Enterprise wireless local area network switching system

• US 20080228942A1
• Filed: 05/22/2008
• Published: 09/18/2008
• Est. Priority Date: 10/08/2002
• Status: Active Grant

• Current Assignee: Avago Technologies International Sales Pte Limited (Broadcom, Inc.)
• Original Assignee: Broadcom Corporation (Broadcom, Inc.)
• Inventors: Martin, Richard, Hassen, Alarabi Omar, Lor, Kar-Wing Edward
• Granted Patent: US 7,779,071 B2
• Time in Patent Office: Days
• US Class Current: 709/238
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04W 12/088 using filters or firewalls
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 74/06 using polling
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A process of controlling a flow of data in a wireless network providing wireless access to the wireless network by wireless devices is disclosed. Data is received from a wireless device by a network device, through one access point of a plurality of access points in communication with the network device, indicating a client identifier for the wireless device. The client identifier is forwarded to an authentication server and the network device mediated authentication of the wireless device with the authentication server. Thereafter, data packets received from portions of the wireless network and from the plurality of access points are evaluated and the received data packets are passed to portions of the wireless network and to the plurality of access points, based on the evaluation of the received data packets. In addition, the network device periodically polls for a status of the wireless device from the access point.

Claims

1. A network device for controlling a flow of data in a wireless network providing wireless access to the wireless network by wireless devices, said network device comprising:

receiving means for receiving data from a wireless device by the network device, through one access point of a plurality of access points in communication with the network device, indicating a client identifier for the wireless device;

forwarding means for forwarding the client identifier to an authentication server;

mediating means for mediating authentication of the wireless device with the authentication server;

evaluating means for evaluating data packets received from portions of the wireless network and from the plurality of access points; and

passing means for passing the received data packets to portions of the wireless network and to the plurality of access points, based on the evaluation of the received data packets;

wherein the network device is configured to periodically poll for a status of the wireless device from the access point, and

wherein the access points and the network device exchange information relating to configuration, status, and client session statuses of the access points through a messaging protocol.

2. A network device as recited in claim 1, wherein said evaluating means comprises filtering means for filtering the received data packets, such that filtered data packets can be dropped to limit an effectiveness of a denial of service attack.

3. A network device as recited in claim 1, wherein said mediating means comprises restricting means for restricting access to the wireless network by the wireless device based on a category of user determined from the client identifier.

4. A network device as recited in claim 3, wherein said restricting means is configured to restrict access based on a type of device to which the wireless device belongs.

5. A network device as recited in claim 1, wherein said mediating means comprises restricting means for restricting access to the wireless network by the wireless device based on an hour and a day of the week in which the data was received from the wireless device.

6. A network device as recited in claim 5, wherein said restricting means is configured to restrict access based on at least one of a type of device to which the wireless device belongs and on a category of user determined from the client identifier.

7. A network device as recited in claim 1, wherein said mediating means comprises restricting means for restricting access to the wireless network by the wireless device based on a physical location of the one access point of a plurality of access points.

8. A network device as recited in claim 1, wherein said mediating means comprises restricting means for restricting access to the wireless network by the wireless device based on a type of an application, running on the wireless device, seeking network access for the wireless device.

9. A network device as recited in claim 1, wherein said passing means comprises forwarding means for forwarding updates to software and configurations of the plurality of access points to the plurality of access points from a single site on the wireless network through a single update.

10. A network device as recited in claim 1, wherein coverage areas for at least two of the plurality of access points overlap and the network device further comprises:

monitoring means for monitoring usage by wireless devices of the at least two of the plurality of access points; and

prompting means for prompting the at least two of the plurality of access points to change the usage by the wireless devices such that a load carried by the at least two of the plurality of access points is approximately balanced.

11. A network device as recited in claim 10, wherein load carried by the at least two of the plurality of access points is determined by at least one of a number of wireless devices using the at least two of the plurality of access points, a number of packets transmitted and received by the at least two of the plurality of access points and an average bandwidth carried by the at least two of the plurality of access points.

12. A network device as recited in claim 10, wherein load carried by the at least two of the plurality of access points is determined by at least one of priorities of packets recently transmitted and received by the at least two of the plurality of access points, a type of application running on the wireless devices and communicating with the at least two of the plurality of access points and a signal strength provided to the wireless devices provided by the at least two of the plurality of access points.

13. A network device as recited in claim 1, wherein said passing means comprises maintaining means for maintaining a priority indicated by the data packets and tagging the data packets with a priority tag to be evaluated by the access points.

14. A network device as recited in claim 1, wherein said passing means comprises establishing means for establishing a prioritization policy based on filtering of the data packets and tagging the data packets with a priority tag to be evaluated by the access points based on the established prioritization policy.

15. A network device as recited in claim 1, further comprising establishing means for establishing a bandwidth usage policy for the wireless devices and instructing the plurality of access points to follow the established bandwidth usage policy.

16. A network device as recited in claim 1, further comprising:

second receiving means for receiving a re-association request from a transferring wireless device through a new access point of the plurality of access points, where the transferring wireless device was previously associated with an old access point of the plurality of access points;

providing means for providing session information for the transferring wireless device to the new access point; and

updating means for updating a routing table with a routing location of the transferring wireless device.

17. A network device as recited in claim 16, further comprising encapsulating means for encapsulating received data packets with Internet protocol information associated with the new access point and updating routing information in a local routing table.

18. A network device as recited in claim 1, further comprising:

second receiving means for receiving a re-association request from a transferring wireless device through a new access point of the plurality of access points, where the transferring wireless device was previously associated with an alternate access point in communication with the wireless network through an alternate network device;

sending means for sending a request for configuration information for the transferring wireless device from the alternate network device; and

second forwarding means for forwarding access point configuration data, determined from the configuration information for the transferring wireless device received from the alternate network device, to the new access point.

19. A network device as recited in claim 1, wherein the wireless device is a wireless internet protocol phone, the client identifier is call setup data and said step of passing the received data packets comprises passing voice over internet protocol data packets to portions of the wireless network and to the plurality of access points, based on the evaluation of the received voice over internet protocol data packets.

20. A network device as recited in claim 19, wherein said mediating means comprises:

sending means for sending a call connected signal received from an Internet protocol phone gateway to the one access point; and

second mediating means for mediating a negotiation of network resources between the Internet protocol phone gateway and the wireless Internet protocol phone.

21. A process of controlling a flow of data in a wireless network in an enterprise environment providing wireless access to the wireless network by wireless devices, said process comprising:

receiving data from a wireless device by a network device, through one access point of a plurality of access points in communication with the network device, indicating a client identifier for the wireless device;

forwarding the client identifier to an authentication server;

mediating authentication of the wireless device with the authentication server;

evaluating data packets received from portions of the wireless network and from the plurality of access points; and

passing the received data packets to portions of the wireless network and to the plurality of access points, based on the evaluation of the received data packets;

wherein the network device periodically polls for a status of the wireless device from the access point, and

wherein the access points and the network device exchange information relating to configuration, status, and client session statuses of the access points through a messaging protocol.

22. A process as recited in claim 21, wherein said step of mediating authentication of the wireless device comprises restricting access to the wireless network by the wireless device based on a category of user within the enterprise environment determined from the client identifier.

23. A process as recited in claim 22, wherein said step of restricting access to the wireless network is based on a type of device to which the wireless device belongs.

24. A process as recited in claim 21, wherein said step of mediating authentication of the wireless device comprises restricting access to the wireless network by the wireless device based on an hour and a day of the week in which the data was received from the wireless device.

25. A process as recited in claim 24, wherein said step of restricting access to the wireless network is based on at least one of a type of device to which the wireless device belongs and on a category of user determined from the client identifier.

26. A process as recited in claim 21, wherein said step of mediating authentication of the wireless device comprises restricting access to the wireless network by the wireless device based on a physical location within the enterprise environment of the one access point of a plurality of access points.

27. A process as recited in claim 21, wherein coverage areas for at least two of the plurality of access points overlap and the process further comprises:

monitoring usage by wireless devices of the at least two of the plurality of access points; and

prompting the at least two of the plurality of access points to change the usage by the wireless devices such that a load carried by the at least two of the plurality of access points is approximately balanced.

28. A process as recited in claim 21, wherein said step of passing the received data packets comprises maintaining a priority indicated by the data packets and tagging the data packets with a priority tag to be evaluated by the access points.

29. A process as recited in claim 21, further comprising:

receiving a re-association request from a transferring wireless device through a new access point of the plurality of access points, where the transferring wireless device was previously associated with an old access point of the plurality of access points;

providing session information for the transferring wireless device to the new access point; and

updating a routing table with a routing location of the transferring wireless device.

30. A process as recited in claim 29, further comprising encapsulating received data packets with Internet protocol information associated with the new access point and updating routing information in a local routing table.

31. A network device for controlling a flow of data in a wireless network in an enterprise environment providing wireless access to the wireless network by wireless devices, said network device comprising:

receiving means for receiving data from a wireless device by the network device, through one access point of a plurality of access points in communication with the network device, indicating a client identifier for the wireless device;

forwarding means for forwarding the client identifier to an authentication server;

mediating means for mediating authentication of the wireless device with the authentication server;

evaluating means for evaluating data packets received from portions of the wireless network and from the plurality of access points; and

passing means for passing the received data packets to portions of the wireless network and to the plurality of access points, based on the evaluation of the received data packets;

wherein the network device is configured to periodically poll for a status of the wireless device from the access point, and

wherein the access points and the network device exchange information relating to configuration, status, and client session statuses of the access points through a messaging protocol.

32. A network device as recited in claim 31, wherein said mediating means comprises restricting means for restricting access to the wireless network by the wireless device based on a category of user within the enterprise environment determined from the client identifier.

33. A network device as recited in claim 32, wherein said restricting means is configured to restrict access based on a type of device to which the wireless device belongs.

34. A network device as recited in claim 31, wherein said mediating means comprises restricting means for restricting access to the wireless network by the wireless device based on an hour and a day of the week in which the data was received from the wireless device.

35. A network device as recited in claim 34, wherein said restricting means is configured to restrict access based on at least one of a type of device to which the wireless device belongs and on a category of user determined from the client identifier.

36. A network device as recited in claim 31, wherein said mediating means comprises restricting means for restricting access to the wireless network by the wireless device based on a physical location within the enterprise environment of the one access point of a plurality of access points.

37. A network device as recited in claim 31, wherein coverage areas for at least two of the plurality of access points overlap and the network device further comprises:

monitoring means for monitoring usage by wireless devices of the at least two of the plurality of access points; and

prompting means for prompting the at least two of the plurality of access points to change the usage by the wireless devices such that a load carried by the at least two of the plurality of access points is approximately balanced.

38. A network device as recited in claim 31, wherein said passing means comprises maintaining means for maintaining a priority indicated by the data packets and tagging the data packets with a priority tag to be evaluated by the access points.

39. A network device as recited in claim 31, further comprising:

second receiving means for receiving a re-association request from a transferring wireless device through a new access point of the plurality of access points, where the transferring wireless device was previously associated with an old access point of the plurality of access points;

providing means for providing session information for the transferring wireless device to the new access point; and

updating means for updating a routing table with a routing location of the transferring wireless device.

40. A network device as recited in claim 39, further comprising encapsulating means for encapsulating received data packets with Internet protocol information associated with the new access point and updating routing information in a local routing table.