Method and apparatus for multi-factor verification of a computing device location within a preset geographic area
A location multi-factor verification method may comprise initiating a boot process of a client device via firmware of the client device, receiving, via a network interface device, an access point (AP) beacon frame identifying a nearby AP, transmitting the AP beacon frame to a location determination service via the network interface device, receiving a geographic location estimation from the location determination service, based on the AP beacon frame, transmitting the geographic location estimation to the nearby AP, and granting a user of the client device access to an operating system of the client device if a boot process authorization instruction is received at the client device via the network interface device.
1. An information handling system of a wireless network access point operating a location multi-factor authentication security system comprising:
a memory storing a private key and a public key;
an access point network interface device operably connecting the wireless network access point to a network receiving a geographic location estimation from a client device requesting access to the network;
the access point network interface device transmitting a random number challenge generated using the private key to the client device if the geographic location estimation is within a preset geographical area;
the access point network interface device receiving a challenge response from the client device;
a processor generating a challenge response comparator by decrypting the random number challenge using a public key;
the processor generating a boot process authorization instruction if the challenge response matches the challenge response comparator; and
the access point network interface device transmitting the boot process authorization instruction to the client device to permit access to the client device operating system if the challenge response matches the challenge response comparator.
2. The information handling system of claim 1 , further comprising:
the access point network interface device disallowing communication between the network and the client device if the geographical location estimation is not within the preset geographical area.
3. The information handling system of claim 1 , further comprising:
the access point network interface device transmitting a boot up abort instruction to the client device if the geographical location estimation is not within the preset geographical area.
4. The information handling system of claim 1 , further comprising:
the access point network interface device transmitting a boot up abort instruction to the client device if the challenge response does not match the challenge response comparator.
5. The information handling system of claim 1 , wherein the geographic location estimation is determined based on an access point beacon frame identifying an access point known to be located within the preset geographical area, received from the client device.
6. The information handling system of claim further comprising:
the processor authenticating the client device through a Wi-Fi Protected Setup (WPS) security protocol.
7. The information handling system of claim further comprising:
the access point network interface device receiving the public key and the private key transmitted from a router within a local network that includes the AP.
8. A location multi-factor verification method comprising:
initiating a boot process of a client device via firmware of the client device;
receiving, via a network interface device, an access point (AP) beacon frame identifying a nearby AP;
transmitting the AP beacon frame to a location determination service via the network interface device;
receiving a geographic location estimation from the location determination service, based on the AP beacon frame;
transmitting the geographic location estimation to the nearby AP; and
granting a user of the client device access to an operating system of the client device if a boot process authorization instruction is received at the client device via the network interface device.
9. The method of claim further comprising:
receiving a boot up abort instruction, via the network interface device, if the geographical location estimation is not within the preset geographical area; and
aborting the boot up process such that the user cannot access the operating system of the client device.
10. The method of claim 8 , further comprising:
receiving a boot process authorization instruction from the nearby AP if the geographic location estimation is within a preset geographical area and the client device transmits a correct asymmetric cryptography challenge response to the AP.
11. The method of claim 10 , further comprising:
receiving, via the network interface device, a random number challenge generated using the private key;
generating a challenge response based on a public key stored in a memory of the client device; and
transmitting the challenge response to the AP via the network interface device.
12. The method of claim 10 , further comprising:
receiving a boot up abort instruction, via the network interface device, if the client device does not transmit the correct asymmetric cryptography challenge response to the AP; and
aborting the boot up process such that the user cannot access the operating system of the client device.
13. The method of claim 8 , wherein the geographic location estimation is determined using a network connection triangulation method.
14. The method of claim 8 , further comprising:
authenticating the client device at the AP through a Wi-Fi Protected Setup (WPS) security protocol, via the processor or network interface device.
15. An information handling system of a wireless network access point operating a location multi-factor authentication security system comprising:
a memory storing a private key and a public key;
an access point network interface device operably connecting the wireless network access point to a network receiving a geographic location estimation from a client device requesting access to the network;
a processor authenticating the client device through a Wi-Fi Protected Setup (WPS) security protocol;
the access point network interface device transmitting a random number challenge generated using the private key to the client device if the geographic location estimation is within a preset geographical area;
the access point network interface device receiving a challenge response from the client device;
a processor generating a challenge response comparator by decrypting the random number challenge using a public key;
the processor generating a boot process authorization instruction if the challenge response matches the challenge response comparator; and
the access point network interface device transmitting the boot process authorization instruction to the client device to permit access to the client device operating system if the challenge response matches the challenge response comparator.
16. The information handling system of claim 15 , further comprising:
the access point network interface device disallowing communication between the network and the client device if the geographical location estimation is not within the preset geographical area.
17. The information handling system of claim 15 , further comprising:
the access point network interface device transmitting a boot up abort instruction to the client device if the geographical location estimation is not within the preset geographical area.
18. The information handling system of claim 15 , further comprising:
the access point network interface device transmitting a boot up abort instruction to the client device if the challenge response does not match the challenge response comparator.
19. The information handling system of claim 15 , further comprising:
the access point network interface device receiving the public key and the private key transmitted from a router within a local network that includes the AP.
20. The information handling system of claim 15 , wherein the AP beacon frame identifies the nearby AP by a MAC address known to be associated with the nearby AP.