US9203840B2/en active Active
- 2015-11-16 US US14/942,154 patent/US20160073252A1/en not_active Abandoned
-
2016
- 2016-10-14 US US15/294,478 patent/US20170034692A1/en not_active Abandoned
Patent Citations (33)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20020116266A1 (en) * | 2001-01-12 | 2002-08-22 | Thaddeus Marshall | Method and system for tracking and providing incentives for time and attention of persons and for timing of performance of tasks |
US20020176579A1 (en) * | 2001-05-24 | 2002-11-28 | Deshpande Nikhil M. | Location-based services using wireless hotspot technology |
US20030031154A1 (en) * | 2001-08-08 | 2003-02-13 | Takero Kobayashi | Network connection apparatus and network connection control method |
US20050038744A1 (en) * | 2001-11-29 | 2005-02-17 | Viijoen Niel Eben | Method and system for operating a banking service |
US20030115288A1 (en) * | 2001-12-14 | 2003-06-19 | Ljubicich Philip A. | Technique for effective management of information and communications using a mobile device |
US20030233458A1 (en) * | 2002-02-19 | 2003-12-18 | Hwang-Sub Kwon | System and method for providing service in wireless network environment using customer relation management |
US8024567B2 (en) * | 2002-03-30 | 2011-09-20 | Momocash Inc. | Instant log-in method for authentificating a user and settling bills by using two different communication channels and a system thereof |
US20040181692A1 (en) * | 2003-01-13 | 2004-09-16 | Johanna Wild | Method and apparatus for providing network service information to a mobile station by a wireless local area network |
US20040235455A1 (en) * | 2003-02-18 | 2004-11-25 | Jiang Yue Jun | Integrating GSM and WiFi service in mobile communication devices |
US20050021781A1 (en) * | 2003-06-05 | 2005-01-27 | Singam Sunder | Method and system of providing access point data associated with a network access point |
US20070113269A1 (en) * | 2003-07-29 | 2007-05-17 | Junbiao Zhang | Controlling access to a network using redirection |
US20050053296A1 (en) * | 2003-09-07 | 2005-03-10 | Microsoft Corporation | Bitplane coding for macroblock field/frame coding type information |
US20050060456A1 (en) * | 2003-09-16 | 2005-03-17 | Denali Software, Inc. | Method and apparatus for multi-port memory controller |
US8166524B2 (en) * | 2003-11-07 | 2012-04-24 | Telecom Italia S.P.A. | Method and system for the authentication of a user of a data processing system |
US7610049B2 (en) * | 2003-11-28 | 2009-10-27 | Hitachi Communication Technologies, Ltd. | Wireless communication system, server and mobile station therefor |
US20050242928A1 (en) * | 2004-04-29 | 2005-11-03 | International Business Machines Corporation | Method and apparatus for responding to medical alerts |
US20080039102A1 (en) * | 2004-09-08 | 2008-02-14 | Pat Sewall | Hotspot Communication Limiter |
US20060073788A1 (en) * | 2004-10-01 | 2006-04-06 | Vesa Halkka | Context based connectivity for mobile devices |
US20060182045A1 (en) * | 2005-02-14 | 2006-08-17 | Eric Anderson | Group interaction modes for mobile devices |
US20090064283A1 (en) * | 2005-03-21 | 2009-03-05 | Matsushita Electric Industrial Co., Ltd. | System and method for automatic security authentication in wireless networks |
US20060236105A1 (en) * | 2005-03-31 | 2006-10-19 | Jacco Brok | Authenticating a user of a communication device to a wireless network to which the user is not associated with |
US20090070859A1 (en) * | 2005-04-22 | 2009-03-12 | Thomson Licensing | Method and Apparatuses for Secure, Anonymous Wireless Lan (WLAN) Acess |
US20090249458A1 (en) * | 2005-09-16 | 2009-10-01 | Jasminder Banga | Systems and methods of network operation and information processing, including user engagement and profiling features |
US20090081992A1 (en) * | 2005-11-14 | 2009-03-26 | Sk Telecom. Co., Ltd. | Authentication for service server in wireless internet and settlement using the same |
US20070156537A1 (en) * | 2005-12-29 | 2007-07-05 | Sap Ag | Methods and systems for determining the user's interests |
US7546276B2 (en) * | 2006-01-23 | 2009-06-09 | Randle William M | Common authentication service for network connected applications, devices, users, and web services |
US20070204027A1 (en) * | 2006-02-24 | 2007-08-30 | Ming-Shan Shih | Method for displaying a real-time message on a mobile communication device |
US7974946B2 (en) * | 2006-03-28 | 2011-07-05 | Alps Electric (North America), Inc. | System and method for synchronizing personal data among a plurality of devices storing such data |
US8151319B2 (en) * | 2006-05-05 | 2012-04-03 | Nxp B.V. | Authentication of devices in a wireless network |
US20080119276A1 (en) * | 2006-11-16 | 2008-05-22 | Alderucci Dean P | Using a first device to verify whether a second device is communicating with a server |
US20080152099A1 (en) * | 2006-12-22 | 2008-06-26 | Mobileaxept As | Efficient authentication of a user for conduct of a transaction initiated via mobile telephone |
US20100107225A1 (en) * | 2007-06-06 | 2010-04-29 | Boldstreet Inc. | Remote service access system and method |
US20150113621A1 (en) * | 2013-10-23 | 2015-04-23 | Qualcomm Incorporated | Peer based authentication |
Cited By (8)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US12028935B2 (en) | 2007-06-06 | 2024-07-02 | Datavalet Technologies | System and method for wireless device detection, recognition and visit profiling |
US9900742B1 (en) | 2017-03-17 | 2018-02-20 | SCRRD, Inc. | Wireless device detection, tracking, and authentication platform and techniques |
US10085118B1 (en) | 2017-03-17 | 2018-09-25 | SCRRD, Inc. | Wireless device detection, tracking, and authentication platform and techniques |
US10341814B2 (en) | 2017-03-17 | 2019-07-02 | SCRRD, Inc. | Wireless device detection, tracking, and authentication platform and techniques |
US11297688B2 (en) | 2018-03-22 | 2022-04-05 | goTenna Inc. | Mesh network deployment kit |
CN109951520A (en) * | 2019-01-24 | 2019-06-28 | 深圳中兴网信科技有限公司 | A kind of data transmission method, air monitering equipment and storage medium |
WO2021076187A1 (en) * | 2019-10-15 | 2021-04-22 | Google Llc | Privacy enhanced personalization on public connections |
WO2023279027A1 (en) * | 2021-06-29 | 2023-01-05 | Juniper Networks, Inc. | Network access anomaly detection and mitigation |
Also Published As
Publication number | Publication date |
---|---|
US9003488B2 (en) | 2015-04-07 |
US20130167196A1 (en) | 2013-06-27 |
US20160073252A1 (en) | 2016-03-10 |
US9203840B2 (en) | 2015-12-01 |
US20150244721A1 (en) | 2015-08-27 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US12028935B2 (en) | System and method for wireless device detection, recognition and visit profiling | |
US9203840B2 (en) | System and method for remote device recognition at public hotspots | |
AU2008258222C1 (en) | Remote service access system and method | |
US11039020B2 (en) | Mobile device and service management | |
US9066227B2 (en) | Hotspot network access system and method | |
US10602309B2 (en) | System and method for wireless device detection, recognition and visit profiling | |
US9578182B2 (en) | Mobile device and service management | |
JP5858495B2 (en) | Service design center for device support services | |
EP3087702B1 (en) | Providing toll-free application data access | |
KR20140009171A (en) | System and method for providing user notifications | |
AU2011336382A1 (en) | End user device that secures an association of application to service policy with an application certificate check | |
US20180213078A1 (en) | Application management for a mobile device | |
EP3085165A2 (en) | Application based selection of a radio network for toll-free applications | |
CA2823895C (en) | System and method for wireless device detection, recognition and visit profiling | |
JP6847949B2 (en) | Network architecture for controlling data signaling | |
OA18993A (en) | Providing toll-free application data access. | |
OA18002A (en) | Application based selection of a radio network for toll-free applications. |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: DATAVALET TECHNOLOGIES, CANADA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:BOLDSTREET INC.;REEL/FRAME:040049/0379 Effective date: 20140812 Owner name: BOLDSTREET INC., CANADA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:SPENCER, RON;CAMPS, TOM;BURCHETT, CHRIS;AND OTHERS;SIGNING DATES FROM 20130219 TO 20130224;REEL/FRAME:040048/0566 |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: NON FINAL ACTION MAILED |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: RESPONSE TO NON-FINAL OFFICE ACTION ENTERED AND FORWARDED TO EXAMINER |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: FINAL REJECTION MAILED |
|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |