Systems and methods for managing location-based access control lists

The disclosed computer-implemented method for managing location-based access control lists may include (i) identifying a collection of devices that are located within a physical space, (ii) determining, based on user activity data received from the collection of devices, that an authorized user is attempting to modify, on a location-based access control list for a wireless network, the access rights of a target computing device near a location indicated by the authorized user in the physical space, (iii) detecting, based on the user activity data, the target computing device near the location indicated by the authorized user, and (iv) in response to detecting the target computing device indicated by the authorized user, modifying, on the location-based access control list, the access rights of the target computing device. Various other methods, systems, and computer-readable media are also disclosed.

BACKGROUND

Individuals and organizations frequently seek to control how others access services under their control. For example, a parent may wish to enforce parental controls on televisions and smart phones in their household in order to control their child's access to various digital media. Similarly, an organization may wish to limit websites that its employees can access during work hours. In some cases, an individual or organization may use different access-control policies for certain people. For example, a parent can input a passcode to bypass parental controls so that they can watch movies that would otherwise be blocked. As an additional example, a project manager may have access to files and/or servers that other employees may be restricted from accessing.

Traditional access-control techniques suffer from a number of drawbacks. for example, existing access-control solutions may not permit a device to easily join a wireless network without sharing the Wi-Fi credentials of the network with the new device. For example, if a guest of a user wishes to gain access to a home wireless network, the user must provide the Wi-Fi credentials to the guest to enable the guest to add their device to the home wireless network. If the user does not want the user to have subsequent access to the home wireless network, they may need to change the Wi-Fi credentials and update all the devices that utilized the previous credentials.

In another example, the user may utilize a Wi-Fi protected setup (WPS), which is a network security standard, to create a secure wireless network. When the WPS is enabled, a router of the wireless network may allow any device in range to connect to the router within a specific time window. However, during the time window, the wireless network may be available to any device within range and an unknown or hostile device may easily join the wireless network. Accordingly, the instant disclosure identifies and addresses a need for improved systems and methods for managing location-based access control lists.

SUMMARY

As will be described in greater detail below, the instant disclosure describes various systems and methods for managing location-based access control lists.

In one example, a method for managing location-based access control lists may include (i) identifying a collection of devices that are located within a physical space and that include monitoring devices that are capable of monitoring user activity within the physical space, (ii) determining, based on user activity data received from the collection of devices, that an authorized user is attempting to modify, on a location-based access control list for a wireless network, the access rights of a target computing device near a location indicated by the authorized user in the physical space, (iii) detecting, based on the user activity data, the target computing device near the location indicated by the authorized user, and (iv) in response to detecting the target computing device indicated by the authorized user, modifying, on the location-based access control list, the access rights of the target computing device.

In some examples, the user activity data may include a photograph or video recording of the authorized user. Detecting the target computing device near the location indicated by the authorized user may include analyzing the photograph or the video recording, identifying the location in the physical space based on the analyzed photograph or video recording, and detecting the target computing device near the location indicated by the authorized user. The analyzed photograph or video recording may include data indicating the authorized user pointing to the target computing device with a hand or a pointing device.

In some examples, the user activity may include an audio recording of the authorized user. Detecting the target computing device near the location indicated by the authorized user based on the user activity data may include analyzing the audio recording, identifying the location in the physical space based on the analyzed audio recording, and detecting the target computing device near the location indicated by the authorized user.

In some examples, modifying the location-based access control list may include at least one of adding the target computing device to the location-based access control list or removing the target computing device from the location-based access control list. In some examples, the location-based access control list may be enforced based on one or more scheduling policies. In some examples, detecting the target computing device near the location in the physical space may include detecting a location associated with signals received from the target computing device using triangulation and detecting the target computing device by comparing the location of the signals to the location indicated by the authorized user in the physical space.

In one embodiment, a system for managing location-based access control lists may include at least one physical processor and physical memory that includes computer-executable instructions that, when executed by the physical processor, cause the physical processor to (i) identify a collection of devices that are located within a physical space and that include monitoring devices that are capable of monitoring user activity within the physical space, (ii) determine, based on user activity data received from the collection of devices, that an authorized user is attempting to modify, on a location-based access control list for a wireless network, the access rights of a target computing device near a location indicated by the authorized user in the physical space, (iii) detect, based on the user activity data, the target computing device near the location indicated by the authorized user, and (iv) in response to detecting the target computing device indicated by the authorized user, modify, on the location-based access control list, the access rights of the target computing device.

In some examples, the above-described method may be encoded as computer-readable instructions on a non-transitory computer-readable medium. For example, a computer-readable medium may include one or more computer-executable instructions that, when executed by at least one processor of a computing device, may cause the computing device to (i) identify a collection of devices that are located within a physical space and that include monitoring devices that are capable of monitoring user activity within the physical space, (ii) determine, based on user activity data received from the collection of devices, that an authorized user is attempting to modify, on a location-based access control list for a wireless network, the access rights of a target computing device near a location indicated by the authorized user in the physical space, (iii) detect, based on the user activity data, the target computing device near the location indicated by the authorized user, and (iv) in response to detecting the target computing device indicated by the authorized user, modify, on the location-based access control list, the access rights of the target computing device.

DETAILED DESCRIPTION OF EXAMPLE EMBODIMENTS

The present disclosure is generally directed to systems and methods for managing location-based access control lists. As will be described in greater detail below, location-based access control lists may be modified by monitoring a physical space using a constellation of additional devices. These additional devices may perform a variety of monitoring functions, such as identifying and authenticating an authorized user to the system and/or capturing user activity through videos, photographs, or audio recordings. The systems and methods described herein may analyze the user activity to identify a location indicated by the authorized user and detect a device near the location. Upon detecting the device near the location, the location-based access control list may be modified to permit the device to join the wireless network.

In an illustrative example, Alice and Bob may be sitting in the living room of Bob's home. Alice may want her tablet to be connected to the home wireless network in Bob's home so that she can watch a movie. The systems and methods described herein may allow Bob to add Alice's tablet to the home wireless network by indicating the position of the tablet. The living room may have multiple devices, such as a smart television, a laptop, a smartphone, and a smart speaker. Bob may indicate that he wishes to add a device to wireless network by vocalizing a command and/or performing a gesture and then indicating the location of the device. One or more of the devices in the living room may capture the command or gesture and then capture Bob's activity, such as pointing his finger or a laser pointer towards the tablet. The systems and methods described herein may identify a location indicated by Bob, detect tablet near the location indicated by Bob, and then modify the location-based access control list to enable Alice's tablet to join the wireless network without having to share the credentials to join the network and ensuring that the network is secure from unauthorized access by other devices.

The following will provide, with reference toFIGS. 1-2, detailed descriptions of example systems for managing location-based access control lists. Detailed descriptions of corresponding computer-implemented methods will also be provided in connection withFIG. 3.FIG. 4provides an illustrative use case for managing location-based access control lists. A detailed description of data flow through the example system for managing location-based access control lists will also be provided in connection withFIG. 5. In addition, detailed descriptions of an example computing system and network architecture capable of implementing one or more of the embodiments described herein will be provided in connection withFIGS. 6 and 7, respectively.

FIG. 1is a block diagram of an example system100for managing location-based access control lists. As illustrated in this figure, the example system100may include one or more modules102for performing one or more tasks. As will be explained in greater detail below, the modules102may include a determination module104, an analysis module106, a location module108, and an access control module110. Although illustrated as separate elements, one or more of the modules102inFIG. 1may represent portions of a single module or application.

In certain embodiments, one or more of the modules102inFIG. 1may represent one or more software applications or programs that, when executed by a computing device, may cause the computing device to perform one or more tasks. For example, and as will be described in greater detail below, one or more of the modules102may represent modules stored and configured to run on one or more computing devices, such as the devices illustrated inFIG. 2(e.g., a server202, a computing device206, a target computing device208, and/or a monitoring device210). One or more of the modules102inFIG. 1may also represent all or portions of one or more special-purpose computers configured to perform one or more tasks.

As illustrated inFIG. 1, the example system100may also include one or more memory devices, such as memory140. The memory140generally represents any type or form of volatile or non-volatile storage device or medium capable of storing data and/or computer-readable instructions. In one example, the memory140may store, load, and/or maintain one or more of modules102. Examples of the memory140include, without limitation, Random Access Memory (RAM), Read Only Memory (ROM), flash memory, Hard Disk Drives (HDDs), Solid-State Drives (SSDs), optical disk drives, caches, variations or combinations of one or more of the same, and/or any other suitable storage memory.

As illustrated inFIG. 1, the example system100may also include one or more physical processors, such as physical processor130. The physical processor130generally represents any type or form of hardware-implemented processing unit capable of interpreting and/or executing computer-readable instructions. In one example, the physical processor130may access and/or modify one or more of the modules102stored in the memory140. Additionally, or alternatively, the physical processor130may execute one or more of the modules102to facilitate managing location-based access control lists. Examples of the physical processor130include, without limitation, microprocessors, microcontrollers, Central Processing Units (CPUs), Field-Programmable Gate Arrays (FPGAs) that implement softcore processors, Application-Specific Integrated Circuits (ASICs), portions of one or more of the same, variations or combinations of one or more of the same, and/or any other suitable physical processor.

As illustrated inFIG. 1, the example system100may also include data storage120. The data storage120generally represents any type or form of computing device capable of data storage. In one example, the data storage120may store one or more access control lists122and/or one or more policies124.

The example system100inFIG. 1may be implemented in a variety of ways. For example, all or a portion of the example system100may represent portions of example system200inFIG. 2. As shown inFIG. 2, the system200may include a server202in communication with a computing device206, a target computing device208, and/or a monitoring device210via a network204. In one example, all or a portion of the functionality of the modules102may be performed by the server202, the computing device206, the target computing device208, the monitoring device210, and/or any other suitable computing system. As will be described in greater detail below, one or more of the modules102fromFIG. 1may, when executed by at least one processor of the server202, the computing device206, the target computing device208, and/or the monitoring device210, enable the server202, the computing device206, the target computing device208, and/or the monitoring device210to manage location-based access control lists122. For example, and as will be described in greater detail below, one or more of the modules102may cause the server202to identify a collection of devices that are located within a physical space. The collection of devices may include one or more monitoring devices, such as the monitoring device210, that are capable of monitoring user activity within the physical space. The server202may determine, based on user activity data216received from the collection of devices, that an authorized user214is attempting to modify, on a location-based access control list122for a wireless network, the access rights of the target computing device208near a location indicated by the authorized user214in the physical space. The server202may detect, based on the user activity data216, the target computing device208near the location indicated by the authorized user214. In response to detecting the target computing device208, the server202may modify the access rights of the target computing device208on the location-based access control list122.

The server202generally represents any type or form of computing device that is capable of reading computer-executable instructions. In one example, the server202may represent a server capable of managing location-based access control lists122. Additional examples of the server202include, without limitation, security servers, application servers, web servers, storage servers, and/or database servers configured to run certain software applications and/or provide various security, web, storage, and/or database services. Although illustrated as a single entity inFIG. 2, the server202may include and/or represent a plurality of servers that work and/or operate in conjunction with one another.

The computing device206generally represents any type or form of computing device capable of reading computer-executable instructions. For example, the computing device206may include an endpoint device (e.g., a mobile computing device) running client-side security software. In some examples, the computing device206may include an authentication module212to identify and authenticate the authorized user214. Additional examples of the computing device206include, without limitation, laptops, tablets, desktops, servers, cellular phones, Personal Digital Assistants (PDAs), multimedia players, embedded systems, wearable devices (e.g., smart watches, smart glasses, etc.), smart vehicles, smart packaging (e.g., active or intelligent packaging), gaming consoles, so-called Internet-of-Things devices (e.g., smart appliances, etc.), variations or combinations of one or more of the same, and/or any other suitable computing device.

The target computing device208generally represents any type or form of computing device capable of reading computer-executable instructions. For example, the target computing device208may include an endpoint device (e.g., a mobile computing device) running client-side security software. Additional examples of the target computing device208include, without limitation, laptops, tablets, desktops, servers, cellular phones, Personal Digital Assistants (PDAs), multimedia players, embedded systems, wearable devices (e.g., smart watches, smart glasses, etc.), smart vehicles, smart packaging (e.g., active or intelligent packaging), gaming consoles, so-called Internet-of-Things devices (e.g., smart appliances, etc.), variations or combinations of one or more of the same, and/or any other suitable computing device.

The monitoring device210generally represents any type or form of computing device capable of reading computer-executable instructions. For example, the monitoring device210may include an endpoint device (e.g., a mobile computing device) running client-side security software capable of monitoring a physical space to identify and authenticate an authorized user214as well as capture user activity data216. Additional examples of the monitoring device210include, without limitation, laptops, tablets, desktops, servers, cellular phones, Personal Digital Assistants (PDAs), multimedia players, embedded systems, wearable devices (e.g., smart watches, smart glasses, etc.), smart vehicles, smart packaging (e.g., active or intelligent packaging), gaming consoles, so-called Internet-of-Things devices (e.g., smart appliances, etc.), variations or combinations of one or more of the same, and/or any other suitable computing device.

As illustrated inFIG. 3, at step302one or more of the systems described herein may identify a collection of devices located within a physical space. The system may identify the collection of devices in any suitable manner. For example, the determination module104may, as part of server202inFIG. 2, determine relative physical locations for each device based on data received from the collection of devices, such as the monitoring devices210. That is, the determination module104may determine which devices are within a physical proximity to each other.

The determination module104may determine that devices are in physical proximity to each other in a variety of ways, including but not limited to evaluating wireless signal strengths, analyzing information captured through a monitoring function of the monitoring device210(e.g., analyzing an image captured by a camera of a smartphone), comparing GPS coordinates, and/or any other suitable method of determining that various devices are in physical proximity of each other. For example, the determination module104may direct a game console to scan for wireless signals and capture an image through a peripheral device attached to the game system. The determination module104may then determine that various other devices are in proximity to the game system based on the wireless signals detected and/or any objects recognized in the captured image.

The term “monitoring device,” as used herein, generally refers to any device or combination of devices that is capable of capturing information about its surroundings and providing that information to another device. Monitoring devices may include a variety of components capable of capturing information about a user, such as a camera, microphone, infrared sensor, wireless antenna, or any other suitable component capable of capturing information of a physical space. Examples of monitoring devices include, without limitation, laptops, smart phones, smart watches, smart TVs, tablet computers, security cameras, and/or any other device that is capable of capturing information about a physical space.

In some examples, the determination module104may triangulate the position of a device based on wireless signals received from the device at a collection of access points. Additionally, or alternatively, the determination module104may retrieve location information from a database that associates devices with physical locations. For example, the determination module104may retrieve location information from a registry maintained by the server202that contains physical-location information associated with each device in the registry. Additionally, or alternatively, the determination module104may request physical-location information from the device, such as GPS coordinates, and determine the physical location of the device based on the physical-location information.

At step304, one or more of the systems described herein may determine that an authorized user, such as the authorized user214, is attempting to modify the access control rights of the target computing device208on the access control list122near a location indicated by the authorized user214. The system may perform this step in any suitable manner. For example, the analysis module106may receive and analyze user activity data216captured by one or more of the collection of devices, such as the monitoring device210, to determine that the authorized user214is attempting to modify the access control rights of the target computing device208.

The term “authorized user,” as used herein, generally refers to any individual that has been identified and authenticated by the system. An authorized user may be a user who has permission, or has been granted permission, to modify the access control lists122associated with a wireless network. The authorized user may be authenticated by providing credentials, such as a password on a computing device or fingerprint on a fingerprint reader of a computing device. In some examples, one or more of the collection of devices may identify the authorized user through authentication techniques, such as facial recognition, voice recognition, or the like.

The term “user activity data,” as used herein, generally refers to data captured by a computing device, such as monitoring device210, in the physical space, indicative of activity of the authorized user214. The user activity data216may be captured in the form of audio or video recordings, photographs, or the like. Examples of the user activity that may be captured by the user activity data216may include, but are not limited to, voice commands or conversation, hand gestures, pointing to objects with hands or a pointing device, movement around the physical space, or the like.

The term “target computing device,” as used herein, generally refers to any computing device in the physical space for which the authorized user would like to modify the access rights on the access control list. Examples of the target computing device include, without limitation, laptops, smart phones, smart watches, smart TVs, tablet computers, security cameras, and/or any other device that is capable of joining a wireless network.

In some examples, one or more monitoring devices210in the physical space may capture user activity data216in the form of a photograph or a video recording. The user activity data216may include data indicative of the authorized user214performing a gesture and/or using a pointing device. The analysis module106may determine, by analyzing the user activity data216, that the authorized user214is attempting to modify the access rights of the target computing device208. In some examples, the authorized user214may issue a voice command or perform a gesture indicating their wish to modify the access rights of the target computing device208. The monitoring device210may identify the voice command and, in response to identify the command, capture user activity data216and transmit the user activity data to the server202.

The analysis module106may analyze the user activity data216to detect a location indicated by the authorized user214. In some examples, the analysis module106may analyze the photograph or video recording to detect a gesture, such as finger pointing, or the presence of a pointing device, such as a laser pointer, that is directed to a location in the physical space. The analysis module106may identify the location in the physical space indicated by the authorized user214using known techniques for location detection. The analysis module106may calculate a region within the physical space based on the location indicated by the authorized user214. The analysis module106may user one or more policies124to determine a region of a predetermined distance from the location identified by the authorized user214. For example, a policy124may indicate that the region in the physical space should include the area that is twelve inches in any direction from the location in the physical space. The analysis module106may pass the identified location and the determined region in the physical space to the location module108.

In some examples, one or more monitoring devices210in the physical space may capture user activity data216in the form of an audio recording. The user activity data216may include data indicative of the authorized user214speaking while in the physical space. The analysis module106may determine, by analyzing the user activity data216, that the authorized user214is attempting to modify the access rights of the target computing device208. For example, the analysis module106may analyze the user activity data216using audio analysis techniques to identify words or phrases. The authorized user214may say a phrase that indicates their wish to modify the access rights of the target computing device208. The monitoring device210may identify the voice command and, in response to the voice command, capture user activity data216in the form of an audio recording and transmit the user activity data216to the server202.

The analysis module106may analyze the user activity data216to detect a location indicated by the authorized user. In some examples, the analysis module106may analyze the audio recording to identify a region in the physical space. The analysis module106may identify the location in the physical space indicated by the authorized user214in the audio recording. For example, the authorized user214may say “the left side of the coffee table” or “the southwest corner of the living room.” The analysis module106may retrieve data, such as a map of the physical room previously generated using the data collected by the collection of devices in the physical space. The analysis module108may identify a location within the physical space based on the user activity data216. The analysis module106may user one or more policies124to determine a region of a predetermined distance from the location identified by the authorized user214. The analysis module106may pass the identified location and the determined region in the physical space to the location module108.

In some examples, the authorized user214may identify a boundary in the physical space, by stating “the kitchen” or “the living room.” The analysis module106may retrieve data that indicates the region in the physical space that corresponds to the identified boundary. The analysis module may pass the data identifying the region in the physical space to the location module108.

In some examples, the analysis module106may analyze the audio recording to identify one or more characteristics of the target computing device208identified by the authorized user214. The analysis module108may obtain and analyze a photograph or video recording captured by the monitoring device210and to detect the location the target computing device208in the physical space. For example, the authorized user214may say “add the tablet with the red case to the network.” The analysis module108may parse the audio recording to determine that the target computing device208is a tablet that has a red case. The analysis module108may obtain the photograph or video recording of the physical space and analyze the photograph or video recording to identify the target computing device208. Upon detecting the target computing device208, the analysis module108may determine a location associated with the target computing device208. The analysis module106may calculate a region within the physical space based on the location indicated by the authorized user214. The analysis module106may user one or more policies124to determine a region of a predetermined distance from the location identified by the authorized user214. The analysis module106may pass the identified location and the determined region in the physical space to the location module108.

At step306one or more of the systems described herein may detect the target computing device208near the location indicated by the authorized user214based on the user activity data216captured by the monitoring device210. The system may perform this step in any suitable manner. For example, the location module108may, as part of server202inFIG. 2, detect a location associated with signals received from the target computing device208using triangulation techniques. The location module108may compare the location of the signals to the location indicated by the authorized user214in the physical space. For example, the location module108may identify the location of the target computing device208by detecting incoming WPS handshake signals from the target computing device208and comparing the location of the WPS handshake signals to the location indicated by the authorized user214.

At step308one or more of the systems described herein may modify the access rights of the target computing device208on the location-based access control list in response to detecting the target computing device208. The system may perform this step in any suitable manner. The access control module110may, as part of server202inFIG. 2, modify the access rights of the target computing device208on the access control list122based on one or more instructions from the authorized user214and/or one or more policies124. In some examples, the access control module110may determine the type of modification requested by the authorized user214based on the user activity data216. For example, the authorized user may indicate using voice commands to modify the access control list122to add or remove the target computing device from the access control list122. The authorized user may indicate the type of modification by interacting with a computing device206and selecting the type of modification. In some examples, the authorized user214may perform a specific gesture associated with a type of modification, which may be identified from user activity data216captured by the monitoring device210.

In some examples, the access control module110may modify the access rights of the target computing device208based on an indication from the authorized user214and one or more policies124, such as scheduling policies or boundary policies. The authorized user214may have designated a schedule to permit wireless network access. For example, a parent may wish to limit the amount of screen time for a child and their friends after 5:00 PM. If the child's friend wishes to join the wireless network, the parent may identify the device. The systems and methods herein may detect the device identified by the parent but may not enable access for the device to join the wireless network because the scheduling policy indicates that no devices are able to join the wireless network after the designated time.

In another example, a boundary policy may prohibit devices from joining the wireless network if they enter a designated area, such as a bedroom. Accordingly, in the scenario described above, the systems and methods herein may detect the device identified by the parent and enable access for the device to join the wireless network. However, the systems and methods described herein may disable the wireless network access if the device is moved to a prohibited area, such as the child's bedroom. The wireless access may be re-enabled once the device has been moved away from the prohibited area.

FIG. 4is an illustrative diagram400of a use case for managing location-based access control lists. As depicted inFIG. 4, an authorized user214may be sitting on a couch in a living. Multiple devices may be located within the living room, such as a smart television, and multiple computing devices located on a coffee table, such as a smartphone (e.g., target computing device208) and a tablet (e.g., additional device405). The smart television may be the monitoring device210capable of monitoring user activity within the physical space (e.g., living room). In some examples, the authorized user214may perform a gesture with his hand, such as pointing towards the right side of the coffee table. The monitoring device210may capture a photograph450of the user activity in the living and transmit the user activity data216(e.g., photograph450) to the server202. The analysis module108of the server202may analyze the photograph450and determine that the authorized user214is pointing to a location in the physical space (e.g., the right side of the coffee table). In some examples, the analysis module108may identify the location within the physical space and determine a region460within the physical space based on the location and one or more policies124that may specify the size of the region. The analysis module106may communicate with the location module108to detect the target computing device208located within the region460and may modify the access control rights of the target computing device208in the access control list122based on the user activity data216of the authorized user214captured by the monitoring device210. The access rights of the additional device405may not be modified as they are not located within the region460indicated by the authorized user214.

The example system100inFIG. 1may be implemented in a variety of ways. For example, all or a portion of the example system100may represent portions of the system500inFIG. 5. As will be described in greater detail below, one or more of the modules102fromFIG. 1may, when executed by at least one processor of the server202, enable the system500to manage location-based access control lists. For example, and as will be described in greater detail below, one or more of the modules102may cause the example system500to identify, by a determination module104, a collection of devices located within a physical space. The collection of devices in the physical space may include one or more monitoring devices, such as the monitoring device210, that are capable of monitoring and capturing user activity within the physical space. The analysis module106may receive user activity data216from the collection of devices and determine, based on the received user activity data216, that an authorized user214is attempting to modify, on a location-based access control list122for a wireless network, the access rights of a target computing device208near a location460indicated by the authorized user214in the physical space. The location module108may detect, based on the user activity data216, the target computing device208near the location460indicated by the authorized user214. In response to detecting the target computing device208indicated by the authorized user214, the access control module110may modify the access rights of the target computing device208on the location-based access control list122to enable the target computing device208to join the wireless network.

Existing access-control solutions may not permit a device to easily or securely join a wireless network without sharing the Wi-Fi credentials of the network with the new device. If a user shares the Wi-Fi credentials of a wireless network with a guest device but does not want the guest device to have subsequent access to the network, the user may need to change the Wi-Fi credentials and update all the devices that utilized the previous credentials. In another example, the user may utilize a Wi-Fi protected setup which may enable a router of the wireless network may allow any device in range to connect to the router within a specific time window. However, during the time window, the wireless network may be available to any device within range and a hostile device may easily join the wireless network. The systems and methods described herein are directed to managing location-based access control lists that may be modified by monitoring a physical space using a constellation of additional devices. These additional devices may perform a variety of monitoring functions, such as identifying and authenticating an authorized user to the system and/or capturing user activity through videos, photographs, or audio recordings. The systems and methods described herein may analyze the user activity to identify a location indicated by the authorized user and detect a device near the location. Upon detecting the device near the location, the location-based access control list may be modified to permit the device to join the wireless network.

The computing system610broadly represents any single or multi-processor computing device or system capable of executing computer-readable instructions. Examples of the computing system610include, without limitation, workstations, laptops, client-side terminals, servers, distributed computing systems, handheld devices, or any other computing system or device. In its most basic configuration, the computing system610may include at least one processor614and a system memory616.

The processor614generally represents any type or form of physical processing unit (e.g., a hardware-implemented central processing unit) capable of processing data or interpreting and executing instructions. In certain embodiments, the processor614may receive instructions from a software application or module. These instructions may cause the processor614to perform the functions of one or more of the example embodiments described and/or illustrated herein.

The system memory616generally represents any type or form of volatile or non-volatile storage device or medium capable of storing data and/or other computer-readable instructions. Examples of the system memory616include, without limitation, Random Access Memory (RAM), Read Only Memory (ROM), flash memory, or any other suitable memory device. Although not required, in certain embodiments, the computing system610may include both a volatile memory unit (such as, for example, system memory616) and a non-volatile storage device (such as, for example, primary storage device632, as described in detail below). In one example, one or more of the modules102fromFIG. 1may be loaded into the system memory616.

In some examples, the system memory616may store and/or load an operating system640for execution by the processor614. In one example, the operating system640may include and/or represent software that manages computer hardware and software resources and/or provides common services to computer programs and/or applications on the computing system610. Examples of the operating system640include, without limitation, LINUX, JUNOS, MICROSOFT WINDOWS, WINDOWS MOBILE, MAC OS, APPLE'S IOS, UNIX, GOOGLE CHROME OS, GOOGLE'S ANDROID, SOLARIS, variations of one or more of the same, and/or any other suitable operating system.

In certain embodiments, the example computing system610may also include one or more components or elements in addition to the processor614and the system memory616. For example, as illustrated inFIG. 6, the computing system610may include a memory controller618, an Input/Output (I/O) controller620, and a communication interface622, each of which may be interconnected via a communication infrastructure612. The communication infrastructure612generally represents any type or form of infrastructure capable of facilitating communication between one or more components of a computing device. Examples of the communication infrastructure612include, without limitation, a communication bus (such as an Industry Standard Architecture (ISA), Peripheral Component Interconnect (PCI), PCI Express (PCIe), or similar bus) and a network.

The memory controller618generally represents any type or form of device capable of handling memory or data or controlling communication between one or more components of the computing system610. For example, in certain embodiments, the memory controller618may control communication between the processor614, the system memory616, and the I/O controller620via the communication infrastructure612.

The I/O controller620generally represents any type or form of module capable of coordinating and/or controlling the input and output functions of a computing device. For example, in certain embodiments, the I/O controller620may control or facilitate transfer of data between one or more elements of the computing system610, such as the processor614, the system memory616, the communication interface622, the display adapter626, the input interface630, and the storage interface634.

As illustrated inFIG. 6, the computing system610may also include at least one display device624coupled to the I/O controller620via a display adapter626. The display device624generally represents any type or form of device capable of visually displaying information forwarded by the display adapter626. Similarly, the display adapter626generally represents any type or form of device configured to forward graphics, text, and other data from the communication infrastructure612(or from a frame buffer, as known in the art) for display on the display device624.

As illustrated inFIG. 6, the example computing system610may also include at least one input device628coupled to the I/O controller620via an input interface630. The input device628generally represents any type or form of input device capable of providing input, either computer or human generated, to example computing system610. Examples of the input device628include, without limitation, a keyboard, a pointing device, a speech recognition device, variations or combinations of one or more of the same, and/or any other input device.

Additionally or alternatively, the example computing system610may include additional I/O devices. For example, the example computing system610may include the I/O device636. In this example, the I/O device636may include and/or represent a user interface that facilitates human interaction with the computing system610. Examples of the I/O device636include, without limitation, a computer mouse, a keyboard, a monitor, a printer, a modem, a camera, a scanner, a microphone, a touchscreen device, variations or combinations of one or more of the same, and/or any other I/O device.

In some examples, the system memory616may store and/or load a network communication program638for execution by the processor614. In one example, the network communication program638may include and/or represent software that enables the computing system610to establish a network connection642with another computing system (not illustrated inFIG. 6) and/or communicate with the other computing system by way of the communication interface622. In this example, the network communication program638may direct the flow of outgoing traffic that is sent to the other computing system via the network connection642. Additionally, or alternatively, the network communication program638may direct the processing of incoming traffic that is received from the other computing system via the network connection642in connection with the processor614.

Although not illustrated in this way inFIG. 6, the network communication program638may alternatively be stored and/or loaded in the communication interface622. For example, the network communication program638may include and/or represent at least a portion of software and/or firmware that is executed by a processor and/or Application Specific Integrated Circuit (ASIC) incorporated in the communication interface622.

As illustrated inFIG. 6, the example computing system610may also include a primary storage device632and a backup storage device633coupled to the communication infrastructure612via a storage interface634. The storage devices632and633generally represent any type or form of storage device or medium capable of storing data and/or other computer-readable instructions. For example, the storage devices632and633may be a magnetic disk drive (e.g., a so-called hard drive), a solid state drive, a floppy disk drive, a magnetic tape drive, an optical disk drive, a flash drive, or the like. The storage interface634generally represents any type or form of interface or device for transferring data between the storage devices632and633and other components of the computing system610. In one example, the data storage120fromFIG. 1may be stored and/or loaded in the primary storage device632.

In certain embodiments, the storage devices632and633may be configured to read from and/or write to a removable storage unit configured to store computer software, data, or other computer-readable information. Examples of suitable removable storage units include, without limitation, a floppy disk, a magnetic tape, an optical disk, a flash memory device, or the like. The storage devices632and633may also include other similar structures or devices for allowing computer software, data, or other computer-readable instructions to be loaded into the computing system610. For example, the storage devices632and633may be configured to read and write software, data, or other computer-readable information. The storage devices632and633may also be a part of the computing system610or may be a separate device accessed through other interface systems.

The computer-readable medium containing the computer program may be loaded into the computing system610. All or a portion of the computer program stored on the computer-readable medium may then be stored in the system memory616and/or various portions of the storage devices632and633. When executed by the processor614, a computer program loaded into the computing system610may cause the processor614to perform and/or be a means for performing the functions of one or more of the example embodiments described and/or illustrated herein. Additionally, or alternatively, one or more of the example embodiments described and/or illustrated herein may be implemented in firmware and/or hardware. For example, the computing system610may be configured as an Application Specific Integrated Circuit (ASIC) adapted to implement one or more of the example embodiments disclosed herein.

The client systems710,720, and730generally represent any type or form of computing device or system, such as example the computing system610inFIG. 6. Similarly, the servers740and745generally represent computing devices or systems, such as application servers or database servers, configured to provide various database services and/or run certain software applications. The network750generally represents any telecommunication or computer network including, for example, an intranet, a WAN, a LAN, a PAN, or the Internet. In one example, the client systems710,720, and/or730and/or the servers740and/or745may include all or a portion of the system100fromFIG. 1.

As illustrated inFIG. 7, one or more storage devices760(1)-(N) may be directly attached to the server740. Similarly, the one or more storage devices770(1)-(N) may be directly attached to the server745. The storage devices760(1)-(N) and the storage devices770(1)-(N) generally represent any type or form of storage device or medium capable of storing data and/or other computer-readable instructions. In certain embodiments, the storage devices760(1)-(N) and the storage devices770(1)-(N) may represent Network-Attached Storage (NAS) devices configured to communicate with the servers740and745using various protocols, such as Network File System (NFS), Server Message Block (SMB), or Common Internet File System (CIFS).

The servers740and745may also be connected to a Storage Area Network (SAN) fabric780. The SAN fabric780generally represents any type or form of computer network or architecture capable of facilitating communication between a plurality of storage devices. The SAN fabric780may facilitate communication between the servers740and745and a plurality of the storage devices790(1)-(N) and/or an intelligent storage array795. The SAN fabric780may also facilitate, via the network750and the servers740and745, communication between the client systems710,720, and730and the storage devices790(1)-(N) and/or the intelligent storage array795in such a manner that the devices790(1)-(N) and they array795appear as locally attached devices to the client systems710,720, and730. As with the storage devices760(1)-(N) and the storage devices770(1)-(N), the storage devices790(1)-(N) and the intelligent storage array795generally represent any type or form of storage device or medium capable of storing data and/or other computer-readable instructions.

In certain embodiments, and with reference to the example computing system610ofFIG. 6, a communication interface, such as communication interface622inFIG. 6, may be used to provide connectivity between each client system710,720, and730and the network750. The client systems710,720, and730may be able to access information on the server740or745using, for example, a web browser or other client software. Such software may allow the client systems710,720, and730to access data hosted by the server740, the server745, the storage devices760(1)-(N), the storage devices770(1)-(N), the storage devices790(1)-(N), or the intelligent storage array795. AlthoughFIG. 7depicts the use of a network (such as the Internet) for exchanging data, the embodiments described and/or illustrated herein are not limited to the Internet or any particular network-based environment.

In at least one embodiment, all or a portion of one or more of the example embodiments disclosed herein may be encoded as a computer program and loaded onto and executed by the server740, the server745, the storage devices760(1)-(N), the storage devices770(1)-(N), the storage devices790(1)-(N), the intelligent storage array795, or any combination thereof. All or a portion of one or more of the example embodiments disclosed herein may also be encoded as a computer program, stored in the server740, run by the server745, and distributed to the client systems710,720, and730over the network750.

As detailed above, the computing system610and/or one or more components of the network architecture700may perform and/or be a means for performing, either alone or in combination with other elements, one or more steps of an example method for managing location-based access control lists.