Light-weight access point protocol

• US 7,508,801 B1
• Filed: 03/21/2003
• Issued: 03/24/2009
• Est. Priority Date: 03/21/2003
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Systems, Inc.
• Inventors: Kelly, Scott G., Suri, Rohit Kumar, Calhoun, Patrice R.
• Primary Examiner(s): Bhattacharya; Sam
• Application Number:
  US10/394,905
• Time in Patent Office: 2,195 Days
• Field of Search: 455/450, 455/671, 455/446, 455/447, 455/448, 455/524, 455/560, 455/418, 370/431, 370/468, 370/338, 370/349, 370/329, 370/85.13, 709/220, 709/222
• US Class Current: 370/338
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/037 of the control plane, e.g. signalling traffic
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 24/02 Arrangements for optimising operational condition
• CPC Class Codes: H04W 40/246 Connectivity information discovery
• CPC Class Codes: H04W 48/16 Discovering, processing access restriction or access information
• CPC Class Codes: H04W 8/005 Discovery of network devices, e.g. terminals
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

Methods, apparatuses and systems facilitating deployment and configuration of managed access points in wireless network systems. An embodiment of the present invention is a light-weight management protocol that reduces the management footprint of a plurality of managed access points in a wireless network system. An embodiment of the invention facilitates deployment and configuration of conventional, substantially autonomous access points operating in connection with a central management node, such as a server or appliance. In another embodiment, the present invention facilitates deployment and configuration of access points in a wireless network system including hierarchical processing of protocol information.

Claims

1. In a wireless network system comprising at least one access element for communication with at least one remote client element, and at least one central control element for controlling and managing wireless connections between access elements and remote client elements, a method facilitating the initialization and configuration of an access element, comprising

transmitting from an access element one or more discovery messages to discover one or more central control elements, wherein the one or more central control elements each provide a central control element identifier and a load parameter identifying the number of access elements associated with the corresponding central control element;

selecting, at the access element, a central control element from the discovered central control elements, wherein the selected central control element reporting the lowest load parameter;

exchanging validating information between the access element and the selected central control element, wherein exchanging validating information comprises

transmitting a first joint request having a first byte size to the selected central control element;

if a join response to the first join request is not received, transmitting a second join request having a second byte size, wherein the second byte size is less than the first byte size; and

exchanging configuration information between the access element and the validated central control element.

2. The method of claim 1 wherein the transmitting step comprises

broadcasting discovery requests over a computer network;

and

receiving at least one discovery response from a central control element.

3. The method of claim 2 wherein the discovery response comprises a central control element identifier and a load parameter.

4. The method of claim 3 wherein the discovery response further indicates whether the responding central control element is a master central control element.

5. The method of claim 4 wherein the selecting step comprises

selecting the master central control element from the discovered central control elements;

else, selecting the central control element reporting the lowest load parameter.

6. The method of claim 1 wherein the join request includes a first digital certificate, the first digital certificate comprising a first public key;

and wherein the method further comprises

receiving a join response from the selected central control element, the join response including a second digital certificate, the second digital certificate comprising a second public key; and

validating the join response.

7. The method of claim 6 wherein the join request further comprises a session identifier.

8. The method of claim 7 wherein the join response further comprises a cipher including at least one cryptographic key, and the session identifier, and wherein the cipher is generated by asymmetric encryption with the first public key, and wherein the cipher and the session identifier are digitally signed a private key of the central control element, and wherein the validating step comprises

validating the second digital certificate;

validating the cipher and session identifier with the second public key;

comparing the session identifier in the join response to the session identifier in the join request;

decrypting the cipher with a private key; and

installing the symmetric encryption key if the second digital certificate and the session identifier in the join response are valid.

9. The method of claim 8 wherein the exchanging configuration step comprises

transmitting a configuration request to the validated central control element, wherein the configuration request comprises at least one overriding configuration parameter;

and

receiving a configuration response from the central control element,

wherein the configuration request and the configuration response are encrypted with the symmetric encryption key.

10. The method of claim 1 wherein the exchanging configuration step comprises

transmitting a configuration request to the validated central control element, wherein the configuration request comprises at least one overriding configuration parameter;

and

receiving a configuration response from the central control element.

11. The method of claim 1 wherein the central control element is a central management appliance.

12. The method of claim 1 wherein the first byte size equals a maximum transmit unit size for a link layer protocol plus a number of bytes corresponding to an encapsulation header, and wherein the second number of bytes is the maximum transmit unit size for the link layer protocol.

13. A wireless network system, comprising

a plurality of access elements for wireless communication with at least one remote client element and for communication with a central control element;

a plurality of central control elements for supervising the access elements, wherein the central control elements are each operative to

manage wireless connections between the access elements and corresponding remote client elements,

exchange validating information with access elements, and

exchange configuration information with validated access elements;

wherein the access elements are each operative to

discover one or more central control elements, wherein the one or more central control elements each provide a central control element identifier and a load parameter identifying the number of access elements associated with the corresponding central control element,

select a central control element from the discovered central control elements wherein the selected central control element reporting the lowest load parameter,

exchange validating information with the selected central control element by transmitting a first joint request having a first byte size to the selected central control element;

if a join response to the first join request is not received, transmitting a second join request having a second byte size, wherein the second byte size is less than the first byte size; and

validating a join response received from the selected control element,

exchange configuration information with the validated central control element, and

establish and maintain, in connection with the validated central control element, wireless connections with remote client elements.

14. The wireless network system of claim 13 wherein at least one central control element of the plurality of central control elements is a master central control element;

and wherein the access elements are operative to select the master control element from the discovered central control elements, else, select the central control element reporting the lowest load parameter.

15. The wireless network system of claim 13 wherein the plurality of central control elements are each operative to

generate cryptographic keys,

provide at least one cryptographic key to validated access elements, and

wherein communication of management data between the plurality of access elements and the plurality of central control elements is encrypted using the at least one cryptographic key.

16. A method comprising

transmitting from an access element one or more discovery messages to discover one or more central control elements;

selecting, at the access element, a central control element from the discovered central control elements;

transmitting a first joint request having a first byte size to the selected central control element;

if a join response to the first join request is not received, transmitting a second join request having a second byte size, wherein the second byte size is less than the first byte size; and

validating a join response transmitted from the selected central control element; and

exchanging configuration information between the access element and the validated central control element.