Location-based access control

Abstract

The embodiment of the invention relates to access control based on location. This technique describes a network management system (NMS) configured to obtain a request to access a resource from a first computing device supporting an ultra wide band (UWB) protocol. The NMS may initiate a UWB secure ranging session between the first computing device and a second computing device supporting a UWB protocol to determine a location of the first computing device. The NMS may acquire a distance measurement between the first computing device and the second computing device based on the UWB secure ranging session. The NMS may determine a location of the first computing device based on the distance measurements. The NMS may provide access to the resource to the first computing device based on the location of the first computing device satisfying a condition of an access policy for the resource.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to U.S. patent application No. 18 / 477,103 filed on September 28, 2023, the entire contents of which are incorporated herein. Technical Field

[0003] The present disclosure relates generally to computer networks and, more particularly, to monitoring and troubleshooting computer networks. Background Art

[0004] Business locations or sites, such as offices, hospitals, airports, stadiums, or retail stores, often have complex wireless network systems installed throughout the location, including a network of multiple wireless access points (APs) to provide wireless network services to one or more wireless client devices (or simply "clients"). An AP is a physical electronic device that enables other devices to wirelessly connect to a wired network using a variety of wireless network protocols and technologies, such as a wireless local area network protocol that complies with one or more of the IEEE 802.11 standard (i.e., "WiFi"), Bluetooth / Bluetooth Low Energy (BLE), mesh network protocols such as ZigBee, or other wireless network technologies. Many different types of wireless client devices, such as laptops, smartphones, tablets, wearable devices, home appliances, and Internet of Things (IoT) devices, all incorporate wireless communication technologies and can be configured to connect to a wireless access point when the device is within range of a compatible wireless access point in order to access a wired network. In the case where a client device runs a cloud-based application (e.g., a Voice Over Internet Protocol (VOIP) application, a streaming video application, a gaming application, or a video conferencing application), during an application session, data is exchanged from the client device through one or more APs and one or more wired network devices (e.g., switches, routers, and / or gateway devices) to reach the cloud-based application server. Summary of the invention

[0005] In general, the present disclosure describes one or more techniques for providing computing device access to restricted resources provided at an enterprise network site based on the physical location of the computing device. A network management system can regulate access to restricted resources to computing devices using ultra-wideband (UWB) technology. The network management system can determine the physical location of the computing device to request access to the resource using UWB secure ranging. For example, the network management system can assign authorized devices (e.g., access points, switches, servers, client devices, etc.) as UWB "beacons." The network management system can use the UWB beacon as a reference point for a physical location in which access to resources can be authorized. The network management system can use the determined physical location of the requesting computing device as a factor in whether to provide access to restricted resources to the requesting computing device.

[0006] The techniques of the present disclosure may provide one or more advantages. For example, the techniques include a network management system that regulates access to resources based on the physical location of a requesting computing device. The network management system may use UWB technology to determine the location of a requesting computing device with relatively high accuracy (e.g., within 1 meter of the actual location of the requesting computing device). The network management system may use UWB technology to prevent a requesting computing device from "spoofing" or broadcasting an erroneous location. In this way, the network management system may safely use the location of the requesting computing device as a reliable factor when determining whether to authorize the requesting computing device to access computer network resources.

[0007] In one example, the present disclosure relates to a network management system, which includes a processing circuit and a memory including instructions. These instructions, when executed by the processing circuit, cause the processing circuit to obtain a request to access a resource from a first computing device on a wireless network at a site, the first computing device supporting an ultra-wideband (UWB) protocol. These instructions may also cause the processing circuit to initiate a UWB secure ranging session between a first computing device and a second computing device to determine the location of the first computing device, wherein the second computing device is on the wireless network at the site and supports the UWB protocol. These instructions may also cause the processing circuit to obtain one or more distance measurements between the first computing device and the second computing device based on the UWB secure ranging session. These instructions may also cause the processing circuit to determine the location of the first computing device based on the one or more distance measurements. These instructions may also cause the processing circuit to provide access to the resource to the first computing device based on the condition that the location of the first computing device satisfies an access policy for the resource.

[0008] In another example, a method includes obtaining a request to access a resource from a first computing device on a wireless network at a site, the first computing device supporting an ultra-wideband (UWB) protocol. The method may also include initiating a UWB secure ranging session between the first computing device and a second computing device to determine the location of the first computing device, wherein the second computing device is on the wireless network at the site and supports the UWB protocol. The method may also include obtaining one or more distance measurements between the first computing device and the second computing device based on the UWB secure ranging session. The method may also include determining the location of the first computing device based on the one or more distance measurements. The method may also include providing access to the resource to the first computing device based on a condition that the location of the first computing device satisfies an access policy for the resource.

[0009] In another example, a computer-readable storage medium includes machine-readable instructions for configuring a processing circuit to obtain a request to access a resource from a first computing device on a wireless network at a site, the first computing device supporting an ultra-wideband (UWB) protocol. The processing circuit may also be configured to initiate a UWB secure ranging session between a first computing device and a second computing device to determine the location of the first computing device, wherein the second computing device is on a wireless network at the site and supports the UWB protocol. The processing circuit may also be configured to obtain one or more distance measurements between the first computing device and the second computing device based on the UWB secure ranging session. The processing circuit may also be configured to determine the location of the first computing device based on the one or more distance measurements. The processing circuit may also be configured to provide access to the resource to the first computing device based on a condition that the location of the first computing device satisfies an access policy for the resource.

[0010] The details of one or more examples of the technology of the present disclosure are set forth in the accompanying drawings and the description below. Other features, objects, and advantages of the technology will be apparent from the description and drawings, and from the claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1A is a block diagram of an example network system that includes a network management system in accordance with one or more techniques of this disclosure.

[0012] Figure 1B It is shown Figure 1A A block diagram of a network system with further example details.

[0013] Figure 1C It is shown Figure 1A A block diagram of another example of a network system.

[0014] Figure 2 is a block diagram of an example access point device in accordance with one or more techniques of this disclosure.

[0015] Figure 3 is a block diagram of an example network management system in accordance with one or more techniques of this disclosure.

[0016] Figure 4 is a block diagram of an example user equipment device, in accordance with one or more techniques of this disclosure.

[0017] Figure 5 is a block diagram of an example UWB beacon (eg, a client device, AP, router, or switch) in accordance with one or more techniques of this disclosure.

[0018] Figure 6 An example graphical user interface for creating a resource access policy is shown.

[0019] Figure 7 is a flow diagram illustrating example operations for enforcing conditional access to resources by a computing device based on a location of the computing device in accordance with one or more techniques of this disclosure.

[0020] Figure 8 is a flow diagram illustrating example operations for authorizing a computing device to access a resource based on a location of the computing device in accordance with one or more techniques of this disclosure. DETAILED DESCRIPTION

[0021] Figure 1A 1 is a block diagram of an example network system 100 including a network management system (NMS) 130 according to one or more techniques of the present disclosure. The example network system 100 includes a plurality of sites 102A through 102N at which network service providers manage one or more wireless networks 106A through 106N, respectively. Figure 1A , each site 102A-102N is shown as including a single wireless network 106A-106N, respectively, but in some examples each site 102A-102N may include multiple wireless networks, and the present disclosure is not limited in this regard.

[0022] Each site 102A to 102N includes a plurality of network access server (NAS) devices, such as a plurality of access points (APs) 142, switches 146, or routers (not shown). For example, site 102A includes a plurality of APs 142A-1 to 142A-M. Similarly, site 102N includes a plurality of APs 142N-1 to 142N-M. Each AP 142 may include at least one type of wireless access point, including but not limited to a business or enterprise AP, a router, or another device connected to a wired network and capable of providing wireless network access to client devices within the site.

[0023] Each site 102A to 102N also includes multiple client devices, otherwise referred to as user equipment (UE) devices, commonly referred to as UE or client devices 148, which represent various wireless-enabled devices within each site. For example, multiple UEs 148A-1 to 148A-K are currently located at site 102A. Similarly, multiple UEs 148N-1 to 148N-K are currently located at site 102N. Each UE 148 may include at least one type of wireless client device, including but not limited to mobile devices (such as smart phones, tablet computers or notebook computers), personal digital assistants (PDAs), wireless terminals, smart watches, smart rings, or other wearable devices. UE 148 may also include wired client devices, for example, IoT devices such as printers, security devices, environmental sensors, or another device connected to a wired network and configured to communicate through one or more wireless networks 106.

[0024] In order to provide wireless network services to UE 148 and / or communicate over wireless network 106, multiple APs 142 and other wired client devices at site 102 are connected to one or more network devices (e.g., switches, routers, etc.) either directly or indirectly via physical cables (e.g., Ethernet cables). Figure 1A In the example of , site 102A includes switch 146A to which each of the plurality of APs 142A-1 to 142A-M at site 102A is connected. Similarly, site 102N includes switch 146N to which each of the APs 142N-1 to 142N-M at site 102N is connected. Figure 1A , it appears as if each site 102 includes a single switch 146 and multiple APs 142 of a given site 102 are connected to a single switch 146, but in other examples, each site 102 may include more or fewer switches and / or routers. In addition, multiple APs and other wired client devices of a given site may be connected to two or more switches and / or routers. In addition, two or more switches at a site may be interconnected and / or connected to two or more routers, for example, via a mesh or partial mesh topology in a hub-and-spoke architecture. In some examples, the interconnected switches and routers include a wired local area network (LAN) at the site 102 hosting the wireless network 106.

[0025] The example network system 100 also includes various network components for providing network services within the wired network, which includes, as an example, an authentication, authorization, and accounting (AAA) server 110 (e.g., an identity access management (IAM) system, an identity provider (IdP), a service provider (SP), etc.) for authenticating users and / or UEs 148 (e.g., according to one or more business rules, access policies, etc.), a dynamic host configuration protocol (DHCP) server 116 for dynamically allocating a network address (e.g., an IP address) to the UE 148 upon authentication, a domain name system (DNS) server 122 for resolving domain names into network addresses, a plurality of servers 128A to 128X (collectively referred to as "servers 128") (e.g., web servers, database servers, file servers, etc.), and a network management system (NMS) 130. As shown in Figure 1A As shown in FIG. 1 , the various devices and systems of network 100 are coupled together via one or more networks 134 , such as the Internet and / or a corporate intranet.

[0026] exist Figure 1A In an example of the present invention, NMS 130 is a cloud-based computing platform that manages wireless networks 106A to 106N at one or more of sites 102A to 102N. As further described herein, NMS 130 provides a set of integrated management tools and implements various technologies of the present disclosure. In general, NMS 130 can provide a cloud-based platform for wireless network data collection, monitoring, activity logging, reporting, predictive analysis, network anomaly identification, and alarm generation. In some examples, NMS 130 outputs notifications, such as alarms, warnings, graphical indicators on a dashboard, log messages, text / SMS messages, email messages, etc., and / or suggestions about wireless network problems to a site or network administrator ("administration") that interacts with and / or operates management device 111. In addition, in some examples, NMS 130 operates in response to configuration input received from an administrator that interacts with and / or operates management device 111.

[0027] Administrators and management devices 111 may include IT personnel and administrator computing devices associated with one or more of the sites 102. Management device 111 may be implemented as one or more suitable devices for presenting output and / or accepting user input. For example, management device 111 may include a display. Management device 111 may be a computing system, such as a mobile or non-mobile computing device operated by a user and / or by an administrator. For example, management device 111 may represent a workstation, a portable computer or notebook computer, a desktop computer, a tablet computer, or another computing device that can be operated by a user and / or presents a user interface according to one or more aspects of the present disclosure. Management device 111 may be physically separated from NMS 130 and / or in a different location from NMS 130, which allows management device 111 to communicate with NMS 130 via network 134 or other communication methods.

[0028] In some examples, one or more of the NAS devices (e.g., AP 142, switch 146, or router) can be connected to edge devices 150A to 150N via physical cables (e.g., Ethernet cables). Edge device 150 includes a cloud-managed wireless local area network (LAN) controller. Each of edge devices 150 can include a local device at site 102 that communicates with NMS 130 to extend certain microservices from NMS 130 to the local NAS device, while using NMS 130 and its distributed software architecture for scalable and resilient operations, management, troubleshooting, and analysis.

[0029] Each of the network devices of the network system 100, such as the servers 110, 116, 122 and / or 128, the AP 142, the UE 148, the switch 146, and other servers or devices attached to or forming part of the network system 100, may include a system log or error log module, wherein each of the network devices records the state of the network device, including normal operating states and error conditions. Throughout the present disclosure, one or more of the network devices of the network system 100, such as the servers 110, 116, 122 and / or 128, the AP 142, the UE 148, and the switch 146, may be considered a "third party" network device when the network device is owned and / or associated with a different entity than the NMS 130 such that the NMS 130 does not receive, collect, or otherwise have access to the recorded state and other data of the third party network device. In some examples, the edge device 150 may provide an agent through which the recorded state and other data of the third party network device may be reported to the NMS 130.

[0030] In some examples, the NMS 130 monitors network data 137, such as one or more service level expectation (SLE) metrics received from the wireless networks 106A to 106N at each site 102A to 102N, respectively, and manages network resources, such as the AP 142 at each site, to deliver a high-quality wireless experience to end users, IoT devices, and clients at the site. For example, the NMS 130 may include a virtual network assistant (VNA) 133 that implements an event processing platform for providing real-time insights and simplified troubleshooting for IT operations, and automatically takes corrective actions or provides recommendations to proactively resolve wireless network problems. For example, the VNA 133 may include an event processing platform that is configured to process hundreds or thousands of concurrent streams of network data 137 from sensors and / or agents associated with the APs 142 and / or nodes within the network 134. For example, according to various examples described herein, the VNA 133 of the NMS 130 may include a basic analysis and network error identification engine and alarm system. The underlying analytics engine of the VNA 133 can apply historical data and models to the inbound event stream to compute assertions, such as the occurrence of an identified anomaly or a predicted event that constitutes a network error condition. In addition, the VNA 133 can provide real-time alerts and reports to notify site or network administrators via one or more management devices 111 of predicted events, anomalies, trends, and can perform root cause analysis and automatic or assisted error remediation. In some examples, the VNA 133 of the NMS 130 can apply machine learning techniques to identify the root cause of an error condition detected or predicted from the network data stream 137. If the root cause can be automatically resolved, the VNA 133 can invoke one or more corrective actions to correct the root cause of the error condition, thereby automatically improving the potential SLE metrics and also automatically improving the user experience.

[0031] Further example details of the operations implemented by the VNA 133 of the NMS 130 are disclosed in U.S. Patent No. 9,832,082, issued on November 28, 2017, and entitled “Monitoring Wireless Access Point Events”; U.S. Patent No. 9,832,082, issued on September 30, 2021, and entitled “Monitoring Wireless Access Point Events”; 2021 / 0306201 and entitled “Network system fault resolution using machine learning models,” U.S. Patent No. 10,985,969 issued on April 20, 2021 and entitled “Systems and methods for virtual network assistants,” U.S. Patent No. 10,958,585 issued on March 23, 2021 and entitled “Methods and apparatus for facilitating fault detection and / or predictive fault detection,” U.S. Patent No. 10,958,537 issued on March 23, 2021 and entitled “Methods for spatiotemporal modeling,” and U.S. Patent No. 10,862,742 issued on December 8, 2020 and entitled “Method for communicating AP error codes via BLE advertisements,” the entire contents of which are incorporated herein.

[0032] In operation, NMS 130 may observe, collect and / or receive network data 137, which may take the form of data extracted from one or more distance measurements, messages, counters and statistics, for example. According to one particular implementation, the computing device is part of NMS 130. According to other implementations, NMS 130 may include one or more computing devices, dedicated servers, virtual machines, containers, services, or other forms of environments for executing the techniques described herein. Similarly, the computing resources and components that implement VNA 133 may be part of NMS 130, may be executed on other servers or execution environments, or may be distributed to nodes (e.g., routers, switches, controllers, gateways, etc.) within network 134.

[0033] According to one or more techniques of the present disclosure, NMS 130 may be configured to authorize client device 148 to access resources based on the determined physical location of client device 148. NMS 130 may be configured to utilize UWB technology of the devices of site 102 to accurately determine the location of client device 148. In some cases, client device 148 and AP 142 may each include a UWB chipset with a UWB antenna. For example, client device 148 and AP 142 may each implement UWB technology in accordance with IEEE 802.15.4z-2020 entitled “IEEE Standard for Low-Rate Wireless Networks—Amendment 1: Enhanced Ultra-Wideband (UWB) Physical Layer (PHY) and Associated Ranging Techniques,” which is incorporated herein by reference in its entirety. In this manner, client devices 148 and APs 142 may be able to interact with each other such that NMS 130 may determine the location of client devices 148 and / or APs 142 with relatively high accuracy (eg, within one meter of the actual location of client devices 148 and / or APs 142).

[0034] exist Figure 1A In an example of the present invention, the NMS 130 may include an ultra-wideband (UWB) secure ranging session module 135. The UWB secure ranging session module 135 may initiate a UWB secure ranging session between at least two devices at one of the sites 102. The UWB secure ranging session module 135 may initiate a UWB secure ranging session by generating and sending an encryption key to at least two devices involved in a specific UWB secure ranging session. For example, the UWB secure ranging session module 135 may generate an encryption key for the UWB secure ranging session according to the Advanced Encryption Standard (AES) (e.g., AES-128 Deterministic Random Bit Generator (DRBG)). In some instances, the UWB secure ranging session module 135 may include a scrambled timestamp sequence (STS) field in the encryption key. For example, the UWB secure ranging session module 135 may include an encryption key of the STS field of one or more pseudo-random pulse sequences generated from AES-128 bits.

[0035] The UWB secure ranging session module 135 may send a generated encryption key including an STS field to at least two devices involved in the UWB secure ranging session. The UWB secure ranging session module 135 may send an encryption key including an STS field to at least two devices, which enables at least two devices to communicate securely (e.g., receive and / or send pulses for distance measurement) using the received encryption key generated for the UWB secure ranging session. The UWB secure ranging session module 135 may send the encryption key through a secure channel provided by a secure connection between the NMS 130 and the devices involved in the UWB secure ranging session. In this way, the NMS 130 may ensure that the distance measurements obtained based on the UWB secure ranging session are secure from both accidental interference and intentional malicious attacks.

[0036] exist Figure 1A In the example of , the NMS 130 may include a conditional access module 136 to implement policies or business rules associated with accessing specific resources. The conditional access module 136 may communicate with the AAA server 110 via the network 134 to determine whether the requesting device can be authorized to access specific resources, and implement policies or business rules associated with restricted resources. For example, the NMS 130 may store business rules or policies that specify that the requesting UE (e.g., the client device 148) must satisfy one or more requests associated with the location of the requesting UE. In this example, when the requesting UE at the site requests access to a resource via one of the APs or another NAS device in the AP 142, the UWB secure ranging session module 135 of the NMS 130 initiates a UWB secure ranging session between the requesting UE device and at least one other device at the site (e.g., one of the APs or NAS devices in the AP 142 or another UE device). The UWB secure ranging session module 135 may obtain one or more distance measurements from the requesting UE device and / or at least one other device involved in the UWB secure ranging session. The UWB secure ranging session module 135 may relay one or more distance measurements to the conditional access module 136 to determine whether the one or more distance measurements meet the requirements for accessing the requested resource based on the business rules or policies associated with the requested resource. In some instances, if the requesting UE meets the requirements associated with the acquired distance measurements, the conditional access module 136 may distribute a network access certificate or token to the requesting UE. In some examples, the conditional access module 136 may notify the AAA server 110 that the requesting UE is distributed a network access certificate or token, which enables the AAA server 110 to provide the requested resource to the requesting UE as long as the requesting UE maintains a valid network access certificate or token.

[0037] In operation, NMS 130 may obtain a request from one or more of client devices 148 via one of APs 142 or another NAS device. NMS 130 may obtain a request to access a secure resource. For example, NMS 130 may obtain a request to access resources such as network resources, computing resources, encrypted electronic documents, websites, sensitive systems, computing devices, a service set identifier (SSID) for access to a local area network, software applications, and the like.

[0038] The NMS 130 may initiate a UWB secure ranging session based on receiving a request to access a resource. For example, the client device 148A-1 may request access to a resource associated with a business rule or access policy stored in the NMS 130. The NMS 130, or more specifically, the conditional access module 136, may store a business rule or access policy requiring the requesting UE (e.g., the client device 148A-1) to be in a certain space near at least one of the APs 142A-1 to 142A-M. In an example, the client device 148A-1 may request access to a resource associated with the business rule or access via the AP 142A-1.

[0039] For example, the NMS 130, and more specifically the UWB secure ranging session module 135, may initiate a UWB secure ranging session between the requesting client device 148A-1 and other client devices 148 (e.g., client devices 148A-N) or one or more network devices (e.g., the AP 142, the switch 146, or other NAS devices at the site 102A). The UWB secure ranging session module 130 may initiate the UWB secure ranging session by generating an encryption key. The UWB secure ranging session module 135 may generate the encryption key based on AES-128 including an STS field of the key. For example, the UWB secure ranging session module 135 may generate an encryption key having STS fields, which may include a pulse sequence generated using an AES-128 algorithm (e.g., an AES-128 deterministic random bit generator (DRBG)).

[0040] Continuing with the above example, the NMS 130, or more specifically, the UWB secure ranging session module 135, can generate an encryption key that can be processed by the UWB chipset of the requesting client device 148A-1 and by the UWB chipsets of one or more network devices of the site 102A (e.g., the AP 142A-1). For example, the UWB secure ranging session module 135 can generate the encryption key according to the UWB physical layer (PHY) protocol. The UWB secure ranging session module 135 can include an STS field in the encryption key by adding the generated pulse sequence to a high rate pulse repetition frequency (HRP) UWB physical layer (PHY) frame structure. The UWB secure ranging session module 135 may include an STS field in a generated encryption key to verify a temporal position of a reference marker (RMARKER) included in a sequence of communications between the requesting client device 148A-1 and at least one other device in the site 102A (e.g., the AP 142A-1), which may be used to calculate one or more distance measurements between the requesting client device 148A-1 and at least one other device (e.g., the AP 142A) involving the UWB secure ranging session.

[0041] In some instances, the UWB secure ranging session module 135 may initiate a UWB secure ranging session between at least two devices to obtain one or more distance measurements based on the UWB secure ranging session. Continuing with the above example, the client device 148A-1 may request access to a resource that requires the requesting UE to be within a certain space proximate to the AP 142A-1. The client device 148A-1 may send a request for the resource to the NMS 130 via one of the NAS devices of the site 102A. The NMS 130, or more specifically, the conditional access module 136, may determine that the requested resource requires a certain space proximate to the AP 142A-1 based on business rules or access policies maintained by the NMS 130 and / or the AAA server 110. The conditional access module 136 may send an instruction to the UWB secure ranging session module 135 to obtain one or more distance measurements between the requesting client device 148A-1 and the AP 142A-1. The UWB secure ranging session module 135 may generate an encryption key for the UWB secure ranging session and send the encryption key to the client device 148A-1 and the AP 142A-1. The UWB secure ranging session module 135 may send the encryption key to the client device 148A-1 via a first secure channel between the client device 148A-1 and the NMS 130. The UWB secure ranging session module 135 may send the encryption key to the AP 142A-1 via a second secure channel between the AP 142A-1 and the NMS 130. The UWB secure ranging session module 135 may send the encryption key to the devices involved in the UWB secure ranging session via a secure channel connection (e.g., a RadSec tunnel or another encrypted tunnel) between the NMS 130 and the devices involved in the UWB secure ranging session. The client device 148A-1 and the AP 142A-1 may reliably send and receive pulses with each other using encryption keys to determine one or more distance measurements used to verify whether the client device 148A-1 can access requested resources according to business rules or access policies managed by the NMS 130 and / or AAA server 110.

[0042] In this example client device 148A-1 and AP 142A-1, NMS 130, or more specifically, UWB secure ranging session module 135, can obtain one or more distance measurements between devices involved in the UWB secure ranging session. In some instances, UWB secure ranging session module 135 can obtain distance measurements including physical time of flight (ToF) measurements between the requesting device and the reference device. UWB secure ranging session module 135 can obtain distance measurements including angle of arrival (AoA), which can represent, for example, the direction or angle at which client device 148A-1 is located with respect to AP 142A-1. For example, client device 148A-1 or AP 142A-1 can send a signal or electromagnetic pulse to AP 142A-1 or client device 148A-1, respectively. Client device 148A-1 and / or AP 142A-1 can send the signal or electromagnetic pulse using a received encryption key associated with the UWB secure ranging session including an STS field. The AP 142A-1 and / or the client device 148A-1 may receive the signal or electromagnetic pulse and generate a sequence based on the characteristics of the received signal or electromagnetic pulse. For example, the AP 142A-1 and / or the client device 148A-1 may generate a sequence associated with one or more distance measurements (e.g., ToF, AoA, etc.) determined by applying a direction discovery (DF) function. If the encryption key used to send the signal or electromagnetic pulse is associated with the encryption key received from the UWB secure ranging session module 135, the AP 142A-1 and / or the client device 148A-1 may use the UWB chipset and software module to apply the DF function to determine one or more distance measurements. The AP 142A-1 and / or the client device 148A-1 may use a software module (e.g., a software application client, a software service, a software agent, etc.) to send a sequence associated with one or more distance measurements to the UWB secure ranging session module 135 via the network 134. In some instances, the AP 142A-1 and / or the client device 148A-1 may send the one or more distance measurements to the NMS 130 as the network data 137. The UWB secure ranging session module 135 may confirm whether the acquired one or more distance measurements were acquired during a specific UWB secure ranging session using the STS field included in the generated encryption key to verify the temporal position of the RMARKER included in the sequence associated with the one or more distance measurements.

[0043] The UWB secure ranging session module 135 may relay one or more distance measurements obtained and associated with the requesting UE to the conditional access module 136 to determine whether the requesting UE can be authorized to access the requested resource. For example, the UWB secure ranging session module 135 may relay one or more distance measurements obtained from the requesting client device 148A-1 and / or the reference AP 142A-1 to the conditional access module 136. The UWB secure ranging session module 135 may relay one or more distance measurements, such as ToF or AoA associated with electromagnetic pulses sent between the requesting client device 148A-1 and the reference AP 142A-1. The conditional access module 136 may determine the location of the requesting computing device 148A-1 based on the obtained distance measurements. In some examples, the conditional access module 136 may determine that the location of the client device 148A-1 that is spatially close (e.g., within one meter) to the reference AP 142A-1. The conditional access module 136 may compare the determined location of the client device 148A-1 with a business rule or access policy to determine whether the computing device 148A-1 can be authorized to access the requested resource. For example, the client device 148A-1 may request access to a resource with an access policy that specifies that the distance between the requesting UE and the AP 142A-1 may not exceed 5 meters. In this example, the conditional access module 136 may use the obtained one or more distance measurements to determine that the distance between the client device 148A-1 and the AP 142A-1 is 2 meters. The conditional access module 136 may compare the determined location of the client device 148A-1 with the access policy associated with the requested resource, and confirm that the client device 148A-1 meets the requirements of the access policy. The conditional access module 136 may then authorize the client device 148A-1 to access the requested resource. In some examples, the conditional access module 136 may send a positive indication to the AAA server 110 that the requesting computing device has met the requirements of the access policy. The AAA server 110 may then enable single sign-on (SSO) for the requesting computing device to access the resource.

[0044] In some instances, the AAA server 110 may verify whether the requesting device meets the requirements for accessing the resource. For example, the NMS 130 may send the distance measurement obtained during the UWB secure ranging session to the AAA server 110 via the network 134 (e.g., the NMS 130 may send the distance measurement to the AAA server 110 as a web hook). The AAA server 110 may process the distance measurement to determine whether the requesting device meets the location, spatial, positioning, etc. requirements of the business rules or access policies associated with the requested resource. The AAA server 110 may implement single sign-on (SSO), single sign-out (SLO), multi-factor authentication (MFA), or other technologies for providing access to resources to authorize, revoke, or otherwise verify whether the login information and location information of the requesting UE meets the requirements for accessing the resource. In some examples, the AAA server 110 may execute a conditional access module 136.

[0045] Conditional access module 136 and / or AAA server 110 may maintain a map of independent devices including a UWB chipset and a corresponding UWB antenna. In some examples, according to the technology of the present disclosure, AP 142, switch 146, and edge device 150 may be UWB beacons. Conditional access module 136 may determine one or more areas associated with business rules or access policies for resources managed by NMS 130 and AAA server 110 based on the map of UWB beacons. When NMS 130 receives a request to access a resource associated with a business rule or access policy, specifying that the resource can only be accessed when the requesting device is in a specific area with respect to the UWB beacon, NMS 130 may initiate a UWB security range session between the requesting device and the UWB beacon. Then, NMS 130 may obtain a distance measurement based on the UWB security ranging session between the requesting device and the UWB beacon to determine the location or spatial proximity of the requesting device with respect to the UWB beacon. Based on the location or spatial proximity determined by NMS 130 , NMS 130 and / or AAA server 110 may authorize access to the requesting device if the determined location satisfies the spatial proximity, location, or positioning requirements specified in a business rule or access policy associated with the requested resource.

[0046] The conditional access module 136 and / or the AAA server 110 may determine that the requirements of the access policy are no longer met. The conditional access module 136 and / or the AAA server 110 may revoke access to the resource for the requesting computing device. In some instances, the NMS 130 may monitor the location or position of the requesting client device to determine whether the location of the requesting client device has changed. The NMS 130, or more specifically, the UWB secure ranging session module 135, may continuously, periodically, or in response to one or more events send encryption keys to devices involved in the UWB secure ranging session. The UWB secure ranging session module 135 and / or the conditional access module 136 may obtain multiple sets of one or more distance measurements, the distance measurements including a timestamp associated with when the distance measurements were taken. The conditional access module 136 may continuously or periodically determine whether the requesting UE continues to meet the business rules or access policies associated with the resources that the requesting UE was previously authorized to access. The conditional access module 136 may continuously or periodically determine whether the requesting UE continues to meet the business rules or access policies associated with the resource based on the location change determined by one or more distance measurements obtained throughout the UWB secure ranging session. In some examples, the conditional access module 136 may determine that the location change of the requesting UE is a location or physical location that violates the business rules or access policies associated with the previously authorized resources. For example, the conditional access module 136 may send an instruction to the AAA server 110 to initiate a single logout (SLO) and block access to the requested resource to the requesting UE. In some instances, the conditional access module 136 and / or the AAA server 110 may manage access to the resource by using a token or other type of cryptographic authentication key. The conditional access module 136 and / or the AAA server 110 may distribute or provide a physical UWB token to the requesting UE when authorizing UE access to the resource. When the requesting UE no longer meets the criteria associated with the business rules or access policies of the resource, the conditional access module 136 and / or the AAA server 110 may revoke the token distributed to the requesting UE.

[0047] In some instances, the conditional access module 136 and the AAA server 110 can regulate access to many different types of resources. For example, the conditional access module 136 can regulate access to high-level resources such as websites, electronic documents, computing devices, SSIDs for wireless local area networks, or other types that can be managed by the AAA server 110 and / or the NMS 130. The conditional access module 136 enforces business rules or access policies that specify requirements or criteria for the requested resources. The conditional access module 136 can enforce business rules or access policies related to the location, positioning, spatial proximity, etc. of the requesting device. For example, the conditional access module 136 can enforce business rules or access policies that require the requesting device to be in a specific physical area, in certain spaces close to reference devices, in a specific room, in certain spatial proximity or positioning of a quorum of devices (e.g., a minimum number of devices), and the like.

[0048] An example use case will now be described in which an access policy for a resource requires that a requesting device be within a spatial region relative to a reference device in order to gain access to the resource. The UWB secure ranging session module 135 may initiate a UWB secure ranging session between a requesting UE (e.g., client device 148A-1) and one or more APs based on an access policy that specifies that the requesting UE must be within a specified region defined with respect to one or more APs. In some examples, the conditional access module 136 may maintain a map of a site (e.g., site 102A) that may include location information for one or more devices (e.g., AP 142A, switch 146A, edge device 150A, etc.) in the site. The conditional access module 136 and / or the AAA server 110 may enforce business rules or access policies that authorize access to a resource only if the requesting UE is within a spatial region relative to one or more reference devices in the site. When a UE (e.g., client device 148A-1) requests access to a resource associated with a business rule or access policy in this example, the UWB secure ranging session module 135 may initiate a UWB secure ranging session between the requesting UE and one or more devices associated with the conditional access policy for the requested resource. The conditional access module 136 may obtain one or more distance measurements between the requesting UE and the devices specified in the access policy to determine the spatial proximity or location of the requesting UE with respect to the devices involved in the UWB secure ranging session. The conditional access module 136 may determine whether the spatial proximity or location of the requesting UE satisfies the access policy. If the determined spatial proximity or location of the requesting UE satisfies the access policy, the conditional access module 136 or alternatively the AAA server 110 may authorize access to the requesting UE.

[0049] An example use case in which an access policy for a resource requires a quota to access the resource will now be described. For example, the conditional access module 136 and / or the AAA server 110 may enforce an access policy that a requesting device is spatially close to a specific number of other devices. The client device 148A-1 may send a request via a NAS device of the site 102A to access a resource associated with an access policy that allows access to the resource if a certain number of devices are within a specific space close to each other. In response to obtaining a request originating from the client device 148A-1 to access a resource associated with a quota requirement, the NMS 130 may initiate a UWB secure ranging session between the client device 148A-1 and other client devices 148A. In some examples, the NMS 130 may initiate a UWB secure ranging session between the client device 148A-1 and other NAS devices (e.g., AP 142A) of the site 102A, and may also initiate a UWB secure ranging session between other client devices of the client device 148A and the NAS device of the site 102A-based on a specific quota requirement associated with the access policy. The NMS 130 may obtain one or more sets of distance measurements based on one or more UWB secure ranging sessions to determine whether a quota or minimum number of client devices 148A are present in a space close to each other. For example, the NMS 130 may obtain a first set of distance measurements between the client device 148A-1 and the AP 142A-1, and obtain a second set of distance measurements between the client device 148A-N and the AP 142A-1 or between the client device 148A-N and the client device 148A-1. The NMS 130, or more specifically, the conditional access module 136, may determine a count of the number of devices in proximity to the requesting client device 148A-1 based on the set of distance measurements. In response to the NMS 130 determining that the count of the number of devices in proximity to the requesting client device 148A-1 satisfies the quota requirement associated with the resource, the NMS 130 and / or the AAA server 110 may authorize the client device 148A-1 to access the resource. If, while client device 148A-1 is accessing the resource, NMS 130 determines that quota requirements associated with the resource are no longer met, NMS 130 and / or AAA server 110 can initiate a logout technique to restrict access to the resource, such that client device 148A-1—or other client devices requesting access to the resource—can no longer access the resource.

[0050] An example use case will now be described in which an access policy for a resource requires a quota in a specified area to access the resource. For example, conditional access module 136 and / or AAA server 110 may enforce a business rule or access policy that requires a specific number of devices of a specific type (e.g., three client devices 148A) to be in an area (e.g., site 102A, within a room at site 102A, spatially proximate to at least one of AP 142A, etc.) to meet the quota in the specified area requirement. For example, when client device 148A-1 requests access to a resource associated with a quota in a specified area access policy, NMS 130, or more specifically, UWB secure ranging session module 135, may initiate a UWB secure ranging session between client device 148A-1, AP 142A-1, and client devices 148A-N. The NMS 130 may obtain a first set of distance measurements between the client device 148A-1 and the AP 142A-1 and a second set of distance measurements between the client device 148A-N and the AP 142A-1 or between the client device 142A-N and the client device 142A-1. The NMS 130 may determine a location of the client device 148A-1 based on a set of distance measurements between the client device 148A-1 and the AP 142A-1. The NMS 130 may determine a location of the client device 148A-N based on a set of distance measurements between the client device 148A-N and the AP 142A-1 and / or a set of distance measurements between the client device 148A-N and the client device 148A-1. The NMS 130 may determine a count of the number of devices within a spatial region relative to the AP 142A-1 based on the determined locations of the client device 148A-1 and the client devices 148A-N according to an access policy associated with the requested resource. In response to NMS 130 determining that the count of the number of devices within the spatial region relative to AP 142A-1 satisfies the quota in the spatial region access policy, NMS 130 may provide access to resources to client device 148A-1 and also to client device 148-N.

[0051] An example use case in which a location-based access policy can regulate access to a resource (e.g., the content of a computing device) will now be described. For example, the conditional access module 135 and the AAA server 110 can enforce a business rule or access policy associated with a resource, which can include login access to a profile or content of a computing device. For example, the conditional access module 135 and the AAA server 110 can enforce an access policy that requires a requesting UE (e.g., client device 148A-1) to be in a certain space close to or far away from a computing device (e.g., client devices 148A-N) to access a specific resource of the computing device (e.g., data stored locally on the computing device). In this example, the client devices 148A-N may include resources protected by a software module (e.g., a software application client, a software service, a software agent, etc.) that enables communication between the client devices 148A-N and the NMS 130 via at least one NAS device of a network site of the network system 100. The NMS 130, or more specifically, the UWB secure ranging session module 135, may initiate a UWB secure ranging session between the client device 148A-1 and the client devices 148A-N. The NMS 130 may obtain one or more distance measurements based on the UWB secure ranging session between the client device 148A-1 and the client devices 148A-N. The NMS 130, or more specifically, the conditional access module 136, may determine a location, spatial proximity, or positioning of the client device 148A-1 with respect to the client devices 148A-N. The conditional access module 136 and / or the AAA server 110 may determine whether the location, spatial proximity, or positioning of the client device 148A-1 satisfies an access policy associated with access to protected resources stored on the client devices 148A-N. In response to the conditional access module 136 and / or the AAA server 110 determining that the location, spatial proximity, or positioning of the client device 148A-1 satisfies the access policy, the conditional access module 136 and / or the AAA server 110 may authorize the client device 148A-1 to access the protected resources stored on the client devices 148A-N by sending a token to the client device 148A-1. In this manner, the client device 148A-1 may act as a physical UWB token. The NMS 130 may continue to obtain distance measurements between the client device 148A-1 and the client devices 148A-N to determine whether the token provided to the client device 148A-1 is still valid according to the access policy associated with access to the client devices 148A-N.

[0052] An example use case in which a location-based access policy can regulate access to a resource based on the number of people detected will now be described. For example, the conditional access module 135 and / or the AAA server 110 can enforce a business rule or access policy that utilizes the radar capabilities of the UWB-enabled device involved in the UWB secure ranging session. For example, the conditional access module 135 can enforce a resource access policy that requires the UWB-enabled AP 142A-1 to detect a certain number of people present in a specified secure area in order to authorize access to the resource by the requesting client device. The AP 142A-1 can use the UWB radar capabilities of the integrated UWB chipset to estimate the heart or breathing rate within a certain distance of the AP 142A-1. In response to receiving an encryption key generated by the UWB secure ranging session module 135, the AP 142A-1 can begin counting the number of people in the specified area. The AP 142A-1 can relay the number of people detected to the conditional access module 136 to verify whether the requesting client device meets the network access policy.

[0053] The technology of the present disclosure provides one or more technical advantages and practical applications. For example, the technology enables a network management system to securely determine the location of a requesting device with relatively high accuracy (e.g., within decimeters). The network management system can make full use of UWB-enabled devices to determine the location of the requesting device to authorize access to resources based on the determined location. The network management system can apply UWB technology to determine the location of the requesting device based on electromagnetic pulses between the requesting device and one or more reference devices. In this way, the network management system can mitigate replay and / or man-in-the-middle (MiM) attacks. The network management system adopts the UWB protocol to provide encryption on the physical layer (PHY), which makes it difficult to forge or deceive reference devices at the PHY level. In addition, the network management system can securely send encryption keys to the device via a secure channel (e.g., a RadSec tunnel or another encrypted tunnel). The network management system can further prevent unauthorized access to resources based on false locations by maintaining a map of reference devices. The network management system can maintain a map of the locations of reference devices relative to each other. In this way, the network management system can be able to detect whether the reference device has moved to attempt unauthorized access to the requested resource.

[0054] Although the techniques of the present disclosure are described in this example as being performed by NMS 130, the techniques described herein may be performed by other computing devices (multiple), systems (multiple), and / or servers (multiple), and the present disclosure is not limited in this regard. For example, one or more computing devices configured to perform the functions of the techniques of the present disclosure may reside in a dedicated server or be included in other servers outside of NMS 130, or may be distributed throughout network 100, and may or may not form part of NMS 130.

[0055] Figure 1B It is shown Figure 1A A block diagram of a network system with further example details is provided. In this example, Figure 1B 1 shows an NMS 130 configured to execute according to an artificial intelligence / machine learning based computing platform that provides comprehensive automation, insight and assurance (WiFi assurance, wired assurance and WAN assurance) covering everything from “clients” (e.g., connecting to wireless network 106 and wired LAN 175 ( Figure 1B 148) to the “cloud” (e.g., a cloud-based application service 181 (which may be hosted by computing resources in a data center 179). Figure 1B on the far right).

[0056] As described herein, NMS 130 provides an integrated set of management tools and implements various technologies of the present disclosure. Typically, NMS 130 can provide a cloud-based platform for wireless network data collection, monitoring, activity logging, reporting, predictive analysis, network anomaly identification, and alarm generation. For example, the network management system 130 can be configured to actively monitor and adaptively configure the network 100, thereby providing autonomous driving capabilities. In addition, VNA 133 includes a natural language processing engine to provide AI-driven support and troubleshooting, anomaly detection, AI-driven location services, and AI-driven radio frequency (RF) optimization with reinforcement learning.

[0057] As in Figure 1BAs shown in the example of , the AI-driven NMS 130 also provides configuration management, monitoring, and automated supervision of a software-defined wide area network (SD-WAN) 177, which acts as an intermediate network to communicatively couple the wireless network 106 and the wired LAN 175 to the data center 179 and application services 181. Typically, the SD-WAN 177 provides seamless, secure, business-engineered connectivity between "spoke" routers 187A (e.g., a branch or campus network) of the wired network 175 hosting the wireless network 106 to a "hub" router 187B further on the cloud stack toward the cloud-based application services 181. The SD-WAN 177 often executes and manages an overlay network on an underlying physical wide area network (WAN) that provides connectivity to geographically independent customer networks. In other words, the SD-WAN 177 extends software-defined networking (SDN) capabilities to the WAN and allows the network to decouple the underlying physical network infrastructure from the virtualized network infrastructure and applications, which enables (multiple) networks to be configured and managed in a flexible and scalable manner.

[0058] In some examples, the underlying routers of the SD-WAN 177 can implement a stateful, session-based routing scheme in which the routers 187A, 187B dynamically modify the contents of the original packet header provided by the client device 148 to direct the traffic along a selected path (e.g., path 189) to the application service 181 without requiring the use of tunnels and / or additional labels. In this way, the routers 187A, 187B can be more efficient and scalable for large networks because the use of tunnel-free, session-based routing can enable the routers 187A, 187B to realize considerable network resources by avoiding the need to perform encapsulation and decapsulation at the tunnel endpoints. In addition, in some examples, each router 187A, 187B can independently perform path selection and traffic engineering to control the packet flow associated with each session without requiring the use of a centralized SDN controller for path selection and label distribution. In some examples, the routers 187A, 187B implement session-based routing, namely, Security Vector Routing (SVR) provided by Juniper Networks.

[0059] Additional information about session-based routing and SVR is described in U.S. Patent No. 9,729,439, issued on August 8, 2017, and entitled "Computer Network Packet Flow Controller"; U.S. Patent No. 9,729,682, issued on August 8, 2017, and entitled "Network Device and Method for Processing Sessions Using Packet Signatures"; U.S. Patent No. 9,762,485, issued on September 12, 2017, and entitled "Network Packet Flow Controller with Extended Session Management"; U.S. Patent No. 9,871,748, issued on January 16, 2018, and entitled "Router with Optimized Statistics Function"; U.S. Patent No. 9,985,883, issued on May 29, 2018, and entitled "Network Device and Method for Processing Sessions Using Packet Signatures ... and entitled “Name-Based Routing System and Method”; U.S. Patent No. 10,200,264, issued on February 5, 2019, and entitled “Link State Monitoring Based on Packet Loss Detection”; U.S. Patent No. 10,277,506, issued on April 30, 2019, and entitled “Stateful Load Balancing in a Stateless Network”; U.S. Patent No. 10,432,522, issued on October 1, 2019, and entitled “Network Packet Flow Controller with Extended Session Management”; and U.S. Patent No. 11,075,824, issued on July 27, 2021, and entitled “Online Performance Monitoring”, the entire contents of each of which are incorporated herein by reference.

[0060] In some examples, the AI-driven NMS 130 can enable intent-based configuration and management of the network system 100, including making it possible to construct, present, and execute intent-driven workflows for configuring and managing devices associated with the wireless network 106, the wired LAN network 175, and / or the SD-WAN 177. For example, declarative requirements express the desired configuration of network components without specifying the exact native device configuration and control flow. By utilizing declarative requirements, it is possible to specify what should be done, rather than how it should be done. Declarative requirements can be contrasted with imperative instructions, which describe the exact device configuration syntax and control flow to achieve the configuration. By utilizing declarative requirements instead of imperative instructions, users and / or user systems are relieved of the burden of determining the exact device configuration required to achieve the expected results of the user / system. For example, when utilizing a variety of different types of devices from different suppliers, it is often difficult and cumbersome to specify and manage exact imperative instructions to configure each device of the network. As new devices are added and device failures occur, the types and categories of devices of the network may change dynamically. Managing a variety of different types of devices from different vendors with different configuration protocols, syntaxes, and software versions to configure a network of cohesive devices is often difficult to implement. Therefore, by requiring only the user / system to specify declarative requirements that specify expected results applicable across a variety of different types of devices, management and configuration of network devices becomes more efficient. Further example details and techniques of intent-based network management systems are described in U.S. Patent No. 10,756,983 and entitled "Intent-Based Analysis" and U.S. Patent No. 10,992,543 and entitled "Automatically Generating Intent-Based Network Models of Existing Computer Networks," each of which is incorporated herein by reference in its entirety.

[0061] According to the techniques described in the present disclosure, the NMS 130 may authorize one or more of the client devices 148 to access the requested resource based on the determined location, positioning, spatial proximity, etc. of the requesting client device. For example, the conditional access module 136 of the NMS 130 may receive a request to access a resource originating from the client device 148 via one of the NAS devices of the network site. The client device 148 may request access to a resource hosted by the application service 181 and / or the data center 179. For example, the client device 148 may request access to a resource, such as a website, an electronic document, a computing device, an SSID for a wireless local area network, or other types of advanced resources. In some instances, the client device 148 may send a request to access a resource to the NMS 130 via at least one NAS device of the site of the network system 100. In the request for the resource, the client device 148 may include login information (e.g., user name, password, etc.) associated with the requested resource. The NMS 130, or more specifically, the conditional access module 136, may initially determine whether the received login information corresponds to the login information associated with the requested resource. In response to the conditional access module 136 determining that the received login information corresponds to the login information associated with the requested resource, the conditional access module 136 may send an instruction to the UWB secure ranging session module 135 to initiate a UWB secure ranging session between one or more requesting client devices 148 and at least one reference device (e.g., a UWB beacon) having UWB technology.

[0062] The NMS 130, or more specifically, the UWB secure ranging session module 135, can initiate a UWB secure ranging session between a requesting client device 148 and one or more reference devices, such as one or more UWB beacons. The UWB secure ranging session module 135 can initiate a secure ranging session between a client device of the client device 148 requesting access to a resource and a UWB beacon associated with a business rule or access policy that requires the requesting device to be in a certain location, spatial proximity, physical location, etc. with respect to the UWB beacon. For example, the client device 148 can request access to a resource associated with a business rule that requires the requesting device to be in the same room as the UWB beacon (e.g., at least one device of the wireless network 106 and / or at least one device of the wired network 175). The NMS 130, or more specifically, the UWB secure ranging session module 135, can initiate a UWB secure ranging session between the requesting client device 148 and the UWB beacon. The UWB secure ranging session module 135 may initiate a UWB secure ranging session by sending an encryption key to the requesting client device 148 and the UWB beacon. The UWB secure ranging session module 135 may send the requesting client device 148 and the UWB beacon encryption key including the STS field to ensure that the position, spatial or positioning information determined during the UWB secure ranging session is accurate, secure and real-time. The UWB secure ranging session module 135 may send the encryption key to the requesting client device 148 and the UWB beacon via a secure channel connection. The client device 148 and the UWB beacon may obtain the encryption key using a software module (e.g., a software application client, a software service, a software agent, etc.) executed on the client device 148 and the UWB beacon. The client device 148 and the UWB beacon may send electromagnetic pulses to each other to obtain distance measurements such as ToF or AoA. The NMS 130 may obtain distance measurements from the client device 148 and / or the UWB beacon to determine the location, physical location, or spatial proximity of the requesting client device 148 to the UWB beacon. As long as the determined location, physical location, or spatial proximity of the requesting client device 148 satisfies the criteria associated with the business rules governing access to the requested resource, the NMS 130 may authorize the requesting client device 148 to access the requested resource.

[0063] NMS 130, or more specifically, conditional access module 136, can enforce business rules by maintaining a map of the locations of UWB beacons specified in the room, the business rule requiring a requesting device to be in the same room as the UWB beacon to access a resource. For example, conditional access module 136 can maintain a map of a specified room by including the distance of the UWB beacon from the edge of the room. Conditional access module 136 can authorize access to requesting client device 148 by verifying that the determined location of requesting client device 148 satisfies the requirement of the business rule that requesting client device 148 is in the same room as the UWB beacon. Conditional access module 136 can verify whether requesting client device 148 is in the same room as the UWB beacon by comparing the determined location of requesting client device 148 to a map maintained by conditional access module 136. In response to the conditional access module 136 verifying that the requesting client device 148 is in the same room as the UWB beacon, the conditional access module 136 may authorize access to the client device 148 as long as the distance measurements from the UWB secure ranging session indicate that the requesting client device 148 is still in the room. The conditional access module 136 may authorize the client device 148 to access the resource by sending a token or network access certificate to a software module executing on the client device 148. The conditional access module 136 may send the token to the client device 148, which may include configuration information, credentials, access keys, etc., that enable the user of the client device 148 to access the resource. In response to the distance measurements obtained during the UWB secure ranging session no longer indicating that the requesting client device 148 satisfies the business rules or access policies associated with the resource, the conditional access module 136 may revoke the token provided to the client device 148.

[0064] Figure 1C According to the technology described in this article, Figure 1A A block diagram of a network system with further example details is provided. In this example, Figure 1C An exemplary network system 100 is shown, which includes an NMS 130, a network access control (NAC) system 180, (multiple) AAA servers 110, UWB beacons 152, and client devices 148. The NAC system 180 may include or provide access to the AAA server 110 for authenticating users and / or client devices 148. The NAC system 180 may include a cloud-based network access control service at the site 102. Typically, network access control functions are provided by local devices that are limited by processing power and memory, as well as maintenance and upgrade issues. Providing a cloud-based network access control service avoids these limitations and improves network management. However, centralized, cloud-based deployment of network access control introduces issues with latency and failures, which may hinder network access for client devices.

[0065] As in Figure 1C As shown in the example of FIG. 1 , the NMS 130 may include a NAC controller 138 that implements a NAC configuration platform that provides a user interface for creating and assigning access policies for client devices 148 and provides appropriate enterprise-specific configuration information 139 to the NAC system 180. The NMS 130 is configured to manage NAC configurations, including access policies for the enterprise network, and push appropriate NAC configuration data or files to the NAC system 180. In this way, the NAC system 180 can provide the same benefits as a centralized, cloud-based network access control service, while having lower latency and high availability.

[0066] NMS 130 may have a secure connection 184, such as a RadSec tunnel or another encrypted tunnel, with NAC system 180. Through secure connection 184, NAC system 180 may download appropriate configuration information 139 from NMS 130. In some examples, NAC controller 138 may record or map which enterprise networks are served by NAC system 180.

[0067] The NAC system 180 may provide a method for authenticating client devices 148 access to resources (e.g., website access, electronic document access, network access, etc.) managed by an administrator branch or campus network. The NAC system 180 may provide a method for authenticating device access credentials based on business rules or access policies established by an administrator of the network. The NAC system 180 may provide a method for authenticating device credentials for business rules or access policies that require the requesting device to be in a specific location, spatial proximity, or positioning based on distance measurements obtained during a tamper-proof UWB secure ranging session. Each NAC system 180 may include or provide access to one or more authentication, authorization, and accounting (AAA) servers 110, such as a RADIUS server, to verify the identity of the client device 148 before providing access to resources. In some examples, the NAC system 180 may enable certificate-based authentication of the client device 148, or enable interaction with a user directory service (e.g., an active directory) to verify the identity of the client device 148. The NAC system 180 can supplement the conditional access authentication system (e.g., IaM system, AAA server 110, identity service provider, etc.) with the location information of the client device 148 obtained during the UWB secure ranging session. Figure 1C In the example of FIG. 1 , NAC system 180 may include conditional access module 136 .

[0068] The NAC system 180 can identify the client device 148 and provide appropriate authorization or access policies to the client device 148 based on the identity associated with the client device 148, for example, by assigning the client device 148 to a virtual local area network (VLAN), applying certain access control lists (ACLs), directing the client device 148 to certain registration portals, etc. The NAC system 180 can identify the client device 148 by analyzing the network behavior of the client device 148, which is called fingerprinting. The identification of the client device and / or NAS device can be performed based on a media access control (MAC) address, a DHCP option used to request an IP address, a link layer discovery protocol (LLDP) packet, a hypertext transfer protocol (HTTP) user agent information, location information, DNS information, and / or device type and operating system information. In some instances, the NAC system 180 can provide appropriate authorization or access to the client device 148 based on the location of the client device 148 determined using a UWB secure ranging session. For example, NAC system 180 may implement location-based conditional access based on the location of client device 148 relative to other UWB-enabled devices (e.g., client devices, one or more devices of site 102, etc.). Figure 1C In an example of , the NAC system 180 can determine the location of the client device 148 relative to the UWB beacon 152A and the UWB beacon 152B (collectively referred to herein as "UWB beacons 152"). The UWB beacon 152 may include one or more types of devices having a UWB chipset and a corresponding UWB antenna. For example, the UWB beacon 152 may include at least one of the client device 148, the AP 142, the switch 146, or the edge device 150. The UWB beacon 152 may include a UWB antenna that complies with a mandatory emission mask given by the Federal Communications Commission (FCC) or other regulatory agency. For example, the UWB beacon 152 can produce an absolute bandwidth of no less than 500 MHz or a fractional bandwidth of at least 0.2 (i.e., the bandwidth of the device divided by its center frequency).

[0069] Figure 1C The client devices 148 may include multiple different categories of devices associated with a given enterprise, such as trusted enterprise devices, bring your own device (BYOD) devices, IoT devices, and guest devices. The NAC system 180 may be configured to enable different types of tracking, different types of authorization, and different levels of access for each of the different categories of devices. In some examples, after a client device gains access to an enterprise network or a resource managed by an enterprise network administrator, the NAC system 180 may monitor the activity of the client device to identify security concerns and, in response, reassign the client device to a quarantine VLAN or another less privileged VLAN to limit the access of the client device.

[0070] exist Figure 1C In the example shown in FIG. 1 , client device 148 and UWB beacon 152 have a direct, secure connection 182 to NAC system 180, such as a RadSec tunnel or another encrypted tunnel. In some examples, devices at site 102 (e.g., client device 148 or UWB beacon 152) can communicate with the NAC system 180 via an edge device (not in FIG. Figure 1C ) has an indirect connection to the NAC system 180. The devices at site 102 may not support establishment of a secure connection directly to the NAC system 180, but edge devices (e.g., Figure 1A The edge device 150 of the client device 148 may provide a proxy through which the device can connect to the NAC system 180. For example, the client device 148 may have a direct connection to the edge device (e.g., a RADIUS tunnel), and the edge device has a direct secure connection to the NAC system 180 (e.g., connection 182).

[0071] According to the techniques described in the present disclosure, the NMS 130 may authorize access of the client device 148 to the requested resource based on the determined location of the client device 148. The NMS 130 may receive the resource access request from the client device 148 via at least one NAS device at the site 102. The NMS 130 may execute the UWB secure ranging session module 135 to initiate the UWB secure ranging session to determine whether the client device 148 meets the location-based conditional access requirements. The NAC system 180 may obtain one or more distance measurements generated based on the UWB secure ranging session. For example, the NMS 130 may collect the distance measurements from the UWB secure ranging session as network data 137 and send the distance measurements to the conditional access module 136 of the NAC system 180 via the secure connection 184. The NAC system 180, or more specifically, the conditional access module 136, may determine the location, position, or spatial proximity of the client device 148 based on the distance measurements (e.g., ToF, AoA, etc.) obtained during the UWB secure ranging session. The NAC system 180 may determine the location of the client device 148 by determining the spatial proximity of the client device 148 relative to the UWB beacons 152. In some examples, the NAC system 180 may maintain a map of the physical locations of the UWB beacons 152 within the site 102, and more specifically, within the rooms 104. The NAC system 180 may maintain a map of the rooms in which the UWB beacons are located, such as room 104A and room 104B. Based on configuration information provided by an administrator of the network system 100 and / or based on distance measurements obtained from the UWB beacons 152 and other UWB-enabled devices of the site 102, the NAC system 180 may maintain a map of the locations of the UWB beacons 152 and / or rooms of the site 102. The NAC system 180 may determine the location of the client device 148 based on the distance measurements from the UWB secure ranging session and the map.

[0072] The NAC system 180 and / or the AAA server 110 may authorize access of the client device 148 to the requested resource based on the determined location of the client device 148. For example, the NAC system 180 and / or the AAA server 110 may enforce a business rule or access policy associated with the requested resource that requires the client device 148 to be in the same room as the UWB beacon 152A (e.g., room 104A) or in the same room as the UWB beacon 152B (e.g., room 104B). The NAC system 180 may receive distance measurements from a UWB secure ranging session between the client device 148 and the UWB beacon 152. For example, the NAC system 180 may receive distance measurements including ToF and / or AoA calculated based on electromagnetic signals sent by the client device 148 to the UWB beacon 152 and / or electromagnetic signals sent by the UWB beacon 152 to the client device 148. For example, NAC system 180 may determine that client device 148 is in the same room (e.g., room 104A) as UWB beacon 152A, but in a different room than UWB beacon 152B. NAC system 180 may determine whether client device 148 is in the same room as at least one of UWB beacons 152 based on the acquired distance measurements and a map of the rooms in which UWB beacons 152 are located. In this example, because NAC system 180 determined that client device 148 is in the same room as UWB beacon 152A, NAC system 180 and / or AAA server 110 may authorize client device 148 access to the resource.

[0073] Figure 2 is a block diagram of an example access point (AP) device 200 in accordance with one or more techniques of this disclosure. Figure 2 The example access point 200 shown in FIG. 1 may be used to implement the embodiments of the present invention with respect to Figure 1A One or more of APs 142 are shown and described. Access point 200 may include, for example, a Wi-Fi, Bluetooth, and / or Bluetooth Low Energy (BLE) base station or other type of wireless access point.

[0074] exist Figure 2 In the example of FIG. 1 , access point 200 includes a wired interface 230, wireless interfaces 220A-220B, one or more processors 206, memory 212, and input / output 210, which are coupled together via a bus 214 through which the various elements can exchange data and information. Wired interface 230 represents a physical network interface and includes a receiver 232 and a transmitter 234 for sending and receiving network communications (e.g., packets). Wired interface 230 couples access point 200 to a wired network device within a wired network, such as a wireless network device, directly or indirectly, via a cable such as an Ethernet cable. Figure 1A A switch among switches 146.

[0075] The first and second wireless interfaces 220A and 220B represent wireless network interfaces and include receivers 222A and 222B, respectively, each of which includes a receiving antenna, via which the access point 200 can receive wireless signals from wireless communication devices, such as Figure 1A The first and second wireless interfaces 220A and 220B further include transmitters 224A and 224B, respectively, each of which includes a transmitting antenna, via which the access point 200 can transmit wireless signals to the wireless communication device, for example Figure 1A UE 148. In some examples, the first wireless interface 220A may include a Wi-Fi 802.11 interface (eg, 2.4 GHz and / or 5 GHz), and the second wireless interface 220B may include a Bluetooth interface and / or a Bluetooth Low Energy (BLE) interface.

[0076] Processor(s) 206 are programmable hardware-based processors configured to execute software instructions, such as those used to define software or computer programs stored to a computer-readable storage medium (e.g., memory 212), such as a non-transitory computer-readable medium including a storage device (e.g., a disk drive or optical drive) or memory (e.g., flash memory or RAM) or other type of volatile or non-volatile memory that stores instructions to cause one or more processors 206 to perform the techniques described herein.

[0077] Memory 212 includes one or more devices configured to store programming modules and / or data associated with the operation of access point 200. For example, memory 212 may include a computer-readable storage medium, such as a non-transitory computer-readable medium, including a storage device (e.g., a disk drive or optical drive) or memory (e.g., flash memory or RAM) or other types of volatile or non-volatile memory that stores instructions to cause one or more processors 206 to perform the techniques described herein.

[0078] In this example, the memory 212 stores executable software, which includes an application programming interface (API) 240, a communication manager 242, configuration settings 250, a device status log 252, a data store 254, and a log controller 255. The device status log 252 includes a list of events specific to the access point 200. The events may include a log of normal events and error events, such as memory status, restart or re-initiate events, crash events, cloud disconnection with self-recovery events, low link speed or link speed jitter events, Ethernet port status, Ethernet interface packet errors, upgrade failure events, firmware upgrade events, configuration changes, etc., as well as time and date stamps for each event. The log controller 255 determines the log level for the device based on instructions from the NMS 130. The data 254 may store data used and / or generated by the access point 200, including data collected from the UE 148, such as data used to calculate one or more SLE metrics, which are transmitted by the access point 200 for cloud-based management of the wireless network 106A by the NMS 130.

[0079] Input / output (I / O) 210 represents physical hardware components that enable interaction with a user, such as buttons, displays, etc. Although not shown, memory 212 typically stores executable software for controlling a user interface for input received via I / O 210. Communications manager 242 includes program code that, when executed by processor(s) 206, allows access point 200 to communicate with UE 148 and / or network 134 via interface(s) 230 and / or 220A-220C. Configuration settings 250 may include device settings for access point 200, such as radio settings for each of wireless interface(s) 220A-220C. These settings may be manually configured or remotely monitored and managed by NMS 130 to optimize wireless network performance on a regular basis (e.g., hourly or daily).

[0080] As described herein, the AP device 200 can measure and report network data from the status log 252 to the NMS 130. The network data can include event data, telemetry data, and / or other SLE-related data. The network data can include various parameters indicating wireless network performance and / or status. The parameters can be measured and / or determined by one or more of the UE devices and / or by one or more of the APs in the wireless network. The NMS 130 can determine one or more SLE metrics based on the SLE-related data received from the APs in the wireless network and store the SLE metrics as network data 137 ( Figure 1A ).

[0081] exist Figure 2In the example of FIG. 1 , the AP device 200 may be used as a UWB beacon (eg, Figure 1C The AP device 200 may include a UWB chipset 226 that may include a transmitter and / or antenna for short-range wireless communication. The UWB chipset 226 may include one or more modules to configure the UWB chipset 226 to comply with the UWB communication protocol. The UWB chipset 226 may use frequencies from 3.1 GHz to 10.6 GHz. The UWB chipset 226 may include a channel bandwidth of 500 MHz, which results in accurate location determination (e.g., within one meter of the actual location) during a UWB secure ranging session. The UWB chipset 226 may be configured to implement an encryption mechanism to prevent forging or spoofing the location of the AP 200.

[0082] Figure 3 is a block diagram of an exemplary network management system (NMS) 300 according to one or more techniques of the present disclosure. NMS 300 may be used to implement, for example, Figures 1A to 1B In these examples, NMS 300 is responsible for monitoring and managing one or more 106A to 106N wireless networks at sites 102A to 102N, respectively.

[0083] NMS 300 includes a communication interface 330, one or more processors 306, a user interface 310, a memory 312, and a database 318. The various elements are coupled together by a bus 314, and the various elements can exchange data and information on the bus. In some examples, NMS 300 receives data from client devices 148, APs 142, switches 146, and other network nodes (e.g., Figure 1B The NMS 300 may receive data from one or more of the routers 187 in the wireless network, which may be used to calculate one or more SLE metrics and / or update the network data 316 in the database 318. The NMS 300 analyzes the data for cloud-based management of the wireless networks 106A to 106N. In some examples, the NMS 300 may be Figure 1A A portion of another server shown in or a portion of another server not shown.

[0084] The processor(s) 306 execute software instructions, such as those used to define a software or computer program, stored in a computer-readable storage medium (e.g., memory 312), such as a non-computer-readable medium including a storage device (e.g., a disk drive, or an optical drive) or memory (such as flash memory or RAM) or other type of volatile or non-volatile memory, which stores instructions causing the one or more processors 306 to perform the techniques.

[0085] The communication interface 330 may include, for example, an Ethernet interface. The communication interface 330 couples the NMS 300 to a network and / or the Internet, such as Figure 1A The communication interface 330 includes a receiver 332 and a transmitter 334, through which the NMS 300 transmits and receives data to / from the client device 148, the AP 142, the switch 146, the servers 110, 116, 122, 128 and / or the components shown in FIG. Figure 1A Other network nodes, devices, or systems that are part of the illustrated network system 100 receive / transmit data and information. In some scenarios described herein, the network system 100 includes "third-party" network devices that are owned and / or associated with entities other than the NMS 300, and the NMS 300 does not receive, collect, or otherwise access network data from the third-party network devices.

[0086] The data and information received by NMS 300 may include, for example, information received from client devices AP 148, AP 142, switch 146, or other network nodes (e.g., Figure 1B The NMS 300 may also transmit the data to one or more network devices, such as the client device 148, the AP 142, the switch 146, other network nodes within the network 134, the management device 111, through the communication interface 330 to remotely manage the wireless networks 106A to 106N and portions of the wired network.

[0087] The memory 312 includes one or more devices configured to store programming modules and / or data related to the operation of the NMS 300. For example, the memory 312 may include a computer-readable storage medium, such as a non-transitory computer-readable medium including a storage device (e.g., a disk drive or optical drive) or a memory (e.g., flash memory or RAM) or other type of volatile or non-volatile memory that stores instructions to cause the one or more processors 306 to perform the techniques described herein.

[0088] In this example, the memory 312 includes an API 320, an SLE module 322, a virtual network assistant (VNA) / AI engine 350, and a radio resource management (RRM) engine 360. According to the disclosed technology, the NMS 300 may include a UWB secure ranging session module 335 for initiating a UWB secure ranging session between a requesting device and one or more reference devices to determine the location of the requesting device. The NMS 300 may also include other programming modules, software engines, and / or interfaces configured for remote monitoring and management of the wireless networks 106A to 106N and portions of the wired network, including remote monitoring and management of the AP 142 / 200, the switch 146, or other network devices, such as Figure 1B Router 187 in.

[0089] The SLE module 322 is capable of setting and tracking thresholds for SLE metrics for each 106A to 106N network. The SLE module 322 further analyzes SLE related data collected by APs, such as AP 142, from terminals of each wireless network 106A to 106N. For example, APs 142a-1 to 142a-n collect SLE related data from terminals 148a-1 to 148A-N currently connected to the wireless network 106A. The data is transmitted to the NMS 300 and executed by the SLE module 322 to determine one or more SLE metrics for each UE 148A-1 through 148A-N currently connected to the wireless network 106A. This data is in addition to the network data collected by one or more APs 142A-1 to 142A-N in the wireless network 106A, and is also transmitted to the NMS 300 and stored in the database 318 as, for example, network data 316.

[0090] The RRM engine 360 ​​monitors one or more metrics for each site 102A to 102N in order to understand and optimize the RF environment of each site. For example, the RRM engine 360 ​​can monitor the coverage and capacity SLE metrics of the wireless network 106 at the site 102 to identify potential problems with SLE coverage and / or capacity in the wireless network 106, and adjust the radio settings of each site access point to solve the identified problems. For example, the RRM engine can determine the channel and transmission power allocation across APs 142 in each 106A to 106N network. For example, the RRM engine 360 ​​can monitor events, power, channels, bandwidth, and the number of clients connected to each AP. The RRM engine 360 ​​can further automatically change or update the configuration of one or more APs 142 at the site 102 in order to improve the coverage and capacity SLE metrics, thereby providing users with an improved wireless experience.

[0091] The VNA / AI engine 350 analyzes the data received from the network device and its own data to identify an undesirable abnormal state encountered on one of the network devices. For example, the VNA / AI engine 350 can identify the root cause of an undesirable or abnormal state, for example, (multiple) bad SLE metrics indicating one or more network device connection problems. In addition, the VNA / AI engine 350 can automatically call one or more corrective actions intended to solve the identified root causes of one or more bad SLE metrics. Examples of corrective operations that the VNA / AI engine 350 can automatically call include, but are not limited to, calling RRM360 to re-initiate one or more APs, adjusting / modifying the transmit power of a specific radio in a specific AP, adding SSID configuration to a specific AP, changing the channel on an AP or a group of APs, etc. Corrective operations may also include re-initiating switches and / or routers, calling to download new software to APs, switches or routers, etc. These corrective measures are for example purposes only, and the disclosure is not limited to this aspect. If automatic corrective actions are not available or do not adequately address the root cause, the VNA / AI engine 350 may proactively provide notifications, including recommended corrective actions for IT personnel (e.g., a site or network administrator using the management device 111) to take to resolve the network error.

[0092] According to one or more techniques of the present disclosure, NMS 300 may authorize a device to access a resource based on a determined physical location of the requesting device. NMS 300 may receive a request from a device (e.g., Figure 1A The NMS 130 may receive a request to access a resource via a communication interface 330. In response to receiving a request to access a resource, the NMS 130, or more specifically, the UWB secure ranging session module 335, may initiate a UWB secure ranging session between the requesting device and one or more other reference devices. The NMS 130 may obtain one or more distance measurements (e.g., ToF, AoA, etc.) from the requesting device and / or the reference device. The NMS 130 may obtain the distance measurements via the communication interface 330. The NMS 130, or more specifically, the conditional access module 336, may determine the location of the requesting device based on the distance measurements to verify whether the requesting device meets criteria or requirements associated with accessing the requested resource.

[0093] In some cases, NMS 130 may enable an administrator to establish business rules or access policies to regulate access to resources. For example, UI 310 may provide an administrator with a platform to enter business rules or access policies that require a requesting device to be in a specific location, spatial proximity, or location relative to one or more reference devices.

[0094] The conditional access module 336 of the NMS 300 can maintain a map of reference devices to determine the location of the requesting UE based on the distance measurements obtained during the UWB secure ranging session between the requesting device and the reference device. The conditional access module 336 can maintain a map of the reference device locations via the distance measurements obtained using the UWB function of the reference device. In some examples, the conditional access module 36 can maintain a map configured by an administrator of the NMS 300. The conditional access module 336 can accurately determine the location of the requesting device based on the distance measurements obtained and the location map of the reference devices used in the UWB secure ranging session. The conditional access module 336 can implement SSO, SLO and / or MFA functions to effectively regulate access to resources. For example, the conditional access module 336 can implement MFA to initially verify the requesting device, and then - depending on the access policy associated with the requested resource - the conditional access module 336 can require that the location of the requesting computing device meets the location-based requirements of the access policy. Conditional access module 336 may implement SSO and / or SLO by issuing and / or revoking tokens associated with whether a requesting device meets location-based criteria related to accessing a resource.

[0095] The technology of the present disclosure provides one or more technical advantages and practical applications. For example, the NMS 300 can authorize, monitor and / or revoke access to resources based on the accurate location of the requesting device. For example, the NMS 300 can use UWB technology and protocols to accurately determine the location, spatial proximity or location of the requesting device within one meter. The NMS 300 can use UWB technology to determine the location of the device in a site, building, etc. The NMS 300 can establish location-based areas in the building that can be used to regulate access to resources (for example, the NMS 300 defines the area or room of the building in which the requesting device must be in order to access a specific WiFi WLAN). The NMS 300 can additionally utilize encryption mechanisms associated with UWB technology (for example, including the STS field in the encryption key used in the UWB secure ranging session) to mitigate forgery or spoofing of the location used to determine the requesting device's access to resources. In this way, the NMS 300 can safely and accurately determine the location of the requesting device to verify whether the requesting device can be authorized to access the resource.

[0096] Although the techniques of the present disclosure are described in this example as being performed by NMS 130, the techniques described herein may be performed by other computing devices, systems, and / or servers, and the present disclosure is not limited in this regard. For example, one or more computing devices configured to perform the functions of the techniques of the present disclosure may reside in a dedicated server or included in another server external to NMS 130 or otherwise, or may be distributed throughout network 100 and may or may not constitute part of NMS 130.

[0097] Figure 4 An example user equipment (UE) device 400 is shown, in accordance with one or more techniques of this disclosure. Figure 4 The exemplary UE device 400 shown in FIG. 4 may be used to implement the present invention with respect to Figure 1A UE 148 is shown and described. UE device 400 may include one or more types of wireless client devices, and the present disclosure is not limited in this regard. For example, UE device 400 may include a mobile device such as a smart phone, a tablet or laptop computer, a personal digital assistant (PDA), a wireless terminal, a smart watch, a smart ring, or other types of mobile or wearable devices. In some examples, UE 400 may also include a wired client device, such as an IoT device, such as a printer, a security sensor or device, an environmental sensor, or other device connected to a wired network and configured to communicate via one or more wireless networks.

[0098] UE device 400 includes a wired interface 430, wireless interfaces 420A to 420C, one or more processors 406, memory 412, and a user interface 410. The various elements are coupled together via a bus 414, and the various elements can exchange data and information on the bus 414. The wired interface 430 represents a physical network interface, including a receiver 432 and a transmitter 434. If desired, the wired interface 430 can be used to directly or indirectly connect the UE 400 to the network through a cable, such as Figure 1A One of the Ethernet cables 144 is coupled to a wired network device within the wired network, such as Figure 1A A switch among switches 146.

[0099] The first, second and third wireless interfaces 420A, 420B and 420C include receivers 422A, 422B and 422C, respectively, each including a receiving antenna, through which the UE 400 can receive wireless signals from wireless communication devices, such as Figure 1A AP 142 Figure 2The first, second and third wireless interfaces 420A, 420B and 420C further include transmitters 424A, 424B and 424C, respectively, each including a transmitting antenna, through which the UE 400 can send wireless signals to the wireless communication device, such as Figure 1A AP 142 Figure 2 AP 200, other UE 148 and / or other devices configured for wireless communication. In some examples, the first wireless interface 420A may include a Wi-Fi 802.11 interface (e.g., 2.4 GHz and / or 5 GHz), and the second wireless interface 420B may include a Bluetooth interface and / or a Bluetooth low energy interface. The third wireless interface 420C may include, for example, a cellular interface through which the UE device 400 can connect to a cellular network.

[0100] The processor(s) 406 execute software instructions, such as those defining software or a computer program stored in a computer-readable storage medium (e.g., memory 412), such as a non-transitory computer-readable medium including a storage device (e.g., a disk drive or optical drive) or memory (e.g., flash memory or RAM) or other type of volatile or non-volatile memory that stores instructions to cause the processor(s) 406 to perform the techniques described herein.

[0101] Memory 412 includes one or more devices configured to store programming modules and / or data related to the operation of UE 400. For example, memory 412 may include a computer-readable storage medium, such as a non-transitory computer-readable medium, including a storage device (e.g., a disk drive or an optical drive) or a memory (e.g., flash memory or RAM) or other types of volatile or non-volatile memory, which stores instructions to cause one or more processors 406 to perform the techniques described herein.

[0102] In this example, memory 412 includes operating system 440, applications 442, communication module 444, configuration settings 450, and data storage 454. Communication module 444 includes program code that, when executed by processor 406, enables UE 400 to communicate using wired interface 430, wireless interfaces 420A-420B, and / or cellular interface 450C. Configuration settings 450 may include device settings for UE 400, settings for each of wireless interfaces 420A-420B, and / or cellular interface 420C.

[0103] The data store 454 may include, for example, a status / error log including a list of events specific to the UE 400. These events may include a log of normal events and error events, depending on the log level based on the instructions of the NMS 130. The data store 454 may store data used and / or generated by the UE 400, such as data used to calculate one or more SLE metrics or identify relevant behavioral data, which is collected by the UE 400 and transmitted directly to the NMS 130 or transmitted to the AP 142 in the wireless network 106 for further transmission to the NMS 130.

[0104] As described herein, UE 400 can measure and report network data from data store 454 to NMS 130. Network data can include event data, telemetry data, and / or other SLE-related data. Network data can include various parameters indicating wireless network performance and / or status. NMS 130 can determine one or more SLE metrics based on SLE-related data received from terminals or client devices in the wireless network and store the SLE metrics as network data 137 ( Figure 1A ).

[0105] Optionally, the UE device 400 may include an NMS agent 456. The NMS agent 456 is a software agent of the NMS 130 that is installed on the UE 400. In some examples, the NMS agent 456 may be implemented as a software application running on the UE 400. The NMS agent 456 collects information from the UE 400, including detailed client device attributes, including insights into the roaming behavior of the UE 400. This information provides insights into the client roaming algorithm, because roaming is a decision of the client device. In some examples, the NMS agent 456 may display the client-device attributes on the UE 400. The NMS agent 456 sends the client device attributes to the NMS 130 via the AP device to which the UE 400 is connected. The NMS agent 456 can be integrated into a custom application or as part of a location application. The NMS agent 456 can be configured to identify the device connection type (e.g., cellular or Wi-Fi) and the corresponding signal strength. For example, the NMS agent 456 identifies the access point connection and its corresponding signal strength. The NMS agent 456 can store information specifying the APs identified by the UE 400 and their corresponding signal strengths. The NMS agent 456 or other elements of the UE 400 also collect information about which APs the UE 400 is connected to and which APs the UE 400 is not connected to. The NMS agent 456 of the UE 400 sends this information to the NMS 130 through the AP to which it is connected, so that the UE 400 not only sends the AP information to which the UE 400 is connected, but also sends other APs that the UE 400 has identified but is not connected to and their signal strength information. The AP then forwards this information to the NMS, including information about other APs identified by the UE 400. This additional level of granularity enables the NMS 130, and ultimately the network administrator, to better determine the Wi-Fi experience directly from the perspective of the client device.

[0106] In some examples, the NMS agent 456 further enriches the client device data utilized in the service level. For example, the NMS agent 456 can go beyond basic fingerprinting to provide supplemental details about attributes such as device type, manufacturer, and different operating system versions. In client detailed attributes, the NMS 130 can display the radio hardware and firmware information of the UE 400 received from the NMS client agent 456. The more details that the NMS agent 456 can extract, the better the VNA / AI engine is at high-level device classification. The VNA / AI engine of the NMS 130 is constantly learning and becoming more accurate in distinguishing between device-specific issues or broad device issues, such as specifically identifying that a specific operating system version is affecting certain clients.

[0107] In some examples, the NMS agent 456 may cause the user interface 410 to display a prompt prompting the end user of the UE 400 to enable location permissions before the NMS agent 456 can report the device's location, client information, and network connection data to the NMS. The NMS agent 456 will then begin reporting connection data and location data to the NMS. In this way, the end user of the client device can control whether to enable the NMS agent 456 to report client device information to the NMS.

[0108] exist Figure 4 In an example, UE 400 may include a UWB chipset 426. UE 400 may include a UWB chipset 426 that may include a transmitter and / or antenna for short-range wireless communication. UWB chipset 426 may include a module for configuring UWB chipset 426 to comply with the UWB communication protocol. UWB chipset 426 may use frequencies from 3.1 GHz to 10.6 GHz. UWB chipset 426 may include a channel bandwidth of 500 MHz, which results in accurate location determination (e.g., within one meter of the actual location) during a UWB secure ranging session. UWB chipset 426 may be configured to implement an encryption mechanism to prevent forgery or spoofing of the location of UE 400. In some examples, UE 400 may act as a UWB beacon (e.g., Figure 1C UWB beacon 152) to determine the location of another UE requesting access to resources.

[0109] Figure 5 is a block diagram of an example UWB beacon 500, such as a client device, AP, router, or switch, in accordance with one or more techniques of this disclosure. Figure 5 In the example of FIG. 1 , the UWB beacon 500 may be Figure 1A In one or more examples, the UWB beacon 500 implements a connection to a device at the site 102 (e.g., client device 148, AP 142, switch 146, edge device 150, etc.). Figure 1A A device or server of the network 134, such as a switch 146, an AAA server 110, a DHCP server 116, a DNS server 122, a web server 128, etc., or a device or server supporting a wireless network 106, a wired LAN 175, or a SD-WAN 177 or Figure 1B Another network device, such as router 187, in one or more of data centers 179.

[0110] In this example, UWB beacon 500 includes a wired interface 502, such as an Ethernet interface, a processor 506, an input / output 508, such as a display, buttons, a keyboard, a keypad, a touch screen, a mouse, etc., and a memory 512 coupled together by a bus 514, on which the various elements can exchange data and information. Wired interface 502 couples UWB beacon 500 to a network, such as an enterprise network. Although only one interface is shown by way of example, a network node can (and typically does) have multiple communication interfaces and / or multiple communication interface ports. Wired interface 502 includes a receiver 520 and a transmitter 522.

[0111] exist Figure 5 In an example of the UWB beacon 500, the UWB chipset 526 may include a UWB chipset 526. The UWB chipset 526 may include a transmitter and / or antenna for short-range wireless communication. The UWB chipset 526 may include one or more modules for configuring the UWB chipset 526 to comply with the UWB communication protocol. For example, the UWB chipset 526 may use frequencies from 3.1 GHz to 10.6 GHz. The UWB chipset 526 may include a channel bandwidth of 500 MHz, which results in accurate location determination (e.g., within one meter of the actual location) during a UWB secure ranging session. The UWB chipset 526 may be configured to implement an encryption mechanism to prevent forgery or spoofing of the location of the UWB beacon 500.

[0112] The memory 512 stores executable software applications 532, an operating system 540, and data / information 530. The data 530 may include system logs and / or error logs that store event data (including behavioral data) for the UWB beacon 500. In examples where the UWB beacon 500 comprises a "third party" network device, the same entity does not own or have access to the AP or wired client device and the UWB beacon 500. Thus, in examples where the UWB beacon 500 is a third party network device, the NMS 130 does not receive, collect, or otherwise access network data from the UWB beacon 500.

[0113] In an embodiment where the UWB beacon 500 includes a server, the UWB beacon 500 can receive data and information through the receiver 520, such as registration requests, AAA services, DHCP requests, simple notification service (SNS) searches, web page requests, and other operation-related information, and send data and information through the transmitter 522, such as configuration information, authentication information, web page data, and the like.

[0114] In an example where the UWB beacon 500 includes a wired network device, the UWB beacon 500 can be connected to one or more APs or other wired client devices, such as an IoT device, via a wired interface 502. For example, the UWB beacon 500 can include multiple wired interfaces 502 and / or the wired interface 502 can include multiple physical ports to connect to multiple APs or other wired client devices within a site via respective Ethernet cables. In some examples, each of the APs or other wired client devices connected to the UWB beacon 500 can access a wired network via the wired interface 502 of the UWB beacon 500. In some examples, one or more APs or other wired client devices connected to the UWB beacon 500 can obtain power from the UWB beacon 500 via respective Ethernet cables and Power over Ethernet (PoE) ports of the wired interface 502.

[0115] The data collected and reported by the UWB beacon 500 may include periodically reported data and event-driven data. The UWB beacon 500 is configured to extract data from messages and / or counters at the logical path (such as a peer path or tunnel) level through a bidirectional forwarding detection (BFD) probe to perform logical path statistics. In some examples, the UWB beacon 500 is configured to collect statistics and / or sample other data at a first periodic interval, such as every 3 seconds, every 5 seconds, etc. The UWB beacon 500 may store the collected and sampled data as path data, such as in a buffer.

[0116] In some examples, the UWB beacon 500 optionally includes an NMS agent 544. The NMS agent 544 may periodically create statistical packets according to a second periodic interval, for example, every 3 minutes. The collected and sampled data reported periodically in the statistical packets may be referred to herein as "oc-stats". In some examples, the statistical packets may also include detailed information about the clients connected to the UWB beacon 500 and the related client sessions. The NMS agent 544 may then report the statistical packets to the NMS 130 in the cloud. In other examples, the NMS 130 may receive the statistical packets from the UWB beacon 500 via another request, retrieval, or otherwise in an API, an open configuration protocol, or a communication protocol. The statistical packets created by the NMS agent 544 or another module of the UWB beacon 500 may include a header identifying the UWB beacon 500 and statistical data and data samples for each logical path in the logical paths from the UWB beacon 500. In other examples, the NMS agent 544 reports event data to the NMS 130 in the cloud in response to certain events occurring at the UWB beacon 500 when the event occurs. Event-driven data may be referred to herein as "oc-events".

[0117] Figure 6An example graphical user interface 600 for creating a resource access policy is shown. The graphical user interface 600 may include fields and / or options that allow an administrator to establish a resource access policy. For example, the graphical user interface 600 may include a Figure 1A The NMS 130 may generate data representing the graphical user interface 600 for display by the management device 111 of the diagram. The management device 111 may receive user input to create a resource access policy through the graphical user interface 600. Figure 6 In the example of , graphical user interface 600 may include a policy name field 602 , a resource field 604 , a condition field 606 , and a create field 608 .

[0118] Graphical user interface 600 may receive input specifying a resource access policy name in policy name field 602. Graphical user interface 600 may receive input defining a resource access policy in resource field 604. For example, graphical user interface 600 may receive a file path, a media access control (MAC) address, an Internet Protocol (IP) address, or other types of information defining resources that may be subject to resource access policy restrictions.

[0119] The graphical user interface 600 may receive input of conditions defining when and / or how a resource access policy authorizes access to a resource defined in the resource field 604. The graphical user interface 600 may receive conditional definitions related to resource access in the condition field 606. The graphical user interface 600 may receive location-based conditions related to accessing a resource defined in the resource field 604. The condition field 606 may output one or more suggestions of location-based condition types that may be assigned to the resource access policy. For example, the condition field 606 may output options of "defining a specified area" or "defining quota requirements," which may be used to restrict or otherwise regulate access to the resource defined in the resource field 604. The condition field 606 may include a map for an area (e.g., location or proximity data associated with a UWB beacon), for example, as input for defining a specified area. The condition field 606 may include a count of required devices (e.g., the number and / or type of UEs that must be located at a certain distance from the requesting UE) as input for defining a quota requirement. The condition field 606 may include one or more conditions of the resource access policy. Graphical user interface 600 may include a creation field 608, such as to push a resource access policy to Figure 1A In some examples, the create field 608 may output options that define when to begin enforcing the newly created resource access policy.

[0120] Figure 7is a flow chart illustrating example operations for implementing conditional access to resources based on the location of client device 748 in accordance with one or more techniques of this disclosure. Figure 7 In the example of FIG. 7 , NMS 730, client device 748, and UWB beacon 752 may correspond to Figure 1C The NMS 130, the client device 148, and the UWB beacon 152 in the UWB beacon 752. The UWB beacon 752 may correspond to one or more client devices 148, AP 142, switch 146, edge device 150, or Figure 1A The client device 748 may request access to a resource (702). The client device 748 may request access to a resource, such as a website, an electronic document, a computing device, an SSID of a wireless local area network, or other types of high-level resources.

[0121] The NMS 730 may initiate a UWB secure ranging session (704). The NMS 730 may initiate a UWB secure ranging session between a client device 748 and a UWB beacon 752. The NMS 730 may initiate a UWB secure ranging session (706) by generating an encryption key. The NMS 730 may generate an encryption key based on a UWB physical layer frame structure. The NMS 730 may generate an encryption key, including an STS in a field of the encryption key, to ensure that the UWB secure ranging session is secure and that the devices involved in the UWB secure ranging session are not forged or deceived. The NMS 730 may send the encryption key to the client device 748 and the UWB beacon 752 via a secure channel connection. The client device 748 may receive the encryption key (708A) via a secure channel connection, and the UWB beacon 752 may receive the encryption key (708B) via another secure channel connection.

[0122] In response to receiving the encryption key associated with the UWB secure ranging session, the client device 748 or the UWB beacon 752 may transmit electromagnetic pulses to other devices in the UWB secure ranging session to determine distance measurements. Figure 7 In an example of the present invention, UWB beacon 752 may send an electromagnetic pulse (710) using an encryption key generated by NMS 730. Client device 748 may receive the electromagnetic pulse and determine one or more distance measurements (712). For example, client device 748 may implement a direction finding function to determine a time of flight of an angle of arrival of the electromagnetic pulse. Client device 748 may send one or more distance measurements (714) to NMS 730 using a software module executed on client device 748. In some examples, UWB beacon 752 may determine one or more distance measurements based on a UWB secure ranging session and send the one or more distance measurements to NMS 730.

[0123] The NMS 730 may obtain one or more distance measurements (716). The NMS 730 may obtain the distance measurements from the client device 748 or the UWB beacon 752. The NMS 730 may determine the location of the client device 748 based on the obtained distance measurements (718). For example, the NMS 730 may determine the geographic location, spatial proximity, or location of the client device 748 based on the ToF and AoA measurements determined during the UWB secure ranging session. In some examples, the NMS 730 may apply a map where the UWB beacons 752 are located to determine the location of the client device 748.

[0124] The NMS 730 may use the determined location of the client device 748 to determine whether a condition for accessing the requested resource has been met (720). For example, the NMS 730 may determine whether the location of the client device 748 meets criteria associated with a business rule or access policy established for regulating access to the requested resource. In some instances, the NMS 730 may determine that the location of the client device 748 meets the condition and authorizes access to the client device 748 (the "yes" branch of 720). The client device 748 may receive access to the resource (722). For example, the client device 748 may receive a token with credentials for accessing the resource, which enables the client device 748 to act as a physical UWB token associated with access to the resource. In some instances, the NMS 730 may determine that the location of the client device 748 does not meet the condition (the "no" branch of 720). The NMS 730 may output an indication of a denial of the request to access the resource (724). NMS 730 may output a denial of the request to access the resource to a software module of client device 748. In some examples, in response to NMS 730 determining that the location of client device 748 no longer satisfies the location-based conditions for accessing the resource, if client device 748 already has a token associated with access to the resource, NMS 730 may revoke the token, mark the token as expired, or otherwise protect the content of the resource.

[0125] Figure 8 is a flow diagram illustrating example operations for authorizing a computing device's access to a resource based on the computing device's location, in accordance with one or more techniques of this disclosure. Figure 8 Figure 1 to Figure 6 The discussion is for example only.

[0126] NMS130 may obtain a request to access a resource (802). For example, NMS130 may obtain a request from a first computing device supporting the UWB protocol via a NAS device of a network site of network system 100. NMS130 may obtain a request from a first computing device on a wireless network at site 102. NMS130 may initiate a UWB secure ranging session (804). NMS130 may initiate a UWB secure ranging session between a first computing device and a second computing device supporting the UWB protocol. NMS130 may initiate a UWB secure ranging session to determine the location of the first computing device. NMS130 may obtain one or more distance measurements based on the UWB secure ranging session (806). NMS130 may obtain distance measurements such as ToF or AoA by sending electromagnetic pulses between the first computing device and the second computing device. NMS130 may determine the location of the first computing device based on the one or more distance measurements (808). NMS130 may determine the location of the first computing device based on the distance measurements and a map specifying the location of the second computing device. The NMS 130 may provide access to the resource to the first computing device based on the location ( 810 ).The NMS 130 may provide access to the resource to the first computing device by issuing a token associated with valid credentials to access content of the requested resource.

[0127] The following examples may illustrate one or more aspects of the present disclosure.

[0128] Example 1: A network management system includes a processing circuit; and a memory including obtaining a request to access a resource from a first computing device on a wireless network at a site, the first computing device supporting an ultra-wideband (UWB) protocol; initiating a UWB secure ranging session between the first computing device and a second computing device to determine a location of the first computing device, wherein the second computing device is on the wireless network at the site and supports the UWB protocol; obtaining one or more distance measurements between the first computing device and the second computing device based on the UWB secure ranging session; determining a location of the first computing device based on the one or more distance measurements; and providing access to the resource to the first computing device based on the location of the first computing device satisfying an access policy condition for the resource.

[0129] Example 2: The network management system of Example 1, wherein, in order to initiate a UWB secure ranging session between a first device and a second device, the instruction further causes the processing circuit to: generate multiple encryption keys; send a first encryption key of the multiple encryption keys to the first computing device via a first secure channel with the first computing device; and send a second encryption key of the multiple encryption keys to the second computing device via a second secure channel with the second computing device.

[0130] Example 3: The network management system of Example 2, wherein the first secure channel comprises a network connection between the network management system and a first computing device, and wherein the second secure channel comprises a network connection between the network management system and a second computing device.

[0131] Example 4: The network management system of any of Examples 2 and 3, wherein the instruction further causes the processing circuit to: generate at least one scrambled timestamp sequence associated with the UWB secure ranging session; and add the at least one scrambled timestamp sequence to a field of each key in a plurality of encryption keys.

[0132] Example 5: The network management system of any of Examples 1 to 4, wherein, in order to provide access to a resource to a first computing device, the instructions further cause the processing circuit to: monitor a change in position of the first computing device by continuously acquiring distance measurements associated with the first computing device relative to a second computing device during a UWB secure ranging session; determine a change in position of the first computing device relative to a determined position of the first computing device based on the continuously acquired distance measurements; and revoke access to the resource provided to the first computing device based on the change in position of the first computing device no longer satisfying an access policy condition for the resource.

[0133] Example 6: The network management system of any of Examples 1 to 5, wherein the condition of the access policy for the resource includes a spatial region relative to the second computing device.

[0134] Example 7: A network management system of any of Examples 1 to 6, wherein a UWB secure ranging session is between a first computing device, a second computing device, and a third computing device, wherein one or more distance measurements between the first computing device and the second computing device include a first set of distance measurements, and wherein the instructions further cause the processing circuit to: obtain a second set of distance measurements between the third computing device and at least one of the first computing device or the second computing device based on the UWB secure ranging session; determine a location of the third computing device based on the second set of distance measurements; and determine a count of the number of devices in a spatial area relative to the second computing device based on the location of the first computing device and the location of the third computing device, wherein in order to provide access to a resource to the first computing device, the instructions further cause the processing circuit to provide access to a resource to the first computing device based on the location of the first computing device in the spatial area and the number of devices in the spatial area satisfying a condition of an access policy for the resource, wherein the condition of the access policy includes a quota of required devices being in the spatial area relative to the second computing device.

[0135] Example 8: A network management system of any of Examples 1 to 7, wherein a UWB secure ranging session is between a first computing device, a second computing device, and a third computing device, wherein one or more distance measurements between the first computing device and the second computing device include a first set of distance measurements, and wherein the instructions further cause the processing circuit to: based on the UWB secure ranging session, obtain a second set of distance measurements between the third computing device and at least one of the first computing device or the second computing device; and determine a count of the number of devices approaching the first computing device based on the first set of distance measurements and the second set of distance measurements, wherein in order to provide access to a resource to the first computing device, the instructions further cause the processing circuit to provide access to a resource to the first computing device based on a location of the first computing device and the number of devices approaching the first computing device satisfying a condition of an access policy for the resource, wherein the condition of the access policy includes a quota of required devices approaching the first computing device.

[0136] Example 9: The network management system of any of Examples 1 to 8, wherein each of the one or more distance measurements comprises at least one of: a physical time-of-flight measurement between the first computing device and the second computing device or an angle-of-arrival measurement between the first computing device and the second computing device.

[0137] Example 10: The network management system of any of Examples 1 to 9, wherein the first computing device is a client device executing a network management system client module, and wherein the second computing device is an access point (AP) or a network access server (NAS) device.

[0138] Example 11: The network management system of any of Examples 1 to 10, wherein the first computing device and the second computing device are client devices each executing a respective network management system client module.

[0139] Example 12: A method, comprising obtaining a request to access a resource from a first computing device on a wireless network at a site, the first computing device supporting an ultra-wideband (UWB) protocol; initiating a UWB secure ranging session between the first computing device and a second computing device to determine that the first computing device and the second computing device are on the wireless network at the site and support the UWB protocol; obtaining one or more distance measurements between the first computing device and the second computing device based on the UWB secure ranging session; determining a location of the first computing device based on the one or more distance measurements; and providing access to the resource to the first computing device based on a condition that the location of the first computing device satisfies an access policy for the resource.

[0140] Example 13: The method of Example 12, wherein initiating a UWB secure ranging session between a first computing device and a second computing device includes: generating multiple encryption keys; sending a first encryption key of the multiple encryption keys to the first computing device via a first secure channel with the first computing device; and sending a second encryption key of the multiple encryption keys to the second computing device via a second secure channel with the second computing device.

[0141] Example 14: The method of Example 13, wherein the first secure channel comprises a network connection between the network management system and the first computing device, and wherein the second secure channel comprises a network connection between the network management system and the second computing device.

[0142] Example 15: The method of any of Examples 13 and 14, further comprising generating at least one scrambled timestamp sequence associated with the UWB secure ranging session; and adding the at least one scrambled timestamp sequence to a field of each of the plurality of encryption keys.

[0143] Embodiment 16: Any of the methods of Embodiments 12 to 15, wherein in order to provide the first computing device with access to the resource, it also includes: during the UWB secure ranging session, monitoring the position change of the first computing device by continuously acquiring distance measurements associated with the first computing device; determining the position change of the first computing device relative to the determined position of the first computing device based on the continuously acquired distance measurements; and revoking access to the resource provided to the first computing device based on the position change of the first computing device no longer satisfying the conditions of the access policy for the resource.

[0144] Example 17: The method of any of Examples 12 to 16, wherein the condition for the access policy for the resource includes a spatial region relative to the second computing device.

[0145] Example 18: The method of any of Examples 12 to 17, wherein a UWB secure ranging session is between a first computing device, a second computing device, and a third computing device, wherein one or more distance measurements between the first computing device and the second computing device include a first set of distance measurements, and wherein the method further includes: obtaining a second set of distance measurements between the third computing device and at least one of the first computing device or the second computing device based on the UWB secure ranging session; determining a location of the third computing device based on the second set of distance measurements; and determining a count of the number of devices within a spatial region relative to the second computing device based on the location of the first computing device and the location of the third computing device, wherein providing access to a resource to the first computing device includes providing access to the resource to the first computing device based on the location of the first computing device within the spatial region and the number of devices within the spatial region satisfying a condition of an access policy for the resource, wherein the condition of the access policy includes a quota of required devices within the spatial region relative to the second computing device.

[0146] Example 19: The method of any of Examples 12 to 18, wherein a UWB secure ranging session is between a first computing device, a second computing device, and a third computing device, wherein one or more distance measurements between the first computing device and the second computing device include a first set of distance measurements, and wherein the method further comprises: obtaining a second set of distance measurements between the third computing device and at least one of the first computing device or the second computing device based on the UWB secure ranging session; and determining a number of devices proximate to the first computing device based on the first set of distance measurements and the second set of distance measurements, wherein providing access to a resource to the first computing device comprises providing access to a resource to the first computing device based on a location of the first computing device satisfying a condition of an access policy for the resource and the number of devices proximate to the first computing device, wherein the condition of the access policy includes a quota of required devices being proximate to a requesting device of the first computing device.

[0147] Example 20: The method of any of Examples 12 to 19, wherein each of the one or more distance measurements comprises at least one of: a physical time-of-flight measurement between the first computing device and the second computing device or an angle-of-arrival measurement between the first computing device and the second computing device.

[0148] Example 21: The method of any of Examples 12 to 20, wherein the first computing device is a client device executing a network management system client module, and wherein the second computing device is an access point (AP) or a network access server (NAS) device.

[0149] Example 22: The method of any of Examples 12 to 21, wherein the first computing device and the second computing device are client devices each executing a respective network management system client module.

[0150] Example 23: Computer-readable storage medium, comprising obtaining a request to access a resource from a first computing device on a wireless network at a site, the first computing device supporting an ultra-wideband (UWB) protocol; initiating a UWB secure ranging session between the first computing device and a second computing device to determine the locations of the first computing device and the second computing device on the wireless network at the site and supporting the UWB protocol; obtaining one or more distance measurements between the first computing device and the second computing device based on the UWB secure ranging session; determining the location of the first computing device based on the one or more distance measurements; and providing access to the resource to the first computing device based on a condition that the location of the first computing device satisfies an access policy for the resource.

[0151] Example 24: Computer-readable storage medium of Example 23, wherein, in order to initiate a UWB secure ranging session between a first device and a second device, the instructions cause the processing circuit to: generate multiple encryption keys; send a first encryption key of the multiple encryption keys to the first computing device via a first secure channel with the first computing device; and send a second encryption key of the multiple encryption keys to the second computing device via a second secure channel with the second computing device.

[0152] Example 25: The computer-readable storage medium of Example 24, wherein the first secure channel comprises a network connection between the network management system and the first computing device, and wherein the second secure channel comprises a network connection between the network management system and the second computing device.

[0153] Example 26: The computer-readable storage medium of any of Examples 24 and 25, wherein the instructions further cause the processing circuit to: generate at least one scrambled timestamp sequence associated with the UWB secure ranging session; and add at least one scrambled timestamp sequence to a field of each key in a plurality of encryption keys.

[0154] Example 27: A computer-readable storage medium of any of Examples 23 to 26, wherein, in order to provide access to the resource to the first computing device, the instructions further cause the processing circuit to: monitor a change in position of the first computing device by continuously acquiring distance measurements associated with the first computing device relative to a second computing device during a UWB secure ranging session; determine a change in position of the first computing device relative to a determined position of the first computing device based on the continuously acquired distance measurements; and revoke access to the resource provided to the first computing device based on the change in position of the first computing device no longer satisfying a condition of an access policy for the resource.

[0155] Example 28: The computer-readable storage medium of any of Examples 23 to 27, wherein the condition of the access policy for the resource includes a spatial region relative to the second computing device.

[0156] Example 29: Computer-readable storage medium of any of Examples 23 to 28, wherein a UWB secure ranging session is between a first computing device, a second computing device, and a third computing device, wherein one or more distance measurements between the first computing device and the second computing device include a first set of distance measurements, and wherein the instructions further cause the processing circuit to: based on the UWB secure ranging session, obtain a second set of distance measurements between the third computing device and at least one of the first computing device or the second computing device; determine a location of the third computing device based on the second set of distance measurements; and determine a count of the number of devices in a spatial region relative to the second computing device based on the location of the first computing device and the location of the third computing device, wherein in order to provide access to a resource to the first computing device, the instructions further cause the processing circuit to provide access to the resource to the first computing device based on the location of the first computing device in the spatial region and the number of devices in the spatial region satisfying a condition of an access policy for the resource, wherein the condition of the access policy includes a quota of required devices being in the spatial region relative to the second computing device.

[0157] Example 30: A computer-readable storage medium of any of Examples 23 to 29, wherein a UWB secure ranging session is between a first computing device, a second computing device, and a third computing device, wherein one or more distance measurements between the first computing device and the second computing device include a first set of distance measurements, and wherein instructions cause the processing circuit to: based on the UWB secure ranging session, obtain a second set of distance measurements between the third computing device and at least one of the first computing device or the second computing device; and determine a count of the number of devices proximate to the first computing device based on the first set of distance measurements and the second set of distance measurements, wherein in order to provide access to a resource to the first computing device, the instructions further cause the processing circuit to provide access to the resource to the first computing device based on a location of the first computing device and the number of devices proximate to the first computing device satisfying a condition of an access policy for the resource, wherein the condition of the access policy includes a quota of required devices being proximate to the first computing device.

[0158] Example 31: Computer-readable storage medium of any of Examples 23 to 30, wherein each of the one or more distance measurements comprises at least one of: a physical time-of-flight measurement between the first computing device and the second computing device or an angle-of-arrival measurement between the first computing device and the second computing device.

[0159] Example 32: The computer-readable storage medium of any of Examples 23 to 31, wherein the first computing device is a client device executing a network management system client module, and wherein the second computing device is an access point (AP) or a network access server (NAS) device.

[0160] Example 33: The computer readable storage medium of any of Examples 23 to 32, wherein the first computing device and the second computing device are client devices each executing a respective network management system client module.

[0161] The techniques described herein may be implemented in hardware, software, firmware, or any combination thereof. The various features described as modules, units, or components may be implemented together in an integrated logic device, or separately as discrete but interoperable logic devices or other hardware devices. In some cases, the various features of the electronic circuit may be implemented as one or more integrated circuit devices, such as an integrated circuit chip or chipset.

[0162] If implemented in hardware, the present disclosure may be directed to an apparatus such as a processor or device, such as an integrated circuit chip or chipset. Alternatively or additionally, if implemented in software or firmware, the technology may be implemented at least in part by a computer-readable data storage medium including instructions that, when executed, cause a processor to perform one or more of the methods described above. For example, a computer-readable data storage medium may store such instructions for execution by a processor.

[0163] Computer readable media may form part of a computer program product, which may include packaging materials. Computer readable media may include computer data storage media, such as random access memory (RAM), read-only memory (ROM), non-volatile random access memory (NVRAM), electrically erasable programmable read-only memory (EEPROM), flash memory, magnetic or optical data storage media, etc. In some examples, an article of manufacture may include one or more computer readable storage media.

[0164] In some examples, computer-readable storage media may include non-transitory media. The term "non-transitory" may indicate that the storage media is not embodied in a carrier wave or propagating signal. In some examples, non-transitory storage media may store data that changes over time (e.g., in RAM or cache).

[0165] Codes or instructions may be software and / or firmware executed by processing circuitry including one or more processors, such as one or more digital signal processors (DSPs), general-purpose microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other equivalent integrated or discrete logic circuits. Accordingly, the term "processor," as used herein, may refer to any of the foregoing structures or any other structure suitable for implementation of the techniques described herein. Furthermore, in some aspects, the functionality described in the present disclosure may be provided within a software module or a hardware module.

Claims

1. A network management system, comprising: Processing circuit; as well as a memory comprising instructions which, when executed by the processing circuit, cause the processing circuit to: Obtaining a request to access a resource from a first computing device on a wireless network at a site, the first computing device supporting an ultra-wideband (UWB) protocol; initiating a UWB secure ranging session between the first computing device and a second computing device to determine a location of the first computing device, wherein the second computing device is on the wireless network at the site and supports the UWB protocol; obtaining one or more distance measurements between the first computing device and the second computing device based on the UWB secure ranging session; determining the location of the first computing device based on the one or more distance measurements; as well as Access to the resource is provided to the first computing device based on a condition that the location of the first computing device satisfies an access policy for the resource.

2. The network management system of claim 1, wherein to initiate the UWB secure ranging session between the first computing device and the second device, the instructions further cause the processing circuit to: Generate multiple encryption keys; sending a first encryption key of the plurality of encryption keys to the first computing device via a first secure channel with the first computing device; as well as A second encryption key of the plurality of encryption keys is sent to the second computing device via a second secure channel with the second computing device.

3. The network management system of claim 2, wherein the first secure channel comprises a network connection between the network management system and the first computing device, and wherein the second secure channel comprises a network connection between the network management system and the second computing device.

4. The network management system of claim 2, wherein the instructions further cause the processing circuit to: generating at least one scrambled timestamp sequence associated with the UWB secure ranging session; and The at least one scrambled timestamp sequence is added to a field of each encryption key of the plurality of encryption keys.

5. The network management system according to any one of claims 1 to 4, wherein in order to provide the first computing device with access to the resource, the instructions further cause the processing circuit to: monitoring a change in position of the first computing device by continuously acquiring range measurements associated with the first computing device relative to the second computing device during the UWB secure ranging session; determining a change in the position of the first computing device relative to the determined position of the first computing device based on the continuously acquired distance measurements; as well as Access to the resource provided to the first computing device is revoked based on the change in location of the first computing device no longer satisfying the condition of the access policy for the resource.

6. The network management system according to any one of claims 1 to 4, wherein the condition of the access policy for the resource includes a spatial region relative to the second computing device.

7. The network management system of any one of claims 1 to 4, wherein the UWB secure ranging session is between the first computing device, the second computing device, and a third computing device, wherein the one or more distance measurements between the first computing device and the second computing device include a first set of distance measurements, and wherein the instructions further cause the processing circuit to: obtaining, based on the UWB secure ranging session, a second set of range measurements between the third computing device and at least one of the first computing device or the second computing device; determining a location of the third computing device based on the second set of distance measurements; as well as determining a count of the number of devices within a spatial region relative to the second computing device based on the location of the first computing device and the location of the third computing device, Wherein, in order to provide the first computing device with access to the resource, the instructions further cause the processing circuit to provide the first computing device with access to the resource based on the location of the first computing device being within the spatial region and the number of devices within the spatial region satisfying the conditions of the access policy for the resource, wherein the conditions of the access policy include a quota of required devices being within the spatial region relative to the second computing device.

8. The network management system of any one of claims 1 to 4, wherein the UWB secure ranging session is between the first computing device, the second computing device, and a third computing device, wherein the one or more distance measurements between the first computing device and the second computing device include a first set of distance measurements, and wherein the instructions further cause the processing circuit to: obtaining a second set of range measurements between the third computing device and at least one of the first computing device or the second computing device based on the UWB secure ranging session; and determining a count of the number of devices proximate to the first computing device based on the first set of distance measurements and the second set of distance measurements, Wherein, in order to provide the first computing device with access to the resource, the instructions further cause the processing circuit to provide the first computing device with access to the resource based on the location of the first computing device and the number of devices proximate to the first computing device satisfying the conditions of the access policy for the resource, wherein the conditions of the access policy include a quota of required devices being proximate to the first computing device.

9. A network management system according to any one of claims 1 to 4, wherein each of the one or more distance measurements comprises at least one of: a physical flight time measurement between the first computing device and the second computing device or an arrival angle measurement between the first computing device and the second computing device.

10. The network management system according to any one of claims 1 to 4, wherein the first computing device is a client device executing a network management system client module, and wherein the second computing device is an access point AP or a network access server NAS device.

11. The network management system according to any one of claims 1 to 4, wherein the first computing device and the second computing device are client devices each executing a corresponding network management system client module.

12. A computer networking method, comprising: Obtaining a request to access a resource from a first computing device on a wireless network at a site, the first computing device supporting an ultra-wideband (UWB) protocol; initiating a UWB secure ranging session between the first computing device and a second computing device, the second computing device being on the wireless network at the site and supporting the UWB protocol, to determine a location of the first computing device; obtaining one or more distance measurements between the first computing device and the second computing device based on the UWB secure ranging session; determining the location of the first computing device based on the one or more distance measurements; as well as Access to the resource is provided to the first computing device based on a condition that the location of the first computing device satisfies an access policy for the resource.

13. The computer networking method of claim 12, wherein initiating the UWB secure ranging session between the first computing device and the second computing device comprises: Generate multiple encryption keys; sending a first encryption key of the plurality of encryption keys to the first computing device via a first secure channel with the first computing device; as well as A second encryption key of the plurality of encryption keys is sent to the second computing device via a second secure channel with the second computing device.

14. The computer networking method of claim 13, wherein the first secure channel comprises a network connection between a network management system and the first computing device, and wherein the second secure channel comprises a network connection between the network management system and the second computing device.

15. The computer networking method according to claim 13, further comprising: generating at least one scrambled timestamp sequence associated with the UWB secure ranging session; as well as The at least one scrambled timestamp sequence is added to a field of each encryption key of the plurality of encryption keys.

16. The computer networking method according to any one of claims 12 to 15, wherein providing the first computing device with access to the resource further comprises: monitoring a change in position of the first computing device by continuously acquiring range measurements associated with the first computing device relative to the second computing device during the UWB secure ranging session; determining a change in the position of the first computing device relative to the determined position of the first computing device based on the continuously acquired distance measurements; as well as Access to the resource provided to the first computing device is revoked based on the change in location of the first computing device no longer satisfying the condition of the access policy for the resource.

17. The computer networking method according to any one of claims 12 to 15, wherein the condition of the access policy for the resource includes a spatial region relative to the second computing device.

18. The computer networking method of any one of claims 12 to 15, wherein the UWB secure ranging session is between the first computing device, the second computing device, and a third computing device, wherein the one or more distance measurements between the first computing device and the second computing device include a first set of distance measurements, and wherein the method further comprises: obtaining, based on the UWB secure ranging session, a second set of range measurements between the third computing device and at least one of the first computing device or the second computing device; determining a location of the third computing device based on the second set of distance measurements; as well as determining a count of the number of devices within a spatial region relative to the second computing device based on the location of the first computing device and the location of the third computing device, Wherein providing access to the resource to the first computing device includes providing access to the resource to the first computing device based on the location of the first computing device being within the spatial region and the number of devices within the spatial region satisfying the conditions of the access policy for the resource, wherein the conditions of the access policy include a quota of required devices being within the spatial region relative to the second computing device.

19. The computer networking method of any one of claims 12 to 15, wherein each of the one or more distance measurements comprises at least one of: a physical time-of-flight measurement between the first computing device and the second computing device or an angle-of-arrival measurement between the first computing device and the second computing device.

20. A computer-readable storage medium encoded with instructions for causing one or more programmable processors to be configured as the network management system according to any one of claims 1 to 11, or to be configured to implement the computer networking method according to any one of claims 12 to 19.

Images