Balancing wireless access based on centralized information

• US 7,929,973 B2
• Filed: 12/31/2007
• Issued: 04/19/2011
• Est. Priority Date: 10/26/2004
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Schieber, Ami, Stieglitz, Jeremy, Zavalkovsky, Arthur
• Primary Examiner(s): Negrón; Daniell L
• Assistant Examiner(s): Nguyen; Huy D
• Application Number:
  US11/968,049
• Publication Number:
  US 20080104242A1
• Time in Patent Office: 1,205 Days
• Field of Search: 455/453, 455/450, 455/432.1, 455/434, 455/435.1, 455/435.2, 455/435.3
• US Class Current: 455/453
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 48/02 Access restriction performed under specific conditions

Abstract

A method and apparatus for managing and balancing wireless access based on centralized information is provided. A request to provide service to a wireless client is received from a first access node in a plurality of access node. An access policy, applicable to the first access node, is selected from a plurality of stored policies. The stored policies may include a variety of rules, such as how many or which wireless clients may be serviced by an access node. A centralized manager, such as an AAA server, may perform the selection of the access policy. A determination is made as to whether to allow the first access node to provide service to the wireless client based on the selected access policy. A message that instructs the first access node whether to provide or deny service to the wireless client is transmitted to the first access node.

Claims

1. A machine-implemented method, comprising:

a computer receiving, from a first access node in a plurality of access nodes, a request to provide wireless access to a wireless client to connect the wireless client with the first access node, wherein each of said plurality of access nodes is configured to provide wireless access to one or more clients;

the computer selecting, from among a plurality of stored policies, a first access policy applicable to said first access node;

wherein said first access policy comprises, at least in part, one or more rules that, based on characteristics of a user of the wireless client, limit a number of wireless clients that are able to wirelessly access said first access node;

the computer determining whether to allow said first access node to provide wireless access to said wireless client based on said first access policy;

the computer, upon determining that said first access policy allows said first access node to provide wireless access to said wireless client, transmitting a first message, to said first access node, that instructs said first access node to provide wireless access to said wireless client; and

the computer, upon determining that said first access policy does not allow said first access node to provide wireless access to said wireless client, transmitting a second message, to said first access node, that instructs said first access node to deny wireless access to said wireless client and instructs said wireless client not to send another request to said first access node to provide wireless access.

2. The method of claim 1, wherein said request comprises client identification data, and wherein said first access policy comprises, at least in part, one or more rules about whether to allow said first access node to provide wireless access to said wireless client based on said client identification data.

3. The method of claim 2, wherein said client identification data identifies either a user of said wireless client, a position associated with said user of said wireless client, or an organizational group associated with said user of said wireless client.

4. The method of claim 1, further comprising the step of:

storing data that identifies one or more access nodes of the plurality of access nodes as belonging to a set of access nodes, wherein membership of said set is based on characteristics of the one or more access nodes.

5. The method of claim 4, wherein said characteristics comprise the physical location of said one or more access nodes.

6. The method of claim 1, wherein said step of selecting said first access policy is performed based on access node identity information comprised in said request, and wherein said access node identity information identifies said first access node.

7. The method of claim 1, further comprising:

prior to said step of receiving said request, receiving, at each of two or more access nodes of said plurality of access nodes, a pre-authentication message, from said wireless client, that requests to establish a security association between said wireless client and the receiving access node.

8. The method of claim 7, wherein said first access policy comprises, at least in part, one or more rules about which wireless clients are able to be serviced by a set of access nodes of said plurality of access nodes based on a set of pre-authentication messages received by said set of access nodes.

9. A non-transitory machine-readable volatile or non-volatile storage medium storing one or more sequences of instructions, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform:

receiving, from a first access node in a plurality of access nodes, a request to provide wireless access to a wireless client to connect the wireless client with the first access node, wherein each of said plurality of access nodes is configured to provide wireless access to one or more clients;

selecting, from among a plurality of stored policies, a first access policy applicable to said first access node;

wherein said first access policy comprises, at least in part, one or more rules that, based on characteristics of a user of the wireless client, limit a number of wireless clients that are able to wirelessly access said first access node;

determining whether to allow said first access node to provide wireless access to said wireless client based on said first access policy;

upon determining that said first access policy allows said first access node to provide wireless access to said wireless client, transmitting a first message, to said first access node, that instructs said first access node to provide wireless access to said wireless client; and

upon determining that said first access policy does not allow said first access node to provide wireless access to said wireless client, transmitting a second message, to said first access node, that instructs said first access node to deny wireless access to said wireless client and instructs said wireless client not to send another request to said first access node to provide wireless access.

10. The non-transitory machine-readable medium of claim 9, wherein said request comprises client identification data, and wherein said first access policy comprises, at least in part, one or more rules about whether to allow said first access node to provide wireless access to said wireless client based on said client identification data.

11. The non-transitory machine-readable medium of claim 10, wherein said client identification data identifies either a user of said wireless client, a position associated with said user of said wireless client, or an organizational group associated with said user of said wireless client.

12. The non-transitory machine-readable medium of claim 9, wherein execution of the one or more sequences of instructions by the one or more processors further causes the one or more processors to perform the step of:

storing data that identifies one or more access nodes of the plurality of access nodes as belonging to a set of access nodes, wherein membership of said set is based on characteristics of the one or more access nodes.

13. The non-transitory machine-readable medium of claim 12, wherein said characteristics comprise the physical location of said one or more access nodes.

14. The non-transitory machine-readable medium of claim 9, wherein said step of selecting said first access policy is performed based on access node identity information comprised in said request, and wherein said access node identity information identifies said first access node.

15. The non-transitory machine-readable medium of claim 9, wherein execution of the one or more sequences of instructions by the one or more processors further causes the one or more processors to perform the steps of:

prior to said step of receiving said request, receiving, at each of two or more access nodes of said plurality of access nodes, a pre-authentication message, from said wireless client, that requests to establish a security association between said wireless client and the receiving access node.

16. The non-transitory machine-readable medium of claim 15, wherein said first access policy comprises, at least in part, one or more rules about which wireless clients are able to be serviced by a set of access nodes of said plurality of access nodes based on a set of pre-authentication messages received by said set of access nodes.

17. An apparatus, comprising:

one or more processors;

means for receiving, from a first access node in a plurality of access nodes, a request to provide wireless access to a wireless client to connect the wireless client with the first access node, wherein each of said plurality of access nodes is configured to provide wireless access to one or more clients;

means for selecting, from among a plurality of stored policies, a first access policy applicable to said first access node;

wherein said first access policy comprises, at least in part, one or more rules that, based on characteristics of a user of the wireless client, limit a number of wireless clients that are able to wirelessly access said first access node;

means for determining whether to allow said first access node to provide wireless access to said wireless client based on said first access policy;

means for transmitting a first message, to said first access node, that instructs said first access node to provide wireless access to said wireless client upon determining that said first access policy allows said first access node to provide wireless access to said wireless client; and

means for transmitting a second message, to said first access node, that instructs said first access node to deny wireless access to said wireless client upon determining that said first access policy does not allow said first access node to provide wireless access to said wireless client and instructs said wireless client not to send another request to said first access node to provide wireless access.

18. The apparatus of claim 17, wherein said request comprises client identification data, and wherein said first access policy comprises, at least in part, one or more rules about whether to allow said first access node to provide wireless access to said wireless client based on said client identification data.

19. The apparatus of claim 17, wherein said client identification data identifies either a user of said wireless client, a position associated with said user of said wireless client, or an organizational group associated with said user of said wireless client.

20. The apparatus of claim 17, further comprising means for storing data that identifies one or more access nodes of the plurality of access nodes as belonging to a set of access nodes, wherein membership of said set is based on characteristics of the one or more access nodes.

21. The apparatus of claim 20, wherein said characteristics comprise the physical location of said one or more access nodes.

22. The apparatus of claim 17, wherein said means for selecting said first access policy selects said first access policy based on access node identity information comprised in said request, and wherein said access node identity information identifies said first access node.

23. The apparatus of claim 17, further comprising means for receiving, at each of two or more access nodes of said plurality of access nodes, a pre-authentication message, from said wireless client, that requests to establish a security association between said wireless client and the receiving access node.

24. The apparatus of claim 23, wherein said first access policy comprises, at least in part, one or more rules about which wireless clients are able to be serviced by a set of access nodes of said plurality of access nodes based on a set of pre-authentication messages received by said set of access nodes.

25. A computer apparatus, comprising:

a network interface that is configured to couple to a network that comprises one or more access nodes;

one or more processors;

logic encoded in one or more storage media which logic when executed causes the one or more processors to perform;

receiving, from a first access node in a plurality of access nodes, a request to provide wireless access to a wireless client to connect the wireless client with the first access node, wherein each of said plurality of access nodes is configured to provide wireless access to one or more clients;

selecting, from among a plurality of stored policies, a first access policy applicable to said first access node;

wherein said first access policy comprises, at least in part, one or more rules that, based on characteristics of a user of the wireless client, limit a number of wireless clients that are able to wirelessly access said first access node;

determining whether to allow said first access node to provide wireless access to said wireless client based on said first access policy;

upon determining that said first access policy allows said first access node to provide wireless access to said wireless client, transmitting a first message, to said first access node, that instructs said first access node to provide wireless access to said wireless client; and

upon determining that said first access policy does not allow said first access node to provide wireless access to said wireless client, transmitting a second message, to said first access node, that instructs said first access node to deny wireless access to said wireless client and instructs said wireless client not to send another request to said first access node to provide wireless access.