Controlling wireless access to a network

• US 20060153122A1
• Filed: 01/13/2005
• Published: 07/13/2006
• Est. Priority Date: 01/13/2005
• Status: Active Grant

• Current Assignee: CommScope Technologies, LLC (CommScope Holding Company, Inc.)
• Original Assignee: 2Wire, Inc. (CommScope Holding Company, Inc.)
• Inventors: Hinman, Brian L., Romano, Pasquale, Bednarz, Philip
• Granted Patent: US 7,499,438 B2
• Time in Patent Office: Days
• US Class Current: 370/328
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/71 Hardware identity
• CPC Class Codes: H04W 72/51 based on terminal or device properties
• CPC Class Codes: H04W 80/00 Wireless network protocols or protocol adaptations to wireless operation
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

Various methods and apparatus are described in for a wireless access point. The wireless access point allows access to a wireless LAN that has two or more service set identifiers (SSIDs). At least one of the SSIDs is associated with a public wireless LAN. The wireless access point implements a segmentation policy that 1) provides unimpeded access to a Wide Area network through the public wireless LAN based on a first type of application or a first type of device detected by the wireless access point and 2) restricts access to the Wide Area network through the public wireless LAN by requiring an authorization check to access the Wide Area network based on detecting a second type of application.

Claims

1. A method, comprising:

establishing communication with a wireless device configured with a network identifier, the wireless device comprising a class of wireless device having a class of wireless application;

detecting at least one of the class of wireless device and the class of wireless application;

classifying the class of wireless device or the class of wireless application as a first class of wireless device or wireless application or a second class of wireless device or wireless application; and

providing at least a first class of access to a network to the first class of wireless device or wireless application and a second class of network access to the second class of wireless device or wireless application.

2. The method of claim 1, wherein providing the first class of network access comprises providing access to a wide area network (WAN), and wherein providing the second class of network access comprises restricting access to the WAN.

3. The method of claim 1, wherein providing the first class of network access comprises providing access to a plurality of resources on a LAN, and wherein providing the second class of network access comprises restricting access to the plurality of resources on the LAN.

4. The method of claim 1, wherein the first class of wireless device or application is a narrowband device or application.

5. The method of claim 4, wherein the narrowband device is one of a personal digital assistant and a cellular telephone device.

6. The method of claim 4, wherein the narrowband application is one of an email application and a voice application.

7. The method of claim 1, wherein detecting the first class of wireless device comprises reading one of a media access control (MAC) address of the wireless device and an electronic serial number of the wireless device.

8. The method of claim 1, wherein detecting the first class of wireless application comprises detecting the data protocol of the wireless application.

9. The method of claim 8, wherein the data protocol is voice over IP (VoIP) protocol.

10. The method of claim 1 wherein detecting the first class of wireless application comprises matching a destination IP address requested by the wireless application with a list of service providers.

11. The method of claim 10, further comprising:

providing access to the destination IP address by implementing an IP tunneling protocol to establish a virtual private network (VPN) connection with the destination IP address.

12. The method of claim 1, wherein the LAN is a wireless LAN.

13. The method of claim 1, wherein the LAN is a wired LAN.

14. The method of claim 1, wherein the LAN is a virtual subnet of the LAN.

15. The method of claim 1, further comprising:

verifying the identity of the wireless device by

reading a hardware identifier of the wireless device;

deriving a password from the hardware identifier; and

obtaining remote authentication of the password.

16. The method of claim 15, wherein the hardware identifier is at least one of a MAC address of the wireless device and an ESN of the wireless device.

17. The method of claim 2, wherein restricting access to the WAN comprises at least one of unconditional blocking, requiring a password and requiring an electronic payment.

18. An apparatus to perform the operations stated in claim 1.

19. A machine-readable medium having instructions stored thereon, which when executed by the machine, cause the machine to perform the following operations, comprising:

establishing communication with a wireless device configured with a network identifier, the wireless device comprising a class of wireless device having a class of wireless application;

detecting at least one of the class of wireless device and the class of wireless application;

classifying the class of wireless device or the class of wireless application as a first class of wireless device or wireless application or a second class of wireless device or wireless application; and

providing at least a first class of access to a network to the first class of wireless device or wireless application and a second class of network access to the second class of wireless device or wireless application.

20. The article of manufacture of claim 19, wherein the instructions cause the machine to perform the following operations, comprising:

broadcasting a first SSID associated with a public LAN; and

broadcasting a second SSID associated with a private LAN.

21. An apparatus, comprising:

a wireless access point allowing access to a wireless LAN that has two or more service set identifiers (SSIDs), at least one of the SSIDs being associated with a public wireless LAN, wherein the wireless access point implements a segmentation policy that

     1) provides unimpeded access to a Wide Area network through the public wireless LAN based on a first type of application or a first type of device detected by the wireless access point and

     2) restricts access to the Wide Area network through the public wireless LAN by requiring an authorization check to access the Wide Area network based on detecting a second type of application.

22. The apparatus of claim 21, wherein the second SSID is associated with a private LAN.

23. The apparatus of claim 21, wherein the first type of device is a wireless device limited to low bandwidth and identifiable at least one of the following its 1) Electronic Serial Number, 2) MAC address, or 3) Destination IP address.

24. The apparatus of claim 21, wherein the wireless device capable of low bandwidth is a cell phone.

25. The apparatus of claim 21, wherein the first type of application is a low bandwidth application such as voice data.

26. The apparatus of claim 21, wherein the second type of application is a high bandwidth application.

27. The apparatus of claim 21, wherein the authorization check is a password verification.

28. The apparatus of claim 21, wherein the wireless access point is configured to allow at least one of the first type of wireless device and wireless application to access a private segment of the LAN, through the public segment of the LAN, when the first type of wireless device or wireless application provides access credentials for the private segment of the LAN.

29. The apparatus of claim 21, wherein the wireless access point has a second identifier associated with a private segment of the wireless LAN, and the wireless access point to provide wireless access to the private segment of the wireless LAN for the first type of wireless device or wireless application when the first type of wireless device or wireless application is configured to the second identifier and provides access credentials for the private segment of the LAN.