Intelligent equipment use management and control method based on geographic position

Abstract

The invention relates to an intelligent equipment use management and control method based on a geographic position. The intelligent equipment use management and control method is composed of seven core modules including a server, a client, a position information collector, a personnel authentication module, an authority strategy interaction module and strategy management. And the server stores information and strategies and is connected with the client. And the client is installed at the equipment end to execute the instruction. The position information collector obtains three-dimensional geographic data. And the personnel authentication module carries out identity authentication. And the authority strategy interaction module supports network issuing and offline synchronization of the strategy. And the strategy management module makes a decision according to the geographic position and the authority strategy. According to the method, refined forced management and control of equipment startup, use, personnel and places are realized, and the safety management level and asset protection capability of high-value or secret-related equipment are remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of smart device security management technology, specifically to a method for managing the use of smart devices based on geographic location. Background Technology

[0002] With the rapid development of the Internet of Things (IoT), mobile internet, and smart terminal technologies, smart devices have been widely used in many fields such as industrial production, public services, security monitoring, and personal consumption. These devices often possess high value or process sensitive data. If their use lacks effective supervision, it can easily lead to risks such as device abuse, illegal misappropriation, data leakage, and asset loss. In practical application scenarios, especially when the number of devices is large, their distribution is wide, and the users are complex, ensuring that smart devices are used legally and compliantly only in authorized locations by authorized personnel for authorized purposes has become a pressing technical and management challenge. Traditional device management methods mainly rely on physical locks, on-site personnel supervision, or simple software password logins. These methods are not only inefficient and lack granular management, but also fail to provide fine-grained dynamic control over the geographical location of device use, making them unsuitable for the needs of modern distributed and mobile device usage.

[0003] To address the aforementioned issues, several technical solutions combining location information for device management have emerged in recent years. Some solutions integrate GPS modules into the devices, reporting their geographic location information to a management platform. Administrators can then view device distribution and set up electronic fences based on two-dimensional latitude and longitude. When a device enters or leaves the fenced area, the platform issues an alarm. While these solutions achieve device location monitoring and boundary crossing alerts, their management methods are relatively passive, typically limited to post-event tracking and alarms, lacking direct, real-time, and mandatory intervention in device usage permissions (such as powering on and enabling functions). Other solutions attempt to combine identity authentication with location information, requiring users to verify not only password or biometric authentication but also whether the device is currently within a pre-defined list of trusted locations. However, these solutions mostly rely on two-dimensional geographic location judgment, lacking sufficient differentiation of height information, making them prone to management loopholes in multi-story buildings or complex three-dimensional spaces. Furthermore, the updating and distribution of permission policies heavily depend on real-time network connectivity. In offline environments with poor or interrupted network signals, device management policies cannot be synchronized and take effect in a timely manner, affecting system availability and reliability.

[0004] In summary, existing location-based device management technologies often suffer from problems such as limited management dimensions, delayed control actions, and policy failures in offline scenarios. Therefore, this invention proposes a method that integrates 3D geospatial data, supports multi-mode policy synchronization, and enables real-time mandatory control of devices throughout the entire process from power-on to usage. This method effectively ensures the secure use of smart devices under strict geographical location and personnel access constraints, improving the management level and security capabilities of valuable or confidential assets. It has significant application value in fields such as smart manufacturing, public safety, and equipment management in confidential locations. Summary of the Invention

[0005] To address these issues, this invention provides a method for managing the use of smart devices based on geographic location.

[0006] This invention is achieved through the following technical solution: a method for controlling the use of intelligent devices based on geographic location, comprising six core parts: a server (1), a client (2), a location information collector (3), a personnel authentication module (4), a permission policy interaction module (5), and a policy management module (6). The method is characterized in that: the server (1) connects to the client (2) through a first communication channel (7) to transmit device permission policy information; the client (2) connects to the location information collector (3) through a second communication channel (8) to obtain the device's three-dimensional geospatial data; the location information collector (3)... The system connects to the policy management module (6) via the third communication channel (9) to transmit longitude, latitude and altitude data; the personnel authentication module (4) connects to the client (2) via the fourth communication channel (10) to perform personnel identity authentication and authorization; the permission policy interaction module (5) connects to the server (1) via the fifth communication channel (11) to support network distribution and offline synchronization of permission policies; the policy management module (6) connects to the client (2) via the sixth communication channel (12) to manage the power-on, use, operation personnel and location permissions of smart devices based on three-dimensional geospatial data and permission policies.

[0007] The server (1) as described in claim 1 is responsible for storing device information and permission policies, characterized in that: it includes a device information storage unit (13) and a permission policy storage unit (14), the device information storage unit (13) and the permission policy storage unit (14) are directly connected; the permission policy storage unit (14) sends device permission information, including a geographical location whitelist, to the client (2) through a first communication channel (7).

[0008] The client (2) as described in claim 1 is responsible for executing control commands on the smart device, characterized in that: it includes a strategy execution unit (15) and a device control unit (16), wherein the strategy execution unit (15) is directly connected to the device control unit (16); the strategy execution unit (15) receives three-dimensional geospatial data from the location information collector (3) through the second communication channel (8); and the device control unit (16) controls the power-on, use and maintenance operations of the smart device based on the received permission policy.

[0009] The location information collector (3) as described in claim 1 is responsible for collecting three-dimensional geospatial data of intelligent devices, characterized in that: it includes a longitude collection unit (17), a latitude collection unit (18) and an altitude collection unit (19); the longitude collection unit (17), the latitude collection unit (18) and the altitude collection unit (19) are interconnected and transmit data to the strategy management module (6) through a third communication channel (9).

[0010] The personnel authentication module (4) as described in claim 1 is responsible for performing identity authentication and permission identification of operators. It is characterized in that: it includes an identity authentication unit (20) and a permission identification unit (21), wherein the identity authentication unit (20) and the permission identification unit (21) are directly connected; the identity authentication unit (20) supports account password and human biometric authentication; the permission identification unit (21) is connected to the client (2) through the fourth communication channel (10) to transmit the authentication result.

[0011] The permission policy interaction module (5) as described in claim 1 is responsible for the transmission and synchronization of permission policies. It is characterized in that: it includes a network distribution unit (22) and an offline synchronization unit (23), wherein the network distribution unit (22) and the offline synchronization unit (23) are directly connected; the network distribution unit (22) and the offline synchronization unit (23) are connected to the server (1) through the fifth communication channel (11) to realize the online distribution and offline synchronization of permission policies.

[0012] The strategy management module (6) as described in claim 1 is responsible for making comprehensive control decisions based on geographic location and permission policies. It is characterized in that: it includes a geographic location analysis unit (24) and a permission decision unit (25). The geographic location analysis unit (24) is directly connected to the permission decision unit (25). The geographic location analysis unit (24) receives three-dimensional geospatial data from the location information collector (3) through the third communication channel (9). The permission decision unit (25) issues control instructions to the client (2) through the sixth communication channel (12).

[0013] The policy execution unit (15) as described in claim 3 is responsible for executing the received permission policy on the smart device, characterized in that: it receives the location data of the location information collector (3) through the second communication channel (8) and performs control operations in coordination with the device control unit (16).

[0014] The longitude acquisition unit (17) as described in claim 4 is responsible for acquiring the longitude coordinate information of the device, characterized in that: it is connected to the strategy management module (6) through the third communication channel (9) to transmit longitude data.

[0015] The network distribution unit (22) as described in claim 6 is responsible for distributing permission policies to the client (2) via wired or wireless network, characterized in that: it connects to the server (1) through the fifth communication channel (11) to obtain the latest permission policies and distribute them via network.

[0016] Compared with traditional smart device management methods, the location-based smart device usage control method proposed in this invention has the following advantages: 1. Enhance the accuracy and security of equipment asset management. Traditional equipment management often relies on manual registration or simple electronic fence alarms, failing to provide comprehensive and mandatory real-time control over equipment usage location, users, and specific operating permissions. This invention integrates three-dimensional geospatial data (longitude, latitude, and altitude) with multiple permission policies to achieve refined, end-to-end control over core elements of smart devices, such as "whether they can be powered on, whether they can be used, who is using them, and where they are used." This effectively prevents devices from being illegally activated in unauthorized areas or by unauthorized personnel, significantly reducing the risks of device theft, misuse, and data leakage. It is particularly suitable for managing high-value equipment in geographically sensitive or confidential situations.

[0017] 2. Enhance the reliability and environmental adaptability of the control system. Existing solutions typically require a continuous network connection between the device and the server to verify permissions and location. Once the network is interrupted, the control function may fail. This invention, by supporting both network-based distribution and offline synchronization of permission policies, ensures that even in environments with poor network signal or no network coverage, the device can still execute mandatory control based on the latest pre-synchronized policies. This represents a leap from "online control" to "integrated offline / online control," significantly improving the system's availability and reliability under various complex operating conditions.

[0018] 3. Improve the flexibility and response efficiency of access control. Traditional access control modifications are often cumbersome and delayed in taking effect, especially for dynamically changing needs such as equipment maintenance, temporary borrowing, and emergency tasks. This invention provides a flexible policy interaction mechanism, allowing administrators to remotely and in batches issue temporary maintenance policies or modify power-on and usage permissions to clients of designated devices via the server. This "policy as instruction" model enables device permissions to be quickly adjusted and take effect immediately according to actual business needs, without requiring on-site personnel or physical intervention, greatly simplifying management processes and improving operational response speed and management efficiency.

[0019] 4. Ensuring the Enforceability of the Client and a Seamless User Experience. To ensure the effectiveness of control, some existing solutions require installing applications on the device that can be uninstalled or interfered with by the user, posing a risk of circumvention. The client of this invention is designed as a pre-installed or embedded software module on the smart device, imperceptible to ordinary users and non-removable. As a gatekeeper at the device's underlying level, it silently executes authentication and location verification commands from the server at key nodes such as device startup and function invocation, achieving both mandatory and transparent control. Users can use the device normally and seamlessly within authorized limits; however, once a policy prohibition is triggered, the client will directly block the access, ensuring the unbypassable nature of the control policy from a fundamental technical perspective.

[0020] 5. Implement dual-factor authentication of personnel identity and spatial location. Single password authentication or location verification are vulnerable to impersonation or cracking. This invention combines personnel authentication with a three-dimensional geographic location whitelist verification, forming a dual security factor of "who + where." The device is only allowed to be used when authorized personnel initiate operations within the authorized geographic location. This strong authentication mechanism elevates device access control from a traditional single dimension to a multi-dimensional security level linking personnel, space, and time, building a more robust defense for the use of smart devices. Attached Figure Description

[0021] Figure 1 Process description for specific implementation on the server side Figure 2 Detailed process description for client-side implementation Figure 3 A detailed description of the implementation process for location information collection. Figure 4 Explanation of the specific implementation process for personnel authentication Detailed Implementation

[0022] The specific embodiments of the present invention will now be described clearly and in detail with reference to the accompanying drawings. The described embodiments are merely a part of the embodiments of the present invention.

[0023] The technical solution of this invention to solve the above-mentioned technical problems is: a method for managing the use of intelligent devices based on geographical location. This invention includes: a server, a client, a location information collector, a personnel authentication module, a permission policy interaction module, and a policy management module.

[0024] 1) Server The server-side is the data hub and control center of the entire management system, responsible for the centralized management of all smart device information, access policies, and personnel identities. Specific implementation steps include: Information Storage and Management: The server is deployed in the management center and has a built-in database for persistent storage. The stored information includes: basic information such as the unique identifier, device model, and hardware configuration of all registered smart devices; device usage permission information, specifically including power-on permissions, function usage permissions, maintenance permissions, and their corresponding effective time ranges; and a set of geographical location whitelists defined based on 3D geospatial data, each whitelist being able to be bound to a specific permission policy. Policy parsing and distribution: Receives permission policy instructions generated by the policy management module, and parses and encapsulates the instructions. Based on network conditions and target device status, the permission policy interaction module selects to distribute the policy instructions via real-time network or synchronize them to the device client cache, ensuring that the control policies are accurately conveyed to the terminal.

[0025] II) Client The client is enforcement software installed on the smart device, responsible for implementing specific control logic locally. It is transparent to the user and cannot be uninstalled. The specific implementation method is as follows: Silent resident and auto-start: The client is installed at the bottom layer of the smart device's operating system as a system service or daemon process, ensuring that it is loaded before the user interface during the device's power-on startup process and runs resident in memory. Ordinary users cannot terminate its process or uninstall it through conventional means. Permission verification and interception: Triggered at critical operation nodes of the device. The client intercepts the operation request and executes a local verification process: calling the location information collector to obtain the current 3D geographic location; calling the personnel authentication module to obtain the current operator's identity; reading the latest permission policy stored locally. After comprehensively comparing the geographic location whitelist, personnel permissions, and time policy, a decision is made to allow or prohibit the operation. If prohibited, a predefined prompt message is returned to the user and subsequent operations are blocked; Policy caching and offline execution: The client has a secure local storage area for caching the latest permission policies synchronized from the server. When the device is in a network-free environment, the client makes permission decisions based on the locally cached policies, ensuring control capabilities even when offline.

[0026] (iii) Location Information Collector A location information collector is a hardware / software module integrated into a smart device or used in conjunction with a client to accurately acquire the device's three-dimensional geospatial coordinates. The specific workflow is as follows: Data acquisition: The device's longitude, latitude, and altitude data are collected in real time through various means such as the built-in global satellite navigation system chip, cellular network base station positioning, Wi-Fi positioning technology, or in combination with the built-in barometer, indoor positioning beacon, etc. Data preprocessing and optimization: The raw positioning data is filtered, denoised, and fused to improve positioning accuracy and stability. For example, in indoor environments with weak satellite signals, the positioning method can be switched to Wi-Fi or Bluetooth beacon-based methods. Coordinate reporting: Provides the processed, standardized 3D geographic coordinate data to the client for geographical location whitelist matching and verification.

[0027] (iv) Personnel Authentication Module The user authentication module is responsible for verifying the identity of the person intending to operate the smart device, providing a basis for permission decisions. The specific implementation steps are as follows: Multimodal authentication support: Multiple authentication methods are provided based on the hardware configuration differences of smart devices. For devices equipped with cameras, facial recognition is supported; for devices equipped with fingerprint sensors, fingerprint recognition is supported; for devices equipped with microphones, voiceprint recognition is supported; and account password authentication is generally supported as well. Authentication credentials are pre-registered on the server and bound to the user's identity. Localized authentication process: To improve response speed and offline availability, the authentication process is primarily completed locally on the device. The client calls the personnel authentication module, collects the authentication information submitted by the user, compares it with the authorized personnel credential template securely stored on the device and synchronized from the server, and outputs the identity verification result. Result feedback: Return the identity identifier of the successfully authenticated person or the result of the authentication failure to the client for subsequent permission policy matching.

[0028] (v) Permission Policy Interaction Module The permission policy interaction module is responsible for establishing a reliable and flexible policy command transmission channel between the server and the client. The specific implementation method is as follows: Real-time network delivery: When the device's network connection is normal, the server can push newly created or modified permission policy instructions to the target device's client in real time via an encrypted communication protocol. Upon receiving the instructions, the client immediately updates its local policy cache and applies the changes. Offline synchronization mechanism: To address scenarios with unstable or no network access, an offline synchronization solution is provided. Administrators can export policy instructions as encrypted policy files on the server and transfer them to the target device via secure removable storage media under physical contact conditions. The client recognizes and imports the policy file, updating its local cache. Similarly, operation logs generated on the device can also be reverse-synchronized to the server in this way. Interaction Status Confirmation: During policy instruction transmission, the module ensures the integrity, confidentiality, and non-repudiation of the instructions. After successfully receiving and applying the policy, the client must return a confirmation response to the server, which then updates the policy distribution status accordingly.

[0029] (vi) Strategy Management Module The policy management module is a console based on a server-side interactive interface, allowing administrators to define, combine, and publish permission policies. The specific workflow is as follows: Policy element definition: Administrators can define the core elements of the policy separately, including: personnel / user group list, device / device group list, three-dimensional geolocation whitelist area, allowed operation permissions, and time period; Policy rule combination: The above elements are flexibly combined to generate specific control rules. The combined policy rules are submitted to the server. The policy management module calls the permission policy interaction module to distribute the policy to the clients of all target devices covered by the rule. The policy can be set to take effect immediately or at a set time according to management needs, realizing fine-grained and dynamic control over whether smart devices can be powered on, whether they can be used, who uses them, and where they are used, based on 3D geospatial data.

Claims

1. A method for controlling the use of intelligent devices based on geolocation, comprising six core components: a server (1), a client (2), a location information collector (3), a personnel authentication module (4), a permission policy interaction module (5), and a policy management module (6), characterized in that: The server (1) connects to the client (2) through the first communication channel (7) to transmit device permission policy information; The client (2) connects to the location information collector (3) through the second communication channel (8) to obtain the device's three-dimensional geospatial data; The location information collector (3) is connected to the strategy management module (6) through the third communication channel (9) to transmit longitude, latitude and altitude data; The personnel authentication module (4) is connected to the client (2) through the fourth communication channel (10) to perform personnel identity authentication and authorization; The permission policy interaction module (5) is connected to the server (1) through the fifth communication channel (11), supporting the network distribution and offline synchronization of permission policies; The policy management module (6) is connected to the client (2) through the sixth communication channel (12) and manages the power-on, use, operator and location permissions of the smart device based on three-dimensional geospatial data and permission policies.

2. The server (1) as described in claim 1, responsible for storing device information and permission policies, characterized in that: It includes a device information storage unit (13) and a permission policy storage unit (14), wherein the device information storage unit (13) and the permission policy storage unit (14) are directly connected; The permission policy storage unit (14) sends device permission information, including a geographical location whitelist, to the client (2) through the first communication channel (7).

3. The client (2) as described in claim 1, responsible for executing control commands on the smart device, characterized in that: It includes a strategy execution unit (15) and a device control unit (16), wherein the strategy execution unit (15) is directly connected to the device control unit (16); The strategy execution unit (15) receives three-dimensional geospatial data from the location information collector (3) through the second communication channel (8); The device control unit (16) controls the power-on, use and maintenance operations of the smart device based on the received permission policy.

4. The location information collector (3) as described in claim 1, responsible for collecting three-dimensional geospatial data of intelligent devices, characterized in that: It includes a longitude acquisition unit (17), a latitude acquisition unit (18), and an altitude acquisition unit (19); The longitude acquisition unit (17), latitude acquisition unit (18) and altitude acquisition unit (19) are interconnected and transmit data to the strategy management module (6) through the third communication channel (9).

5. The personnel authentication module (4) as described in claim 1, responsible for performing identity authentication and authorization verification of operators, characterized in that: It includes an identity authentication unit (20) and an authorization authentication unit (21), wherein the identity authentication unit (20) and the authorization authentication unit (21) are directly connected; The identity authentication unit (20) supports account password and human biometric authentication; The authorization authentication unit (21) is connected to the client (2) through the fourth communication channel (10) to transmit the authentication result.

6. The permission policy interaction module (5) as described in claim 1, responsible for the transmission and synchronization of permission policies, characterized in that: It includes a network distribution unit (22) and an offline synchronization unit (23), wherein the network distribution unit (22) and the offline synchronization unit (23) are directly connected; The network distribution unit (22) and the offline synchronization unit (23) are connected to the server (1) through the fifth communication channel (11) to realize the online distribution and offline synchronization of the permission policy.

7. The strategy management module (6) as described in claim 1, responsible for making comprehensive control decisions based on geographic location and permission policies, characterized in that: It includes a geographic location analysis unit (24) and an access control decision unit (25), wherein the geographic location analysis unit (24) and the access control decision unit (25) are directly connected; The geographic location analysis unit (24) receives three-dimensional geospatial data from the location information collector (3) through the third communication channel (9); The permission decision unit (25) sends control instructions to the client (2) through the sixth communication channel (12).

8. The policy execution unit (15) as described in claim 3, responsible for executing the received permission policy on the smart device, characterized in that: The location data of the location information collector (3) is received through the second communication channel (8), and the control operation is performed in coordination with the equipment control unit (16).

9. The longitude acquisition unit (17) as described in claim 4, responsible for acquiring the longitude coordinate information of the device, characterized in that: Longitude data is transmitted via a third communication channel (9) connected to the strategy management module (6).

10. The network distribution unit (22) as described in claim 6, responsible for distributing permission policies to the client (2) via a wired or wireless network, characterized in that: The system connects to the server (1) via the fifth communication channel (11) to obtain the latest permission policy and distribute it over the network.

Images