Managed Access Point Protocol

• US 20090158042A1
• Filed: 02/18/2009
• Published: 06/18/2009
• Est. Priority Date: 03/21/2003
• Status: Active Grant

• Current Assignee: Cisco Systems, Inc.
• Original Assignee: Cisco Systems, Inc.
• Inventors: Calhoun, Patrice R., Kelly, Scott G., Suri, Rohit Kumar
• Granted Patent: US 8,169,987 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/037 of the control plane, e.g. signalling traffic
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 24/02 Arrangements for optimising operational condition
• CPC Class Codes: H04W 40/246 Connectivity information discovery
• CPC Class Codes: H04W 48/16 Discovering, processing access restriction or access information
• CPC Class Codes: H04W 8/005 Discovery of network devices, e.g. terminals
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

Methods, apparatuses and systems facilitating deployment and configuration of managed access points in hierarchical wireless network systems. An embodiment of the invention facilitates deployment and configuration of conventional, substantially autonomous access points operating in connection with a central management node, such as a server or appliance. In another embodiment, the present invention facilitates deployment and configuration of light-weight access points in a hierarchical wireless network system. In one embodiment, the present invention also provides a streamlined encryption key exchange protocol adapted to hierarchical wireless network system architectures.

Claims

1. A method, comprising:

transmitting from a first network device a first message having a first byte size to a second network device over a network;

if a response to the first message is not received at the first network device, transmitting a second message having a second byte size to the second network device, wherein the second byte size is less than the first byte size; and

validating the response to the first or second message transmitted from the second network device.

2. The method of claim 1 further comprising exchanging information between the first network device and the validated second network device.

3. The method of claim 1 wherein the first byte size is greater than 1500 bytes.

4. The method of claim 1 wherein the first byte size is greater than the maximum size of an Ethernet frame.

5. The method of claim 1 wherein the second byte size is less than or equal to the maximum size of an Ethernet frame.

6. The method of claim 1 wherein the second byte size is equal to 1500 bytes.

7. The method of claim 1 wherein the second byte size is less than 1500 bytes.

8. The method of claim 1 wherein the first byte size equals a maximum transmit unit size for a link layer protocol plus a number of bytes corresponding to an encapsulation header, and wherein the second number of bytes is the maximum transmit unit size for the link layer protocol.

9. A method comprising

transmitting from a first network device one or more discovery messages to discover one or more other network devices connected to a network;

selecting, at the first network device, a second network device from the one or more discovered network devices;

transmitting over the network a first message having a first byte size to the second network device;

if a response to the first message is not received at the first network device, transmitting a second message having a second byte size to the second network device, wherein the second byte size is less than the first byte size; and

validating the response to the first or second message transmitted from the second network device.

10. The method of claim 9 further comprising exchanging information between the first network device and the validated second network device.

11. The method of claim 9 wherein the first byte size is greater than 1500 bytes.

12. The method of claim 9 wherein the first byte size is greater than the maximum size of an Ethernet frame.

13. The method of claim 9 wherein the second byte size is less than or equal to the maximum size of an Ethernet frame.

14. The method of claim 9 wherein the first byte size equals a maximum transmit unit size for a link layer protocol plus a number of bytes corresponding to an encapsulation header, and wherein the second number of bytes is the maximum transmit unit size for the link layer protocol.

15. The method of claim 9 wherein the transmitting one or more discovery messages comprises

broadcasting discovery requests over the network;

and

receiving at least one discovery response from one or more network devices.

16. The method of claim 9 wherein the first and second messages each include a first digital certificate, the first digital certificate comprising a first public key;

and wherein the response includes a second digital certificate, the second digital certificate comprising a second public key;

the method further comprising validating the response using the second public key.

17. The method of claim 16 wherein the response further comprises a cipher including at least one cryptographic key, and a session identifier, and wherein the cipher is generated by asymmetric encryption with the first public key, and wherein the cipher and the session identifier are digitally signed with a private key of the central control element, and wherein validating the response comprises

validating the second digital certificate;

validating the cipher and session identifier with the second public key;

comparing the session identifier in the join response to the session identifier in the join request;

decrypting the cipher with a private key; and

installing the symmetric encryption key if the second digital certificate and the session identifier in the join response are valid.

18. A wireless network system, comprising

a plurality of access elements operative to communicate with one or more central control elements;

a plurality of central control elements for supervising the access elements, wherein the central control elements are each operative to

exchange validating information with access elements, and

exchange configuration information with validated access elements;

wherein the access elements are each operative to

discover one or more central control elements, wherein the one or more central control elements each provide a central control element identifier,

select a central control element from the discovered central control elements,

exchange validating information with the selected central control element by transmitting a first join request having a first byte size to the selected central control element;

if a join response to the first join request is not received, transmitting a second join request having a second byte size, wherein the second byte size is less than the first byte size; and

validating a join response received from the selected control element,

exchange configuration information with the validated central control element, and

establish and maintain, under control of the validated central control element, wireless connections with remote client elements.

19. The wireless network system of claim 18 wherein at least one central control element of the plurality of central control elements is a master central control element;

and wherein the access elements are operative to select the master control element from the discovered central control elements, else, select the central control element reporting a lowest load parameter.

20. The wireless network system of claim 18 wherein the plurality of central control elements are each operative to

generate cryptographic keys,

provide at least one cryptographic key to validated access elements, and wherein communication of management data between the plurality of access elements and the plurality of central control elements is encrypted using the at least one cryptographic key.