Remote grant of network access

• US 9,426,118 B2
• Filed: 10/28/2014
• Issued: 08/23/2016
• Est. Priority Date: 10/28/2014
• Status: Active Grant

• Current Assignee: Belkin International Incorporated (Hon Hai Precision Industry Co., Ltd.)
• Original Assignee: Belkin International Incorporated (Hon Hai Precision Industry Co., Ltd.)
• Inventors: Kim, Ryan Yong
• Primary Examiner(s): Pwu, Jeffrey
• Assistant Examiner(s): Ambaye, Samuel
• Application Number:
  US14/525,443
• Publication Number:
  US 20160119284A1
• Time in Patent Office: 665 Days
• Field of Search: 726/12
• US Class Current: 1/1
• CPC Class Codes: H04L 2101/622 Layer-2 addresses, e.g. medium access control [MAC] addresses
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 76/10 Connection setup
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

Systems and techniques for granting of network access to a new network device are described. Specifically, various techniques and systems are provided for connecting a new network device to a network and limiting access of the network device while authenticating the new network device. Exemplary embodiments of the present invention include a computer-implemented method. The method comprises receiving, at a gateway on a network, a communication including a request for a new network device to join the network; establishing a connection between the new network device and the gateway; generating a firewall configured to prevent the new network device from communicating with an additional device on the network; transmitting a query, wherein the query includes a request to determine whether the new network device is associated with the network; receiving a communication including a response to the query indicating that the new network device is associated with the network; removing the firewall so as to allow the new network device to communicate with the additional network device.

Claims

1. A computer-implemented method, comprising:

receiving, at a gateway on a network, a communication including a request for a new network device to join the network;

establishing a connection between the new network device and the gateway, wherein establishing the connection between the new network device and the gateway includes allowing the new network device to connect to a guest entry point of the network;

generating a firewall configured to prevent the new network device from communicating with an existing device on the network, wherein establishing a connection between the new network device and the gateway and generating a firewall configured to prevent the new network device from communicating with an additional device on the network occur at substantially the same time;

transmitting a query, wherein the query includes a request to determine whether the new network device is associated with the network;

receiving a communication including a response to the query indicating that the new network device is associated with the network; and

removing the firewall to allow the new network device to communicate with the existing network device.

2. The method of claim 1, further comprising:

storing a data table including media access control (MAC) addresses associated with network devices on the network, wherein the new network device is associated with a MAC address on the data table.

3. The method of claim 2, wherein the data table is an address resolution protocol (ARP) table.

4. The method of claim 2, wherein generating the firewall includes removing the MAC address of the new network device from the data table.

5. The method of claim 2, wherein removing the firewall includes adding the MAC address of the new network device to the data table.

6. The method of claim 1, wherein the query is transmitted in response to establishing the connection between the new network device and the gateway.

7. The method of claim 1, wherein after the query is received, the query is presented on a display so as to allow a response to be entered at the display.

8. The method of claim 1, further comprising:

transmitting a communication, including network credentials, to the new network device so as to allow the new network device to connect to the network.

9. A computing device, comprising:

one or more processors; and

a memory having instructions stored thereon, which when executed by the one or more processors, cause the computing device to perform operations including;

receiving, at a gateway on a network, a communication including a request for a new network device to join the network;

establishing a connection between the new network device and the gateway, wherein establishing the connection between the new network device and the gateway includes allowing the new network device to connect to a guest entry point of the network;

generating a firewall configured to prevent the new network device from communicating with an existing device on the network, wherein establishing a connection between the new network device and the gateway and generating a firewall configured to prevent the new network device from communicating with an additional device on the network occur at substantially the same time;

transmitting a query, wherein the query includes a request to determine whether the new network device is associated with the network;

receiving a communication including a response to the query indicating that the new network device is associated with the network; and

removing the firewall to allow the new network device to communicate with the existing network device.

10. The computing device of claim 9, further comprising instructions, which when executed by the one or more processors, cause the computing device to perform operations including:

storing a data table including media access control (MAC) addresses associated with network devices on the network, wherein the new network device is associated with a MAC address on the data table.

11. The computing device of claim 10, wherein the data table is an address resolution protocol (ARP) table.

12. The computing device of claim 10, wherein generating the firewall includes removing the MAC address of the new network device from the ARP table.

13. The computing device of claim 10, wherein removing the firewall includes adding the MAC address of the new network device to the ARP table.

14. The computing device of claim 9, wherein the query is transmitted in response to establishing the connection between the new network device and the gateway.

15. The computing device of claim 9, wherein after the query is received, the query is presented on a display so as to allow a response to be entered at the display.

17. The computing device of claim 9, further comprising instructions, which when executed by the one or more processors, cause the computing device to perform operations including:

transmitting a communication, including network credentials, to the new network device so as to allow the new network device to connect to the network.

16. A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions configured to cause a data processing apparatus to:

receive, at a gateway on a network, a communication including a request for a new network device to join the network;

establish a connection between the new network device and the gateway, wherein establishing the connection between the new network device and the gateway includes allowing the new network device to connect to a guest entry point of the network;

generate a firewall configured to prevent the new network device from communicating with an existing device on the network, wherein establishing a connection between the new network device and the gateway and generating a firewall configured to prevent the new network device from communicating with an additional device on the network occur at substantially the same time;

transmit a query, wherein the query includes a request to determine whether the new network device is associated with the network;

receive a communication including a response to the query indicating that the new network device is associated with the network; and

remove the firewall to allow the new network device to communicate with the existing network device.

18. The computer-program product of claim 16, further comprising instructions configured to cause the data processing apparatus to:

store a data table including media access control (MAC) addresses associated with network devices on the network, wherein the new network device is associated with a MAC address on the data table.

19. The computer-program product of claim 18, wherein the data table is an address resolution protocol (ARP) table.

20. The computer-program product of claim 18, wherein generating the firewall includes removing the MAC address of the new network device from the data table.

21. The computer-program product of claim 18, wherein removing the firewall includes adding the MAC address of the new network device to the data table.

22. The computer-program product of claim 16, wherein the query is transmitted in response to establishing the connection between the new network device and the gateway.

23. The computer-program product of claim 16, wherein after the query is received, the query is presented on a display so as to allow a response to be entered at the display.

24. The computer-program product of claim 16, further comprising instructions configured to cause the data processing apparatus to:

transmit a communication, including network credentials, to the new network device so as to allow the new network device to connect to the network.