System and method for automated whitelist management in an enterprise small cell network environment

• US 9,219,816 B2
• Filed: 10/18/2013
• Issued: 12/22/2015
• Est. Priority Date: 10/18/2013
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Grayson, Mark
• Primary Examiner(s): Bhattacharya, Sam
• Application Number:
  US14/057,849
• Publication Number:
  US 20150111534A1
• Time in Patent Office: 795 Days
• Field of Search: 455/410, 455/411, 455/432.1, 455/433, 370/329, 370/331, 370/338
• US Class Current: 1/1
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04M 3/4931 Directory assistance systems
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/72 Subscriber identity
• CPC Class Codes: H04W 4/16 Communication-related supplementary services, e.g. call-transfer or call-hold
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A method is provided in one embodiment and includes receiving a network address associated with a wireless device at a first network element in which the network address identifies the wireless device on a first network, and receiving user credentials from a directory service associated with a second network. The user credentials identify a user associated with the wireless device on the second network. The method further includes associating the user credentials with the network address, and communicating a request message to a second network element. The request message includes a request for a user identifier identifying the user on a third network. The method further includes receiving a response message from the second network element including the user identifier, associating the user credentials with the user identifier, and storing the association of the user credentials and the user identifier in a whitelist.

Claims

1. A method, comprising:

receiving a network address associated with a wireless device at a first network element, the network address identifying the wireless device on a first network;

receiving user credentials from a directory service associated with a second network, the user credentials identifying a user associated with the wireless device on the second network;

associating the user credentials with the network address;

communicating a request message to a second network element, the request message including a request for a user identifier identifying the user on a third network;

receiving a response message from the second network element including the user identifier;

associating the user credentials with the user identifier; and

storing the association of the user credentials and the user identifier in a whitelist.

2. The method of claim 1, further comprising:

receiving an access request including an attaching user identifier, the access request indicative of a request by an attaching wireless device to access one or more services of the second network; and

determining whether the attaching user identifier matches the user identifier in the whitelist.

3. The method of claim 2, further comprising providing one or more services of the second network to the attaching wireless device based upon the user credentials associated with the matching user identifier in the whitelist when the attaching user identifier matches the user identifier in the whitelist.

4. The method of claim 1, wherein the network address is a MAC address of the wireless device.

5. The method of claim 1, wherein the first network includes a WiFi network.

6. The method of claim 1, wherein the second network includes an enterprise network associated with the directory service.

7. The method of claim 1, wherein the third network includes a cellular network.

8. The method of claim 1, wherein the user identifier includes an International Mobile Subscriber Identity (IMSI).

9. The method of claim 8, wherein an Extensible Authentication Protocol (EAP) exchange is terminated prematurely after the user identifier has been recovered.

10. The method of claim 9, wherein the user identifier is recovered using the first network using an initial EAP-SIM exchange.

11. The method of claim 9, wherein the user identifier is recovered using the first network using an initial EAP-AKA exchange.

12. The method of claim 1, wherein the second network element includes a wireless controller.

19. The media of claim 1, wherein the user identifier includes an International Mobile Subscriber Identity (IMSI).

13. One or more non-transitory media that includes code for execution and when executed by a processor operable to perform operations comprising:

receiving a network address associated with a wireless device at a first network element, the network address identifying the wireless device on a first network;

receiving user credentials from a directory service associated with a second network, the user credentials identifying a user associated with the wireless device on the second network;

associating the user credentials with the network address;

communicating a request message to a second network element, the request message including a request for a user identifier identifying the user on a third network;

receiving a response message from the second network element including the user identifier;

associating the user credentials with the user identifier; and

storing the association of the user credentials and the user identifier in a whitelist.

14. The media of claim 13, wherein the operations further include:

receiving an access request including an attaching user identifier, the access request indicative of a request by an attaching wireless device to access one or more services of the second network; and

determining whether the attaching user identifier matches the user identifier in the whitelist.

15. The media of claim 14, wherein the operations further include providing one or more services of the second network to the attaching wireless device based upon the user credentials associated with the matching user identifier in the whitelist when the attaching user identifier matches the user identifier in the whitelist.

16. The media of claim 13, wherein the first network includes a WiFi network.

17. The media of claim 13, wherein the second network includes an enterprise network associated with the directory service.

18. The media of claim 13, wherein the third network includes a cellular network.

20. A network element, comprising:

a memory element configured to store electronic code;

a processor operable to execute instructions associated with the electronic code; and

a module coupled to the memory element and the processor, wherein the network element is configured for;

receiving a network address associated with a wireless device at a first network element, the network address identifying the wireless device on a first network;

receiving user credentials from a directory service associated with a second network, the user credentials identifying a user associated with the wireless device on the second network;

associating the user credentials with the network address;

communicating a request message to a second network element, the request message including a request for a user identifier identifying the user on a third network;

receiving a response message from the second network element including the user identifier;

associating the user credentials with the user identifier; and

storing the association of the user credentials and the user identifier in a whitelist.

21. The network element of claim 20, wherein the network element is further configured for:

receiving an access request including an attaching user identifier, the access request indicative of a request by an attaching wireless device to access one or more services of the second network; and

determining whether the attaching user identifier matches the user identifier in the whitelist.

22. The network element of claim 21, wherein the operations further include providing one or more services of the second network to the attaching wireless device based upon the user credentials associated with the matching user identifier in the whitelist when the attaching user identifier matches the user identifier in the whitelist.

23. The network element of claim 20, wherein the first network includes a WiFi network.

24. The network element of claim 20, wherein the second network includes an enterprise network associated with the directory service.

25. The network element of claim 20, wherein the third network includes a cellular network.

26. The network element of claim 20, wherein the user identifier includes an International Mobile Subscriber Identity (IMSI).