Anchoring client devices for network service access control

1. A client device comprising:

a processor; and

a memory that stores computer-executable instructions that, in response to execution by the processor, cause the processor to perform operations comprising:

receiving an anchor instantiation command to anchor the client device to an authorized service location, wherein the authorized service location corresponds to a location at which a network service is authorized, wherein the anchor instantiation command initiates an anchor instantiation time period, and wherein the client device is located at the authorized service location during the anchor instantiation time period,

determining, during the anchor instantiation time period, a first plurality of anchor attributes associated with the client device located at the authorized service location,

creating an anchor location token that represents the authorized service location based on the first plurality of anchor attributes that were determined during the anchor instantiation time period, wherein each of the first plurality of anchor attributes is represented within the anchor location token as a corresponding anchor attribute vector, wherein each anchor attribute vector comprises a corresponding penalty value and a corresponding penalty decay value, wherein the corresponding penalty value represents a probability that a change in a corresponding anchor attribute indicates that the client device has moved away from the authorized service location, and wherein the corresponding penalty decay value provides a rate at which the corresponding penalty value will be diminished,

subsequent to the anchor instantiation time period, determining a second plurality of anchor attributes associated with the client device, and

comparing the first plurality of anchor attributes to the second plurality of anchor attributes to determine whether the client device remains at the authorized service location where the network service is authorized.

2. The client device of claim 1 , wherein the anchor location token is configured to prevent a network service data stream associated with the network service from being routed through the client device in response to the client device moving outside of the authorized service location.

3. The client device of claim 1 , wherein the operations further comprise:

instantiating an instance of the anchor location token on at least the client device located at the authorized service location; and

providing the anchor location token to a headend system.

4. The client device of claim 1 , wherein the first plurality of anchor attributes comprise a network interface controller identifier, an instance of extended display identification data, and a serial number corresponding to user equipment that is communicatively coupled to the client device.

5. The client device of claim 1 , wherein the operations further comprise assembling a communication environment attribute set based on the second plurality of anchor attributes determined subsequent to the anchor instantiation time period.

6. The client device of claim 1 , wherein determining the first plurality of anchor attributes associated with the client device located at the authorized service location comprises at least one of determining communication components of the client device that are active on the client device during the anchor instantiation time period, determining information about a user equipment coupled to the client device during the anchor instantiation time period, determining information about a network access point that provides a local client network for the authorized service location, or determining information about other client devices also associated with the authorized service location during the anchor instantiation time period.

7. The client device of claim 1 , wherein the operations further comprise in response to detecting that the client device has moved outside of the authorized service location, preventing a network service data stream associated with the network service from being routed through the client device.

8. A method comprising:

receiving, by a client device, an anchor instantiation command to anchor the client device to an authorized service location, wherein the authorized service location corresponds to a location at which a network service is authorized, wherein the anchor instantiation command initiates an anchor instantiation time period, and wherein the client device is located at the authorized service location during the anchor instantiation time period;

determining, by the client device during the anchor instantiation time period, a first plurality of anchor attributes associated with the client device located at the authorized service location;

creating, by the client device, an anchor location token that represents the authorized service location based on the first plurality of anchor attributes that were determined during the anchor instantiation time period, wherein each of the first plurality of anchor attributes is represented within the anchor location token as a corresponding anchor attribute vector, wherein each anchor attribute vector comprises a corresponding penalty value and a corresponding penalty decay value, wherein the corresponding penalty value represents a probability that a change in a corresponding anchor attribute indicates that the client device has moved away from the authorized service location, and wherein the corresponding penalty decay value provides a rate at which the corresponding penalty value will be diminished;

subsequent to the anchor instantiation time period, determining, by the client device, a second plurality of anchor attributes associated with the client device; and

comparing, by the client device, the first plurality of anchor attributes to the second plurality of anchor attributes to determine whether the client device remains at the authorized service location where the network service is authorized.

9. The method of claim 8 , wherein the anchor location token is configured to prevent a network service data stream associated with the network service from being routed through the client device in response to the client device moving outside of the authorized service location.

10. The method of claim 8 , further comprising:

instantiating, via the client device an instance of the anchor location token on at least the client device at the authorized service location; and

providing, via the client device, the anchor location token to a headend system.

11. The method of claim 8 , wherein the first plurality of anchor attributes comprise a network interface controller identifier, an instance of extended display identification data, and a serial number corresponding to user equipment that is communicatively coupled to the client device.

12. The method of claim 8 , further comprising assembling, by the client device, a communication environment attribute set based on the second plurality of anchor attributes determined subsequent to the anchor instantiation time period.

13. The method of claim 8 , wherein determining the first plurality of anchor attributes associated with the client device located at the authorized service location comprises at least one of determining communication components of the client device that are active on the client device during the anchor instantiation time period, determining information about a user equipment coupled to the client device during the anchor instantiation time period, determining information about a network access point that provides a local client network for the authorized service location, or determining information about other client devices also associated with the authorized service location during the anchor instantiation time period.

14. The method of claim 8 , further comprising in response to detecting that the client device has moved outside of the authorized service location, preventing, by the client device, a network service data stream associated with the network service from being routed through the client device.

15. A computer storage medium having computer-executable instructions stored thereon that, in response to execution by a processor of a client device, cause the processor to perform operations comprising:

receiving an anchor instantiation command to anchor the client device to an authorized service location, wherein the authorized service location corresponds to a location at which a network service is authorized, wherein the anchor instantiation command initiates an anchor instantiation time period, and wherein the client device is located at the authorized service location during the anchor instantiation time period;

determining, during the anchor instantiation time period, a first plurality of anchor attributes associated with the client device located at the authorized service location;

creating an anchor location token that represents the authorized service location based on the first plurality of anchor attributes that were determined during the anchor instantiation time period, wherein each of the first plurality of anchor attributes is represented within the anchor location token as a corresponding anchor attribute vector, wherein each anchor attribute vector comprises a corresponding penalty value and a corresponding penalty decay value, wherein the corresponding penalty value represents a probability that a change in a corresponding anchor attribute indicates that the client device has moved away from the authorized service location, and wherein the corresponding penalty decay value provides a rate at which the corresponding penalty value will be diminished;

subsequent to the anchor instantiation time period, determining a second plurality of anchor attributes associated with the client device; and

comparing the first plurality of anchor attributes to the second plurality of anchor attributes to determine whether the client device remains at the authorized service location where the network service is authorized.

16. The computer storage medium of claim 15 , wherein the anchor location token is configured to prevent a network service data stream associated with the network service from being routed through the client device in response to the client device moving outside of the authorized service location.

17. The computer storage medium of claim 15 , wherein the operations further comprise:

instantiating an instance of the anchor location token on at least the client device at the authorized service location; and

providing the anchor location token to a headend system.

18. The computer storage medium of claim 15 , wherein determining the first plurality of anchor attributes associated with the client device located at the authorized service location comprises at least one of determining communication components of the client device that are active on the client device during the anchor instantiation time period, determining information about a user equipment coupled to the client device during the anchor instantiation time period, determining information about a network access point that provides a local client network for the authorized service location, or determining information about other client devices also associated with the authorized service location during the anchor instantiation time period.

19. The computer storage medium of claim 15 , wherein the operations further comprise assembling a communication environment attribute set based on the second plurality of anchor attributes determined subsequent to the anchor instantiation time period.

20. The computer storage medium of claim 19 , wherein the operations further comprise in response to detecting that the client device has moved outside of the authorized service location, preventing a network service data stream associated with the network service from being routed through the client device.