# US 9,882,898 B2 · Network authentication of a geo-fenced volume > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,882,898 B2 - Document ID: US9882898B2 - Status: Granted - Kind: B2 - Application number: 15/055,070 - Filed: 2016-02-26 - Published: 2016-11-10 - Granted: 2018-01-30 - Earliest claimed: 2015-05-08 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Franck Barillaud; Insoo Cho; Daniel M. Christiani; Mark R. Thill; David S. Zhang - Web page: https://patentgrep.com/patent/US9882898B2 ## CPC - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - H04L 41/0813: characterised by the conditions triggering a change of settings - H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities - H04W 4/021: Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences - H04W 4/50: Service provisioning or reconfiguring - H04W 12/069: using certificates or pre-shared keys - H04W 12/088: using filters or firewalls - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04L 67/306: User profiles - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Provided is a method for managing a software defined network using a software control layer to regulate a geo-fenced volume. The software control layer can use a Global Positioning System (GPS) including a range of latitudes, a range of longitudes and a range of altitudes. A resource within the geo-fenced volume can be assigned a location using the GPS coordinates. The resource can be managed by external applications that are operating through the software control layer. To determine an access of a device to the geo-fenced volume, the GPS coordinates, are gathered as a geographical location of the device. A user profile can be accessed to determine an access path of the user. Depending on the geographical location of the device a first condition can be generated based on the device being within the geo-fenced volume. A network permission can be granted to the device based on the first condition. ## Claims ### Claim 1 A computer implemented method for managing a software defined network by a processor in a wireless access point hardware security device, the method comprising: defining a first geo-fenced volume of the software defined network using a coordinate system that includes a range of latitudes, a range of longitudes, and a range of altitudes, wherein the range of latitudes, the range of longitudes, and the range of altitudes is included in data received from a Global Positioning System; determining a geographic location of a device using a latitude, a longitude, and an altitude within the coordinate system, wherein the latitude, the longitude, and the altitude is included in the data received from the Global Positioning System; accessing a user profile for the device that includes one or more network permissions based on the geographic location of the device relative to the first geo-fenced volume, wherein the one or more network permissions includes access to resources within the first geo-fenced volume, wherein the user profile includes the geographic location of the device and security information of a user, wherein the security information includes at least one of a biometric identity marker scan and an authentication identifier of the user, wherein the biometric identity markers scan is selected from the group consisting of a retinal scan and a fingerprint scan, wherein the authentication identifier is selected from the group consisting of badge access and guarded entries; determining a first condition where the geographic location of the device is within the first geo-fenced volume; granting the one or more network permissions in response to the first condition wherein the device is within the first geo-fenced volume; and providing physical access to the user to a second geo-fenced volume of the software defined network through a point of access based on the security information, wherein the point of access includes a locked doorway. ### Claim 2 (depends on 1) The method of claim 1, wherein accessing the user profile includes: authenticating the software defined network to access the user profile on the device; and determining one or more resources accessible to the user profile based on the one or more network permissions. ### Claim 3 (depends on 2) The method of claim 2, wherein authenticating the device includes authenticating the user by using biometric identity markers of the user. ### Claim 4 (depends on 2) The method of claim 2, wherein authenticating the device includes authenticating the user by using the authentication identifier of the user. ### Claim 5 (depends on 1) The method of claim 1, further comprising: defining the second geo-fenced volume of the software defined network; accessing the user profile for the device that includes the one or more network permissions further based on the geographic location of the device relative to the first geo-fenced volume and the second geo-fenced volume, wherein the one or more network permissions further includes access to resources within the second geo-fenced volume; determining whether the geographic location of the device is within the second geo-fenced volume; and granting the one or more network permissions in response to determining that the device is within the second geo-fenced volume. ### Claim 6 (depends on 5) The method of claim 5, wherein the second geo-fenced volume is contained within the first geo-fenced volume. ### Claim 7 (depends on 5) The method of claim 5, further comprising: defining the point of access to the second geo-fenced volume from the first geo-fenced volume; securing the point of access from the first geo-fenced volume to the second geo-fenced volume to prevent users from entering the second geo-fenced volume without authenticating the user to enter the second geo-fenced volume; and granting an access permission to the device based on the user profile in response to the device being within the second geo-fenced volume. ### Claim 8 (depends on 1) The method of claim 1, further comprising: reconfiguring the one or more network permissions; and using the reconfigured one or more network permissions to alter an accessibility of the software defined network. ### Claim 9 (depends on 8) The method of claim 8, wherein the reconfigured one or more network permissions increases the accessibility of the software defined network. ### Claim 10 (depends on 8) The method of claim 8, wherein the reconfigured one or more network permissions decreases the accessibility of the software defined network.