# US 12,182,291 B2 · System and method for access control using network verification > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,182,291 B2 - Document ID: US12182291B2 - Status: Granted - Kind: B2 - Application number: 17/990,516 - Filed: 2022-11-18 - Published: 2023-03-16 - Granted: 2024-12-31 - Earliest claimed: 2013-07-11 - Assignees: Open Text SA ULC - Applicants: Open Text SA ULC - Inventors: Simon Dominic Copsey - Web page: https://patentgrep.com/patent/US12182291B2 ## CPC - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/101: {Access control lists [ACL]} - H04L 63/105: {Multiple levels of security} - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04W 12/06: Authentication - H04W 12/065: Continuous authentication - H04W 12/08: Access security - H04W 12/084: using delegated authorisation, e.g. open authorisation [OAuth] protocol - G06F 2221/2111: Location-sensitive, e.g. geographical location, GPS - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - H04L 63/10: {for controlling access to devices or network resources} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Systems, methods, and computer program products for controlling access by applications to application data are provided. A computing device receives a request for access control data over a network and returns access control data to the requestor to control an applications access over the network to application data. The access control data returned to the requestor includes access-point dependent access control data to control the application's access to the application data based on the access point used to access the network. ## Claims ### Claim 1 A computer-implemented method for controlling application access to data, the method comprising: accessing a datastore storing first access control data for a plurality of applications, the first access control data comprising first device dependent access control data for a plurality of applications; receiving, over a network, a request for access control data for a first application, wherein the request for access control data for the first application comprises: an access point identifier for an access point used by the first application; an application identifier for the first application, and network path information for a network path; and servicing the request for access control data for the first application to return second access control data over the network to control access by the first application to application data over the network, wherein servicing the request for access control data for the first application comprises determining the second access control data from the first access control data, wherein the determining comprises determining the second access control data using the application identifier, the access point identifier and the network path information, the second access control data comprising first access point-dependent access control data from the first device dependent access control data, wherein the second access point-dependent access control data specifies a level of access for the first application when using the access point identified by the access point identifier to access the application data. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the request for access control data for the first application comprises the access point identifier for an access point, wherein determining the second access control data from the first access control data comprises determining the first access point-dependent access control data from the first device dependent access control data based on an association between the first access point-dependent access control data and the access point identifier. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the application identifier identifies the first application, and wherein the determining of the second access control data from the first access control data comprises determining the second access control data based on an association between the second access control data and the application identifier. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the request for access control data for the first application comprises an application identifier identifying the first application and the access point identifier identifying an access point, wherein determining the second access control data from the first access control data comprises identifying the second access control data from the first access control data using the application identifier and the access point identifier. ### Claim 5 (depends on 4) The computer-implemented method of claim 4, wherein the determining of the second access control data from the first access control data comprises determining that the first access point-dependent access control data is associated with both the application identifier and the access point identifier. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the request for access control data for the first application comprises network path information for a network path, and wherein determining the second access control data from the first access control data comprises determining second device dependent access control data from the first device dependent access control data based on an association between the second device dependent access control data and a device in the network path. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein the request for access control data for the first application comprises an application identifier for the first application and network path information for a network path, and wherein determining the second access control data from the first access control data comprises determining the second access control data using the application identifier and the network path information. ### Claim 8 (depends on 7) The computer-implemented method of claim 7, wherein the second access control data comprises second device dependent access control data from the first device dependent access control data, and wherein determining the second access control data using the application identifier and the network path information comprises determining the first access point-dependent access control data based on an association between the first access point-dependent access control data and the application identifier and determining the second device dependent access control data from the first device dependent access control data based on an association between the second device dependent access control data and a device in the network path. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, wherein the second access control data comprises second device dependent access control data from the first device dependent data, and wherein determining the second access control data using the application identifier, the access point identifier and the network path information comprises: determining the first access point-dependent access control data based on an association between the first access point-dependent access control data and the application identifier and the access point identifier; and determining the second device dependent access control data from the first device dependent access control data based on an association between the second device dependent access control data and a device in the network path. ### Claim 10 (depends on 1) The computer-implemented method of claim 1, further comprising: receiving, over the network, a request for access control data for a second application; and servicing the request for access control data for the second application to return third access control data over the network to control access by the second application to the application data over the network, wherein servicing the request for access control data for the second application comprises determining the third access control data from the first access control data, the third access control data comprising second access point-dependent access control data from the first device dependent access control data. ### Claim 11 (depends on 10) The computer-implemented method of claim 10, wherein the first application and the second application execute on a same computing device. ### Claim 12 (depends on 1) The computer-implemented method of claim 1, wherein the second access point-dependent access control data comprises the access point identifier and an associated level of access. ### Claim 13 (depends on 1) The computer-implemented method of claim 1, wherein the second access point-dependent access control data comprises a plurality of access point identifiers and an associated level of access for each of the plurality of access point identifiers. ### Claim 14 (depends on 1) The computer-implemented method of claim 1, wherein the request for the access control data for the first application is serviced by a first computing device, the first application executes on a second computing device, and the application data is hosted by a third computing device. ### Claim 15 A computer program product comprising a non-transitory, computer-readable medium, the non-transitory, computer-readable medium storing computer-executable instructions, the computer-executable instructions comprising instructions for: accessing a datastore storing first access control data, the first access control data comprising first device dependent access control data for a plurality of applications; receiving, over a network, a request for access control data for a first application, wherein the request for access control data for the first application comprises an access point identifier for an access point used by the first application; servicing the request for access control data for the first application to return second access control data over the network to control access by the first application to application data over the network, wherein servicing the request for access control data for the first application comprises determining the second access control data from the first access control data, the second access control data comprising first access point-dependent access control data from the first device dependent access control data, wherein the second access point-dependent access control data specifies a level of access for the first application when using the access point identified by the access point identifier to access the application data; receiving, over the network, a request for access control data for a second application; and servicing the request for access control data for the second application to return third access control data over the network to control access by the second application to the application data, wherein servicing the request for access control data for the second application comprises determining the third access control data from the first access control data, the third access control data comprising second access point-dependent access control data from the first device dependent access control data. ### Claim 16 (depends on 15) The computer program product of claim 15, wherein the request for access control data for the first application comprises the access point identifier for an access point, wherein determining the second access control data from the first access control data comprises determining the first access point-dependent access control data from the first device dependent access control data based on an association between the first access point-dependent access control data and the access point identifier. ### Claim 17 (depends on 16) The computer program product of claim 16, wherein the request for access control data for the first application comprises an application identifier identifying the first application, and wherein determining the second access control data from the first access control data comprises determining the second access control data based on an association between the second access control data and the application identifier. ### Claim 18 (depends on 15) The computer program product of claim 15, wherein the request for access control data for the first application comprises network path information for a network path, and wherein determining the second access control data from the first access control data comprises determining second device dependent access control data from the first device dependent access control data based on an association between the second device dependent access control data and a device in the network path. ### Claim 19 (depends on 15) The computer program product of claim 15, wherein the request for access control data for the first application comprises an application identifier for the first application and network path information for a network path, and wherein determining the second access control data from the first access control data comprises determining the second access control data using the application identifier and the network path information. ### Claim 20 (depends on 15) The computer program product of claim 15, wherein the application identifier for the first application, the access point identifier for an access point and network path information for a network path, and wherein determining the second access control data from the first access control data comprises determining the second access control data using the application identifier, the access point identifier and the network path information. ### Claim 21 A computer-implemented method for controlling application access to data, the method comprising: accessing a datastore storing first access control data for a plurality of applications, the first access control data comprising first device dependent access control data for a plurality of applications; receiving, over a network, a request for access control data for a first application, wherein the request for access control data for the first application comprises an access point identifier for an access point used by the first application; and servicing the request for access control data for the first application to return second access control data over the network to control access by the first application to application data over the network, wherein servicing the request for access control data for the first application comprises determining the second access control data from the first access control data, the second access control data comprising first access point-dependent access control data from the first device dependent access control data, wherein the second access point-dependent access control data specifies a level of access for the first application when using the access point identified by the access point identifier to access the application data; receiving, over the network, a request for access control data for a second application; and servicing the request for access control data for the second application to return third access control data over the network to control access by the second application to the application data over the network, wherein servicing the request for access control data for the second application comprises determining the third access control data from the first access control data, the third access control data comprises the second access point-dependent access control data from the first device dependent access control data. ### Claim 22 (depends on 21) The computer-implemented method of claim 21, wherein the first application and the second application execute on a same computing device. ### Claim 23 (depends on 21) The computer-implemented method of claim 21, wherein the second access point-dependent access control data comprises the access point identifier and an associated level of access for the second application. ### Claim 24 (depends on 21) The computer-implemented method of claim 21, wherein the second access point-dependent access control data comprises a plurality of access point identifiers and an associated level of access for each of the plurality of access point identifiers. ### Claim 25 (depends on 21) The computer-implemented method of claim 21, wherein the request for the access control data for the first application is serviced by a first computing device, the first application executes on a second computing device, the second application executes on the second computing device, and the application data is hosted by a third computing device. ### Claim 26 A computer program product comprising a non-transitory, computer-readable medium, the non-transitory, computer-readable medium storing computer-executable instructions, the computer-executable instructions comprising instructions for: accessing a datastore storing first access control data, the first access control data comprising first device dependent access control data for a plurality of applications; receiving, over a network, a request for access control data for a first application, wherein the request for access control data for the first application comprises: an access point identifier for an access point used by the first application; an application identifier for the first application, and network path information for a network path; and servicing the request for access control data for the first application to return second access control data over the network to control access by the first application to application data over the network, wherein servicing the request for access control data for the first application comprises determining the second access control data from the first access control data, wherein the determining comprises determining the second access control data using the application identifier, the access point identifier and the network path information, the second access control data comprising first access point-dependent access control data from the first device dependent access control data, wherein the second access point-dependent access control data specifies a level of access for the first application when using the access point identified by the access point identifier to access the application data. ### Claim 27 (depends on 26) The computer program product of claim 26, wherein the first device dependent access control data is determined based on an association between the first access point-dependent access control data and the access point identifier. ### Claim 28 (depends on 26) The computer program product of claim 26, wherein the application identifier identifies the first application, and wherein determining the second access control data from the first access control data comprises determining the second access control data based on an association between the second access control data and the application identifier. ### Claim 29 (depends on 15) The computer program product of claim 15, wherein determining the second access control data from the first access control data comprises determining second device dependent access control data from the first device dependent access control data based on an association between the second device dependent access control data and a device in the network path. ### Claim 30 (depends on 15) The computer program product of claim 15, wherein determining the second access control data from the first access control data comprises determining the second access control data using the application identifier and the network path information.