Wireless network having multiple security interfaces

• US 20060177063A1
• Filed: 02/07/2005
• Published: 08/10/2006
• Est. Priority Date: 02/07/2005
• Status: Active Grant

• Current Assignee: Juniper Networks Incorporated
• Original Assignee: Juniper Networks Incorporated
• Inventors: Mo, Ning, Conway, Adam Michael, Klarich, Lee
• Granted Patent: US 7,627,123 B2
• Time in Patent Office: Days
• US Class Current: 380/270
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04W 80/10 adapted for application session management, e.g. SIP [Session Initiation Protocol] connection management H04W76/00; arrangements for session management H04L67/14

Abstract

A number of wireless networks are established by a network device, each wireless network having an identifier. Requests are received from client devices to establish wireless network sessions via the wireless networks using the identifiers. Network privileges of the client devices are segmented into discrete security interfaces based on the identifier used to establish each wireless network session.

Claims

1. A method for providing wireless network functionality, comprising:

establishing, by a network device, a number of wireless networks, each network having an identifier;

receiving requests, at the network device, from client devices to establish wireless network sessions via the wireless networks using the identifiers; and

segmenting network privileges of the client devices into discrete interfaces based on the identifier used to establish each wireless network session.

2. The method of claim 1, wherein the unique identifiers are Service Set Identifiers (SSIDs).

3. The method of claim 1, further comprising:

mapping the identifiers to security zones; and

segmenting security privileges of the client devices based on the security zone mapped to the identifier used to establish each wireless network session.

4. The method of claim 1, further comprising:

receiving network traffic from a client device bound for a network resource;

identifying a source security zone associated with the client device based on the identifier used to establish the wireless network session;

identifying a destination security zone of the requested network resource; and

performing security processing on the network traffic based on the identified source and destination security zones.

5. The method of claim 4, wherein security processing includes determining whether to pass the network traffic to the network resource.

6. The method of claim 4, wherein performing security processing includes performing a security policy search.

7. The method of claim 4, wherein security processing includes uniform resource locator (URL) filtering for disabling access to predefined network resources.

8. The method of claim 4, wherein performing security processing includes performing network address translation.

9. The method of claim 1, further comprising

mapping the identifiers to a discrete internet protocol (IP) address ranges for assignment to the client devices;

and

segmenting security privileges of the client devices based on the discrete IP address range associated with an identifier used to establish each wireless network session.

10. The method of claim 9, further comprising:

receiving a request from a client device to access a network resource;

identifying a source IP address associated with the client device;

identifying a destination IP address associated with the requested network resource; and

performing a security processing on the request based on the identified source and destination IP addresses.

11. The method of claim 1, comprising:

performing network level authentication on the client devices prior to establishing the wireless network sessions.

12. A network device for providing network security, comprising:

means for providing discrete wireless network interfaces, each discrete wireless network interface having an identifier associated therewith;

means for establishing wireless network sessions with client devices based on the identifiers; and

means for applying differing levels of network security based on the identifier used to establish each wireless network session.

13. The network device of claim 12, further comprising:

means for mapping the identifiers to security zones; and

means for segmenting security privileges of the client devices based on the security zone associated with an identifier used to establish each wireless network session.

14. The network device of claim 12, further comprising:

means for receiving a request from a client device to access a network resource;

means for identifying a source security zone associated with the client device;

means for identifying a destination security zone of the requested network resource; and

means for performing security processing on the request based on the identified source and destination security zones.

15. The network device of claim 14, wherein means for performing security processing includes means for performing a security policy search.

16. The network device of claim 12, wherein the identifiers comprise discrete internet protocol (IP) address ranges, further comprising:

means for mapping the discrete IP address ranges to security zones; and

means for segmenting security privileges of the client devices based on the security zone mapped to the discrete IP address ranges.

17. The network device of claim 16, comprising:

means for receiving network traffic from a client device bound for a network resource, wherein the discrete IP address range assigned to the client device is associated with a source security zone;

means for identifying a destination IP address associated with the network resource, wherein the destination IP address is associated with a destination security zone; and

means for performing security processing on the request based on the identified source and destination security zones.

18. A method for providing wireless network security, comprising:

mapping wireless network identifiers to predefined security policies;

receiving a request from a client device to access a wireless network using one of the wireless network identifiers;

establishing a wireless network session with the client device;

receiving network traffic from the client device, the network traffic having a destination resource; and

performing security processing on the network traffic based on the predefined security policies mapped to the wireless network identifier used to establish the wireless network session.

19. The method of claim 18, further comprising:

mapping the wireless network identifiers to predefined security zones, wherein the predefined security zones establish the security policies and data processing privileges associated with the connected client devices.

20. An apparatus, comprising:

a network device configured to provide discrete wireless network interfaces, each discrete wireless network interface having an identifier associated therewith,

wherein the network device is configured to map the identifiers to a number of security zones,

wherein the network device is configured to establish wireless network sessions with client devices based on the identifiers, and

wherein the network device is configured to segment security privileges of the client devices based on the security zone associated with the identifier used to establish each wireless network session.