User-based network onboarding

• US 10,003,615 B2
• Filed: 04/05/2017
• Issued: 06/19/2018
• Est. Priority Date: 12/13/2013
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: Aerohive Networks Incorporated (Extreme Networks, Inc.)
• Inventors: Lin, Mu, Zou, Xu, Hanay, John William
• Primary Examiner(s): Rahman, Shawnchoy
• Application Number:
  US15/480,273
• Publication Number:
  US 20170208101A1
• Time in Patent Office: 440 Days
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol

Abstract

A request related to an access to a network by a first user device may be received. The user device may be included in a plurality of user devices associated with a first first-level security profile assigned to the user. An application extension to an application executing on the first user device may be accessed in response to the request related to the access. A network connectivity file may be provided to the application extension. The network connectivity file may include network configuration information for the first user device. The network configuration information may be associated with a first second-level security profile assigned to the first user device. Instructions to configure the first user device to access the network based at least in part on the network configuration information in the network connectivity file may be provided.

Claims

1. A method comprising:

receiving user information of a user requesting access to a network with a first user device of the user;

assigning a first-level security profile to the user based on the user information of the user;

assigning a first second-level security profile including first network configuration information to the first user device of the user;

configuring the first user device to access the network using the first network configuration information included in the first second-level security profile assigned to the first user device;

requesting a listing of user devices associated with the first-level security profile, the listing including a second user device of the user associated with the first-level security profile assigned to the user as part of user-based device onboarding;

presenting the listing of the user devices associated with the first-level security profile to the user;

selecting the second user device from the listing of the user devices based on input received from the user in response to presenting the listing of the user devices to the user;

assigning a second second-level security profile including second network configuration information to the second user device;

configuring the second user device to access the network using the second network configuration information included in the second second-level security profile assigned to the second user device.

2. The method of claim 1, wherein the first-level security profile includes a list of devices associated with the user and the second user device is selected from the list of devices.

3. The method of claim 1, wherein the second user device is a browser-based device the method further comprising:

presenting a web portal to the user on the second user device according to the second second-level security profile;

granting the user access to the network through the second user device if the user agrees to terms and services of accessing the network through the web portal.

4. The method of claim 1, wherein the first second-level security profile specifies the first user device has to be in compliance with a mobile device management policy of the network before the first user device is allowed to access the network.

5. The method of claim 1, further comprising:

redirecting the first user device to a web portal before receiving the user information as part of the user requesting access to the network with the first user device;

receiving, through the web portal, the user information, at least in part, manually input into the web portal by the user.

6. The method of claim 1, further comprising:

requesting a listing of user devices associated with the first-level security profile, the listing including the second user device, wherein the listing of the user devices also includes one or more user devices previously onboarded to access the network.

7. The method of claim 1,

wherein the listing of the user devices also includes a third user device associated with the user and onboarded to access the network, the method further comprising

offboarding the third user device from accessing the network based on input received from the user in response to presenting the listing of the user devices to the user.

8. The method of claim 1, further comprising:

determining whether a mobile device management policy of the network has changed to an updated mobile device management policy;

if it is determined the mobile device management policy of the network has changed to the updated mobile device management policy;

determining whether the first user device is in compliance with the updated mobile device management policy;

re-configuring the first user device to access the network using the first network configuration information in compliance with the updated mobile device management policy.

9. The method of claim 1, wherein the first second-level security profile and the second second-level security profile are the same second-level security profile.

10. A system comprising:

a network access system management engine configured to receive user information of a user requesting access to a network with a first user device of the user;

a first level engine configured to assign a first-level security profile to the user based on the user information of the user;

a second level engine configured to assign a first second-level security profile including first network configuration information to the first user device of the user;

a device network configuration engine implemented to configure the first user device to access the network using the first network configuration information included in the first second-level security profile assigned to the first user device;

a web portal request engine configured to request a listing of user devices associated with the first-level security profile, the listing including a second user device of the user associated with the first-level security profile assigned to the user as part of user-based device onboarding;

a device listing engine configured to present the listing of the user devices associated with the first-level security profile to the user;

a device selection engine configured to select the second user device from the listing of the user devices based on input received from the user in response to presenting the listing of the user devices to the user;

wherein the second level engine is further configured to assign a second second-level security profile including second network configuration information to the second user device;

wherein the device network configuration engine is further implemented to configure the second user device to access the network using the second network configuration information included in the second second-level security profile assigned to the second user device.

11. The system of claim 10, wherein the first-level security profile includes a list of devices associated with the user and the second user device is selected from the list of devices.

12. The system of claim 10, wherein the second user device is a browser-based device and the network access system management engine is further configured to:

present a web portal to the user on the second user device according to the second second-level security profile;

grant the user access to the network through the second user device if the user agrees to terms and services of accessing the network through the web portal.

13. The system of claim 10, wherein the first second-level security profile specifies the first user device has to be in compliance with a mobile device management policy of the network before the first user device is allowed to access the network.

14. The system of claim 10, wherein the network access system management engine is further configured to:

redirect the first user device to a web portal before receiving the user information as part of the user requesting access to the network with the first user device;

receive, through the web portal, the user information, at least in part, manually input into the web portal by the user.

15. The system of claim 10, further comprising:

a web portal request engine configured to request a listing of user devices associated with the first-level security profile, the listing including the second user device wherein the listing of the user devices also includes one or more user devices previously onboarded to access the network.

16. The system of claim 10,

wherein the listing of the user devices also includes a third user device associated with the user and onboarded to access the network;

and

the network access system management engine is further configured to offboard the third user device from accessing the network based on input received from the user in response to presenting the listing of the user devices to the user.

17. The system of claim 10, further comprising:

a mobile device management system configured to determine whether a mobile device management policy of the network has changed to an updated mobile device management policy;

wherein the device network configuration engine is further implemented to;

determine whether the first user device is in compliance with the updated mobile device management policy, if it is determined the mobile device management policy of the network has changed to the updated mobile device management policy;

re-configure the first user device to access the network using the first network configuration information in compliance with the updated mobile device management policy.