SYSTEMS AND METHODS FOR USER-BASED NETWORK ONBOARDING

• US 20150169864A1
• Filed: 02/13/2014
• Published: 06/18/2015
• Est. Priority Date: 12/13/2013
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: Aerohive Networks Incorporated (Extreme Networks, Inc.)
• Inventors: Lin, Mu, Zou, Xu, Hanay, John
• Granted Patent: US 9,152,782 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol

Abstract

A network security system including a first-level security profile engine and a second-level security profile engine is disclosed. In an example of operation, the first-level security profile engine assigns a first-level security profile for a first user device, the first user device requesting access to a network; the second-level security profile engine assigns a first second-level security profile to the first user device, the first second-level security profile providing first network configuration information for the first user device; a device selection engine receives a selection of a second user device associated with the first-level security profile; and the second-level security profile engine assigns a second second-level security profile to the second user device, the second second-level security profile providing second network configuration information for the second user device. A device network configuration engine can then configure the first user device to access the network based on the first network configuration information.

Claims

1. A system comprising:

a first-level security profile engine;

a second-level security profile engine coupled to the first-level security profile engine;

a device selection engine coupled to the second-level security profile engine;

a device network configuration engine coupled to the device selection engine;

wherein, in operation;

the first-level security profile engine assigns a first-level security profile for a first user device, the first user device requesting access to a network;

the second-level security profile engine assigns a first second-level security profile to the first user device, the first second-level security profile providing first network configuration information for the first user device;

the device selection engine receives a selection of a second user device associated with the first-level security profile;

the second-level security profile engine assigns a second second-level security profile to the second user device, the second second-level security profile providing second network configuration information for the second user device;

the device network configuration engine configures the first user device to access the network based on the first network configuration information.

2. The system of claim 1, wherein the device network configuration engine configures the second user device to access the network based on the second network configuration information.

3. The system of claim 1, wherein the device selection engine includes a web portal request engine, a device listing engine, and a listed device selection engine, further comprising:

a network access system management engine configured to maintain a web portal for accessing the network;

the web portal request engine, which is configured to request from the web portal a list of user devices to associate with the first-level security profile;

the device listing engine, which is configured to receive from the web portal a listing of one or more user devices in response to the request for the list;

the listed device selection engine, which is configured to receive a selection from the user of the second user device from the one or more listed user device.

4. The system of claim 1, wherein the device selection engine comprises:

a mobile device management (MDM) engine configured to request from an MDM system a list of user devices to associate with the first-level security profile;

a device listing engine configured to receive from the MDM system a listing of one or more user devices in response to the request for the list;

a listed device selection engine configured to receive a selection from the user of the second user device from the one or more listed user device.

5. The system of claim 1, wherein the first user device comprises a browser-based user device with a web browser.

6. The system of claim 5, further comprising:

a device access notification engine configured to receive a notification of the access to the network by the first user device;

a browser extension engine configured to provide, in response to the notification of the access, a browser extension to the web browser of the first user device;

a network file connectivity transfer engine configured to provide a network connectivity file to the browser extension;

wherein, in operation, the device network configuration engine configures the first user device to access the network based at least in part on information in the network connectivity file.

7. The system of claim 5, wherein the web browser includes a native web browser of the browser-based user device.

8. The system of claim 1, further comprising a third-level security profile engine, wherein in operation the third-level security profile engine assigns a first third-level security profile to the first user device, the first third-level security profile providing first device configuration information for the first user device.

9. The system of claim 8, wherein the third-level security profile engine assigns a second third-level security profile to the second user device, the second third-level security profile providing second device configuration information for the second user device.

10. A method comprising:

assigning a first-level security profile for a user device, the user device requesting access to a network;

assigning a first second-level security profile to the first user device, the first second-level security profile providing first network configuration information for the first user device;

receiving a selection of a second user device associated with the first-level security profile;

assigning a second second-level security profile to the second user profile, the second second-level security profile providing second network configuration information for the second user device;

configuring the second user device to access the network in accordance with the second network configuration information.

11. The method of claim 10, further comprising configuring the second user device to access the network based on the second network configuration information.

12. The method of claim 10, further comprising:

maintaining a web portal for accessing the network;

requesting from the web portal a list of user devices to associate with the first-level security profile;

receiving from the web portal a listing of one or more user devices in response to the request for the list;

receiving a selection from the user of the second user device from the one or more listed user device.

13. The method of claim 10, further comprising:

requesting from a mobile device management (MDM) system a list of user devices to associate with the first-level security profile;

receiving from the MDM system a listing of one or more user devices in response to the request for the list;

receiving a selection from the user of the second user device from the one or more listed user device.

14. The method of claim 10, wherein the first user device comprises a browser-based user device.

15. The method of claim 14, further comprising:

receiving a notification of the access to the network by the first user device;

providing, in response to the notification of the access, a browser extension to a web browser of the first user device;

providing a network connectivity file to the browser extension;

configuring the first user device to access the network based at least in part on information in the network connectivity file.

16. The method of claim 15, wherein the web browser comprises a native web browser of the browser-based user device.

17. The method of claim 10, further comprising assigning a first third-level security profile to the first user device, the first third-level security profile providing first device configuration information for the first user device.

18. The method of claim 17, further comprising assigning a second third-level security profile to the second user device, the second third-level security profile providing second device configuration information for the second user device.

19. The method of claim 10, wherein the method is executed by a processor of a user-based network onboarding system.

20. A system comprising:

means for assigning a first-level security profile to a user of a user device, the user device requesting access to a network;

means for assigning a first second-level security profile to the first user device, the first second-level security profile providing first network configuration information for the first user device;

means for receiving a selection of a second user device associated with the first-level security profile;

means for assigning a second second-level security profile to the second user profile, the second second-level security profile providing second network configuration information for the second user device;

means for configuring the second user device to access the network based on the second network configuration information.