Controlling wireless access to a network

• US 7,499,438 B2
• Filed: 01/13/2005
• Issued: 03/03/2009
• Est. Priority Date: 01/13/2005
• Status: Active Grant

• Current Assignee: CommScope Technologies, LLC (CommScope Holding Company, Inc.)
• Original Assignee: 2Wire, Inc. (CommScope Holding Company, Inc.)
• Inventors: Hinman, Brian L., Romano, Pasquale, Bednarz, Philip
• Primary Examiner(s): Kincaid; Lester
• Assistant Examiner(s): MITCHELL, NATHAN A
• Application Number:
  US11/035,452
• Publication Number:
  US 20060153122A1
• Time in Patent Office: 1,510 Days
• Field of Search: 370/338, 370/342, 370/328, 455/433, 455/439, 455/69, 455/414.1, 709/226, 709/227
• US Class Current: 370/338
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/71 Hardware identity
• CPC Class Codes: H04W 72/51 based on terminal or device properties
• CPC Class Codes: H04W 80/00 Wireless network protocols or protocol adaptations to wireless operation
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

Various methods and apparatus are described in for a wireless access point. The wireless access point allows access to a wireless LAN that has two or more service set identifiers (SSIDs). At least one of the SSIDs is associated with a public wireless LAN. The wireless access point implements a segmentation policy that 1) provides unimpeded access to a Wide Area network through the public wireless LAN based on a first type of application or a first type of device detected by the wireless access point and 2) restricts access to the Wide Area network through the public wireless LAN by requiring an authorization check to access the Wide Area network based on detecting a second type of application.

Claims

1. A method, comprising:

establishing communication with a wireless device configured with a network identifier, the wireless device comprising a class of wireless device having a class of wireless application;

detecting the class of wireless device and the class of wireless application;

classifying the class of wireless device and the class of wireless application, in respect to each other, as a first category, wherein the first category comprises a narrowband device with a resident narrowband application; and

providing a first class of access to a network to the first category.

2. The method of claim 1, wherein providing the first class of network access comprises providing access to a wide area network (WAN).

3. The method of claim 1, wherein providing the first class of network access comprises providing access to a plurality of resources on a local area network (LAN).

4. The method of claim 1, wherein the narrowband device is one of a personal digital assistant and a cellular telephone device.

5. The method of claim 1, wherein the narrowband application is one of an email application and a voice application, resident on a narrowband wireless device.

6. The method of claim 1, wherein detecting the class of wireless device comprises reading one of a media access control (MAC) address of the wireless device and an electronic serial number of the wireless device.

7. The method of claim 1, wherein detecting the class of wireless application comprises detecting the data protocol of the wireless application.

8. The method of claim 7, wherein the data protocol is voice over IP (VoIP) protocol.

9. The method of claim 1 wherein detecting the class of wireless application comprises matching a destination IP address requested by the wireless application with a list of service providers.

10. The method of claim 9, further comprising:

providing access to the destination IP address by implementing an IP tunneling protocol to establish a virtual private network (VPN) connection with the destination IP address.

11. The method of claim 3, wherein the LAN is a wireless LAN and wherein the first class of network access comprises unrestricted access to the wireless LAN.

12. The method of claim 3, wherein the LAN is a wired LAN.

13. The method of claim 3, wherein the LAN is a virtual subnet of the LAN.

14. The method of claim 1, further comprising:

verifying the identity of the wireless device by

reading a hardware identifier of the wireless device;

deriving a password from the hardware identifier; and

obtaining remote authentication of the password.

15. The method of claim 14, wherein the hardware identifier is at least one of a MAC address of the wireless device and an ESN of the wireless device.

16. A computer-readable medium having instructions stored thereon, which when executed by the computer, cause the computer to perform the following operations, comprising:

establishing communication with a wireless device configured with a network identifier, the wireless device comprising a class of wireless device having a class of wireless application;

detecting the class of wireless device and the class of wireless application;

classifying the class of wireless device and the class of wireless application, in respect to each other, as a first category, wherein the first category comprises a narrowband device with a resident narrowband application; and

providing a first class of access to a network to the first category.

17. The computer-readable medium of claim 16, wherein the instructions cause the computer to perform the following operations, comprising:

broadcasting a first SSID associated with a public LAN; and

broadcasting a second SSID associated with a private LAN.

18. An apparatus, comprising:

a wireless access point allowing access to a wireless LAN that has two or more service set identifiers (SSIDs), at least one of the SSIDs being associated with a public wireless LAN, wherein the wireless access point implements a segmentation policy that

     1) provides unimpeded access to a Wide Area network through the public wireless LAN to a first category based on the classification of a first type of device and a first type of application, with respect to each other, detected by the wireless access point, wherein the first category comprises a narrowband wireless device with a resident narrowband application and

     2) restricts access to the Wide Area network through the public wireless LAN by requiring an authorization check to access the Wide Area network for a second category based on detecting a second type of device and a second type of application, with respect to each other, wherein the second category comprises a wideband wireless device with a resident wideband application.

19. The apparatus of claim 18, wherein a second SSID is associated with a private LAN.

20. The apparatus of claim 19, wherein the first type of device is a wireless device limited to low bandwidth and identifiable by at least one of its 1) Electronic Serial Number, 2) MAC address, and 3) Destination IP address.

21. The apparatus of claim 20, wherein the wireless device limited to low bandwidth is a cell phone.

22. The apparatus of claim 19, wherein the first type of application is a low bandwidth application including voice data and is resident on the first type of device being a low bandwidth wireless device.

23. The apparatus of claim 19, wherein the authorization check is a password verification.

24. The apparatus of claim 19, wherein the wireless access point has a second identifier associated with a private segment of the wireless LAN, and the wireless access point to provide wireless access to the private segment of the wireless LAN for the first type of wireless device or wireless application when the first type of wireless device or wireless application is configured to the second identifier and provides access credentials for the private segment of the LAN.

25. The apparatus of claim 19, wherein the segmentation policy further provides unimpeded access to the Wide Area network through the public wireless LAN to a third category based on detecting a second type of device and a first type of application, with respect to each other, wherein the third category comprises a wideband wireless device with a resident narrowband application.

26. A method, comprising:

establishing communication with a wireless device configured with a network identifier, the wireless device comprising a class of wireless device having a class of wireless application;

detecting the class of wireless device and the class of wireless application;

classifying the class of wireless device and the class of wireless application, in respect to each other, as a first category, wherein the first category comprises a wideband device with a resident wideband application; and

providing a first class of access to a network to the first category.

27. The method of claim 26, wherein the first class of network access comprises restricted access to the wireless LAN, wherein restricted access to the WAN comprises at least one of unconditional blocking, requiring a password and requiring an electronic payment.

28. A method, comprising:

establishing communication with a wireless device configured with a network identifier, the wireless device comprising a class of wireless device having a class of wireless application;

detecting the class of wireless device and the class of wireless application;

classifying the class of wireless device and the class of wireless application, in respect to each other, as a first category, wherein the first category comprises a wideband device with a resident narrowband application; and

providing a first class of access to a network to the first category.

29. The method of claim 28, wherein the first class of network access comprises unrestricted access to the wireless LAN.

30. A computer-readable medium having instructions stored thereon, which when executed by the computer, cause the computer to perform the following operations, comprising:

establishing communication with a wireless device configured with a network identifier, the wireless device comprising a class of wireless device having a class of wireless application;

detecting the class of wireless device and the class of wireless application;

classifying the class of wireless device and the class of wireless application, in respect to each other, as a first category, wherein the first category comprises a wideband device with a resident wideband application; and

providing a first class of access to a network to the first category.

31. A computer-readable medium having instructions stored thereon, which when executed by the computer, cause the computer to perform the following operations, comprising:

establishing communication with a wireless device configured with a network identifier, the wireless device comprising a class of wireless device having a class of wireless application;

detecting the class of wireless device and the class of wireless application;

classifying the class of wireless device and the class of wireless application, in respect to each other, as a first category, wherein the first category comprises a wideband device with a resident narrowband application; and

providing a first class of access to a network to the first category.