# US 10,771,472 B2 · System and method for access control using network verification

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,771,472 B2
- Document ID: US10771472B2
- Status: Granted
- Kind: B2
- Application number: 16/230,786
- Filed: 2018-12-21
- Published: 2019-04-25
- Granted: 2020-09-08
- Earliest claimed: 2013-07-11
- Assignees: Open Text SA ULC
- Applicants: Open Text SA ULC
- Inventors: Simon Dominic Copsey
- Web page: https://patentgrep.com/patent/US10771472B2

## CPC

- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04L 63/101: {Access control lists [ACL]}
- H04L 63/105: {Multiple levels of security}
- H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals}
- H04W 12/06: Authentication
- H04W 12/065: Continuous authentication
- H04W 12/08: Access security
- H04W 12/084: using delegated authorisation, e.g. open authorisation [OAuth] protocol
- G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS
- G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices
- H04L 63/10: {for controlling access to devices or network resources}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

A system for controlling access includes a computing device, configured to: determine a first identifier associated with a first access point being used by the computing device to access a network; determine first access control data associated with the first identifier and a first application executing on the computing device; and control access to data over the network by the first application based on the first access control data.

## Claims

### Claim 1

A computing device, comprising:
a processor;
a non-transitory computer readable medium coupled to the processor, the non-transitory computer readable medium storing computer executable instructions, the computer executable instructions executable by the processor of the computing device to:
store, at the computing device, first access control data associated with a first device identifier and second access control data associated with a second device identifier, the first access control data specifying a first level of access for a first local application on the computing device to first application data at a content provisioning platform remote from the computing device and the second access control data specifying a second level of access for the first local application to the first application data at the content provisioning platform;
when the computing device is connected to a first access point:
determine an identifier of the first access point;
determine that the first access control data is associated with the identifier of the first access point;
intercept a first request from the first local application to the content provisioning platform for the first application data;
based on the determination that the first access control data is associated with the identifier of the first access point, determine if the first local application is permitted to access the first application data according to the first access control data;
based on a determination that the first local application is not permitted to access the first application data according to the first access control data, block the first request; and
based on a determination that the first local application is permitted to access the first application data according to the first access control data, allow the first request to be sent to the content provisioning platform through the first access point;
when the computing device is connected to a second access point:
determine an identifier of the second access point;
determine that the second access control data is associated with the identifier of the second access point;
intercept a second request from the first local application to the content provisioning platform for the first application data;
based on the determination that the second access control data is associated with the identifier of the second access point, determine if the first local application is permitted to access the first application data according to the second access control data;
based on a determination that the first local application is not permitted to access the first application data according to the second access control data, block the second request; and
based on a determination that the first local application is permitted to access the first application data according to the second access control data, allow the second request to be sent to the content provisioning platform through the first access point.

### Claim 2 (depends on 1)

The computing device of claim 1, wherein the computer executable instructions are executable to:
store, at the computing device, third access control data associated with the first device identifier, the third access control data specifying a third level of access for a second local application on the computing device to second application data at the content provisioning platform;
when the computing device is connected to the first access point:
determine that the third access control data is associated with the identifier of the first access point;
intercept a request from the second local application to the content provisioning platform for the second application data;
based on the determination that the third access control data is associated with the identifier of the first access point, determine if the second local application is permitted to access the second application data according to the third access control data;
based on a determination that the second local application is not permitted to access the second application data according to the third access control data, block the request from the second local application; and
based on a determination that the second local application is permitted to access the second application data according to the third access control data, allow the request from the second local application to be sent to the content provisioning platform through the first access point, wherein the third level of access is different than the first level of access.

### Claim 3 (depends on 1)

The computing device of claim 1, wherein the computer executable instructions are executable to:
store an access control list, the access control list containing a plurality of device identifiers and associated access control data, the access control list associating the first device identifier with the first access control data; and
determine if the identifier for the first access point matches any of the plurality of device identifiers in the access control list,
wherein the determination that the first access control data is associated with the identifier for the first access point is based on a determination that the identifier for the first access point matches the first device identifier in the access control list.

### Claim 4 (depends on 3)

The computing device of claim 3, wherein the access control list includes the second access control data, and wherein the computer executable instructions are executable to:
when the computing device is connected to the second access point,
determine that the second access control data is associated with the identifier of the second access point in the access control list.

### Claim 5 (depends on 3)

The computing device of claim 3, wherein the computer executable instructions are executable to:
send a request for the access control list to a server, the request including an identifier for the first local application; and
receive the access control list from the server in response to the request for the access control list, wherein the access control list is stored in association with the first local application at the computing device.

### Claim 6 (depends on 1)

The computing device of claim 1, wherein the computer executable instructions are executable to:
send a request for the first access control data to a server, the request for the first access control data including the identifier of the first access point; and
receive the first access control data from the server in response to the request for the first access control data.

### Claim 7 (depends on 1)

The computing device of claim 1, wherein the first level of access permits only read access to the first application data.

### Claim 8

A computer program product comprising a non-transitory computer readable medium, the non-transitory computer readable medium storing computer executable instructions, the computer executable instructions executable by a processor of a computing device to:
store, at the computing device, first access control data associated with a first device identifier and second access control data associated with a second device identifier, the first access control data specifying a first level of access for a first local application on the computing device to first application data at a content provisioning platform remote from the computing device and the second access control data specifying a second level of access for the first local application to the first application data at the content provisioning platform;
when the computing device is connected to a first access point:
determine an identifier of the first access point;
determine that the first access control data is associated with the identifier of the first access point;
intercept a first request from the first local application to the content provisioning platform for the first application data;
based on the determination that the first access control data is associated with the identifier of the first access point, determine if the first local application is permitted to access the first application data according to the first access control data;
based on a determination that the first local application is not permitted to access the first application data according to the first access control data, block the first request; and
based on a determination that the first local application is permitted to access the first application data according to the first access control data, allow the first request to be sent to the content provisioning platform through the first access point;
when the computing device is connected to a second access point:
determine an identifier of the second access point;
determine that the second access control data is associated with the identifier of the second access point;
intercept a second request from the first local application to the content provisioning platform for the first application data;
based on the determination that the second access control data is associated with the identifier of the second access point, determine if the first local application is permitted to access the first application data according to the second access control data;
based on a determination that the first local application is not permitted to access the first application data according to the second access control data, block the second request; and
based on a determination that the first local application is permitted to access the first application data according to the second access control data, allow the second request to be sent to the content provisioning platform through the first access point.

### Claim 9 (depends on 8)

The computer program product of claim 8, wherein the computer executable instructions are executable to:
store, at the computing device, third access control data associated with the first device identifier, the third access control data specifying a third level of access for a second local application on the computing device to second application data at the content provisioning platform;
when the computing device is connected to the first access point:
determine that the third access control data is associated with the identifier of the first access point;
intercept a request from the second local application to the content provisioning platform for the second application data;
based on the determination that the third access control data is associated with the identifier of the first access point, determine if the second local application is permitted to access the second application data according to the third access control data;
based on a determination that the second local application is not permitted to access the second application data according to the third access control data, block the request from the second local application; and
based on a determination that the second local application is permitted to access the second application data according to the third access control data, allow the request from the second local application to be sent to the content provisioning platform through the first access point, wherein the third level of access is different than the first level of access.

### Claim 10 (depends on 8)

The computer program product of claim 8, wherein the computer executable instructions are executable to:
store an access control list, the access control list containing a plurality of device identifiers and associated access control data, the access control list associating the first device identifier with the first access control data; and
determine if the identifier for the first access point matches any of the plurality of device identifiers in the access control list,
wherein the determination that the first access control data is associated with the identifier for the first access point is based on a determination that the identifier for the first access point matches the first device identifier in the access control list.

### Claim 11 (depends on 10)

The computer program product of claim 10, wherein the access control list includes the second access control data, and wherein the computer executable instructions are executable to:
when the computing device is connected to the second access point,
determine that the second access control data is associated with the identifier of the second access point in the access control list.

### Claim 12 (depends on 10)

The computer program product of claim 10, wherein the computer executable instructions are executable to:
send a request for the access control list to a server, the request including an identifier for the first local application; and
receive the access control list from the server in response to the request for the access control list, wherein the access control list is stored in association with the first local application at the computing device.

### Claim 13 (depends on 8)

The computer program product of claim 8, wherein the computer executable instructions are executable to:
send a request for the first access control data to a server, the request for the first access control data including the identifier of the first access point; and
receive the first access control data from the server in response to the request for the first access control data.

### Claim 14 (depends on 8)

The computer program product of claim 8, wherein the first level of access permits only read access to the first application data.

### Claim 15

A method for controlling access, the method comprising:
storing, at a computing device, first access control data associated with a first device identifier and second access control data associated with a second device identifier, the first access control data specifying a first level of access for a first local application on the computing device to first application data at a content provisioning platform remote from the computing device and the second access control data specifying a second level of access for the first local application to the first application data at the content provisioning platform;
when the computing device is connected to a first access point:
determining an identifier of the first access point;
determining that the first access control data is associated with the identifier of the first access point;
intercepting, at the computing device, a first request from the first local application to the content provisioning platform for the first application data;
based on the determination that the first access control data is associated with the identifier of the first access point, determining if the first local application is permitted to access the first application data according to the first access control data; and
based on a determination that the first local application is not permitted to access the first application data according to the first access control data, blocking the first request;
when the computing device is connected to a second access point:
determining an identifier of the second access point;
intercept a second request from the first local application to the content provisioning platform for the first application data;
based on the determination that the second access control data is associated with the identifier of the second access point, determining if the first local application is permitted to access the first application data according to the second access control data; and
based on a determination that the first local application is permitted to access the first application data according to the second access control data, allowing the second request to be sent to the content provisioning platform through the first access point.

### Claim 16 (depends on 15)

The method of claim 15, further comprising:
storing, at the computing device, third access control data associated with the first device identifier, the third access control data specifying a third level of access for a second local application on the computing device to second application data at the content provisioning platform;
when the computing device is connected to the first access point:
determining that the third access control data is associated with the identifier of the first access point;
intercepting, at the computing device, a request from the second local application to the content provisioning platform for the second application data;
based on the determination that the third access control data is associated with the identifier of the first access point, determining if the second local application is permitted to access the second application data according to the third access control data; and
based on a determination that the second local application is permitted to access the second application data according to the third access control data, allowing the request from the second local application to be sent to the content provisioning platform through the first access point, wherein the third level of access is different than the first level of access.

### Claim 17 (depends on 15)

The method of claim 15, further comprising:
storing an access control list at the computing device, the access control list containing a plurality of device identifiers and associated access control data, the access control list associating the first device identifier with the first access control data; and
determining if the identifier for the first access point matches any of the plurality of device identifiers in the access control list,
wherein the determination that the first access control data is associated with the identifier for the first access point is based on a determination that the identifier for the first access point matches the first device identifier in the access control list.

### Claim 18 (depends on 17)

The method of claim 17, further comprising:
including the second access control data in the access control list; and
when the computing device is connected to the second access point,
determining that the second access control data is associated with the identifier of the second access point in the access control list.

### Claim 19 (depends on 17)

The method of claim 17, further comprising:
sending a request for the access control list to a server, the request including an identifier for the first local application; and
receiving the access control list from the server in response to the request for the access control list, wherein the access control list is stored in association with the first local application at the computing device.

### Claim 20 (depends on 15)

The method of claim 15, further comprising:
sending a request for the first access control data to a server, the request for the first access control data including the identifier of the first access point; and
receive the first access control data from the server in response to the request for the first access control data.

### Claim 21 (depends on 15)

The method of claim 15, wherein the first level of access permits only read access to the first application data.