Managed device scatternet administration

• US 10,171,434 B2
• Filed: 08/24/2016
• Issued: 01/01/2019
• Est. Priority Date: 04/14/2016
• Status: Active Grant

• Current Assignee: Omnissa, LLC
• Original Assignee: AirWatch LLC (Broadcom, Inc.)
• Inventors: Laxminarayan, Akshay, Panchapakesan, Ramani
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US15/245,191
• Publication Number:
  US 20170302638A1
• Time in Patent Office: 860 Days
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
• CPC Class Codes: H04W 48/00 Access restriction access security to prevent unauthorised access H04W12/08; Network selection; Access point selection
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

Managed device scatternet administration is described herein. In one example, to form a scatternet of managed devices, a network entry request including a unique device identifier and a public key is received from a client device. The public key is validated and the structure of the scatternet is examined to find an opening for the client device. After validation of the public key, network access data and a session key are encrypted by the public key and forwarded to the client device. The client device can use the network access data to find a network sublayer having the opening in the scatternet. At the same time, client admission data and the session key can also be sent to a sublayer propagator device of the network sublayer. After the client device enters the scatternet, management configuration data can be dispatched to it for device management.

Claims

1. A non-transitory computer-readable medium embodying program code executable in at least one computing device, the program code being configured to cause the at least one computing device to at least:

receive a network entry request from a client device;

examine a structure of a network to identify an opening for the client device in a network sublayer of the network in response to the network entry request;

transmit network access data to the client device, the network access data comprising a network address of a sublayer propagator device for the network sublayer having the opening;

transmit client admission data to the sublayer propagator device, the client admission data comprising a unique identifier for the client device and a session key for communications with the client device; and

dispatch configuration data for the client device to the sublayer propagator device.

2. The non-transitory computer-readable medium according to claim 1, wherein the network entry request from the client device is received through a first physical layer communications channel in the network, and the client admission data is forwarded to the sublayer propagator device through a second physical layer communications channel in the network.

3. The non-transitory computer-readable medium according to claim 1, the program code being further configured to cause the at least one computing device to at least identify the opening for the client device in the network among a plurality of openings in a plurality of network sublayers of the network based on a network layout factor.

4. The non-transitory computer-readable medium according to claim 3, wherein the network layout factor includes at least one of a network signal integrity factor or a network depth factor.

5. The non-transitory computer-readable medium according to claim 1, wherein:

the network entry request includes a device identifier and a public key associated with the client device; and

the program code is further configured to cause the at least one computing device to at least;

query a certificate authority to obtain a verification result for the public key;

encrypt at least one of the network access data or the session key into encrypted network session data using the public key based on the verification result; and

forward the encrypted network session data to the client device.

6. The non-transitory computer-readable medium according to claim 1, the program code being further configured to cause the at least one computing device to at least:

receive, from a second sublayer propagator device, a second network entry request from a second client device;

examine the network to identify a second opening for the second client device in a second network sublayer of the network; and

forward second client admission data to the second sublayer propagator device, the second client admission data comprising a second unique identifier for the second client device and a second session key for communications with the second client device.

7. The non-transitory computer-readable medium according to claim 1, the program code being further configured to cause the at least one computing device to at least:

receive a network exit request from a second client device in a second network sublayer of the network, the second client device operating as a second sublayer propagator device for the second network sublayer;

examine the second network sublayer to determine a topology reorganization for the second network sublayer in response to the network exit request;

dispatch reorganized topology plan data for the topology reorganization to a third client device in the second network sublayer; and

instruct the third client device to operate as the second sublayer propagator device for the second network sublayer in accordance with the topology reorganization.

8. The non-transitory computer-readable medium according to claim 1, the program code being further configured to cause the at least one computing device to at least:

determine that a second client device is no longer communicatively coupled in the network, the second client device being configured as a second sublayer propagator device for a second network sublayer of the network;

in response to the second client device being no longer communicatively coupled in the network, examine the second network sublayer to determine a topology reorganization for the second network sublayer;

dispatch reorganized topology plan data for the topology reorganization to a third client device in the second network sublayer; and

instruct the third client device to operate as the second sublayer propagator device for the second network sublayer in accordance with the topology reorganization.

9. A method, comprising:

establishing, by at least one computing device, a network for managed device administration of a plurality of client devices, the network comprising a scatternet of the plurality of client devices;

receiving, by at least one computing device, a network exit request from a client device among the plurality of client devices, the client device operating as a sublayer propagator device for a network sublayer of the network;

examining, by at least one computing device, the network sublayer to determine a topology reorganization for the network sublayer in response to the network exit request;

dispatching, by at least one computing device, reorganized topology plan data for the topology reorganization to a second client device in the network sublayer; and

instructing, by the at least one computing device, the second client device to operate as the sublayer propagator device for the network sublayer in accordance with the topology reorganization.

10. The method of claim 9, wherein the network sublayer comprises a piconet in the scatternet.

11. The method of claim 9, wherein the network exit request from the client device is received through a first physical layer communications channel in the network, and the reorganized topology plan data is forwarded to second client device through a second physical layer communications channel in the network.

12. The method of claim 9, further comprising:

receiving, by the at least one computing device, a network entry request from a third client device, the network entry request comprising a unique device identifier and a public key;

querying, by the at least one computing device, a certificate authority to obtain a verification result for the public key;

examining, by the at least one computing device, a structure of the network to identify an opening for the third client device in the network based on the verification result;

encrypting, by the at least one computing device, at least one of network access data or a session key into encrypted network session data using the public key based on the verification result; and

forwarding, by the at least one computing device, the encrypted network session data to the third client device over the network.

13. The method of claim 12, further comprising transmitting, by the at least one computing device, client admission data to the second client device operating as the sublayer propagator device for the network sublayer, the client admission data comprising a unique identifier for the third client device and the session key for communications with the third client device.

14. The method of claim 13, further comprising identifying, by the at least one computing device, the opening for the third client device in the network among a plurality of openings in a plurality of network sublayers of the network based on a network layout factor.

15. A method, comprising:

querying, by at least one computing device, a certificate authority to obtain a verification result for a public key of a client device requesting entry to a network;

based on a verification result for the public key, examining, by the at least one computing device, a structure of a network to identify an opening for a client device in the network;

transmitting, by the at least one computing device, client admission data to a sublayer propagator device of a network sublayer having the opening in the network, the client admission data comprising a unique identifier for the client device and a session key for communications with the client device;

transmitting, by the at least one computing device, network access data to the client device, the network access data comprising a network address of the sublayer propagator device and the session key; and

dispatching, by the at least one computing device, configuration data for the client device to the sublayer propagator device.

16. The method of claim 15, further comprising identifying, by the at least one computing device, the opening for the client device in the network among a plurality of openings in a plurality of network sublayers of the network based on a network layout factor.

17. The method of claim 15, wherein the network comprises a scatternet and the network sublayer comprises a piconet in the scatternet.

18. The method of claim 15, further comprising:

receiving, by the at least one computing device, a network entry request from a second client device;

examining, by the at least one computing device, the network to identify a second opening for the second client device in a second network sublayer of the network; and

forwarding, by the at least one computing device, second client admission data to a second sublayer propagator device, the second client admission data comprising a second unique identifier for the second client device and a second session key for communications with the second client device.

19. The method of claim 15, further comprising:

receiving, by the at least one computing device, a network exit request from a second client device in a second network sublayer of the network, the second client device operating as a second sublayer propagator device for the second network sublayer;

examining, by the at least one computing device, the second network sublayer to determine a topology reorganization for the second network sublayer in response to the network exit request; and

dispatching, by the at least one computing device, reorganized topology plan data for the topology reorganization to a third client device in the second network sublayer.

20. The method of claim 15, further comprising:

determining, by the at least one computing device, that a second client device is no longer communicatively coupled in the network, the second client device being configured as a second sublayer propagator device for a second network sublayer of the network;

in response to the second client device being no longer communicatively coupled in the network, examining, by the at least one computing device, the second network sublayer to determine a topology reorganization for the second network sublayer; and

dispatching, by the at least one computing device, reorganized topology plan data for the topology reorganization to a third client device in the second network sublayer.