Segmented network mobile device provisioning system

Patent metadata

Field	Value
Publication number	US-2016255456-A1
Application number	US-201514634462-A
Country	US
Kind code	A1
Filing date	Feb 27, 2015
Priority date	Feb 27, 2015
Publication date	Sep 1, 2016
Grant date	—

Abstract

Disclosed is a personal device container system. The personal device container system typically includes a processor, a memory, and an access management module stored in the memory. The personal device container system is typically configured to establish network communication between a personal computing device and a provisioning system that validates the identity of the personal computing device and provides a certificate to the personal computing device. Thereafter, the personal computing device requests access to a secured network segment and provides the certificate to the personal device container system. The personal device container system then authenticates the personal computing device's certificate before allowing the personal computing device to communicate with the secured network segment. User credentials associated with a user are authenticated before user-specific content associated with the user is provided to the personal computing device. Accordingly, a user-specific experience may be provided to different users of the personal computing device.

First claim

What is claimed is:

1 . A personal device container system, comprising:
a processor; a memory; a communication interface in communication with a distributed network, the distributed network comprising one or more data stores having personal computing device provisioning information stored therein; an access management module stored in the memory, executable by the processor and configured for:
receiving, from a personal computing device, a first request to connect to a provisioning network segment to provision the personal computing device to communicate with a secured network segment, wherein the provisioning network segment and the secured network segment are part of a common network, wherein the first request comprises a first set of security credentials to authenticate the personal computing device;
authenticating the personal computing device to communicate with the provisioning network segment based on the first set of security credentials;
creating a first network tunnel between the personal computing device and the provisioning network segment, wherein the provisioning network segment comprises a provisioning device capable of communicating a certificate to the personal computing device via the first network tunnel to provision the personal computing device;
receiving provisioning filter rules for filtering messages communicated via the first network tunnel;
determining that the personal computing device has communicated a provisioning request to the provisioning device via the first network tunnel, wherein the provisioning request is compliant with the provisioning filter rules;
determining that the provisioning request is compliant with the provisioning filter rules;
routing the provisioning request to the provisioning device based on determining that the provisioning request is compliant with the provisioning filter rules;
receiving a second request, from the personal computing device, for the personal computing device to communicate with the secured network segment, wherein the second request comprises a second set of security credentials based on the certificate;
authenticating the personal computing device to communicate with the secured network segment based on the second set of security credentials;
creating a second network tunnel between the personal computing device and the secured network segment based on authenticating the personal computing device to communicate with the secured network segment;
receiving secured filter rules for filtering messages communicated via the second network tunnel;
determining that the personal computing device has communicated a secured message to a device that is a part of the secured network segment via the second network tunnel, wherein the secured message is compliant with the secured filter rules; and
routing the secured message to the device that is part of the secured network segment.

2 . The personal device container system of claim 1 , wherein the access management module is further configured for:
determining that a second message has been communicated via the second network tunnel, wherein the second message is not complaint with the secured filter rules; determining that the second message does not satisfy the secured filter rules; and filtering the second message based on the determining that the second message does not satisfy the secured filter rules.

3 . The personal device container system of claim 1 , wherein the personal computing device is configured to execute a security function initiated by a remote command, wherein the access management module is further configured for:
determining that the personal computing device is connected to an unauthorized network; and communicating the remote command to the personal computing device to initiate the security function.

4 . The personal device container system of claim 1 , wherein the secured message communicated via the second network tunnel further comprises a geographic location of the personal computing device when the personal computing device communicated the secured message, wherein the access management module is further configured for:
receiving a geographic perimeter from which the personal computing device is allowed to communicate the message over via the second network tunnel to the device located on the secured network segment; determining the geographic location of the device from the message; determining that the location of the personal computing device is not located within the geographic perimeter; and wherein, filtering the message is further based on determining that the location of the personal computing device is not located within the geographic perimeter.

5 . The personal device container system of claim 1 , wherein the distributed network comprises a wireless connection to the distributed network, wherein allowing the personal computing device to connect the distributed network comprises providing a wireless connection to the personal computing device.

6 . The personal device container system of claim 1 , wherein the access management module is further configured for:
receiving a third message, communicated via the second network tunnel, wherein the third message is directed to a device that is not located within the secured network segment; and filtering the third message based on the message being directed to a device that is not located within the secured network segment.

7 . The personal device container system of claim 1 , wherein the request to connect to the provisioning network segment comprises a first secure session identifier (SSID), wherein the request to connect to the secured network segment comprises a second SSID, wherein creating the first network tunnel is further based on receiving the first SSID, and wherein creating the second network tunnel is further based on receiving the second SSID.

8 . The personal device container system of claim 1 , wherein the personal device container system comprises a foreign controller, a control point, and an operations router, wherein the foreign controller directs communications from the personal computing device to the provisioning segment using the first network tunnel and directs communications from the personal computing device to the secured network segment using the second network tunnel, wherein the control point utilizes the provisioning network rules to filter communications over the first network tunnel, and wherein the operations router utilizes the secured network rules to filter communications over the second network tunnel.

9 . A computer program product for provisioning personal computing devices for use on a secured network comprising a non-transitory computer-readable storage medium having computer-executable instructions for:
receiving, from a personal computing device, a first request to connect to a provisioning network segment to provision the personal computing device to communicate with a secured network segment, wherein the provisioning network segment and the secured network segment are part of a common network, wherein the first request comprises a first set of security credentials to authenticate the personal computing device; authenticating the personal computing device to communicate with the provisioning network segment based on the first set of security credentials; creating a first network tunnel between the personal computing device and the provisioning network segment, wherein the provisioning network segment comprises a provisioning device capable of communicating a certificate to the personal computing device via the first network tunnel to provision the personal computing device; receiving provisioning filter rules for filtering messages communicated via the

Assignees

• Bank Of America

Inventors

• Lee Jisoo
• Frankel Yair
• Joseph Eins K
• Goodyear Todd Michael
• Farro Ii Francis George
• Scopis James P
• Smith Brian Joseph

Classifications

• H04L63/0227

  Filtering policies (mail message filtering H04L51/212) · CPC title

• H04W84/12

  WLAN [Wireless Local Area Networks] · CPC title

• H04W4/021

  Services related to particular areas, e.g. point of interest [POI] services, venue services or geofences · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04W4/50 Primary

  Service provisioning or reconfiguring · CPC title