System and method for tracking privacy policy in access networks

Patent metadata

Field	Value
Publication number	US-11956236-B2
Application number	US-202117199101-A
Country	US
Kind code	B2
Filing date	Mar 11, 2021
Priority date	Mar 11, 2021
Publication date	Apr 9, 2024
Grant date	Apr 9, 2024

Abstract

Systems and methods for tracking the privacy policy of an electronic device in a network having a privacy policy server and an authentication server are provided. In one aspect a privacy policy server receives a connection request from the electronic device, queries an authentication server for the device's privacy policy acceptance state. If the device had not accepted the network's privacy policy, the privacy policy server sends a URL to the device so the device may accept or reject the policy. The authentication server locates a network session identifier representing the device's connection with the network and response to the policy server indicating the device's current privacy policy acceptance state if applicable. Advantageously, a network session identifier can track a device's privacy policy acceptance state when the device reconnects with the network. The systems and methods are applicable in wireless networks, such as 802.11.

First claim

The invention claimed is:

1. A method at an authentication server connected within a network, the method comprising:
receiving, from a privacy policy server, a query for a device address of an electronic device;
locating a network session identifier associated with the device address;
searching for a device privacy state tuple containing the network session identifier, with effect that the device privacy state tuple containing the network session identifier is either located or not located;
in response to locating the device privacy state tuple containing the network session identifier, sending, to the privacy policy server, a result to the query, the result indicating a privacy policy acceptance state in the device privacy state tuple; and
in response to not locating the device privacy state tuple containing the network session identifier, creating another device privacy state tuple containing the device address, the network session identifier and a value for the privacy policy acceptance state indicating that the electronic device has not accepted a privacy policy of the network.

2. The method of claim 1 , further comprising in response to determining that the privacy policy acceptance state indicates acceptance of a privacy policy of the network, configuring a gateway to allow the electronic device to have full access to the network.

3. The method of claim 1 , further comprising receiving, from the privacy policy server, a privacy policy response indicating acceptance or rejection of a privacy policy of the network by the electronic device.

4. The method of claim 3 , further comprising in response to determining that the privacy policy response indicates an acceptance of the privacy policy of the network by the electronic device, configuring a gateway to allow the electronic device to have full access to the network.

5. The method of claim 4 , further comprising sending a privacy policy state acknowledgement to the privacy policy server.

6. A non-transitory computer-readable medium storing instructions that when executed by the processing unit of an authentication server, cause the authentication server to:
receive, from a privacy policy server, a query for a device address of an electronic device;
locate a network session identifier associated with the device address;
search for a device privacy state tuple containing the network session identifier, with effect that the device privacy state tuple containing the network session identifier is either located or not located;
in response to locating the device privacy state tuple containing the network session identifier, send, to the privacy policy server, a result to the query, the result indicating a privacy policy acceptance state in the device privacy state tuple; and
in response to not locating the device privacy state tuple containing the network session identifier, create another device privacy state tuple containing the device address, the network session identifier and a value for the privacy policy acceptance state indicating that the electronic device has not accepted a privacy policy of the network.

7. The non-transitory computer-readable medium of claim 6 , wherein the instructions further cause the authentication server to in response to determining that the privacy policy acceptance state indicates acceptance of a privacy policy of the network, configure a gateway to allow the electronic device to have full access to the network.

8. The non-transitory computer-readable medium of claim 6 , wherein the instructions further cause the authentication server to receive, from the privacy policy server, a privacy policy response indicating acceptance or rejection of a privacy policy of the network by the electronic device.

9. The non-transitory computer-readable medium of claim 8 , wherein the instructions further cause the authentication server to in response to determining that the privacy policy response indicates an acceptance of the privacy policy of the network by the electronic device, configure a gateway to allow the electronic device to have full access to the network.

10. The non-transitory computer-readable medium of claim 9 , wherein the instructions further cause the authentication server to send a privacy policy state acknowledgement to the privacy policy server.

11. An authentication server comprising:
a processing unit coupled to a memory, the memory storing instructions that, when executed by the processing unit, cause the authentication server to:
receive, from a privacy policy server, a query for a device address of an electronic device;
locate a network session identifier associated with the device address;
search for a device privacy state tuple containing the network session identifier, with effect that the device privacy state tuple containing the network session identifier is either located or not located;
in response to locating the device privacy state tuple containing the network session identifier, send, to the privacy policy server, a result to the query, the result indicating a privacy policy acceptance state in the device privacy state tuple; and
in response to not locating the device privacy state tuple containing the network session identifier, create another device privacy state tuple containing the device address, the network session identifier and a value for the privacy policy acceptance state indicating that the electronic device has not accepted a privacy policy of the network.

12. The authentication server of claim 11 , wherein the instructions further cause the authentication server to in response to determining that the privacy policy acceptance state indicates acceptance of a privacy policy of the network, configure a gateway to allow the electronic device to have full access to the network.

13. The authentication server of claim 11 , wherein the instructions further cause the authentication server to receive, from the privacy policy server, a privacy policy response indicating acceptance or rejection of a privacy policy of the network by the electronic device.

14. The authentication server of claim 13 , wherein the instructions further cause the authentication server to in response to determining that the privacy policy response indicates an acceptance of the privacy policy of the network by the electronic device, configure a gateway to allow the electronic device to have full access to the network.

15. The authentication server of claim 14 , wherein the instructions further cause the authentication server to send a privacy policy state acknowledgement to the privacy policy server.

Assignees

• Montemurro Michael
• Mccann Stephen
• Sun Sheng
• Au Kwok Shum
• Huawei Tech Co Ltd

Inventors

• Montemurro Michael
• Mccann Stephen
• Sun Sheng
• Au Kwok Shum

Classifications

• G06F21/6245

  Protecting personal data, e.g. for financial or medical purposes · CPC title

• H04L63/0892 Primary

  by using authentication-authorization-accounting [AAA] servers or protocols · CPC title

• H04L63/0254

  Stateful filtering · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title