Native WI-FI architecture for 802.11 networks

• US 8,327,135 B2
• Filed: 01/23/2007
• Issued: 12/04/2012
• Est. Priority Date: 11/27/2002
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Abhishek, Abhishek, Ayyagari, Arun, Shen, Hui, Ganugapati, Krishna, Ruan, Jiandong
• Primary Examiner(s): Najjar, Saleh
• Assistant Examiner(s): Pan, Joseph
• Application Number:
  US11/656,772
• Publication Number:
  US 20070118742A1
• Time in Patent Office: 2,142 Days
• Field of Search: 713/1, 713/2, 713/188, 713/194, 713153- 14, 713160-161, 713/169, 380/200, 380/201, 380/255, 380/277, 726/2, 726/6, 709223-225, 709227-228, 709/250
• US Class Current: 713/160
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 28/06 Optimizing the usage of the radio link, e.g. header compression, information sizing , discarding information system modifying transmission characteristic according to link quality by modifying frame length H04L1/0007; dynamic adaptation of the packet size for flow control or congestion control H04L47/365
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

A software based wireless infrastructure system is provided. The system has a driver that communicates with the network stack and a network interface card (NIC), a station server in communication with the station driver and an 802.1X supplicant or an 802.1X authenticator. Each NIC provides station and/or access point functionality support. The driver drops packets that have been received if the packet has not been authenticated and associated. Packets that have been fragmented or encrypted are unfragmented and decrypted. An association manager is used in conjunction with a configuration table manager to associate stations and access points via management packets. A manager receives 802.1X data packets from the packet processor and sends them up to a station server that communicates with user mode applications and an 802.1X supplicant or an 802.1X authenticator that are used to authenticate and deauthenticate stations and access points. APIs are provided to enable communication between the components.

Claims

1. A device comprising:

a network interface card configured for communicating with a wireless network, and configured for operating in a station only mode, in an access point only mode, and in a station and access point mode; and

a software-based wireless infrastructure system configured for implementing components that are configured for operating in the station only mode, in the access point only mode, and in the station and access point mode, the components comprising;

a station driver configured for communicating with the network interface card;

an access point driver configured for communicating with the network interface card;

a user interface configured for dynamically configuring the device for operation as a station or as an access point, the configuring comprising setting a mode of operation of the network interface card, the mode of operation being selected from a group of modes of operation comprising the station only mode, the access point only mode, and the station and access point mode.

2. The system of claim 1 wherein the station driver comprises:

a first filtering engine configured for receiving packets including data packets, 802.1X data packets, and management packets, the first filtering engine configured for dropping data packets and 802.1X data packets if they have not been authenticated and associated;

a packet processor configured for communicating with the filtering engine, the packet processor further configured for receiving packets from the first filtering engine that have been authenticated and associated from, the packet processor further configured for reassembling received packets that have been fragmented;

a station association manager configured for receiving management packets from the packet processor;

a second filtering engine configured for receiving data packets from the packet processor, the second filtering engine further configured for dropping data packets sent by an unauthenticated device and for sending to a network stack the data packets sent by the authenticated device; and

a station manager configured for receiving 802.1X data packets from the packet processor, the station manager further configured for communicating with a station server.

3. The system of claim 2 wherein the packet processor decrypts packets that have been encrypted.

4. The system of claim 2 wherein the station driver further comprises:

a first demux between the packet processor and the second filtering engine, the first demux configured for receiving packets from the packet processor and for sending management packets to the station association manager; and

a second demux between the first demux and the second filtering engine, the second demux configured for receiving packets from the first demux and for sending 802.1X management packets to the station manager and for sending data packets to the second filtering engine.

5. The system of claim 2 wherein the station driver further comprises a configuration table in communication with the station association manager.

6. The system of claim 5 further comprising a control mux in communication with the station server, the station association manager, and the configuration table.

7. The system of claim 2 further comprising a packet converter configured for converting 802.11 data packet sent to the network stack to 802.3 data packets, the packet converter configured for communicating with the network stack and the second filtering engine.

8. The system of claim 1 wherein the access point driver comprises:

a first filtering engine configured for receiving packets including data packets, 802.1X data packets, and management packets, the first filtering engine configured for dropping data packets and 802.1X data packets if they have not been authenticated and associated;

a packet processor configured for communicating with the filtering engine, the packet processor further configured for receiving packets from the first filtering engine that have been authenticated and associated, the packet processor further configured for reassembling received packets that have been fragmented;

a access point association manager configured for receiving management packets from the packet processor;

a second filtering engine configured for receiving data packets from the packet processor, the second filtering engine further configured for dropping data packets sent by an unauthenticated device and for sending to a network stack the data packets sent by the authenticated device; and

an access point manager configured for receiving 802.1X data packets from the packet processor, the access point manager further configured for communicating with an access point server.

9. The system of claim 8 wherein the packet processor decrypts packets that have been encrypted.

10. The system of claim 8 wherein the access point driver further comprises:

a first demux between the packet processor and the second filtering engine, the first demux configured for receiving packets from the packet processor and for sending management packets to the access point association manager; and

a second demux between the first demux and the second filtering engine, the second demux configured for receiving packets from the first demux and for sending 802.1X management packets to the access point manager and for sending data packets to the second filtering engine.

11. The system of claim 8 wherein the access point driver further comprises a configuration table in communication with the access point association manager.

12. The system of claim 11 further comprising a control mux in communication with the access point server, the access point association manager, and the configuration table.

13. The system of claim 10 further comprising:

a third demux configured for determining if a destination of a packet is a device on the wireless LAN; and

an access point bridge configured for communicating with the third demux, the access point bridge further configured for receiving packets from the third demux that have a destination to the device on the wireless LAN, the access point bridge further configured for sending packets that have a destination to the device on the wireless LAN to the network interface card for transmission to the device.

14. A method of operating a computer comprising at least one processor and a network interface card that is configured for communicating with a wireless network, the method comprising:

by operating the at least one processor;

via a user interface, dynamically configuring software within the computer, the software configured for operating as a station driver and an access point driver, the software further configured for operating the computer as a station or an access point; and

setting a mode of operation of the network interface card in accordance with the configured software, the mode of operation being selected from a group of modes of operation comprising a station only mode, an access point only mode, and a station and access point mode, wherein the network interface card supports each mode of the group.

15. The method of claim 14, wherein the network interface card has an interface, the method further comprising:

in response to the software being dynamically configured to operate as a station;

setting the mode of operation of the network interface card to the station only mode, and

communicating with the network interface card as a station; and

in response to the software being dynamically configured to operate as an access point;

setting the mode of operation of the network interface card to the access point only mode, and

communicating with the network interface card as an access point.

16. The method of claim 15, wherein the method further comprises, in response to the software being dynamically configured to operate as a station:

receiving packets in a first filtering engine, the packets including data packets, 802.1X data packets, and management packets, the first filtering engine dropping data packets and 802.1X packets if they have not been authenticated and associated;

receiving, in a packet processor, packets that have been authenticated and associated from the first filtering engine, the packet processor reassembling packets that have been fragmented;

receiving, in a station association manager, management packets from the packet processor;

receiving, in a second filtering engine, data packets from the packet processor, the second filtering engine dropping data packets sent by an unauthenticated device and sending to a network stack data packets sent by an authenticated device; and

receiving, in a station manager, 802.1X data packets from the packet processor, the station manager configured for communicating with a station server.

17. The method of claim 16, further comprising:

decrypting, in the packet processor, packets that have been encrypted.

18. The method of claim 16, further comprising:

converting, in a packet converter, 802.11 data packets sent to the network stack to 802.3 data packets, the packet converter configured for communicating with the network stack and the second filtering engine.

19. The method of claim 15, wherein the method further comprises, in response to the software being dynamically configured to operate as an access point:

in a first filtering engine, receiving packets, the packets including data packets, 802.1X data packets, and management packets, and dropping data packets and 802.1X packets if they have not been authenticated and associated;

in a packet processor, receiving from the first filtering engine packets that have been authenticated and associated, and reassembling packets that have been fragmented;

receiving, in an access point association manager, management packets from the packet processor;

in a second filtering engine, receiving data packets from the packet processor, dropping data packets sent by an unauthenticated device, and sending to a network stack data packets sent by an authenticated device; and

receiving, in an access point manager, 802.1X data packets from the packet processor, the access point manager configured for communicating with an access point server.

20. The method of claim 19, further comprising:

determining, in a demultiplexer, that a destination of a packet is a device on the wireless network;

receiving packets, in an access point bridge, from the demultiplexer that have a destination to the device on the wireless network, and sending packets by the access point bridge that have a destination to the device on the wireless network to the network interface card for transmission to the device.