Method and apparatus for balancing wireless access based on centralized information

• US 7,336,960 B2
• Filed: 10/26/2004
• Issued: 02/26/2008
• Est. Priority Date: 10/26/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Stieglitz, Jeremy, Schieber, Ami, Zavalkovsky, Arthur
• Primary Examiner(s): Gelin; Jean
• Assistant Examiner(s): Nguyen; Huy D
• Application Number:
  US10/974,418
• Publication Number:
  US 20060089122A1
• Time in Patent Office: 1,218 Days
• Field of Search: 455/453, 455/450, 455/432.1, 455/434, 455/435.1, 455/435.2, 455/435.3
• US Class Current: 455/453
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 48/02 Access restriction performed under specific conditions

Abstract

A method and apparatus for managing and balancing wireless access based on centralized information is provided. A request to provide service to a wireless client is received from a first access node in a plurality of access node. An access policy, applicable to the first access node, is selected from a plurality of stored policies. The stored policies may include a variety of rules, such as how many or which wireless clients may be serviced by an access node. A centralized manager, such as an AAA server, may perform the selection of the access policy. A determination is made as to whether to allow the first access node to provide service to the wireless client based on the selected access policy. A message that instructs the first access node whether to provide or deny service to the wireless client is transmitted to the first access node.

Claims

1. A machine-implemented method, comprising:

receiving, from a first access node in a plurality of access nodes, a request to provide service to a wireless client, wherein each of said plurality of access nodes is configured to provide wireless service to one or more clients;

selecting, from among a plurality of stored policies, a first access policy applicable to said first access node;

wherein said first access policy comprises, at least in part, one or more rules about whether to allow said first access node to provide service to said wireless client based on how many other wireless clients are being serviced by a set of access nodes associated with said first access node;

determining whether to allow said first access node to provide service to said wireless client based on said first access policy;

upon determining that said first access policy allows said first access node to provide service to said wireless client, transmitting a first message, to said first access node, that instructs said first access node to provide service to said wireless client; and

upon determining that said first access policy does not allow said first access node to provide service to said wireless client, transmitting a second message, to said first access node, that instructs said first access node to deny service to said wireless client.

2. The method of claim 1, further comprising the steps of:

receiving, from a second access node in said plurality of access nodes, a second request to provide service to said wireless client;

selecting, from among said plurality of stored policies, a second access policy applicable to said second access node

determining whether to allow said second access node to provide service to said wireless client based on said second access policy;

upon determining that said second access policy allows said second access node to provide service to said wireless client, transmitting a third message, to said second access node, that instructs said second access node to provide service to said wireless client; and

upon determining that said second access policy does not allow said second access node to provide service to said wireless client, transmitting a fourth message, to said second access node, that instructs said second access node to deny service to said wireless client.

3. The method of claim 1, wherein said first access policy comprises, at least in part, one or more rules about how many wireless clients are able to be serviced by one or more of said plurality of access nodes.

4. The method of claim 1, wherein said first access policy comprises, at least in part, one or more rules about when one or more of a plurality of wireless clients are able to be serviced by one or more of said plurality of access nodes.

5. The method of claim 1, wherein said first access policy comprises, at least in part, one or more rules about whether to allow said first access node to provide service to said wireless client based on data describing how much bandwidth is being consumed at said first access node.

6. A machine-readable medium carrying one or more sequences of instructions, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of, comprising:

receiving, from a first access node in a plurality of access nodes, a request to provide service to a wireless client, wherein each of said plurality of access nodes is configured to provide wireless service to one or more clients;

selecting, from among a plurality of stored policies, a first access policy applicable to said first access node;

wherein said first access policy comprises, at least in part, one or more rules about whether to allow said first access node to provide service to said wireless client based on how many other wireless clients are being serviced by a set of access nodes associated with said first access node;

determining whether to allow said first access node to provide service to said wireless client based on said first access policy;

upon determining that said first access policy allows said first access node to provide service to said wireless client, transmitting a first message, to said first access node, that instructs said first access node to provide service to said wireless client; and

upon determining that said first access policy does not allow said first access node to provide service to said wireless client, transmitting a second message, to said first access node, that instructs said first access node to deny service to said wireless client.

7. The machine-readable medium of claim 6, wherein execution of the one or more sequences of instructions by the one or more processors further causes the one or more processors to perform the steps of:

receiving, from a second access node in said plurality of access nodes, a second request to provide service to said wireless client;

selecting, from among said plurality of stored policies, a second access policy applicable to said second access node

determining whether to allow said second access node to provide service to said wireless client based on said second access policy;

upon determining that said second access policy allows said second access node to provide service to said wireless client, transmitting a third message, to said second access node, that instructs said second access node to provide service to said wireless client; and

upon determining that said second access policy does not allow said second access node to provide service to said wireless client, transmitting a fourth message, to said second access node, that instructs said second access node to deny service to said wireless client.

8. The machine-readable medium of claim 6, wherein said first access policy comprises, at least in part, one or more rules about how many wireless clients are able to be serviced by one or more of said plurality of access nodes.

9. The machine-readable medium of claim 6, wherein said first access policy comprises, at least in part, one or more rules about when one or more of a plurality of wireless clients are able to be serviced by one or more of said plurality of access nodes.

10. The machine-readable medium of claim 6, wherein said first access policy comprises, at least in part, one or more rules about whether to allow said first access node to provide service to said wireless client based on data describing how much bandwidth is being consumed at said first access node.

11. An apparatus, comprising:

means for receiving, from a first access node in a plurality of access nodes, a request to provide service to a wireless client, wherein each of said plurality of access nodes is configured to provide wireless service to one or more clients;

means for selecting, from among a plurality of stored policies, a first access policy applicable to said first access node;

wherein said first access policy comprises, at least in part, one or more rules about whether to allow said first access node to provide service to said wireless client based on how many other wireless clients are being serviced by a set of access nodes associated with said first access node;

means for determining whether to allow said first access node to provide service to said wireless client based on said first access policy;

means for transmitting a first message, to said first access node, that instructs said first access node to provide service to said wireless client upon determining that said first access policy allows said first access node to provide service to said wireless client; and

means for transmitting a second message, to said first access node, that instructs said first access node to deny service to said wireless client upon determining that said first access policy does not allow said first access node to provide service to said wireless client.

12. The apparatus of claim 11, further comprising:

means for receiving, from a second access node in said plurality of access nodes, a second request to provide service to said wireless client;

means for selecting, from among said plurality of stored policies, a second access policy applicable to said second access node

means for determining whether to allow said second access node to provide service to said wireless client based on said second access policy;

means for transmitting a third message, to said second access node, that instructs said second access node to provide service to said wireless client upon determining that said second access policy allows said second access node to provide service to said wireless client; and

means for transmitting a fourth message, to said second access node, that instructs said second access node to deny service to said wireless client upon determining that said second access policy does not allow said second access node to provide service to said wireless client.

13. The apparatus of claim 11, wherein said first access policy comprises, at least in part, one or more rules about how many wireless clients are able to be serviced by one or more of said plurality of access nodes.

14. The apparatus of claim 11, wherein said first access policy comprises, at least in part, one or more rules about when one or more of a plurality of wireless clients are able to be serviced by one or more of said plurality of access nodes.

15. The apparatus of claim 11, wherein said first access policy comprises, at least in part, one or more rules about whether to allow said first access node to provide service to said wireless client based on data describing how much bandwidth is being consumed at said first access node.

16. An apparatus, comprising:

a network interface that is coupled to the data network for receiving one or more packet flows therefrom;

a processor; and

one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out;

receiving, from a first access node in a plurality of access nodes, a request to provide service to a wireless client, wherein each of said plurality of access nodes is configured to provide wireless service to one or more clients;

selecting, from among a plurality of stored policies, a first access policy applicable to said first access node;

wherein said first access policy comprises, at least in part, one or more rules about whether to allow said first access node to provide service to said wireless client based on how many other wireless clients are being serviced by a set of access nodes associated with said first access node;

determining whether to allow said first access node to provide service to said wireless client based on said first access policy;

upon determining that said first access policy allows said first access node to provide service to said wireless client, transmitting a first message, to said first access node, that instructs said first access node to provide service to said wireless client; and

upon determining that said first access policy does not allow said first access node to provide service to said wireless client, transmitting a second message, to said first access node, that instructs said first access node to deny service to said wireless client.

17. The apparatus of claim 16, comprising further sequences which when executed cause the one or more processors to perform:

receiving, from a second access node in said plurality of access nodes, a second request to provide service to said wireless client;

selecting, from among said plurality of stored policies, a second access policy applicable to said second access node

determining whether to allow said second access node to provide service to said wireless client based on said second access policy;

upon determining that said second access policy allows said second access node to provide service to said wireless client, transmitting a third message, to said second access node, that instructs said second access node to provide service to said wireless client; and

upon determining that said second access policy does not allow said second access node to provide service to said wireless client, transmitting a fourth message, to said second access node, that instructs said second access node to deny service to said wireless client.

18. The apparatus of claim 16, wherein said first access policy comprises, at least in part, one or more rules about how many wireless clients are able to be serviced by one or more of said plurality of access nodes.

19. The apparatus of claim 16, wherein said first access policy comprises, at least in part, one or more rules about when one or more of a plurality of wireless clients are able to be serviced by one or more of said plurality of access nodes.

20. The apparatus of claim 16, wherein said first access policy comprises, at least in part, one or more rules about whether to allow said first access node to provide service to said wireless client based on data describing how much bandwidth is being consumed at said first access node.