VLAN tagging in WLANs

• US 7,505,434 B1
• Filed: 06/23/2005
• Issued: 03/17/2009
• Est. Priority Date: 06/23/2005
• Status: Active Grant

• Current Assignee: Intellectual Ventures Assets 192 LLC (Intellectual Ventures LLC)
• Original Assignee: Autocell Laboratories Incorporated
• Inventors: Backes, Floyd J.
• Primary Examiner(s): MEHRPOUR, NAGHMEH
• Application Number:
  US11/159,955
• Time in Patent Office: 1,363 Days
• Field of Search: 370/331, 370/401, 370/338, 370/463, 370/412, 370/466, 370/474, 370/201, 455/432.1, 455/436, 455/442
• US Class Current: 370/331
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

A wireless access point is operable to tag packets received from mobile clients. For example, a VLAN tag or Layer-3 tunnel tag for a packet is determined based at least in-part on a mapping between a mobile client and tag maintained by the access point. In one embodiment the access point uses Association IDs (“AIDs”) to uniquely identify mobile clients in the BSS. Hence, the mapping is between A/Ds and VLAN tags/Layer-3 tunnel tags. The mapping may be generated by snooping authentication related communications or from information maintained by a switch, such as a MAC address to tag mapping.

Claims

1. A wireless access point that supports communication by an associated mobile client via a communications path authenticated by an authentication device, comprising:

processing logic operable to create a mapping between;

a client identifier that uniquely identifies the associated mobile client relative to the access point, and

an identifier indicative of the authenticated communications path; and

processing logic operable to modify a data unit received from the mobile client by identifying the authenticated communications path from the client identifier and adding the authenticated communications path identifier to the data unit before transmitting the modified data unit from the access point.

2. The access point of claim 1 wherein the client identifier includes an Association ID (“

AID”

).

3. The access point of claim 2 wherein the authenticated communications path identifier includes a Virtual Local Area Network (“

VLAN”

) tag.

4. The access point of claim 2 wherein the authenticated communications path identifier includes a Layer-3 tunnel tag.

5. The access point of claim 1 wherein the mapping is created by snooping authentication-related communication between the mobile client and a RADIUS server.

6. The access point of claim 1 wherein the mapping is created by snooping authentication-related communication between the mobile client and a switch in the same subnet as the access point.

7. The access point of claim 1 wherein the mapping is obtained directly from a switch in the same subnet as the access point.

8. A method executed by an access point for supporting communication by an associated mobile client via a communications path authenticated by an authentication device, comprising the steps of:

creating a mapping between;

a client identifier that uniquely identifies the associated mobile client relative to the access point, and

an identifier indicative of the authenticated communications path; and

modifying a data unit received from the mobile client by;

identifying the authenticated communications path from the client identifier, and

adding the authenticated communications path identifier to the data unit before transmitting the modified data unit from the access point.

9. The method of claim 8 wherein the client identifier includes an Association ID (“

AID”

).

10. The method of claim 9 wherein the authenticated communications path identifier includes a Virtual Local Area Network (“

VLAN”

) tag.

11. The method of claim 9 wherein the authenticated communications path identifier includes a Layer-3 tunnel tag.

12. The method of claim 8 including the further step of creating the mapping by snooping authentication-related communication between the mobile client and a RADIUS server.

13. The method of claim 8 including the further step of creating the mapping by snooping authentication-related communication between the mobile client and a switch in the same subnet as the access point.

14. The method of claim 8 including the further step of obtaining the mapping directly from a switch in the same subnet as the access point.