Group isolation in wireless networks

• US 10,447,542 B2
• Filed: 07/05/2017
• Issued: 10/15/2019
• Est. Priority Date: 06/24/2014
• Status: Active Grant

• Current Assignee: Ruckus IP Holdings LLC
• Original Assignee: ARRIS Enterprises LLC (CommScope Holding Company, Inc.)
• Inventors: Stiff, David
• Primary Examiner(s): Phan, Tri H
• Application Number:
  US15/642,233
• Publication Number:
  US 20180152350A1
• Time in Patent Office: 832 Days
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/71 Hardware identity
• CPC Class Codes: H04W 12/76 Group identity
• CPC Class Codes: H04W 4/08 User group management
• CPC Class Codes: H04W 88/08 Access point devices
• CPC Class Codes: H04W 88/12 Access point controller devices

Abstract

Methods and systems here may be used for managing a wireless network including associating a first and second wireless access device to an access point (AP), assigning the first and second wireless access device to respective first and second isolation groups, providing local communication via the AP within the isolation group, and prohibiting local communication via the AP between the first and second isolation groups.

Claims

1. A method for managing a wireless network, comprising:

by at least one access point (AP) in communication with a network and a first wireless device, second wireless device, and third wireless device,

aggregating the first and second wireless device into an isolation group;

by the at least one AP, assigning a specific permission set to the isolation group;

by the at least one AP, allowing direct local communication to the first wireless device and second wireless device in the isolation group by routing communication between the first wireless device and the second wireless device by the at least one AP locally; and

by the at least one AP, routing communication of the third wireless device, not assigned to the isolation group, through the AP and the network.

2. The method of claim 1, wherein the at least one AP uses a single service set identification (SSID) and single virtual local area network (VLAN).

3. The method of claim 1, wherein the isolation group shares a dynamic pre-shared key.

4. The method of claim 1, wherein the isolation group is identified in an identifier list stored in a lightweight directory access protocol server (LDAP).

5. The method of claim 1, further comprising an isolation group identifier that is a list of media access control (MAC) addresses.

6. The method of claim 1, further comprising an isolation group identifier that is obtained via a third party website.

7. The method of claim 1, further comprising an authentication, authorization and accounting (AAA) server in communication with the network, wherein the isolation group is defined at the AAA server.

8. A non-transitory computer readable medium having computer-executable instructions thereon for a method for managing a wireless network, the method comprising:

by at least one access point (AP) in communication with a network and a first wireless device, second wireless device, and third wireless device,

aggregating the first and second wireless device into an isolation group;

by the at least one AP, assigning a specific permission set to the isolation group;

by the at least one AP, allowing direct local communication to the first wireless device and second wireless device in the isolation group by routing communication between the first wireless device and the second wireless device by the at least one AP locally; and

by the at least one AP, routing communication of the third wireless device, not assigned to the isolation group, through the AP and the network.

9. The non-transitory computer readable medium of claim 8, wherein the first wireless device is assigned to the isolation group using an access control list.

10. The non-transitory computer readable medium of claim 9, wherein the access control list uses at least one of a single service set identification (SSID) and a single virtual local area network (VLAN).

11. The non-transitory computer readable medium of claim 9, wherein the access control list uses username and password credentials.

12. The non-transitory computer readable medium of claim 9, wherein the access control list uses third-party website credentials.

13. The non-transitory computer readable medium of claim 9, wherein the access control list is created at a controller and sent to the at least one AP.

14. The non-transitory computer readable medium of claim 9, wherein the access control list uses at least one of a pre-shared key and a dynamic pre-shared key.

15. A system for managing a wireless network, comprising:

an access point (AP) in communication with a network and a first wireless device, second wireless device, and third wireless device, the AP configured to,

aggregate the first and second wireless device into an isolation group;

the at least one AP, further configured to, assign a specific permission set to the isolation group;

by the at least one AP, further configured to, allow direct local communication to the first wireless device and second wireless device in the isolation group by routing communication between the first wireless device and the second wireless device by the at least one AP locally; and

by the at least one AP, further configured to, route communication of the third wireless device, not assigned to the isolation group, through the AP and the network.

16. The system of claim 15, wherein the AP is further configured to, aggregate the third wireless device and a fourth wireless device in a second isolation group;

assign a different permission set to the second isolation group;

allow direct local communication between the third wireless device and the fourth wireless device by the AP locally.

17. The system of claim 15, wherein the at least one AP uses a single service set identification (SSID) and single virtual local area network (VLAN).

18. The system of claim 15, wherein the first wireless device and the second wireless device are assigned to the isolation group using an access control list.

19. The system of claim 18 wherein the access control list uses at least one of, username and password credentials, third-party website credentials, and controller created list.