Content access based on mobile device geographical location

Content access based on mobile device geographical location is described. A system receives, from a mobile device, a request to access content which is created independently of any geographical location. The system determines if the mobile device provides a corresponding geographical location that is within a specified distance of a specified geographical location. The system enables access, for the mobile device, to the content in response to a determination that the mobile device provides the corresponding geographical location that is within the specified distance of the specified geographical location.

BACKGROUND

With the increasing usage of mobile devices, mobile offices are becoming ubiquitous as workers are accessing work documents and data on their mobile devices at any time and at any place in order to become more proficient and productive.

DETAILED DESCRIPTION

A corporation or an enterprise may desire for protected content to be accessible only from the corporation's or the enterprise's geographical location in order to protect sensitive information. For example, a manufacturing company would like to limit its engineers to access to its design blue prints when the engineers are located on the company premises. In the prior art there is no way to prevent content from being accessed from off-site locations while applying the usual access control policies.

Embodiments herein provide content access based on geographical location. A request is received from a mobile device to access content which is created independently of any geographical location. A determination is made whether the mobile device provides a corresponding geographical location that is within a specified distance of a specified geographical location, which can colloquially be referred to as a “specified geographical fence.” Access is enabled for the mobile device to the content if the mobile device provides a corresponding geographical location that is within the specified distance of the specified geographical location. For example, an access application receives a request to access a manufacturing company's design blueprints from a laptop computer used by one of the manufacturing company's engineers. The access application determines if the laptop computer identifies its geographical location as within 500 feet of the center of the manufacturing company's headquarters. The access application sends the requested design blueprints to the laptop computer because the access application has determined that the engineer's laptop computer is within 500 feet of the center of the manufacturing company's headquarters. The access application provides a new level of security and compliance for content to be accessed only from specified geographic locations.

Prior to describing the subject matter in detail, an exemplary hardware device in which the subject matter may be implemented shall first be described. Those of ordinary skill in the art will appreciate that the elements illustrated inFIG. 1may vary depending on the system implementation. With reference toFIG. 1, an exemplary system for implementing the subject matter disclosed herein includes a hardware device100, including a processing unit102, memory104, storage106, data entry module108, display adapter110, communication interface112, and a bus114that couples elements104-112to the processing unit102.

The bus114may comprise any type of bus architecture. Examples include a memory bus, a peripheral bus, a local bus, etc. The processing unit102is an instruction execution machine, apparatus, or device and may comprise a microprocessor, a digital signal processor, a graphics processing unit, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), etc. The processing unit102may be configured to execute program instructions stored in memory104and/or storage106and/or received via data entry module108.

The memory104may include read only memory (ROM)116and random access memory (RAM)118. Memory104may be configured to store program instructions and data during operation of device100. In various embodiments, memory104may include any of a variety of memory technologies such as static random access memory (SRAM) or dynamic RAM (DRAM), including variants such as dual data rate synchronous DRAM (DDR SDRAM), error correcting code synchronous DRAM (ECC SDRAM), or RAMBUS DRAM (RDRAM), for example. Memory104may also include nonvolatile memory technologies such as nonvolatile flash RAM (NVRAM) or ROM. In some embodiments, it is contemplated that memory104may include a combination of technologies such as the foregoing, as well as other technologies not specifically mentioned. When the subject matter is implemented in a computer system, a basic input/output system (BIOS)120, containing the basic routines that help to transfer information between elements within the computer system, such as during start-up, is stored in ROM116.

The storage106may include a flash memory data storage device for reading from and writing to flash memory, a hard disk drive for reading from and writing to a hard disk, a magnetic disk drive for reading from or writing to a removable magnetic disk, and/or an optical disk drive for reading from or writing to a removable optical disk such as a CD ROM, DVD or other optical media. The drives and their associated computer-readable media provide nonvolatile storage of computer readable instructions, data structures, program modules and other data for the hardware device100.

It is noted that the methods described herein can be embodied in executable instructions stored in a computer readable medium for use by or in connection with an instruction execution machine, apparatus, or device, such as a computer-based or processor-containing machine, apparatus, or device. It will be appreciated by those skilled in the art that for some embodiments, other types of computer readable media may be used which can store data that is accessible by a computer, such as magnetic cassettes, flash memory cards, digital video disks, Bernoulli cartridges, RAM, ROM, and the like may also be used in the exemplary operating environment. As used here, a “computer-readable medium” can include one or more of any suitable media for storing the executable instructions of a computer program in one or more of an electronic, magnetic, optical, and electromagnetic format, such that the instruction execution machine, system, apparatus, or device can read (or fetch) the instructions from the computer readable medium and execute the instructions for carrying out the described methods. A non-exhaustive list of conventional exemplary computer readable medium includes: a portable computer diskette; a RAM; a ROM; an erasable programmable read only memory (EPROM or flash memory); optical storage devices, including a portable compact disc (CD), a portable digital video disc (DVD), a high definition DVD (HD-DVD™), a BLU-RAY disc; and the like.

A number of program modules may be stored on the storage106, ROM116or RAM118, including an operating system122, one or more applications programs124, program data126, and other program modules128. A user may enter commands and information into the hardware device100through data entry module108. Data entry module108may include mechanisms such as a keyboard, a touch screen, a pointing device, etc. Other external input devices (not shown) are connected to the hardware device100via external data entry interface130. By way of example and not limitation, external input devices may include a microphone, joystick, game pad, satellite dish, scanner, or the like. In some embodiments, external input devices may include video or audio input devices such as a video camera, a still camera, etc. Data entry module108may be configured to receive input from one or more users of device100and to deliver such input to processing unit102and/or memory104via bus114.

A display132is also connected to the bus114via display adapter110. Display132may be configured to display output of device100to one or more users. In some embodiments, a given device such as a touch screen, for example, may function as both data entry module108and display132. External display devices may also be connected to the bus114via external display interface134. Other peripheral output devices, not shown, such as speakers and printers, may be connected to the hardware device100.

The hardware device100may operate in a networked environment using logical connections to one or more remote nodes (not shown) via communication interface112. The remote node may be another computer, a server, a router, a peer device or other common network node, and typically includes many or all of the elements described above relative to the hardware device100. The communication interface112may interface with a wireless network and/or a wired network. Examples of wireless networks include, for example, a BLUETOOTH network, a wireless personal area network, a wireless 802.11 local area network (LAN), and/or wireless telephony network (e.g., a cellular, PCS, or GSM network). Examples of wired networks include, for example, a LAN, a fiber optic network, a wired personal area network, a telephony network, and/or a wide area network (WAN). Such networking environments are commonplace in intranets, the Internet, offices, enterprise-wide computer networks and the like. In some embodiments, communication interface112may include logic configured to support direct memory access (DMA) transfers between memory104and other devices.

In a networked environment, program modules depicted relative to the hardware device100, or portions thereof, may be stored in a remote storage device, such as, for example, on a server. It will be appreciated that other hardware and/or software to establish a communications link between the hardware device100and other devices may be used.

It should be understood that the arrangement of hardware device100illustrated inFIG. 1is but one possible implementation and that other arrangements are possible. It should also be understood that the various system components (and means) defined by the claims, described below, and illustrated in the various block diagrams represent logical components that are configured to perform the functionality described herein. For example, one or more of these system components (and means) can be realized, in whole or in part, by at least some of the components illustrated in the arrangement of hardware device100.

In addition, while at least one of these components are implemented at least partially as an electronic hardware component, and therefore constitutes a machine, the other components may be implemented in software, hardware, or a combination of software and hardware. More particularly, at least one component defined by the claims is implemented at least partially as an electronic hardware component, such as an instruction execution machine (e.g., a processor-based or processor-containing machine) and/or as specialized circuits or circuitry (e.g., discrete logic gates interconnected to perform a specialized function), such as those illustrated inFIG. 1.

Other components may be implemented in software, hardware, or a combination of software and hardware. Moreover, some or all of these other components may be combined, some may be omitted altogether, and additional components can be added while still achieving the functionality described herein. Thus, the subject matter described herein can be embodied in many different variations, and all such variations are contemplated to be within the scope of what is claimed.

In the prior art, there is no way to prevent content from being accessed from off-site locations while applying the usual access control policies. Embodiments herein provide content access based on mobile device geographical location. An access application provides a new level of security and compliance for content to be accessed only from specified geographical locations.

FIG. 2illustrates a block diagram of a system that implements content access based on mobile device geographical location, under an embodiment. As shown inFIG. 2, system200may illustrate a cloud computing environment in which data, applications, services, and other resources are stored and delivered through shared data-centers and appear as a single point of access for the users. The system200may also represent any other type of distributed computer network environment in which servers control the storage and distribution of resources and services for different client users.

In an embodiment, the system200represents a cloud computing system that includes a first client202, a second client204, and a third client206; and a server208that may be provided by a hosting company. The first client202may be a laptop computer, the second client204may be a tablet, and a third client206may be a mobile telephone such as a smart phone. The clients202-206and the server208communicate via a network210. The server208includes a set of content212, an access application214, a set of distances216, and a set of locations218. AlthoughFIG. 2depicts the system200with three clients202-206, one server208, one network210, one set of content212, one access application214, one set of distances216, and one set of locations218, the system200may include any number of clients202-206, any number of servers208, any number of networks210, any number of sets of content212, any number of access applications214, any number of sets of distances216, and any number of sets of locations218. The clients202-206and the server208may each be substantially similar to the system100depicted inFIG. 1.FIG. 2depicts the set of content212, the access application214, the set of distances216, and the set of locations218residing completely on the server208, but the set of content212, the access application214, the set of distances216, and the set of locations218may reside completely on any of the clients202-206, completely on another server that is not depicted inFIG. 2, or in any combination of partially on the server208, partially on the clients202-206, and partially on the other server.

The access application214receives a request, from a mobile device, to access content which is created independently of any geographical location. For example, the access application214receives a request to download from the set of content212, which includes the manufacturing company's design blueprints212, to the laptop computer202, the tablet204or the mobile telephone206used by one of the manufacturing company's engineers. The content being created independently of any geographical location means that the content is not associated with any geographical location when the content is created. For example, when a manufacturing company engineer creates the manufacturing company's design blueprints212using the laptop computer202, the metadata associated with the manufacturing company's design blueprints212may indicate creation by the manufacturing company engineer using the laptop computer202, but the metadata associated with the manufacturing company's design blueprints212does not specify the geographic location of the laptop computer202when creating the manufacturing company's design blueprints212. In the examples discussed below, the access application214receives a request from the laptop computer202. However, the request can also be received from the tablet204or the mobile telephone206.

The access application214determines whether a mobile device provides a corresponding geographical location that is within a specified distance of a specified geographical location. For example, the access application214determines if the laptop computer202identifies its geographical location as within 500 feet of the center of the manufacturing company's headquarters or within 200 feet of the center of the manufacturing company's branch office. A system administrator may specify the set of distances216, such as 500 feet and 200 feet, and the set of locations218, such as the center of the manufacturing company's headquarters and the center of the manufacturing company's branch office.

The access application214enables access, for a mobile device, to content if the mobile device provides a corresponding geographical location that is within a specified distance of a specified geographical location. For example, the access application214enables the downloading of the requested design blueprints212to the laptop computer202because the access application214has determined that the engineer's laptop computer202is within 500 feet of the center of the manufacturing company's headquarters. The access to the set of content212may be based on a policy that specifies a number of accesses, a time duration for potential accesses, and/or a type of access. For example, when the access application214determines that the engineer's laptop computer202is within 500 feet of the center of the manufacturing company's headquarters, the access application214checks an access policy which specifies that the specific engineer has the specific permission download and read the design blueprints212via the laptop computer202when the engineer's laptop computer202is within 500 feet of the center of the manufacturing company's headquarters, but the engineer is limited to only reading the design blueprints212via the laptop computer202when the engineer's laptop computer202is within 200 feet of the center of the manufacturing company's branch office. In another example, the specific engineer has the specific permission to download the design blueprints212to the laptop computer202only once within the first week that the design blueprints212are created, but has the specific permission to read the design blueprints212via the laptop computer202on an unlimited number of occasions.

If the access application214determines that a mobile device does not provide a corresponding geographical location that is within a specified distance of a specified geographical location, the access application214may determine if the mobile device provides any corresponding geographical location. If the access application214determines that a mobile device does not provide any corresponding geographical location, the access application214requests the mobile device to provide the corresponding geographical location. For example, if the engineer has disabled the geo-location feature of the laptop computer202, the access application214responds to the request to download the design blueprints212by prompting the engineer to enable the geo-location feature of the laptop computer202and to resubmit the request. If a mobile device provides a corresponding geographical location, but the corresponding geographical location is not within a specified distance of any specified geographical location, the access application214disables access, for the mobile device, to the set of the content212. For example, if the laptop computer202is at a hotel, the access application214does not enable the design blue print212to be downloaded to the laptop computer202, and sends a request denied/access disabled message to the laptop computer202.

If the access application214enables a mobile device to download content, the access application214may embed an offline access control key in the downloaded content to provide off-line access control for the content. For example, the access application214enables the downloading of the requested design blueprints212to the laptop computer202, wherein the downloaded design blueprints212includes an offline access control key.

An offline access control key created by the access application214receives a request, from a mobile device, to access content on the mobile device. For example, the offline access control key created by the access application214receives a request to read the copy of the manufacturing company's design blueprints212which is stored to the laptop computer202used by one of the manufacturing company's engineers.

An offline access control key created by the access application214determines whether a mobile device provides a corresponding geographical location that is within a specified distance of a specified geographical location. For example, the offline access control key created by the access application214determines if the laptop computer202identifies its geographical location as within 500 feet of the center of the manufacturing company's headquarters, within 200 feet of the center of the manufacturing company's branch office, or within 100 feet of the center of the engineer's home residence. A system administrator may specify the set of distances216, such as 500 feet, 200 feet, and 100 feet, and the set of locations218, such as the center of the manufacturing company's headquarters, the center of the manufacturing company's branch office, and the center of the engineer's home residence.

An offline access control key created by the access application214enables access, for a mobile device, to content stored on the mobile device if the mobile device provides a corresponding geographical location that is within a specified distance of a specified geographical location. For example, the offline access control key created by the access application214enables the reading of the requested design blueprints212via the laptop computer202because the access application214has determined that the engineer's laptop computer202is within 100 feet of the center of the engineer's home residence. The access to the set of content212may be based on a policy that specifies a number of accesses, a time duration for potential accesses, and/or a type of access. For example, when the offline access control key created by the access application214determines that the engineer's laptop computer202is within 100 feet of the center of the engineer's home residence, the offline access control key created by the access application214checks an access policy which specifies that the specific engineer has the specific permission to read the design blueprints212via the laptop computer202when the engineer's laptop computer202is within 100 feet of the center of the engineer's home residence, but the specific engineer does not have the specific permission to download or edit the design blueprints212via the laptop computer202when the engineer's laptop computer202is within 100 feet of the center of the engineer's home residence.

If an offline access control key created by the access application214determines that a mobile device does not provide a corresponding geographical location that is within a specified distance of a specified geographical location, the offline access control key created by the access application214determines if the mobile device provides any corresponding geographical location. If the offline access control key created by the access application214determines that a mobile device does not provide any corresponding geographical location, the offline access control key created by the access application214requests the mobile device to provide the corresponding geographical location. For example, if the engineer has disabled the geo-location feature of the laptop computer202, the offline access control key created by the access application214responds to the request to read the copy of the design blueprints212stored on the laptop computer202by prompting the engineer to enable the geo-location feature of the laptop computer202and to resubmit the request. If a mobile device provides a corresponding geographical location, but the corresponding geographical location is not within a specified distance of any specified geographical location, an offline access control key created by the access application214disables access, for the mobile device, to the content stored on the mobile device. For example, if the laptop computer202is at a hotel, the offline access control key created by the access application214does not enable the copy of the design blueprints212stored on the laptop computer202to be read via the laptop computer202, and sends a request denied/access disabled message to the laptop computer202. Furthermore, disabling off-line access to content stored on a mobile device may include deleting the content on the mobile device and/or scrambling the content on the mobile device. For example, if the laptop computer202is at a hotel, the offline access control key created by the access application214scrambles and then deletes the design blueprints212from the laptop computer202, and sends a request denied/content scrambled and deleted message to the laptop computer202. The access application214provides a new level of security and compliance for the set of content212to be accessed only from specified geographical locations.

FIG. 3is a flowchart that illustrates a method for content access based on mobile device geographical location, under an embodiment. Flowchart300illustrates method acts illustrated as flowchart blocks for certain steps involved in and/or between the clients202-206and/or the server208ofFIG. 2.

A request is received, from a mobile device, to access content which is created independently of any geographical location, block302. For example, the access application214receives a request to download from the set of content212, which includes the manufacturing company's design blueprints212, to the laptop computer202used by one of the manufacturing company's engineers.

A determination is made whether a mobile device provides a corresponding geographical location that is within a specified distance of a specified geographical location, block304. For example, the access application214determines if the laptop computer202identifies its geographical location as within 500 feet of the center of the manufacturing company's headquarters or within 200 feet of the center of the manufacturing company's branch office. If a mobile device provides a corresponding geographical location that is within a specified distance of a specified geographical location, the flowchart300continues to block306. If a mobile device does not provide a corresponding geographical location that is within a specified distance of a specified geographical location, the flowchart300proceeds to block308.

Access is enabled, for a mobile device, to content, block306. For example, the access application214enables the downloading of the requested design blueprints212to the laptop computer202because the access application214has determined that the engineer's laptop computer202is within 500 feet of the center of the manufacturing company's headquarters. Then the flowchart300continues to block314.

A determination is optionally made whether a mobile device provides any corresponding geographical location, block308. For example, the access application214determines whether the laptop computer202provides any corresponding geographical location. If a mobile device does not provide any corresponding geographical location, the flowchart300continues to block310. If a mobile device provides any corresponding geographical location, the flowchart300proceeds to block312.

A mobile device is optionally requested to provide a corresponding geographical location, block310. For example, if the engineer has disabled the geo-location feature of the laptop computer202, the access application214responds to the request to download the design blueprints212by prompting the engineer to enable the geo-location feature of the laptop computer202and to resubmit the request. Then the flowchart300restarts at block302.

Access is optionally disabled, for a mobile device, to content, block312. For example, if the laptop computer202is at a hotel, the access application214does not enable the design blueprints212to be downloaded to the laptop computer202, and sends a request denied/access disabled message to the laptop computer202. Then the flowchart300restarts at block302.

A request is optionally received, from a mobile device, to access content on the mobile device, block314. For example, an offline access control key created by the access application214receives a request to read the copy of the manufacturing company's design blueprints212which is stored to the laptop computer202used by one of the manufacturing company's engineers.

A determination is optionally made whether a mobile device provides a corresponding geographical location that is within a specified distance of a specified geographical location, block316. For example, the offline access control key created by the access application214determines if the laptop computer202identifies its geographical location as within 500 feet of the center of the manufacturing company's headquarters, within 200 feet of the center of the manufacturing company's branch office, or within 100 feet of the center of the engineer's home residence. If a mobile device provides a corresponding geographical location that is within a specified distance of a specified geographical location, the flowchart300continues to block318. If a mobile device does not provide a corresponding geographical location that is within a specified distance of a specified geographical location, the flowchart300proceeds to block320.

Access is optionally enabled, for a mobile device, to content stored on the mobile device, block318. For example, the offline access control key created by the access application214enables the reading of the requested design blueprints212via the laptop computer202because the offline access control key created by the access application214has determined that the engineer's laptop computer202is within 100 feet of the center of the engineer's home residence. Then the flowchart300restarts at block302.

A determination is optionally made whether a mobile device provides any corresponding geographical location, block320. For example, the offline access control key created by the access application214determines whether the laptop computer202provides any corresponding geographical location. If a mobile device does not provide any corresponding geographical location, the flowchart300continues to block322. If a mobile device provides any corresponding geographical location, the flowchart300proceeds to block324.

A mobile device is optionally requested to provide a corresponding geographical location, block322. For example, if the engineer has disabled the geo-location feature of the laptop computer202, the offline access control key created by the access application214responds to the request to read the copy of the design blueprints212stored on the laptop computer202by prompting the engineer to enable the geo-location feature of the laptop computer202and to resubmit the request. Then the flowchart300restarts at block302.

Access is optionally disabled, for a mobile device, to content stored on the mobile device, block324. For example, if the laptop computer202is at a hotel, the offline access control key created by the access application214does not enable the copy of the design blueprints212stored on the laptop computer202to be read via the laptop computer202, and sends a request denied/access disabled message to the laptop computer202. Then the flowchart300restarts at block302.

AlthoughFIG. 3depicts the blocks302-324occurring in a specific order, the blocks302-324may occur in another order. In other implementations, each of the blocks302-324may also be executed in combination with other blocks and/or some blocks may be divided into a different set of blocks.