User-based network onboarding

• US 10,320,847 B2
• Filed: 05/11/2018
• Issued: 06/11/2019
• Est. Priority Date: 12/13/2013
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: Aerohive Networks Incorporated (Extreme Networks, Inc.)
• Inventors: Lin, Mu, Zou, Xu, Hanay, John
• Primary Examiner(s): Rahman, Shawnchoy
• Application Number:
  US15/977,310
• Publication Number:
  US 20180262535A1
• Time in Patent Office: 396 Days
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol

Abstract

A request related to an access to a network by a first user device may be received. The user device may be included in a plurality of user devices associated with a first first-level security profile assigned to the user. An application extension to an application executing on the first user device may be accessed in response to the request related to the access. A network connectivity file may be provided to the application extension. The network connectivity file may include network configuration information for the first user device. The network configuration information may be associated with a first second-level security profile assigned to the first user device. Instructions to configure the first user device to access the network based at least in part on the network configuration information in the network connectivity file may be provided.

Claims

1. A method comprising:

receiving user information of a user requesting access to a network with a first user device of the user;

assigning a first-level security profile to the user based on the user information of the user;

assigning a second-level security profile including first network configuration information to the first user device of the user;

providing a browser extension to the first user device and causing the first user device to install the provided browser extension in a web browser of the first user device;

after assigning the second-level security profile to the first user device, providing a network connectivity file containing the first network configuration information to the first user device and causing the first user device to load the network connectivity file into the browser extension installed in the web browser of the first user device;

enabling the first user device to access the network through the web browser using the first network configuration information included in the network connectivity file loaded into the browser extension.

2. The method of claim 1, further comprising receiving, from the first user device, a notification that the network connectivity file has been loaded into the browser extension installed in the web browser of the first user device, wherein the first user device is enabled to access the network through the web browser upon receiving the notification.

3. The method of claim 1, wherein the browser extension installed in the web browser of the first user device comprises a dedicated tab of the web browser.

4. The method of claim 1, wherein the first-level security profile includes a list of devices associated with the user and the first user device is included in the list of devices.

5. The method of claim 1, further comprising:

causing a web portal to be presented to the web browser of the first user device, the web portal including one or more selectable objects to select an ownership status of the first user device;

configuring a degree of network access to the network by the first user device based on the ownership status selected through the web portal.

6. The method of claim 1, further comprising:

causing a web portal to be presented to the web browser of the first user device;

granting the user access to the network through the first user device if the user agrees to terms and services of accessing the network through the web portal.

7. The method of claim 1, wherein the second-level security profile specifies that the first user device has to be in compliance with a mobile device management policy of the network before the first user device is allowed to access the network.

8. The method of claim 1, further comprising:

redirecting the first user device to a web portal before receiving the user information as part of the user requesting access to the network with the first user device;

receiving, through the web portal, the user information, at least in part, manually input into the web portal by the user.

9. The method of claim 1, further comprising:

determining whether a mobile device management policy of the network has changed to an updated mobile device management policy;

if it is determined the mobile device management policy of the network has changed to the updated mobile device management policy;

determining whether the first user device is in compliance with the updated mobile device management policy;

re-configuring the first user device to access the network through the web browser using the first network configuration information included in the network connectivity file loaded into the browser extension in compliance with the updated mobile device management policy.

10. The method of claim 1, further comprising:

requesting a listing of user devices associated with the first-level security profile, the listing including a second user device of the user associated with the first-level security profile assigned to the user as part of user-based device onboarding;

causing the listing of the user devices associated with the first-level security profile to be presented to the user;

selecting the second user device from the listing of the user devices based on input received from the user in response to presenting the listing of the user devices to the user;

assigning a second second-level security profile including second network configuration information to the second user device;

enabling the second user device to access the network using the second network configuration information included in the second second-level security profile assigned to the second user device.

11. A system comprising:

one or more processors;

memory storing instructions, when executed by the one or more processors, configured to cause the one or more processors to perform a computer-implemented method, the computer-implemented method comprising;

receiving user information of a user requesting access to a network with a first user device of the user;

assigning a first-level security profile to the user based on the user information of the user;

assigning a second-level security profile including first network configuration information to the first user device of the user;

providing a browser extension to the first user device and causing the first user device to install the provided browser extension in a web browser of the first user device;

after assigning the second-level security profile to the first user device, providing a network connectivity file containing the first network configuration information to the first user device and causing the first user device to load the network connectivity file into the browser extension installed in the web browser of the first user device;

enabling the first user device to access the network through the web browser using the first network configuration information included in the network connectivity file loaded into the browser extension.

12. The system of claim 11, wherein the computer-implemented method further comprises receiving, from the first user device, a notification that the network connectivity file has been loaded into the browser extension installed in the web browser of the first user device, wherein the first user device is enabled to access the network browser upon receiving the notification.

13. The system of claim 11, wherein the browser extension installed in the web browser of the first user device comprises a dedicated tab of the web browser.

14. The system of claim 11, wherein the first-level security profile includes a list of devices associated with the user and the first user device is included in the list of devices.

15. The system of claim 11, wherein the computer-implemented method further comprises:

causing a web portal to be presented to the web browser of the first user device, the web portal including one or more selectable objects to select an ownership status of the first user device;

configuring a degree of network access to the network by the first user device based on the ownership status selected through the web portal.

16. The system of claim 11, wherein the computer-implemented method further comprises:

causing a web portal to be presented to the web browser of the first user device;

granting the user access to the network through the first user device if the user agrees to terms and services of accessing the network through the web portal.

17. The system of claim 11, wherein the second-level security profile specifies that the first user device has to be in compliance with a mobile device management policy of the network before the first user device is allowed to access the network.

18. The system of claim 11, wherein the computer-implemented method further comprises:

redirecting the first user device to a web portal before receiving the user information as part of the user requesting access to the network with the first user device;

receiving, through the web portal, the user information, at least in part, manually input into the web portal by the user.

19. The system of claim 11, wherein the computer-implemented method further comprises:

determining whether a mobile device management policy of the network has changed to an updated mobile device management policy;

if it is determined the mobile device management policy of the network has changed to the updated mobile device management policy;

determining whether the first user device is in compliance with the updated mobile device management policy;

re-configuring the first user device to access the network through the web browser using the first network configuration information included in the network connectivity file loaded into the browser extension in compliance with the updated mobile device management policy.

20. The system of claim 11, wherein the computer-implemented method further comprises:

requesting a listing of user devices associated with the first-level security profile, the listing including a second user device of the user associated with the first-level security profile assigned to the user as part of user-based device onboarding;

causing the listing of the user devices associated with the first-level security profile to be presented to the user;

selecting the second user device from the listing of the user devices based on input received from the user in response to presenting the listing of the user devices to the user;

assigning a second second-level security profile including second network configuration information to the second user device;

enabling the second user device to access the network using the second network configuration information included in the second second-level security profile assigned to the second user device.