Method and apparatus for balancing wireless access based on centralized information

• US 20060089122A1
• Filed: 10/26/2004
• Published: 04/27/2006
• Est. Priority Date: 10/26/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Stieglitz, Jeremy, Schieber, Ami, Zavalkovsky, Arthur
• Granted Patent: US 7,336,960 B2
• Time in Patent Office: Days
• US Class Current: 455/410
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 48/02 Access restriction performed under specific conditions

Abstract

A method and apparatus for managing and balancing wireless access based on centralized information is provided. A request to provide service to a wireless client is received from a first access node in a plurality of access node. An access policy, applicable to the first access node, is selected from a plurality of stored policies. The stored policies may include a variety of rules, such as how many or which wireless clients may be serviced by an access node. A centralized manager, such as an AAA server, may perform the selection of the access policy. A determination is made as to whether to allow the first access node to provide service to the wireless client based on the selected access policy. A message that instructs the first access node whether to provide or deny service to the wireless client is transmitted to the first access node.

Claims

1. A machine-implemented method, comprising:

receiving, from a first access node in a plurality of access nodes, a request to provide service to a wireless client, wherein each of said plurality of access nodes is configured to provide wireless service to one or more clients;

selecting, from among a plurality of stored policies, a first access policy applicable to said first access node;

determining whether to allow said first access node to provide service to said wireless client based on said first access policy;

upon determining that said first access policy allows said first access node to provide service to said wireless client, transmitting a first message, to said first access node, that instructs said first access node to provide service to said wireless client; and

upon determining that said first access policy does not allow said first access node to provide service to said wireless client, transmitting a second message, to said first access node, that instructs said first access node to deny service to said wireless client.

2. The method of claim 1, further comprising the steps of:

receiving, from a second access node in said plurality of access nodes, a second request to provide service to said wireless client;

selecting, from among said plurality of stored policies, a second access policy applicable to said second access node

determining whether to allow said second access node to provide service to said wireless client based on said second access policy;

upon determining that said second access policy allows said second access node to provide service to said wireless client, transmitting a third message, to said second access node, that instructs said second access node to provide service to said wireless client; and

upon determining that said second access policy does not allow said second access node to provide service to said wireless client, transmitting a fourth message, to said second access node, that instructs said second access node to deny service to said wireless client.

3. The method of claim 1, wherein said first access policy comprises, at least in part, one or more rules about how many wireless clients are able to be serviced by one or more of said plurality of access nodes.

4. The method of claim 1, wherein said first access policy comprises, at least in part, one or more rules about how which wireless clients are able to be serviced by one or more of said plurality of access nodes.

5. The method of claim 1, wherein said first access policy comprises, at least in part, one or more rules about when one or more of a plurality of wireless clients are able to be serviced by one or more of said plurality of access nodes.

6. The method of claim 1, wherein said request comprises client identification data, and wherein said first access policy comprises, at least in part, one or more rules about whether to allow said first access node to provide service to said wireless client based on said client identification data.

7. The method of claim 6, wherein said client identification data identifies either a user of said wireless client, a position associated with said user of said wireless client, or an organizational group associated with said user of said wireless client.

8. The method of claim 1, wherein said first access policy comprises, at least in part, one or more rules about whether to allow said first access node to provide service to said wireless client based on how many other wireless clients are being serviced by a set of access nodes associated with said first access node.

9. The method of claim 1, further comprising the step of:

storing data that identifies one or more access nodes of the plurality of access nodes as belonging to a set of access nodes, wherein membership of said set is based on characteristics of the one or more access nodes.

10. The method of claim 9, wherein said characteristics comprise the physical location of said one or more access nodes.

11. The method of claim 1, wherein said step of selecting said first access policy is performed based on access node identity information comprised in said request, and wherein said access node identity information identifies said first access node.

12. The method of claim 1, wherein said first access policy comprises, at least in part, one or more rules about whether to allow said first access node to provide service to said wireless client based on data describing how much bandwidth is being consumed at said first access node.

13. The method of claim 1, further comprising:

prior to said step of receiving said request, receiving, at each of two or more access nodes of said plurality of access nodes, a pre-authentication message, from said wireless client, that requests to establish a security association between said wireless client and the receiving access node.

14. The method of claim 13, wherein said first access policy comprises, at least in part, one or more rules about which wireless clients are able to be serviced by a set of access nodes of said plurality of access nodes based on a set of pre-authentication messages received by said set of access nodes.

43. An apparatus, comprising:

a network interface that is coupled to the data network for receiving one or more packet flows therefrom;

a processor; and

one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of any of claims 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, or 14.

15. A machine-readable medium carrying one or more sequences of instructions, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of, comprising:

receiving, from a first access node in a plurality of access nodes, a request to provide service to a wireless client, wherein each of said plurality of access nodes is configured to provide wireless service to one or more clients;

selecting, from among a plurality of stored policies, a first access policy applicable to said first access node;

determining whether to allow said first access node to provide service to said wireless client based on said first access policy;

upon determining that said first access policy allows said first access node to provide service to said wireless client, transmitting a first message, to said first access node, that instructs said first access node to provide service to said wireless client; and

upon determining that said first access policy does not allow said first access node to provide service to said wireless client, transmitting a second message, to said first access node, that instructs said first access node to deny service to said wireless client.

16. The machine-readable medium of claim 15, wherein execution of the one or more sequences of instructions by the one or more processors further causes the one or more processors to perform the steps of:

receiving, from a second access node in said plurality of access nodes, a second request to provide service to said wireless client;

selecting, from among said plurality of stored policies, a second access policy applicable to said second access node

determining whether to allow said second access node to provide service to said wireless client based on said second access policy;

upon determining that said second access policy allows said second access node to provide service to said wireless client, transmitting a third message, to said second access node, that instructs said second access node to provide service to said wireless client; and

upon determining that said second access policy does not allow said second access node to provide service to said wireless client, transmitting a fourth message, to said second access node, that instructs said second access node to deny service to said wireless client.

17. The machine-readable medium of claim 15, wherein said first access policy comprises, at least in part, one or more rules about how many wireless clients are able to be serviced by one or more of said plurality of access nodes.

18. The machine-readable medium of claim 15, wherein said first access policy comprises, at least in part, one or more rules about how which wireless clients are able to be serviced by one or more of said plurality of access nodes.

19. The machine-readable medium of claim 15, wherein said first access policy comprises, at least in part, one or more rules about when one or more of a plurality of wireless clients are able to be serviced by one or more of said-plurality of access nodes.

20. The machine-readable medium of claim 15, wherein said request comprises client identification data, and wherein said first access policy comprises, at least in part, one or more rules about whether to allow said first access node to provide service to said wireless client based on said client identification data.

21. The machine-readable medium of claim 20, wherein said client identification data identifies either a user of said wireless client, a position associated with said user of said wireless client, or an organizational group associated with said user of said wireless client.

22. The machine-readable medium of claim 15, wherein said first access policy comprises, at least in part, one or more rules about whether to allow said first access node to provide service to said wireless client based on how many other wireless clients are being serviced by a set of access nodes associated with said first access node.

23. The machine-readable medium of claim 15, wherein execution of the one or more sequences of instructions by the one or more processors further causes the one or more processors to perform the step of:

storing data that identifies one or more access nodes of the plurality of access nodes as belonging to a set of access nodes, wherein membership of said set is based on characteristics of the one or more access nodes.

24. The machine-readable medium of claim 23, wherein said characteristics comprise the physical location of said one or more access nodes.

25. The machine-readable medium of claim 15, wherein said step of selecting said first access policy is performed based on access node identity information comprised in said request, and wherein said access node identity information identifies said first access node.

26. The machine-readable medium of claim 15, wherein said first access policy comprises, at least in part, one or more rules about whether to allow said first access node to provide service to said wireless client based on data describing how much bandwidth is being consumed at said first access node.

27. The machine-readable medium of claim 15, wherein execution of the one or more sequences of instructions by the one or more processors further causes the one or more processors to perform the steps of:

prior to said step of receiving said request, receiving, at each of two or more access nodes of said plurality of access nodes, a pre-authentication message, from said wireless client, that requests to establish a security association between said wireless client and the receiving access node.

28. The machine-readable medium of claim 27, wherein said first access policy comprises, at least in part, one or more rules about which wireless clients are able to be serviced by a set of access nodes of said plurality of access nodes based on a set of pre-authentication messages received by said set of access nodes.

29. An apparatus, comprising:

means for receiving, from a first access node in a plurality of access nodes, a request to provide service to a wireless client, wherein each of said plurality of access nodes is configured to provide wireless service to one or more clients;

means for selecting, from among a plurality of stored policies, a first access policy applicable to said first access node;

means for determining whether to allow said first access node to provide service to said wireless client based on said first access policy;

means for transmitting a first message, to said first access node, that instructs said first access node to provide service to said wireless client upon determining that said first access policy allows said first access node to provide service to said wireless client; and

means for transmitting a second message, to said first access node, that instructs said first access node to deny service to said wireless client upon determining that said first access policy does not allow said first access node to provide service to said wireless client.

30. The apparatus of claim 29, further comprising:

means for receiving, from a second access node in said plurality of access nodes, a second request to provide service to said wireless client;

means for selecting, from among said plurality of stored policies, a second access policy applicable to said second access node

means for determining whether to allow said second access node to provide service to said wireless client based on said second access policy;

means for transmitting a third message, to said second access node, that instructs said second access node to provide service to said wireless client upon determining that said second access policy allows said second access node to provide service to said wireless client; and

means for transmitting a fourth message, to said second access node, that instructs said second access node to deny service to said wireless client upon determining that said second access policy does not allow said second access node to provide service to said wireless client.

31. The apparatus of claim 29, wherein said first access policy comprises, at least in part, one or more rules about how many wireless clients are able to be serviced by one or more of said plurality of access nodes.

32. The apparatus of claim 29, wherein said first access policy comprises, at least in part, one or more rules about how which wireless clients are able to be serviced by one or more of said plurality of access nodes.

33. The apparatus of claim 29, wherein said first access policy comprises, at least in part, one or more rules about when one or more of a plurality of wireless clients are able to be serviced by one or more of said plurality of access nodes.

34. The apparatus of claim 29, wherein said request comprises client identification data, and wherein said first access policy comprises, at least in part, one or more rules about whether to allow said first access node to provide service to said wireless client based on said client identification data.

35. The apparatus of claim 34, wherein said client identification data identifies either a user-of said wireless client, a position associated with said user of said wireless client, or an organizational group associated with said user of said wireless client.

36. The apparatus of claim 29, wherein said first access policy comprises, at least in part, one or more rules about whether to allow said first access node to provide service to said wireless client based on how many other wireless clients are being serviced by a set of access nodes associated with said first access node.

37. The apparatus of claim 29, further comprising:

means for storing data that identifies one or more access nodes of the plurality of access nodes as belonging to a set of access nodes, wherein membership of said set is based on characteristics of the one or more access nodes.

38. The apparatus of claim 37, wherein said characteristics comprise the physical location of said one or more access nodes.

39. The apparatus of claim 29, wherein said means for selecting said first access policy selects said first access policy based on access node identity information comprised in said request, and wherein said access node identity information identifies said first access node.

40. The apparatus of claim 29, wherein said first access policy comprises, at least in part, one or more rules about whether to allow said first access node to provide service to said wireless client based on data describing how much bandwidth is being consumed at said first access node.

41. The apparatus of claim 29, further comprising:

means for receiving, at each of two or more access nodes of said plurality of access nodes, a pre-authentication message, from said wireless client, that requests to establish a security association between said wireless client and the receiving access node.

42. The apparatus of claim 41, wherein said first access policy comprises, at least in part, one or more rules about which wireless clients are able to be serviced by a set of access nodes of said plurality of access nodes based on a set of pre-authentication messages received by said set of access nodes.