US20200259811A1 - Intelligent Facility Device - Google Patents
Intelligent Facility Device Download PDFInfo
- Publication number
- US20200259811A1 US20200259811A1 US15/729,402 US201715729402A US2020259811A1 US 20200259811 A1 US20200259811 A1 US 20200259811A1 US 201715729402 A US201715729402 A US 201715729402A US 2020259811 A1 US2020259811 A1 US 2020259811A1
- Authority
- US
- United States
- Prior art keywords
- network access
- network
- user interface
- session
- duration
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Abandoned
Links
- 238000000034 method Methods 0.000 claims abstract description 26
- 230000000977 initiatory effect Effects 0.000 claims description 12
- 230000004044 response Effects 0.000 claims description 10
- 238000004590 computer program Methods 0.000 claims description 8
- 238000012545 processing Methods 0.000 claims description 3
- 238000004891 communication Methods 0.000 description 22
- 238000010586 diagram Methods 0.000 description 16
- 230000008901 benefit Effects 0.000 description 4
- 230000005540 biological transmission Effects 0.000 description 4
- 238000013500 data storage Methods 0.000 description 4
- 230000002093 peripheral effect Effects 0.000 description 4
- 238000013475 authorization Methods 0.000 description 3
- 239000000835 fiber Substances 0.000 description 3
- 230000006870 function Effects 0.000 description 2
- 238000007726 management method Methods 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 238000009877 rendering Methods 0.000 description 2
- 241000700605 Viruses Species 0.000 description 1
- 230000001413 cellular effect Effects 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 238000010276 construction Methods 0.000 description 1
- 238000013501 data transformation Methods 0.000 description 1
- 238000001514 detection method Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000002708 enhancing effect Effects 0.000 description 1
- JEIPFZHSYJVQDO-UHFFFAOYSA-N iron(III) oxide Inorganic materials O=[Fe]O[Fe]=O JEIPFZHSYJVQDO-UHFFFAOYSA-N 0.000 description 1
- 230000005055 memory storage Effects 0.000 description 1
- 238000012544 monitoring process Methods 0.000 description 1
- 230000008520 organization Effects 0.000 description 1
- 230000000737 periodic effect Effects 0.000 description 1
- 230000008569 process Effects 0.000 description 1
- 230000001902 propagating effect Effects 0.000 description 1
- 230000011218 segmentation Effects 0.000 description 1
- 230000003068 static effect Effects 0.000 description 1
- 229920000638 styrene acrylonitrile Polymers 0.000 description 1
- 230000001360 synchronised effect Effects 0.000 description 1
- 230000005641 tunneling Effects 0.000 description 1
- 230000003442 weekly effect Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/30—Network architectures or network communication protocols for network security for supporting lawful interception, monitoring or retaining of communications or communication related information
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/108—Network architectures or network communication protocols for network security for controlling access to devices or network resources when the policy decisions are valid for a limited amount of time
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/14—Session management
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/08—Access security
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/30—Security of mobile devices; Security of mobile applications
- H04W12/37—Managing security policies for mobile devices or for controlling mobile applications
Definitions
- Security threats can come from both external and internal sources. Often the internal threats are more concerning than external threats. This is particularly the case in correctional facility environments, where inmates may attempt to harm other people or property.
- residents of secure facilities may be given access to computing devices, such as personal tablet devices.
- the residents may use the tablet devices to access media, documents, books, account information, and other types of information.
- Conventional tablet devices may include wireless communication capabilities for allowing the resident to access facility information systems.
- the resident's access to the facility information systems may be restricted or limited. For example, residents of secure facilities are often restricted to access of internal networks. Also, other content restrictions may be placed on the resident. Usage timing or duration limits may also be placed on the resident.
- One particular security risk may include a resident attempting to circumvent or otherwise attack or hack usage limitations or restrictions. Additional risks include residents attempting to conduct unauthorized communications, either with other residents of the facility or with external contacts. Residents may also attempt to gain access to facility account information, or other sensitive information, without authorization. Many such risks exist, and indeed, many such risks may be unknown to system administrators at the time that security policies are implemented. For example if rouge wireless networks or other network hotspots are accessed by unauthorized residents of a controlled environment covertly then unauthorized pictures or videos could be distributed by unauthorized residents of the controlled environment facility to other inmates or the public. Additionally, criminals may be able to continue directing or carrying on criminal acts while in prison if they gain unauthorized network access.
- an embodiment of a method may include receiving a request for access to a network from a user interface device. The method may also include determining an authorized duration of network access for the user interface device. Additionally, the method may include establishing a temporary network access session between the user interface device and the network for the authorized duration of network access.
- determining the authorized duration includes determining a duration of a transaction to be conducted between the user interface device and the network.
- the duration of the transaction may be determined dynamically during the network access session. Alternatively, the duration is statically determined prior to initiation of the network access session.
- the method also includes generating a temporary network access key for initiating the temporary network access session.
- the temporary network access key may be valid for a limited duration of time.
- the method may include terminating the temporary network access session in response to a determination that the temporary network access key has expired.
- a tangible computer program product comprising computer executable code that, when executed by a data processing device, causes the computer to perform operations corresponding to the steps of the method described above is also presented.
- a system includes a user interface, a network security controller coupled to the user interface, and a network interface coupled to the user interface.
- the user interface may be configured to receive a request for access to a network from a user interface device.
- the network security controller may determine an authorized duration of network access for the user interface device.
- the network interface may establish a temporary network access session between the user interface device and the network for the authorized duration of network access.
- the network security controller is further configured to determine a duration of a transaction to be conducted between the user interface device and the network.
- the duration of the transaction is determined dynamically during the network access session. Alternatively, the duration is statically determined prior to initiation of the network access session.
- the network security controller also includes an access controller configured to generate a temporary network access key for initiating the temporary network access session.
- the temporary network access key may be valid for a limited duration of time.
- the network security controller is further configured to terminate the temporary network access session in response to a determination that the temporary network access key has expired.
- FIG. 1A is a schematic block diagram illustrating one embodiment of a computing system having improved network security.
- FIG. 1B is a schematic block diagram illustrating one embodiment of a computing system having improved network security.
- FIG. 1C is a schematic block diagram illustrating one embodiment of a computing system having improved network security.
- FIG. 2 is a schematic block diagram illustrating one embodiment of a secure network access point.
- FIG. 3 is a schematic block diagram illustrating one embodiment of a network security controller.
- FIG. 4 is a schematic block diagram illustrating one embodiment of a network security controller.
- FIG. 5 is a schematic block diagram illustrating one embodiment of computer system according to the present embodiments.
- FIG. 6 is a schematic flowchart diagram illustrating one embodiment of a method for improved network security.
- FIG. 7 is a diagram illustrating embodiments of session termination conditions.
- FIG. 1A illustrates one embodiment of a system 100 having improved network security.
- the system 100 may include a network 102 and one or more user interface devices 106 configured to access the network 102 via secure network access point 104 .
- the network access point 104 may provide access between the network 102 and the user interface device 106 on a session basis. The access may be restricted based upon one or more pre-set restriction criteria.
- the network 102 is internal to the secure facility, such as an intranet system.
- the intranet system may include a Local Area Network (LAN), or a Wide Area Network (WAN) between a plurality of secure facility locations.
- the network 102 may be a WAN that includes a network management facility.
- the network management facility may be operated by the secure facility administrators or by a third-party vendor.
- the network 102 may include access to the Internet.
- Components of the network 102 may include network routers, switches, hubs, firewalls and other security devices, servers, storage devices, quality of service devices, network access/routing backbone devices, transmission lines and transmission switches, repeaters, and the like.
- network 102 may include various scales and configurations of devices for use in internetworking one or more computing devices.
- User interface device 106 may include a tablet device, a mobile data device, such as a smartphone or web-enabled personal data assistant. In other embodiments, user interface device 106 may include a personal computer, a laptop computer, a kiosk, and other types of computing devices configured to interface with network 102 via secure network access point 104 .
- Secure network access point 104 may provide the user interface device 106 with data communication access to the network 102 .
- secure network access point 104 may provide a wireless data communication link between the user interface device 106 or and the network 102 .
- wireless communication links include WiFi links, such as IEEE 802.11x protocol links, Bluetooth and other Personal Area Network (PAN) links, WiMAX links, 3G or 4G mobile data access links, Near Field Communication (NFC) links, or the like.
- secure network access point 104 may provide a wired data communication link.
- a wired data communication link may include an Ethernet data connection for communication over Transmission Control Protocol and Internet Protocol (TCP/IP), User Datagram Protocol (UDP), or the like.
- TCP/IP Transmission Control Protocol and Internet Protocol
- UDP User Datagram Protocol
- Other embodiments include communication links over Universal Serial Bus (USB), Firewire, or other wired data communications protocols.
- USB Universal Serial Bus
- secure network access point 104 may provide greater overall security to network 102 from attacks by user interface device 106 than conventional network access points.
- secure network access point 104 may operate according to one or more security rules or profiles for enhancing security of the network 102 .
- secure network access point 104 may only provide temporary access to user interface device 106 during a user session, but may not provide access to user interface device 106 outside of the user session.
- Embodiments of methods for providing enhanced security which the secure network access point 104 may be configured to carry out are described herein. For example, various encryption methods and tunneling protocols such as SSH, HTTPS, VPN, GRE and the like may be incorporated. Any encryption keys generated as part of each session may be discarded at the end of the session so that they would be unusable as part of any other transaction.
- FIG. 1B is a schematic block diagram illustrating one embodiment of a computing system 110 having improved network security.
- the system 110 may include network 102 and user interface 106 as described above. Additionally, system 110 may include secure network access point 104 and network security controller 108 .
- Secure network access point 104 may be configured to operate in conjunction with network security controller 108 to provide enhanced network security.
- network access point 104 may be a conventional network access point, but network security controller 108 may be configured to control access provided by network access point 104 such that security is enhanced.
- User interface device 106 may be configured to connect to the network 102 directly through secure network access point 104 , which then connects to the network 102 through network security controller 108 .
- user interface device 106 connects through network security controller 108 , which then connects to network 102 through network access point 104 .
- network security controller 108 connects to network 102 through network access point 104 .
- FIG. 1C is a schematic block diagram illustrating one embodiment of a computing system 120 having improved network security.
- the embodiment of FIG. 1C includes the network 102 , the secure network access point 104 , the user interface device 106 as described above.
- System 120 also includes network security controller 108 , which may be coupled to the network 102 , but may be located remotely from the secure network access point 104 .
- the secure network access point 104 may communicate with network security controller 108 over network 102 to obtain security keys, authorization to provide access to user interface device 106 , or other configuration information.
- FIG. 2 is a schematic block diagram illustrating one embodiment of a secure network access point 104 .
- the secure network access point 104 may include a network interface 202 for connecting to the network 102 .
- Connections to network 102 may include TCP/IP connections to routers, switches, or modems on the network.
- network interface 202 may connect to a fiber optic modem, a cable modem, a Digital Subscriber Line (DSL) modem, a T-1 line, or the like.
- the network interface 202 could include a wireless interface, such as a WiMAX interface, or a cellular data communication interface.
- secure network access point 104 may also include a wired user interface 204 .
- Wired user interface 204 may include ports for connecting to the user interface device 106 via an Ethernet data connection, a USB connection, a Firewire connection, or other wired data communications connections.
- secure network access point 104 may include a wireless user interface 206 .
- the wireless user interface 206 may include components for connecting to the user interface device 106 via a wireless communication link.
- the wireless user interface 206 may include a WiFi module.
- Alternative embodiments may include an NFC module, a Bluetooth module, or the like.
- secure network access point 104 may include logic, circuits, and/or modules for linking the network interface 202 and at least one of the wired user interface 204 or the wireless user interface 206 . Such functions may be carried out by, for example, a data processor.
- a data processor One of ordinary skill in the art would recognize one or more methods for linking traffic between the interfaces 202 , 204 , 206 ; therefore the specific methods are not discussed herein.
- the network security controller 108 may be integrated with the secure network access point 104 .
- the network security controller 108 may have functionality and/or components that may be found both internal to the secure network access point 104 and external to the secure network access point 104 , as shown, for example, in FIG. 1C .
- the internal components may be configured to communicate with external components to receive information, such as a temporary security key, for example. Further embodiments of the network security controller 108 are discussed with reference to the following figures.
- FIG. 3 is a schematic block diagram illustrating one embodiment of a network security controller 108 .
- the network security controller 108 may include one or more modules including a user interface 302 , an access controller 304 , a transaction monitor 306 , a timer 308 and a session monitor 310 . These modules may receive a request for access to a network interface device, determine an authorized duration of network access for the user interface device 106 and to establish a temporary network access session between the user interface device 106 and the network 102 .
- the user interface 302 may be implemented in one or more of a variety of embodiments.
- the user interface 302 may be coupled to one of the wired user interface 204 or the wireless user interface 206 for receiving communications from the user interface device 106 .
- the user interface 302 may be a separate device, such as a separate facility computer, kiosk, telephone system, or the like for accessing the network security controller 108 and collecting information to be used for establishing the temporary network access session.
- the access controller 304 may be coupled to the user interface device 302 in one embodiment.
- the access controller 304 may generate information for establishing a temporary network access session between the user interface device 106 and the network 102 .
- the information may include a temporary network access key for initiating the temporary network access session.
- the access controller 304 may enable a link between the network interface 202 and one of the wired user interface 204 or the wireless user interface for a limited duration.
- the access controller 304 may provide a Personal Identification Number (PIN), or password for enabling access to the network 102 .
- PIN Personal Identification Number
- transaction monitor 306 may track the progress of a transaction conducted between the user interface device 106 and the network 102 .
- an inmate in a correctional facility may request a temporary access code from the access controller 304 via the user interface 302 .
- the access controller 304 may generate a temporary access code for establishing the temporary network access session, the duration of which is determined by the length of the transaction, such as the length of time required to download a media file from the network 102 .
- the transaction monitor 306 may track the progress of the transaction and signal the end of the transaction upon completion. In response, the access controller 304 may deactivate the temporary access code.
- the duration of the network access session may be determined dynamically in response to the progress of the transaction.
- the network security controller 108 may set a time limit for the temporary network access session.
- the timer 308 may track the time during which the temporary network access session is active. Upon expiration of the time period, the access controller 304 may deactivate the temporary access code.
- the duration of the network access session may be determined statically by the access controller 304 .
- the timer 308 may be used to determine whether the network access session has reached a predetermined duration threshold.
- the timer 308 may be used to determine whether the network access threshold has been inactive for a predetermined threshold of time. The timer 308 may make such determinations directly, or in another embodiment, the access controller 304 may use timing information provided by the timer 308 to make the determinations.
- network security controller 108 may also include a session monitor 310 .
- the session monitor 310 may be configured to track activity during a network access session. For example, session monitor 310 may receive information from transaction monitor 306 to determine whether a session is inactive. Session monitor 310 may also receive information from timer 308 to track the duration of session inactivity. In still other embodiments, session monitor 310 may prompt re-entry of a PIN or other access key in response to session inactivity.
- the session monitor 310 may also track transactions conducted or attempted by user interface device 106 . If an attempt to conduct an unauthorized transaction is made, the session monitor 310 may trigger termination of the network access session. For example, the session monitor 310 may communicate the trigger to the access controller 304 , which may terminate the session.
- session monitor 310 may facilitate a system administrator, monitor, or other 3 rd party to monitor the communication session between the user interface device 106 and the network 102 via the secure network access point 104 .
- the session monitor 310 may provide information regarding the transactions being conducted, the time parameters of the session, and other information suitable for monitoring the transactions being conducted in the secure facility network.
- FIG. 4 is a schematic block diagram illustrating one embodiment of a network security controller 108 .
- the network security controller 108 may include the user interface 302 , the transaction monitor 306 , the timer 308 , and/or the session monitor 310 as described in FIG. 3 .
- the access controller 304 may include one or more additional modules for controlling access to the network 102 .
- the access controller 304 may include an SSID controller 402 , a session key generator 404 , a Media Access Control (MAC) address filter 406 , and a power controller 408 . These various modules may perform various functions for limiting access to the network 102 .
- MAC Media Access Control
- the SSID controller 402 may determine whether a Service Set Identifier (SSID) associated with the secure network access point 104 is broadcast. In another embodiment, the SSID controller 402 may broadcast an SSID associated with the secure network access point 104 for a limited period of time. In still a further embodiment, the SSID controller 402 may change the SSID associated with the secure network access point 104 each time the SSID is broadcast to limit the possibility of a user interface device 106 being able to find the SSID of the secure network access point 104 based on a previous connection or previously stored SSID information.
- SSID Service Set Identifier
- the SSID of the secure network access point 104 may be provided to the user interface device 106 or to the user as part of a network access authorization process. In still a further embodiment, the SSID of the secure network access point is not broadcast, but only displayed on the screen of the secure network access point for the purposes of pairing the secure network access point, with portable devices.
- the user may interact with the user interface 302 to request access to the network 102 .
- the SSID controller 402 may generate an SSID to be used for accessing the secure network access point 104 and provided to the user via the user interface 302 .
- the SSID controller 402 may generate a new SSID on a periodic basis, for example on an hourly, daily, weekly, or monthly basis.
- the session key generator 404 may generate a temporary PIN, temporary network access key, temporary session initiation key, a temporary password, or the like.
- the session key generator 404 may generate a Wired Equivalent Privacy (WEP) key, a Wi-Fi Protected Access (WPA) Preshared Key (PSK), or another key for accessing a private session with the secure network access point 104 .
- the secure network access point 104 may be configured to allow the user interface device 106 to access the network 102 via secure network access point 104 for a limited time period by terminating access associated with the key in response to a determination that a key expiration event has occurred.
- a key expiration event may include a connection time threshold being reached, a transaction count threshold being reached, a session inactivity duration threshold being reached, or the like.
- MAC address filter 406 may filter user interface devices 106 that are authorized to access network 102 based on a MAC address assigned to the network interface module of the user interface device 106 .
- MAC address filter 406 may include a list of authorized MAC addresses that may access the secure network access point 104 .
- the MAC address filter 406 may access a list that is stored on/at a separate data storage device or location.
- an access time limit may be assigned to the MAC address, and once the time limit is expired, the user interface device associated with the MAC address is no longer authorized to access the secure network access point 104 .
- the connection with the device associated with the MAC address may be terminated.
- a session number limitation may be imposed, to limit the number of concurrent or independent wireless access sessions to a finite number.
- the inmate may be limited to a single session in some embodiments.
- the access controller 304 may include a power controller.
- the power controller may be configured to terminate power to one or more components of the secure network access point 104 used for establishing the communication link with the user interface device 106 .
- the power controller 408 may reduce Radio Frequency (RF) power on one or more communication channels used for communicating with the user interface device 106 .
- the power to a wired communication link may be terminated.
- the power to one or more modules of the secure network access point 104 may be reduced or turned off rendering the secure network access point 104 inaccessible until it is reinitialized by an authorized user interface device 106 or by a system administrator or by another authorized system user.
- the power controller may also be used to reduce Radio Frequency (RF) power to only the amount necessary to communicate with other devices, within a limited distance proximity, for the purpose of limiting any potential interception by unauthorized devices.
- secure network access point 104 may be implemented or executed by one or more computer systems, an example of which is illustrated in FIG. 5 .
- computer system 500 may be a router, switch, a workstation, a network computer, a desktop computer, a laptop, a tablet device, or the like.
- computer system 500 includes one or more processors 501 A-N coupled to a system memory 502 via bus 503 .
- Computer system 500 further includes network interface 504 coupled to bus 503 , and input/output (I/O) controller(s) 505 , coupled to devices such as cursor control device 506 , keyboard 507 , and display(s) 508 .
- I/O controller(s) 505 input/output controller(s) 505 , coupled to devices such as cursor control device 506 , keyboard 507 , and display(s) 508 .
- a given entity e.g., secure network access point 201
- multiple such systems, or multiple nodes making up computer system 500 may be configured to host different portions or instances of embodiments.
- computer system 500 may be a single-processor system including one processor 501 A, or a multi-processor system including two or more processors 501 A-N (e.g., two, four, eight, or another suitable number).
- Processor(s) 501 A-N may be any processor capable of executing program instructions.
- processor(s) 501 A-N may be general-purpose or embedded processors implementing any of a variety of instruction set architectures (ISAs), such as the x86, POWERPC®, ARM®, SPARC®, or MIPS® ISAs, or any other suitable ISA.
- ISAs instruction set architectures
- each of processor(s) 501 A-N may commonly, but not necessarily, implement the same ISA.
- at least one processor(s) 501 A-N may be a graphics processing unit (GPU) or other dedicated graphics-rendering device.
- GPU graphics processing unit
- System memory 502 may be configured to store program instructions and/or data accessible by processor(s) 501 A-N.
- memory 502 may be used to store a software program.
- system memory 502 may be implemented using any suitable memory technology, such as static random access memory (SRAM), synchronous dynamic RAM (SDRAM), nonvolatile/Flash-type memory, or any other type of memory.
- SRAM static random access memory
- SDRAM synchronous dynamic RAM
- program instructions and data implementing certain operations such as, for example, those described above, may be stored within system memory 502 as program instructions 509 and data storage 510 , respectively.
- program instructions and/or data may be received, sent or stored upon different types of computer-accessible media or on similar media separate from system memory 502 or computer system 500 .
- a computer-accessible medium may include any tangible, non-transitory storage media or memory media such as electronic, magnetic, or optical media—e.g., disk or CD/DVD-ROM coupled to computer system 500 via bus 503 , or non-volatile memory storage (e.g., “flash” memory)
- tangible, non-transitory storage media or memory media such as electronic, magnetic, or optical media—e.g., disk or CD/DVD-ROM coupled to computer system 500 via bus 503 , or non-volatile memory storage (e.g., “flash” memory)
- tangible and “non-transitory,” as used herein, are intended to describe a computer-readable storage medium (or “memory”) excluding propagating electromagnetic signals, but are not intended to otherwise limit the type of physical computer-readable storage device that is encompassed by the phrase computer-readable medium or memory.
- non-transitory computer readable medium or “tangible memory” are intended to encompass types of storage devices that do not necessarily store information permanently, including for example, random access memory (RAM).
- Program instructions and data stored on a tangible computer-accessible storage medium in non-transitory form may further be transmitted by transmission media or signals such as electrical, electromagnetic, or digital signals, which may be conveyed via a communication medium such as a network and/or a wireless link.
- bus 503 may be configured to coordinate I/O traffic between processor 501 , system memory 502 , and any peripheral devices including network interface 504 or other peripheral interfaces, connected via I/O controller(s) 505 .
- bus 503 may perform any necessary protocol, timing or other data transformations to convert data signals from one component (e.g., system memory 502 ) into a format suitable for use by another component (e.g., processor(s) 501 A-N).
- bus 503 may include support for devices attached through various types of peripheral buses, such as a variant of the Peripheral Component Interconnect (PCI) bus standard or the Universal Serial Bus (USB) standard, for example.
- PCI Peripheral Component Interconnect
- USB Universal Serial Bus
- bus 503 may be split into two or more separate components, such as a north bridge and a south bridge, for example.
- some or all of the operations of bus 503 such as an interface to system memory 502 , may be incorporated directly into processor(s) 501 A-N.
- Network interface 504 may be configured to allow data to be exchanged between computer system 500 and other devices, such as other computer systems attached to network 102 , or secure network access point 104 or user interface devices as shown in FIGS. 1A-C , for example.
- network interface 504 may support communication via wired or wireless general data networks, such as any suitable type of Ethernet network, for example; via telecommunications/telephony networks such as analog voice networks or digital fiber communications networks; via storage area networks such as Fiber Channel SANs, or via any other suitable type of network and/or protocol.
- I/O controller(s) 505 may, in some embodiments, enable connection to one or more display terminals, keyboards, keypads, touch screens, scanning devices, voice or optical recognition devices, or any other devices suitable for entering or retrieving data by one or more computer system 500 .
- Multiple input/output devices may be present in computer system 500 or may be distributed on various nodes of computer system 500 .
- similar I/O devices may be separate from computer system 500 and may interact with computer system 500 through a wired or wireless connection, such as over network interface 504 .
- memory 502 may include program instructions 509 , configured to implement certain embodiments described herein, and data storage 510 , comprising various data accessible by program instructions 509 .
- program instructions 509 may include software elements of embodiments illustrated in FIG. 6 .
- program instructions 509 may be implemented in various embodiments using any desired programming language, scripting language, or combination of programming languages and/or scripting languages.
- Data storage 510 may include data that may be used in these embodiments, for example to store lists of authorized user interface devices 106 . In other embodiments, other or different software elements and data may be included.
- computer system 500 is merely illustrative and is not intended to limit the scope of the disclosure described herein.
- the computer system and devices may include any combination of hardware or software that can perform the indicated operations.
- the operations performed by the illustrated components may, in some embodiments, be performed by fewer components or distributed across additional components.
- the operations of some of the illustrated components may not be performed and/or other additional operations may be available. Accordingly, systems and methods described herein may be implemented or executed with other computer system configurations.
- FIG. 6 is a schematic flowchart diagram illustrating one embodiment of a method 600 for improved network security.
- the method 600 starts with receiving 602 a request for a network access session.
- the request may be received 602 from a user interface device 106 or via the user interface 302 of the network security controller 108 .
- the request may be received 602 via a telephone request line or an access request network.
- the user interface 106 may initiate 606 a temporary network access session with the secure network access point 104 . If a session termination condition is reached at block 608 , then the secure network access point 104 may terminate 610 the network access session.
- FIG. 7 is a diagram illustrating embodiments of session termination conditions 702 .
- a session termination condition may include a session timeout event 704 .
- a session timeout event 704 may include a session duration threshold being met, or may include a session inactivity duration threshold being met.
- One of ordinary skill in the art may recognize other suitable timeout events 704 .
- a session termination condition 702 may also include a transaction completion event 706 .
- a transaction completion event 706 may include the completion of a single transaction.
- a transaction completion event 706 may include completion of an authorized set of transactions.
- a session termination condition 702 may include a security threat detection event 708 .
- a security threat may include an unauthorized transaction being initiated by the user interface device 106 .
- a security threat may also include a transaction on a list of threat transactions being initiated.
- One of ordinary skill will recognize a variety of transactions, such as upload of viruses or malware, which may constitute security threat events.
- a session termination condition 702 may include a session termination trigger 710 .
- the session termination trigger 710 may be initated by the user by logging out of a user session.
- the session termination trigger 710 may be initiated by the secure network access point 104 in response to one or more preset conditions being met.
- the session termination trigger 710 may be initiated by a system administrator, monitor, or other 3 rd party user who is authorized to monitor transactions on the network 102 .
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Technology Law (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Description
- This is a continuation of, and claims benefit of, U.S. patent application Ser. No. 13/931,855, also entitled Intelligent Facility Device, filed Jun. 29, 2013, which is hereby incorporated herein by reference.
- This application is related by subject matter to co-pending non-provisional U.S. patent application Ser. No. 13/931,858 also entitled “Intelligent Facility Device,” which is incorporated, in its entirety, herein by reference.
- Secure facilities often face security risks and challenges that go beyond those faced in conventional environments. Security threats can come from both external and internal sources. Often the internal threats are more concerning than external threats. This is particularly the case in correctional facility environments, where inmates may attempt to harm other people or property.
- In certain situations, residents of secure facilities may be given access to computing devices, such as personal tablet devices. The residents may use the tablet devices to access media, documents, books, account information, and other types of information. Conventional tablet devices may include wireless communication capabilities for allowing the resident to access facility information systems.
- The resident's access to the facility information systems may be restricted or limited. For example, residents of secure facilities are often restricted to access of internal networks. Also, other content restrictions may be placed on the resident. Usage timing or duration limits may also be placed on the resident.
- One particular security risk may include a resident attempting to circumvent or otherwise attack or hack usage limitations or restrictions. Additional risks include residents attempting to conduct unauthorized communications, either with other residents of the facility or with external contacts. Residents may also attempt to gain access to facility account information, or other sensitive information, without authorization. Many such risks exist, and indeed, many such risks may be unknown to system administrators at the time that security policies are implemented. For example if rouge wireless networks or other network hotspots are accessed by unauthorized residents of a controlled environment covertly then unauthorized pictures or videos could be distributed by unauthorized residents of the controlled environment facility to other inmates or the public. Additionally, criminals may be able to continue directing or carrying on criminal acts while in prison if they gain unauthorized network access.
- In many environments, residents may be granted limited access to the facility information systems through wireless access points. Conventional wireless access points may not have sufficient security features for implementation in a secure facility environment because of the risks described above, and because of many other risks.
- Embodiments of intelligent facility devices for use in controlled facility environments are described. In various embodiments, the intelligent facility devices provide limited or controlled access to data networks for inmates of a controlled facility. An embodiment of a method may include receiving a request for access to a network from a user interface device. The method may also include determining an authorized duration of network access for the user interface device. Additionally, the method may include establishing a temporary network access session between the user interface device and the network for the authorized duration of network access.
- In one embodiment, determining the authorized duration includes determining a duration of a transaction to be conducted between the user interface device and the network. The duration of the transaction may be determined dynamically during the network access session. Alternatively, the duration is statically determined prior to initiation of the network access session.
- In an embodiment, the method also includes generating a temporary network access key for initiating the temporary network access session. The temporary network access key may be valid for a limited duration of time. In such an embodiment, the method may include terminating the temporary network access session in response to a determination that the temporary network access key has expired.
- A tangible computer program product comprising computer executable code that, when executed by a data processing device, causes the computer to perform operations corresponding to the steps of the method described above is also presented.
- Embodiments of systems for providing limited network access are also presented. In one embodiment a system includes a user interface, a network security controller coupled to the user interface, and a network interface coupled to the user interface. In an embodiment, the user interface may be configured to receive a request for access to a network from a user interface device. The network security controller may determine an authorized duration of network access for the user interface device. Additionally, the network interface may establish a temporary network access session between the user interface device and the network for the authorized duration of network access.
- In an embodiment, the network security controller is further configured to determine a duration of a transaction to be conducted between the user interface device and the network. In one embodiment, the duration of the transaction is determined dynamically during the network access session. Alternatively, the duration is statically determined prior to initiation of the network access session.
- In an embodiment, the network security controller also includes an access controller configured to generate a temporary network access key for initiating the temporary network access session. The temporary network access key may be valid for a limited duration of time. In an embodiment, the network security controller is further configured to terminate the temporary network access session in response to a determination that the temporary network access key has expired.
- Having thus described the invention in general terms, reference will now be made to the accompanying drawings, which are not necessarily drawn to scale, and wherein:
-
FIG. 1A is a schematic block diagram illustrating one embodiment of a computing system having improved network security. -
FIG. 1B is a schematic block diagram illustrating one embodiment of a computing system having improved network security. -
FIG. 1C is a schematic block diagram illustrating one embodiment of a computing system having improved network security. -
FIG. 2 is a schematic block diagram illustrating one embodiment of a secure network access point. -
FIG. 3 is a schematic block diagram illustrating one embodiment of a network security controller. -
FIG. 4 is a schematic block diagram illustrating one embodiment of a network security controller. -
FIG. 5 is a schematic block diagram illustrating one embodiment of computer system according to the present embodiments. -
FIG. 6 is a schematic flowchart diagram illustrating one embodiment of a method for improved network security. -
FIG. 7 is a diagram illustrating embodiments of session termination conditions. - The invention now will be described more fully hereinafter with reference to the accompanying drawings. This invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art. One skilled in the art may be able to use the various embodiments of the invention.
-
FIG. 1A illustrates one embodiment of asystem 100 having improved network security. Thesystem 100 may include anetwork 102 and one or moreuser interface devices 106 configured to access thenetwork 102 via securenetwork access point 104. In one embodiment, thenetwork access point 104 may provide access between thenetwork 102 and theuser interface device 106 on a session basis. The access may be restricted based upon one or more pre-set restriction criteria. - In one embodiment the
network 102 is internal to the secure facility, such as an intranet system. The intranet system may include a Local Area Network (LAN), or a Wide Area Network (WAN) between a plurality of secure facility locations. In another embodiment thenetwork 102 may be a WAN that includes a network management facility. The network management facility may be operated by the secure facility administrators or by a third-party vendor. In a further embodiment, thenetwork 102 may include access to the Internet. Components of thenetwork 102 may include network routers, switches, hubs, firewalls and other security devices, servers, storage devices, quality of service devices, network access/routing backbone devices, transmission lines and transmission switches, repeaters, and the like. One of ordinary skill in the art will recognize thatnetwork 102 may include various scales and configurations of devices for use in internetworking one or more computing devices. -
User interface device 106 may include a tablet device, a mobile data device, such as a smartphone or web-enabled personal data assistant. In other embodiments,user interface device 106 may include a personal computer, a laptop computer, a kiosk, and other types of computing devices configured to interface withnetwork 102 via securenetwork access point 104. - Secure
network access point 104 may provide theuser interface device 106 with data communication access to thenetwork 102. For example, securenetwork access point 104 may provide a wireless data communication link between theuser interface device 106 or and thenetwork 102. Embodiments of wireless communication links include WiFi links, such as IEEE 802.11x protocol links, Bluetooth and other Personal Area Network (PAN) links, WiMAX links, 3G or 4G mobile data access links, Near Field Communication (NFC) links, or the like. - In another embodiment, secure
network access point 104 may provide a wired data communication link. In one embodiment a wired data communication link may include an Ethernet data connection for communication over Transmission Control Protocol and Internet Protocol (TCP/IP), User Datagram Protocol (UDP), or the like. Other embodiments include communication links over Universal Serial Bus (USB), Firewire, or other wired data communications protocols. - In one embodiment, secure
network access point 104 may provide greater overall security to network 102 from attacks byuser interface device 106 than conventional network access points. For example, securenetwork access point 104 may operate according to one or more security rules or profiles for enhancing security of thenetwork 102. For example, securenetwork access point 104 may only provide temporary access touser interface device 106 during a user session, but may not provide access touser interface device 106 outside of the user session. Embodiments of methods for providing enhanced security which the securenetwork access point 104 may be configured to carry out are described herein. For example, various encryption methods and tunneling protocols such as SSH, HTTPS, VPN, GRE and the like may be incorporated. Any encryption keys generated as part of each session may be discarded at the end of the session so that they would be unusable as part of any other transaction. -
FIG. 1B is a schematic block diagram illustrating one embodiment of acomputing system 110 having improved network security. Thesystem 110 may includenetwork 102 anduser interface 106 as described above. Additionally,system 110 may include securenetwork access point 104 andnetwork security controller 108. Securenetwork access point 104 may be configured to operate in conjunction withnetwork security controller 108 to provide enhanced network security. In another embodiment,network access point 104 may be a conventional network access point, butnetwork security controller 108 may be configured to control access provided bynetwork access point 104 such that security is enhanced.User interface device 106 may be configured to connect to thenetwork 102 directly through securenetwork access point 104, which then connects to thenetwork 102 throughnetwork security controller 108. In another embodiment,user interface device 106 connects throughnetwork security controller 108, which then connects to network 102 throughnetwork access point 104. One of ordinary skill in the art may recognize a variety of alternative system configurations which may be suitable for use with the present embodiments. - For example,
FIG. 1C is a schematic block diagram illustrating one embodiment of acomputing system 120 having improved network security. The embodiment ofFIG. 1C includes thenetwork 102, the securenetwork access point 104, theuser interface device 106 as described above.System 120 also includesnetwork security controller 108, which may be coupled to thenetwork 102, but may be located remotely from the securenetwork access point 104. In one embodiment, the securenetwork access point 104 may communicate withnetwork security controller 108 overnetwork 102 to obtain security keys, authorization to provide access touser interface device 106, or other configuration information. -
FIG. 2 is a schematic block diagram illustrating one embodiment of a securenetwork access point 104. The securenetwork access point 104 may include anetwork interface 202 for connecting to thenetwork 102. Connections to network 102 may include TCP/IP connections to routers, switches, or modems on the network. For example,network interface 202 may connect to a fiber optic modem, a cable modem, a Digital Subscriber Line (DSL) modem, a T-1 line, or the like. In one embodiment, thenetwork interface 202 could include a wireless interface, such as a WiMAX interface, or a cellular data communication interface. - In one embodiment, secure
network access point 104 may also include awired user interface 204.Wired user interface 204 may include ports for connecting to theuser interface device 106 via an Ethernet data connection, a USB connection, a Firewire connection, or other wired data communications connections. - In an embodiment, secure
network access point 104 may include awireless user interface 206. Thewireless user interface 206 may include components for connecting to theuser interface device 106 via a wireless communication link. For example, thewireless user interface 206 may include a WiFi module. Alternative embodiments may include an NFC module, a Bluetooth module, or the like. - In addition, secure
network access point 104 may include logic, circuits, and/or modules for linking thenetwork interface 202 and at least one of the wireduser interface 204 or thewireless user interface 206. Such functions may be carried out by, for example, a data processor. One of ordinary skill in the art would recognize one or more methods for linking traffic between theinterfaces - In one embodiment, for example the embodiment of
FIG. 1A , thenetwork security controller 108 may be integrated with the securenetwork access point 104. In an alternative embodiment, thenetwork security controller 108 may have functionality and/or components that may be found both internal to the securenetwork access point 104 and external to the securenetwork access point 104, as shown, for example, inFIG. 1C . For example, the internal components may be configured to communicate with external components to receive information, such as a temporary security key, for example. Further embodiments of thenetwork security controller 108 are discussed with reference to the following figures. -
FIG. 3 is a schematic block diagram illustrating one embodiment of anetwork security controller 108. In one embodiment thenetwork security controller 108 may include one or more modules including auser interface 302, anaccess controller 304, atransaction monitor 306, atimer 308 and asession monitor 310. These modules may receive a request for access to a network interface device, determine an authorized duration of network access for theuser interface device 106 and to establish a temporary network access session between theuser interface device 106 and thenetwork 102. - The
user interface 302 may be implemented in one or more of a variety of embodiments. For example, theuser interface 302 may be coupled to one of the wireduser interface 204 or thewireless user interface 206 for receiving communications from theuser interface device 106. In another embodiment, theuser interface 302 may be a separate device, such as a separate facility computer, kiosk, telephone system, or the like for accessing thenetwork security controller 108 and collecting information to be used for establishing the temporary network access session. - The
access controller 304 may be coupled to theuser interface device 302 in one embodiment. Theaccess controller 304 may generate information for establishing a temporary network access session between theuser interface device 106 and thenetwork 102. For example, the information may include a temporary network access key for initiating the temporary network access session. In other embodiments, theaccess controller 304 may enable a link between thenetwork interface 202 and one of the wireduser interface 204 or the wireless user interface for a limited duration. In other embodiments, theaccess controller 304 may provide a Personal Identification Number (PIN), or password for enabling access to thenetwork 102. - In one embodiment, transaction monitor 306 may track the progress of a transaction conducted between the
user interface device 106 and thenetwork 102. For example, an inmate in a correctional facility may request a temporary access code from theaccess controller 304 via theuser interface 302. Theaccess controller 304 may generate a temporary access code for establishing the temporary network access session, the duration of which is determined by the length of the transaction, such as the length of time required to download a media file from thenetwork 102. The transaction monitor 306 may track the progress of the transaction and signal the end of the transaction upon completion. In response, theaccess controller 304 may deactivate the temporary access code. Thus, in one embodiment, the duration of the network access session may be determined dynamically in response to the progress of the transaction. Thenetwork security controller 108 may set a time limit for the temporary network access session. Thetimer 308 may track the time during which the temporary network access session is active. Upon expiration of the time period, theaccess controller 304 may deactivate the temporary access code. Thus, in one embodiment, the duration of the network access session may be determined statically by theaccess controller 304. In some embodiments, thetimer 308 may be used to determine whether the network access session has reached a predetermined duration threshold. In another embodiment, thetimer 308 may be used to determine whether the network access threshold has been inactive for a predetermined threshold of time. Thetimer 308 may make such determinations directly, or in another embodiment, theaccess controller 304 may use timing information provided by thetimer 308 to make the determinations. Date and time of day access, inmate privilege class, inmate/terminal location, and/or facility segmentations may also be incorporated in the control options. In one embodiment,network security controller 108 may also include asession monitor 310. The session monitor 310 may be configured to track activity during a network access session. For example, session monitor 310 may receive information from transaction monitor 306 to determine whether a session is inactive.Session monitor 310 may also receive information fromtimer 308 to track the duration of session inactivity. In still other embodiments, session monitor 310 may prompt re-entry of a PIN or other access key in response to session inactivity. The session monitor 310 may also track transactions conducted or attempted byuser interface device 106. If an attempt to conduct an unauthorized transaction is made, the session monitor 310 may trigger termination of the network access session. For example, the session monitor 310 may communicate the trigger to theaccess controller 304, which may terminate the session. - In another embodiment, session monitor 310 may facilitate a system administrator, monitor, or other 3rd party to monitor the communication session between the
user interface device 106 and thenetwork 102 via the securenetwork access point 104. In such an embodiment, the session monitor 310 may provide information regarding the transactions being conducted, the time parameters of the session, and other information suitable for monitoring the transactions being conducted in the secure facility network. -
FIG. 4 is a schematic block diagram illustrating one embodiment of anetwork security controller 108. In the depicted embodiment, thenetwork security controller 108 may include theuser interface 302, thetransaction monitor 306, thetimer 308, and/or the session monitor 310 as described inFIG. 3 . In an embodiment, theaccess controller 304 may include one or more additional modules for controlling access to thenetwork 102. For example, theaccess controller 304 may include anSSID controller 402, a sessionkey generator 404, a Media Access Control (MAC)address filter 406, and apower controller 408. These various modules may perform various functions for limiting access to thenetwork 102. - In one embodiment, the
SSID controller 402 may determine whether a Service Set Identifier (SSID) associated with the securenetwork access point 104 is broadcast. In another embodiment, theSSID controller 402 may broadcast an SSID associated with the securenetwork access point 104 for a limited period of time. In still a further embodiment, theSSID controller 402 may change the SSID associated with the securenetwork access point 104 each time the SSID is broadcast to limit the possibility of auser interface device 106 being able to find the SSID of the securenetwork access point 104 based on a previous connection or previously stored SSID information. In still a further embodiment, the SSID of the securenetwork access point 104 may be provided to theuser interface device 106 or to the user as part of a network access authorization process. In still a further embodiment, the SSID of the secure network access point is not broadcast, but only displayed on the screen of the secure network access point for the purposes of pairing the secure network access point, with portable devices. - For example, the user may interact with the
user interface 302 to request access to thenetwork 102. If the user is authorized to access the network, theSSID controller 402 may generate an SSID to be used for accessing the securenetwork access point 104 and provided to the user via theuser interface 302. In another example, theSSID controller 402 may generate a new SSID on a periodic basis, for example on an hourly, daily, weekly, or monthly basis. - In an embodiment, the session
key generator 404 may generate a temporary PIN, temporary network access key, temporary session initiation key, a temporary password, or the like. For example, the sessionkey generator 404 may generate a Wired Equivalent Privacy (WEP) key, a Wi-Fi Protected Access (WPA) Preshared Key (PSK), or another key for accessing a private session with the securenetwork access point 104. In such an embodiment, the securenetwork access point 104 may be configured to allow theuser interface device 106 to access thenetwork 102 via securenetwork access point 104 for a limited time period by terminating access associated with the key in response to a determination that a key expiration event has occurred. A key expiration event may include a connection time threshold being reached, a transaction count threshold being reached, a session inactivity duration threshold being reached, or the like. -
MAC address filter 406 may filteruser interface devices 106 that are authorized to accessnetwork 102 based on a MAC address assigned to the network interface module of theuser interface device 106. For example,MAC address filter 406 may include a list of authorized MAC addresses that may access the securenetwork access point 104. In another embodiment, theMAC address filter 406 may access a list that is stored on/at a separate data storage device or location. In a further embodiment, an access time limit may be assigned to the MAC address, and once the time limit is expired, the user interface device associated with the MAC address is no longer authorized to access the securenetwork access point 104. In other embodiments, once a transaction is concluded or a session has timed out, the connection with the device associated with the MAC address may be terminated. - In still other embodiments, a session number limitation may be imposed, to limit the number of concurrent or independent wireless access sessions to a finite number. For example, the inmate may be limited to a single session in some embodiments.
- In a further embodiment, the
access controller 304 may include a power controller. The power controller may be configured to terminate power to one or more components of the securenetwork access point 104 used for establishing the communication link with theuser interface device 106. For example, once the session has expired, thepower controller 408 may reduce Radio Frequency (RF) power on one or more communication channels used for communicating with theuser interface device 106. In another embodiment, the power to a wired communication link may be terminated. In still a further embodiment, the power to one or more modules of the securenetwork access point 104 may be reduced or turned off rendering the securenetwork access point 104 inaccessible until it is reinitialized by an authorizeduser interface device 106 or by a system administrator or by another authorized system user. The power controller may also be used to reduce Radio Frequency (RF) power to only the amount necessary to communicate with other devices, within a limited distance proximity, for the purpose of limiting any potential interception by unauthorized devices. - In some embodiments, secure
network access point 104, the network security controller, and/or theuser interface device 106 may be implemented or executed by one or more computer systems, an example of which is illustrated inFIG. 5 . In various embodiments,computer system 500 may be a router, switch, a workstation, a network computer, a desktop computer, a laptop, a tablet device, or the like. - As illustrated,
computer system 500 includes one ormore processors 501A-N coupled to asystem memory 502 viabus 503.Computer system 500 further includesnetwork interface 504 coupled tobus 503, and input/output (I/O) controller(s) 505, coupled to devices such ascursor control device 506,keyboard 507, and display(s) 508. In some embodiments, a given entity (e.g., secure network access point 201) may be implemented using a single instance ofcomputer system 500, while in other embodiments multiple such systems, or multiple nodes making upcomputer system 500, may be configured to host different portions or instances of embodiments. - In various embodiments,
computer system 500 may be a single-processor system including oneprocessor 501A, or a multi-processor system including two ormore processors 501A-N (e.g., two, four, eight, or another suitable number). Processor(s) 501A-N may be any processor capable of executing program instructions. For example, in various embodiments, processor(s) 501A-N may be general-purpose or embedded processors implementing any of a variety of instruction set architectures (ISAs), such as the x86, POWERPC®, ARM®, SPARC®, or MIPS® ISAs, or any other suitable ISA. In multi-processor systems, each of processor(s) 501A-N may commonly, but not necessarily, implement the same ISA. Also, in some embodiments, at least one processor(s) 501A-N may be a graphics processing unit (GPU) or other dedicated graphics-rendering device. -
System memory 502 may be configured to store program instructions and/or data accessible by processor(s) 501A-N. For example,memory 502 may be used to store a software program. In various embodiments,system memory 502 may be implemented using any suitable memory technology, such as static random access memory (SRAM), synchronous dynamic RAM (SDRAM), nonvolatile/Flash-type memory, or any other type of memory. As illustrated, program instructions and data implementing certain operations, such as, for example, those described above, may be stored withinsystem memory 502 asprogram instructions 509 anddata storage 510, respectively. In other embodiments, program instructions and/or data may be received, sent or stored upon different types of computer-accessible media or on similar media separate fromsystem memory 502 orcomputer system 500. Generally speaking, a computer-accessible medium may include any tangible, non-transitory storage media or memory media such as electronic, magnetic, or optical media—e.g., disk or CD/DVD-ROM coupled tocomputer system 500 viabus 503, or non-volatile memory storage (e.g., “flash” memory) - The terms “tangible” and “non-transitory,” as used herein, are intended to describe a computer-readable storage medium (or “memory”) excluding propagating electromagnetic signals, but are not intended to otherwise limit the type of physical computer-readable storage device that is encompassed by the phrase computer-readable medium or memory. For instance, the terms “non-transitory computer readable medium” or “tangible memory” are intended to encompass types of storage devices that do not necessarily store information permanently, including for example, random access memory (RAM). Program instructions and data stored on a tangible computer-accessible storage medium in non-transitory form may further be transmitted by transmission media or signals such as electrical, electromagnetic, or digital signals, which may be conveyed via a communication medium such as a network and/or a wireless link.
- In an embodiment,
bus 503 may be configured to coordinate I/O traffic between processor 501,system memory 502, and any peripheral devices includingnetwork interface 504 or other peripheral interfaces, connected via I/O controller(s) 505. In some embodiments,bus 503 may perform any necessary protocol, timing or other data transformations to convert data signals from one component (e.g., system memory 502) into a format suitable for use by another component (e.g., processor(s) 501A-N). In some embodiments,bus 503 may include support for devices attached through various types of peripheral buses, such as a variant of the Peripheral Component Interconnect (PCI) bus standard or the Universal Serial Bus (USB) standard, for example. In some embodiments, the operations ofbus 503 may be split into two or more separate components, such as a north bridge and a south bridge, for example. In addition, in some embodiments some or all of the operations ofbus 503, such as an interface tosystem memory 502, may be incorporated directly into processor(s) 501A-N. -
Network interface 504 may be configured to allow data to be exchanged betweencomputer system 500 and other devices, such as other computer systems attached tonetwork 102, or securenetwork access point 104 or user interface devices as shown inFIGS. 1A-C , for example. In various embodiments,network interface 504 may support communication via wired or wireless general data networks, such as any suitable type of Ethernet network, for example; via telecommunications/telephony networks such as analog voice networks or digital fiber communications networks; via storage area networks such as Fiber Channel SANs, or via any other suitable type of network and/or protocol. - I/O controller(s) 505 may, in some embodiments, enable connection to one or more display terminals, keyboards, keypads, touch screens, scanning devices, voice or optical recognition devices, or any other devices suitable for entering or retrieving data by one or
more computer system 500. Multiple input/output devices may be present incomputer system 500 or may be distributed on various nodes ofcomputer system 500. In some embodiments, similar I/O devices may be separate fromcomputer system 500 and may interact withcomputer system 500 through a wired or wireless connection, such as overnetwork interface 504. - As shown in
FIG. 5 ,memory 502 may includeprogram instructions 509, configured to implement certain embodiments described herein, anddata storage 510, comprising various data accessible byprogram instructions 509. In an embodiment,program instructions 509 may include software elements of embodiments illustrated inFIG. 6 . For example,program instructions 509 may be implemented in various embodiments using any desired programming language, scripting language, or combination of programming languages and/or scripting languages.Data storage 510 may include data that may be used in these embodiments, for example to store lists of authorizeduser interface devices 106. In other embodiments, other or different software elements and data may be included. - A person of ordinary skill in the art will appreciate that
computer system 500 is merely illustrative and is not intended to limit the scope of the disclosure described herein. In particular, the computer system and devices may include any combination of hardware or software that can perform the indicated operations. In addition, the operations performed by the illustrated components may, in some embodiments, be performed by fewer components or distributed across additional components. Similarly, in other embodiments, the operations of some of the illustrated components may not be performed and/or other additional operations may be available. Accordingly, systems and methods described herein may be implemented or executed with other computer system configurations. -
FIG. 6 is a schematic flowchart diagram illustrating one embodiment of amethod 600 for improved network security. In one embodiment, themethod 600 starts with receiving 602 a request for a network access session. The request may be received 602 from auser interface device 106 or via theuser interface 302 of thenetwork security controller 108. In further embodiments, the request may be received 602 via a telephone request line or an access request network. - If a transaction is authorized as determined at
block 604, then theuser interface 106 may initiate 606 a temporary network access session with the securenetwork access point 104. If a session termination condition is reached atblock 608, then the securenetwork access point 104 may terminate 610 the network access session. -
FIG. 7 is a diagram illustrating embodiments ofsession termination conditions 702. In one embodiment a session termination condition may include asession timeout event 704. For example asession timeout event 704 may include a session duration threshold being met, or may include a session inactivity duration threshold being met. One of ordinary skill in the art may recognize othersuitable timeout events 704. - A
session termination condition 702 may also include atransaction completion event 706. For example atransaction completion event 706 may include the completion of a single transaction. In another embodiment, atransaction completion event 706 may include completion of an authorized set of transactions. - In an embodiment, a
session termination condition 702 may include a securitythreat detection event 708. A security threat may include an unauthorized transaction being initiated by theuser interface device 106. A security threat may also include a transaction on a list of threat transactions being initiated. One of ordinary skill will recognize a variety of transactions, such as upload of viruses or malware, which may constitute security threat events. - In still other embodiments, a
session termination condition 702 may include asession termination trigger 710. Thesession termination trigger 710 may be initated by the user by logging out of a user session. Alternatively, thesession termination trigger 710 may be initiated by the securenetwork access point 104 in response to one or more preset conditions being met. In still a further embodiment, thesession termination trigger 710 may be initiated by a system administrator, monitor, or other 3rd party user who is authorized to monitor transactions on thenetwork 102. - The foregoing has outlined rather broadly the features and technical advantages of the present invention in order that the detailed description of the invention that follows may be better understood. Additional features and advantages of the invention will be described hereinafter which form the subject of the claims of the invention. It should be appreciated that the conception and specific embodiment disclosed may be readily utilized as a basis for modifying or designing other structures for carrying out the same purposes of the present invention. It should also be realized that such equivalent constructions do not depart from the invention as set forth in the appended claims. The novel features which are believed to be characteristic of the invention, both as to its organization and method of operation, together with further objects and advantages will be better understood from the following description when considered in connection with the accompanying figures. It is to be expressly understood, however, that each of the figures is provided for the purpose of illustration and description only and is not intended as a definition of the limits of the present invention.
Claims (20)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US15/729,402 US20200259811A1 (en) | 2013-06-29 | 2017-10-10 | Intelligent Facility Device |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US13/931,855 US9787656B1 (en) | 2013-06-29 | 2013-06-29 | Intelligent facility device |
US15/729,402 US20200259811A1 (en) | 2013-06-29 | 2017-10-10 | Intelligent Facility Device |
Related Parent Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/931,855 Continuation US9787656B1 (en) | 2013-06-29 | 2013-06-29 | Intelligent facility device |
Publications (1)
Publication Number | Publication Date |
---|---|
US20200259811A1 true US20200259811A1 (en) | 2020-08-13 |
Family
ID=59981481
Family Applications (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/931,855 Active 2033-10-09 US9787656B1 (en) | 2013-06-29 | 2013-06-29 | Intelligent facility device |
US15/729,402 Abandoned US20200259811A1 (en) | 2013-06-29 | 2017-10-10 | Intelligent Facility Device |
Family Applications Before (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/931,855 Active 2033-10-09 US9787656B1 (en) | 2013-06-29 | 2013-06-29 | Intelligent facility device |
Country Status (1)
Country | Link |
---|---|
US (2) | US9787656B1 (en) |
Families Citing this family (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN112819998A (en) * | 2020-12-30 | 2021-05-18 | 深兰盛视科技(苏州)有限公司 | Control method and device for control tool, control tool and storage medium |
Family Cites Families (17)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US7444669B1 (en) * | 2000-05-05 | 2008-10-28 | Microsoft Corporation | Methods and systems for providing variable rates of service for accessing networks, methods and systems for accessing the internet |
EP1364494B1 (en) | 2001-01-30 | 2009-12-02 | Broadcom Corporation | Method for adding a new device to a wireless network |
US9117216B1 (en) * | 2002-06-07 | 2015-08-25 | At&T Intellectual Property I, L.P. | Time control of internet usage |
JP2006042087A (en) * | 2004-07-29 | 2006-02-09 | Toshiba Corp | Client terminal, access point apparatus and radio communication system |
PL1833219T3 (en) * | 2006-03-08 | 2015-01-30 | Monitise Ltd | Methods, apparatus and software for using a token to calculate time-limited password within cellular telephone |
JP4613969B2 (en) * | 2008-03-03 | 2011-01-19 | ソニー株式会社 | Communication apparatus and communication method |
JP5287110B2 (en) | 2008-10-03 | 2013-09-11 | 富士通モバイルコミュニケーションズ株式会社 | Wireless device |
US8793774B1 (en) * | 2009-03-31 | 2014-07-29 | Juniper Networks, Inc. | Methods and apparatus for accessing a secure network segment |
US8224233B2 (en) * | 2009-10-09 | 2012-07-17 | At&T Mobility Ii Llc | Regulation of service in restricted telecommunication service area |
US9225701B2 (en) * | 2011-04-18 | 2015-12-29 | Intelmate Llc | Secure communication systems and methods |
US8644875B2 (en) | 2011-09-08 | 2014-02-04 | Nokia Corporation | Transmit power control in multi-radio apparatus |
US8832374B1 (en) * | 2011-11-14 | 2014-09-09 | Union Supply Company, Inc. | Providing electronic content to residents of controlled-environment facilities |
JP2013143616A (en) * | 2012-01-10 | 2013-07-22 | Nec Access Technica Ltd | Radio communication terminal, information provision medium, access point, radio communication method, and program |
US9094569B1 (en) * | 2012-02-01 | 2015-07-28 | Gary James Humphries | Remote web-based visitation system for prisons |
US9124763B2 (en) * | 2012-02-01 | 2015-09-01 | Homewav, Llc | Method and apparatus for providing both audio/video visitation and VOIP telephonic visitation originated either by an inmate or by an outside visitor directly between inmates of a prison and an outside visitor without need of intervention by prison personnel |
US9161219B2 (en) * | 2012-06-22 | 2015-10-13 | Guest Tek Interactive Entertainment Ltd. | Authorizing secured wireless access at hotspot having open wireless network and secure wireless network |
US20140280758A1 (en) * | 2013-03-15 | 2014-09-18 | Verizon Patent And Licensing Inc. | Methods and Systems for Providing Location-Based Subsidized Access to Network Content |
-
2013
- 2013-06-29 US US13/931,855 patent/US9787656B1/en active Active
-
2017
- 2017-10-10 US US15/729,402 patent/US20200259811A1/en not_active Abandoned
Also Published As
Publication number | Publication date |
---|---|
US9787656B1 (en) | 2017-10-10 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US20220263868A1 (en) | Methods and systems for providing a secure connection to a mobile communications device with the level of security based on a context of the communication | |
US11392708B2 (en) | Method and system for embedding security in a mobile communications device | |
US10630724B2 (en) | Systems and methods for network vulnerability assessment and protection of Wi-fi networks using a cloud-based security system | |
US10110638B2 (en) | Enabling dynamic authentication with different protocols on the same port for a switch | |
US20210152558A1 (en) | Transaction security systems and methods | |
KR101745221B1 (en) | Automatic sanitization of data on a mobile device in a network environment | |
US10382480B2 (en) | Distributed denial of service attack protection for internet of things devices | |
US8925042B2 (en) | Connecting devices to an existing secure wireless network | |
CN105635084B (en) | Terminal authentication apparatus and method | |
US20160352790A1 (en) | Collaborative business communication information system | |
JP2010263310A (en) | Wireless communication device, wireless communication monitoring system, wireless communication method, and program | |
Al Neyadi et al. | Discovering public wi-fi vulnerabilities using raspberry pi and kali linux | |
Dorobantu et al. | Security threats in IoT | |
US9553849B1 (en) | Securing data based on network connectivity | |
CN108154026B (en) | Root-free and non-invasive secure communication method and system based on Android system | |
US20200259811A1 (en) | Intelligent Facility Device | |
CN109548026B (en) | Method and device for controlling terminal access | |
KR20190012304A (en) | Connect authentication security device of traffic signal controller using smartphone and the method | |
FI128086B (en) | Remote management of wireless user devices | |
US20180288027A1 (en) | Network architecture for controlling data signalling | |
Mukhopadhyay et al. | A Prototype of IoT based Remote Controlled Car for Pentesting Wireless Networks | |
Ahmet et al. | Wi-fi security analysis for E&M-Government applications | |
US10349277B1 (en) | Intelligent facility device | |
KR20120121817A (en) | Apparatus and method of secure data communication by multiplexing wifi and wireless communication | |
WO2023143411A1 (en) | Device authentication methods, apparatus and communication device |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
STCB | Information on status: application discontinuation |
Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION |
|
AS | Assignment |
Owner name: ALLPAID, INC., CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:ALTER DOMUS (US) LLC;REEL/FRAME:066952/0914 Effective date: 20240328 Owner name: SECURUS TECHNOLOGIES, LLC, CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:ALTER DOMUS (US) LLC;REEL/FRAME:066952/0914 Effective date: 20240328 Owner name: AVENTIV TECHNOLOGIES, LLC, CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:ALTER DOMUS (US) LLC;REEL/FRAME:066952/0914 Effective date: 20240328 Owner name: ALLPAID, INC., CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:ALTER DOMUS (US) LLC;REEL/FRAME:066951/0630 Effective date: 20240328 Owner name: SECURUS TECHNOLOGIES, LLC, CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:ALTER DOMUS (US) LLC;REEL/FRAME:066951/0630 Effective date: 20240328 Owner name: AVENTIV TECHNOLOGIES, LLC, CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:ALTER DOMUS (US) LLC;REEL/FRAME:066951/0630 Effective date: 20240328 Owner name: ALLPAID, INC., CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:ALTER DOMUS (US) LLC;REEL/FRAME:066951/0561 Effective date: 20240328 Owner name: SECURUS TECHNOLOGIES, LLC, CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:ALTER DOMUS (US) LLC;REEL/FRAME:066951/0561 Effective date: 20240328 Owner name: AVENTIV TECHNOLOGIES, LLC, CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:ALTER DOMUS (US) LLC;REEL/FRAME:066951/0561 Effective date: 20240328 Owner name: ALLPAID, INC., CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:ALTER DOMUS (US) LLC;REEL/FRAME:066951/0514 Effective date: 20240328 Owner name: SECURUS TECHNOLOGIES, LLC, CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:ALTER DOMUS (US) LLC;REEL/FRAME:066951/0514 Effective date: 20240328 Owner name: AVENTIV TECHNOLOGIES, LLC, CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:ALTER DOMUS (US) LLC;REEL/FRAME:066951/0514 Effective date: 20240328 Owner name: ALLPAID, INC., CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:ALTER DOMUS (US) LLC;REEL/FRAME:066951/0385 Effective date: 20240328 Owner name: SECURUS TECHNOLOGIES, LLC, CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:ALTER DOMUS (US) LLC;REEL/FRAME:066951/0385 Effective date: 20240328 Owner name: AVENTIV TECHNOLOGIES, LLC, CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:ALTER DOMUS (US) LLC;REEL/FRAME:066951/0385 Effective date: 20240328 |