Wireless network steering

• US 10,440,031 B2
• Filed: 07/21/2017
• Issued: 10/08/2019
• Est. Priority Date: 07/21/2017
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Pallus, Derrick, Maassmann, Eric, Barber, Simon
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): Chao, Michael W
• Application Number:
  US15/656,184
• Publication Number:
  US 20190028482A1
• Time in Patent Office: 809 Days
• Field of Search: None
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/75 Indicating network or usage conditions on the user display
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/69 Identity-dependent
• CPC Class Codes: H04W 4/21 for social networking applications
• CPC Class Codes: H04W 48/00 Access restriction access security to prevent unauthorised access H04W12/08; Network selection; Access point selection
• CPC Class Codes: H04W 48/02 Access restriction performed under specific conditions
• CPC Class Codes: H04W 48/14 using user query or user detection
• CPC Class Codes: H04W 48/16 Discovering, processing access restriction or access information
• CPC Class Codes: H04W 48/18 Selecting a network or a communication service
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/10 adapted for operation in multiple networks, e.g. multi-mode access points

Abstract

Systems, methods, and computer-readable media for steering authorized wireless clients to preferred or restricted wireless networks. In some examples, an access point associated with a preferred wireless network and a non-preferred wireless network can receive one or more probe requests from a wireless client. The access point can withhold a response to the one or more probe requests from the wireless client until a probe response triggering event is detected. In response to detecting the probe response triggering event, the access point can steer the wireless client towards the wireless network by sending, to the wireless client, a first probe response associated with the preferred wireless network and withholding a second probe response associated with the non-preferred wireless network.

Claims

1. A system comprising:

one or more processors; and

at least one computer-readable storage medium having stored therein instructions which, when executed by the one or more processors, cause the system to;

receive one or more probe requests sent from a wireless client, the one or more probe requests requesting wireless network information from the system, the system being associated with a preferred wireless network and a non-preferred wireless network;

withhold a first probe response associated with the preferred wireless network until a first predetermined number of probe requests are received from the wireless client and a second probe response associated with the non-preferred wireless network until a second predetermined number of probe requests are received from the wireless client, the second predetermined number being greater than the first predetermined number; and

in response to receiving the first predetermined number of probe requests from the wireless client, send the first probe response associated with the preferred wireless network to the wireless client;

receive the second predetermined number of probe requests from the wireless client; and

in response to receiving the second predetermined number of probe requests from the wireless client, send the second probe response associated with the non-preferred wireless network;

determine that the wireless client is authorized to access the preferred wireless network;

detect a request by the wireless client to access the non-preferred wireless network; and

in response to detecting the request by the wireless client to access the non-preferred wireless network and determining that the wireless client is authorized to access the preferred wireless network, intercept the request by the wireless client to access the non-preferred wireless network and redirect the wireless client to a splash page comprising a notification indicating that the wireless client has a network configuration problem;

wherein receiving the second predetermined number of probe requests after the first predetermined number of probe requests reflects a failure of the wireless client to connect with the preferred wireless network such that the system continues to receive probe requests after sending the first probe response.

2. The system of claim 1, wherein withholding the first probe response and the second probe response comprises:

prior to responding to the one or more probe requests from the wireless client, determine whether the wireless client is authorized to access the preferred wireless network via one or more authorization policies.

3. The system of claim 2, the at least one computer-readable storage medium storing additional instructions which, when executed by the one or more processors, cause the system to:

determine that that wireless client is authorized to access the preferred network via the one or more authorization policies; and

in response to determining that the wireless client is authorized to access the preferred network, send to the wireless client a signal advertising one or more wireless networks associated with the system, the one or more wireless networks comprising the preferred wireless network and excluding the non-preferred wireless network.

4. The system of claim 2, the at least one computer-readable storage medium storing additional instructions which, when executed by the one or more processors, cause the system to:

determine that that wireless client is not authorized to access the preferred network via the one or more authorization policies; and

in response to determining that the wireless client is not authorized to access the preferred network, sending to the wireless client a signal advertising one or more wireless networks associated with the system, the one or more wireless networks comprising the non-preferred wireless network and excluding the preferred wireless network.

5. The system of claim 2, the at least one computer-readable storage medium storing additional instructions which, when executed by the one or more processors, cause the system to:

determine that the wireless client has not accessed the preferred wireless network after the second predetermined number of probe requests; and

in response to determining that the wireless client has not accessed the preferred wireless network after the second predetermined number of probe requests, advertise the non-preferred wireless network to the wireless client.

6. The system of claim 1, the at least one computer-readable storage medium storing additional instructions which, when executed by the one or more processors, cause the system to:

determine whether the wireless client is authorized to access the preferred wireless network to yield client-network authorization information;

store the client-network authorization information; and

based on the client-network authorization information, send a notification to one or more nodes associated with the preferred wireless network, the notification indicating whether the wireless client is authorized to access the preferred wireless network.

7. A non-transitory computer-readable storage medium having stored therein instructions which, when executed by one or more processors associated with an access point, cause the access point to perform operations comprising:

receive one or more probe requests from a wireless client requesting wireless network information from the access point, the access point being associated with a preferred wireless network and a non-preferred wireless network;

withhold, from the wireless client, a first probe response associated with the preferred wireless network and a second probe response associated with the non-preferred wireless network;

receive one or more additional probe requests from the wireless client;

when a total number of probe requests received from the wireless client is greater than a first predetermined number of probe requests and less than a second predetermined number of probe requests;

send the first probe response associated with the preferred wireless network to the wireless client; and

continue to withhold from the wireless client the second probe response associated with the non-preferred wireless network; and

in response to the total number of probe requests received from the wireless client is greater than the second predetermined number of probe requests, send the second probe response associated with the non-preferred wireless network to the wireless client;

determine that the wireless client is authorized to access the preferred wireless network;

detect a request by the wireless client to access the non-preferred wireless network; and

in response to detecting the request by the wireless client to access the non-preferred wireless network and determining that the wireless client is authorized to access the preferred wireless network, intercept the request by the wireless client to access the non-preferred wireless network and redirect the wireless client to a splash page comprising a notification indicating that the wireless client has a network configuration problem;

wherein receiving more than the second predetermined number of probe requests after receipt of the first predetermined number of probe requests reflects a failure of the wireless client to connect with the preferred wireless network such that the access point continues to receive probe requests after sending the first probe response.

8. The non-transitory computer-readable storage medium of claim 7, wherein withholding the first probe response and the second probe response comprises:

prior to sending the first probe response and the second probe response to the wireless client, determine whether the wireless client is authorized to access the preferred wireless network via one or more authorization policies; and

advertise to the wireless client one of the preferred wireless network or the non-preferred wireless network based on whether the wireless client is authorized to access the preferred wireless network via one or more authorization policies.

9. The medium of claim 8, the operations further comprising:

determine that that wireless client is not authorized to access the preferred network via the one or more authorization policies; and

in response to determining that the wireless client is not authorized to access the preferred network, sending to the wireless client a signal advertising one or more wireless networks associated with the access point, the one or more wireless networks comprising the non-preferred wireless network and excluding the preferred wireless network.

10. The medium of claim 8, the operations further comprising:

determine that the wireless client has not accessed the preferred wireless network after the second predetermined number of probe requests; and

in response to determining that the wireless client has not accessed the preferred wireless network after the second predetermined number of probe requests, advertise the non-preferred wireless network to the wireless client.

11. The medium of claim 8, the operations further comprising:

determine whether the wireless client is authorized to access the preferred wireless network to yield client-network authorization information;

store the client-network authorization information; and

based on the client-network authorization information, send a notification to one or more nodes associated with the preferred wireless network, the notification indicating whether the wireless client is authorized to access the preferred wireless network.

12. A method comprising:

receiving one or more probe requests sent from a wireless client, the one or more probe requests requesting wireless network information from a system, the system being associated with a preferred wireless network and a non-preferred wireless network;

withholding a first probe response associated with the preferred wireless network until a first predetermined number of probe requests are received from the wireless client and a second probe response associated with the non-preferred wireless network until a second predetermined number of probe requests are received from the wireless client, the second predetermined number being greater than the first predetermined number; and

in response to receiving the first predetermined number of probe requests from the wireless client, sending the first probe response associated with the preferred wireless network to the wireless client;

receiving the second predetermined number of probe requests from the wireless client; and

in response to receiving the second predetermined number of probe requests from the wireless client, sending the second probe response associated with the non-preferred wireless network;

determining that the wireless client is authorized to access the preferred wireless network;

detecting a request by the wireless client to access the non-preferred wireless network; and

in response to detecting the request by the wireless client to access the non-preferred wireless network and determining that the wireless client is authorized to access the preferred wireless network, intercepting the request by the wireless client to access the non-preferred wireless network and redirect the wireless client to a splash page comprising a notification indicating that the wireless client has a network configuration problem;

wherein receiving the second predetermined number of probe requests after the first predetermined number of probe requests reflects a failure of the wireless client to connect with the preferred wireless network such that the system continues to receive probe requests after sending the first probe response.

13. The method of claim 12, wherein withholding the first probe response and the second probe response comprises:

prior to responding to the one or more probe requests from the wireless client, determining whether the wireless client is authorized to access the preferred wireless network via one or more authorization policies.

14. The method of claim 13, further comprising:

in response to a positive resulting of the determining that the wireless client is authorized to access the preferred network, sending to the wireless client a signal advertising one or more wireless networks associated with the system, the one or more wireless networks comprising the preferred wireless network and excluding the non-preferred wireless network.

15. The method of claim 13, further comprising:

in response to a negative result of the determining, sending to the wireless client a signal advertising one or more wireless networks associated with the system, the one or more wireless networks comprising the non-preferred wireless network and excluding the preferred wireless network.

16. The method of claim 13, further comprising:

in response to determining that the wireless client has not accessed the preferred wireless network after the second predetermined number of probe requests, advertise the non-preferred wireless network to the wireless client.

17. The method of claim 13, further comprising:

determining whether the wireless client is authorized to access the preferred wireless network to yield client-network authorization information;

storing the client-network authorization information; and

based on the client-network authorization information, sending a notification to one or more nodes associated with the preferred wireless network, the notification indicating whether the wireless client is authorized to access the preferred wireless network.