Network based on demand wireless roaming

• US 8,983,433 B2
• Filed: 09/28/2012
• Issued: 03/17/2015
• Est. Priority Date: 09/28/2012
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Torres, Esteban Raul, Friday, Robert J.
• Primary Examiner(s): Sarwar, Babar
• Application Number:
  US13/631,779
• Publication Number:
  US 20140094142A1
• Time in Patent Office: 900 Days
• Field of Search: 455/422.1, 455/414.1, 455/41.2, 455/41.7, 455/418, 455/425, 455/426.1, 455/435.1, 455/435.2, 455/41.3, 455/436, 455/450, 455/443, 370/310, 370/310.2, 370/338, 370/328, 370/311, 370/348, 370/322
• US Class Current: 455/411
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 48/18 Selecting a network or a communication service
• CPC Class Codes: H04W 76/15 Setup of multiple wireless link connections

Abstract

In one embodiment, a method includes receiving at a network device, a request from a mobile device to connect to a wireless local area network, inserting mobile device and network attributes into the request, transmitting the request from the network device to an authentication proxy comprising a policy filter, and receiving a response to the request and offloading mobile data to the wireless local area network if the request is allowed. The policy filter is configured to filter requests received at the authentication proxy based on the attributes and a network policy for offloading mobile data to the wireless local area network. An apparatus and logic are also disclosed herein.

Claims

1. A method comprising:

receiving at a wireless controller in a wireless local area network, a request from a mobile device to connect to the wireless local area network, the mobile device in communication with the wireless local area network and a cellular network;

inserting mobile device and network attributes into said request, and transmitting said request from the wireless controller to an authentication proxy comprising a policy filter, said network attributes comprising cellular network attributes; and

receiving a response to said request and offloading mobile data from the cellular network to the wireless local area network when said request is allowed;

wherein the policy filter is configured to filter requests received at the authentication proxy based on said attributes and a network policy for offloading mobile data from the cellular network to the wireless local area network; and

wherein the authentication proxy is located at a virtual wireless local area network configured to aggregate a plurality of wireless local area networks.

2. The method of claim 1 wherein the wireless controller receives said cellular network attributes from a cellular client located in the wireless local area network.

3. The method of claim 1 wherein the authentication proxy is configured to forward said requests that have not been filtered by the policy filter to a service provider authentication device.

4. The method of claim 1 wherein said mobile device attributes comprise a time of day and a geographic location.

5. The method of claim 1 wherein said network attributes comprise attributes for the wireless local area network and a cellular network transmitting data to the mobile device.

6. The method of claim 1 wherein said network attributes comprise performance parameters for the wireless local area network.

7. The method of claim 1 wherein said network attributes comprise cellular load and cellular coverage for a cellular network transmitting data to the mobile device.

8. The method of claim 1 wherein the policy filter comprises a plurality of policy filters, each associated with an authentication domain and a geographic zone.

9. The method of claim 1 wherein the wireless controller communicates with the authentication proxy over a tunnel with endpoints at the wireless controller and the authentication proxy.

10. The method of claim 1 wherein the authentication proxy comprises an AAA (Authentication, Authorization, and Accounting) server.

11. The method of claim 1 wherein said request comprises an identifier stored at the mobile device.

12. The method of claim 1 wherein said network policy comprises a service provider network policy that identifies under what network conditions to offload to wireless local area network.

13. An apparatus comprising:

a network based roaming module for receiving a request from a mobile device to connect to a wireless local area network, inserting mobile device and network attributes into said request, transmitting said request to an authentication proxy comprising a policy filter, and receiving a response to said request and offloading mobile data to the wireless local area network if said request is allowed; and

memory for storing said attributes;

wherein the policy filter is configured to filter requests received at the authentication proxy based on said attributes and a network policy for offloading mobile data from a cellular network to the wireless local area network, the network based roaming module is configured for operation in the wireless local area network and said network attributes comprise cellular network attributes, and the authentication proxy is located at a virtual wireless local area network configured to aggregate a plurality of wireless local area networks.

14. The apparatus of claim 13 wherein said mobile device attributes comprise a time of day and a geographic location.

15. The apparatus of claim 13 wherein said network attributes comprise attributes for the wireless local area network and a cellular network transmitting data to the mobile device.

16. The apparatus of claim 13 wherein said network attributes comprise performance parameters for the wireless local area network.

17. The apparatus of claim 13 wherein said network attributes comprise cellular load and cellular coverage for a cellular network transmitting data to the mobile device.

18. An apparatus comprising:

an authentication proxy for receiving authentication requests from a wireless local area network, said requests comprising mobile device and network attributes;

a policy filter configured to filter said requests based on said attributes and a network policy for offloading mobile data from a cellular network to the wireless local area network; and

an interface for communication with a service provider node operable to authenticate said requests and set said network policy at the policy filter;

wherein said attributes comprise cellular network attributes; and

wherein the authentication proxy is configured for operation at a virtual wireless local area network configured to aggregate a plurality of wireless local area networks.

19. The apparatus of claim 18 wherein said mobile device attributes comprise a time of day and a geographic location and said network attributes comprise cellular network conditions.