Managed access point protocol

• US 9,179,398 B2
• Filed: 06/17/2013
• Issued: 11/03/2015
• Est. Priority Date: 03/21/2003
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Calhoun, Patrice R., Kelly, Scott G., Suri, Rohit Kumar
• Primary Examiner(s): Huq, Obaidul
• Application Number:
  US13/919,872
• Publication Number:
  US 20130343367A1
• Time in Patent Office: 869 Days
• Field of Search: 370/254, 370/255, 370/310, 370/328, 370/338, 370/351, 370/389, 370/395.1, 370/396, 370/398, 370/395.4, 370/395.42
• US Class Current: 1/1
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/037 of the control plane, e.g. signalling traffic
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 24/02 Arrangements for optimising operational condition
• CPC Class Codes: H04W 40/246 Connectivity information discovery
• CPC Class Codes: H04W 48/16 Discovering, processing access restriction or access information
• CPC Class Codes: H04W 8/005 Discovery of network devices, e.g. terminals
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

Methods, apparatuses and systems facilitating deployment and configuration of managed access points in hierarchical wireless network systems. An embodiment of the invention facilitates deployment and configuration of conventional, substantially autonomous access points operating in connection with a central management node, such as a server or appliance. In another embodiment, the present invention facilitates deployment and configuration of light-weight access points in a hierarchical wireless network system. In one embodiment, the present invention also provides a streamlined encryption key exchange protocol adapted to hierarchical wireless network system architectures.

Claims

1. A method comprising:

at an access element in a wireless local area network, sending a discovery request to one or more central control elements for the wireless local area network;

waiting a threshold period of time for discovery responses from the one or more central control elements;

selecting a central control element that sends a discovery response, wherein selecting is based on priority according to;

(1) first, a primary central control element, if configured;

(2) second, a master central control element; and

(3) third, a central control element reporting a smallest load;

wherein the master central control element is a central control element exclusively tasked with the configuration of access elements.

2. The method of claim 1, further comprising, after selecting a central control element, transmitting a join request to the selected central control element.

3. The method of claim 2, wherein the join request includes an access element identifier, a digital certificate and a session identifier.

4. The method of claim 3, wherein the join request further includes a wireless local area network media access control address and a software image version.

5. The method of claim 3, wherein the digital certificate includes a name or other identifier of the access element, a serial number of the access element, a local area network and/or wireless local area network media access control address associated with the access element, a copy of a public key of the access element for encrypting messages and digital signatures, and a digital signature of a certificate-issuing authority so that central control elements can verify that the digital certificate of the access element is authentic.

6. The method of claim 1, wherein during subsequent start-up of the access element, further comprising the access element associating with the selected central control element.

7. The method of claim 1, further comprising transmitting keep-alive messages to the selected central control element, and determining when a response to a keep-alive message is not received after a threshold period of time.

8. The method of claim 7, further comprising, when it is determined that a response to a keep-alive message has not been received after the threshold period of time, then entering a failover mode;

periodically broadcasting or multicasting discovery requests to the selected central control element; and

re-associating with the selected central access point when the access element receives a discovery response.

9. The method of claim 8, further comprising configuring a new central control element with an identifier that matches that of a failed central control element, thereby allowing the access element to identify the new central control element as its primary controller.

10. The method of claim 9, further comprising comparing an identifier of the new central control element with a stored identifier to determine whether they match, and when a match is determined, associating to the new central control element.

11. A system comprising:

one or more central control elements for a wireless local area network;

an access element in the wireless local area network;

wherein the access element is configured to;

send a discovery request to the one or more central control elements for the wireless local area network;

wait a threshold period of time for discovery responses from the one or more central control elements; and

select a central control element that sends a discovery response, based on priority according to;

(1) first, a primary central control element, if configured;

(2) second, a master central control element; and

(3) third, a central control element reporting a smallest load;

wherein the master central control element is a central control element exclusively tasked with the configuration of access elements in the wireless local area network.

12. The system of claim 11, wherein the access element is further configured to, after selecting a central control element, transmit a join request to the selected central control element.

13. The system of claim 12, wherein the join request includes an access element identifier, a digital certificate and a session identifier.

14. The system of claim 13, wherein the join request further includes a wireless local area network media access control address and a software image version.

15. The system of claim 13, wherein the digital certificate includes a name or other identifier of the access element, a serial number of the access element, a local area network and/or wireless local area network media access control address associated with the access element, a copy of a public key of the access element for encrypting messages and digital signatures, and a digital signature of a certificate-issuing authority so that central control elements can verify that the digital certificate of the access element is authentic.

16. The system of claim 11, wherein during subsequent start-up of the access element, the access element configured to associate with the selected central control element.

17. The system of claim 11, wherein the access element is configured to transmit keep-alive messages to the selected central control element, and determine when a response to a keep-alive message is not received after a threshold period of time.

18. The system of claim 17, wherein the access element is further configured to, when it is determined that a response to a keep-alive message has not been received after the threshold period of time, enter a failover mode;

periodically broadcast or multicast discovery requests to the selected central control element; and

re-associate with the selected central access point when the access element receives a discovery response.

19. The system of claim 18, wherein a new central control element is configured with an identifier that matches that of a failed central control element, thereby allowing the access element to identify the new central control element as its primary controller.

20. The system of claim 19, wherein the access element is configured to compare an identifier of the new central control element with a stored identifier to determine whether they match, and when a match is determined, associate to the new central control element.