Communication management and policy-based data routing

• US 9,537,868 B2
• Filed: 07/29/2014
• Issued: 01/03/2017
• Est. Priority Date: 07/29/2014
• Status: Active Grant

• Current Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Original Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Inventors: Manroa, Arun, Zhang, Qiang
• Primary Examiner(s): Su, Sarah
• Application Number:
  US14/445,605
• Publication Number:
  US 20160036825A1
• Time in Patent Office: 889 Days
• Field of Search: 726/1, 726/11, 726/13, 709/238
• US Class Current: 1/1
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 48/16 Discovering, processing access restriction or access information
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

A network environment includes a wireless access point providing access to a corresponding network. One or more mobile communication devices communicate with the wireless access point to access the network. In response to receiving a request from a mobile communication device to establish the wireless communication link, the wireless access point conveys communications between the mobile communication device and a remote server to authenticate the mobile communication device. During authentication, the wireless access point receives a policy assigned to the mobile communication device. The policy specifies how to route subsequent received data traffic from the mobile communication device. Subsequent to authentication, the wireless access point routes the subsequent data traffic received from the mobile communication device in accordance with the received policy.

Claims

1. A method comprising:

via message processing hardware associated with a wireless access point operable to selectively provide access to multiple different networks, performing operations of;

transmitting communications received from a mobile communication device through a remote gateway resource to a remote server to authenticate the mobile communication device, the remote gateway resource providing the wireless access point access to a first network of the multiple different networks;

receiving a policy specifying how to route subsequent data traffic received from the mobile communication device; and

routing the subsequent data traffic received from the mobile communication device in accordance with the received policy;

at the wireless access point;

processing the received policy to identify a second network amongst the multiple different networks, the policy indicating to forward subsequent data traffic received from the mobile communication device over the second network; and

transmitting the subsequent data traffic received from the mobile communication device over a communication path to the second network as specified by the received policy, the communication path to the second network bypassing the remote gateway resource.

2. The method as in claim 1 further comprising:

associating a network address of the mobile communication device with the received policy.

3. The method as in claim 2, wherein routing the subsequent data traffic further comprises:

detecting presence of the network address in the subsequent data traffic received from the mobile communication device;

mapping the network address to the received policy, the received policy indicating to transmit the subsequent data traffic from the mobile communication device over the second network amongst the multiple different networks; and

bypassing the remote gateway resource, transmitting the subsequent data traffic to the second network as specified by the received policy.

4. The method as in claim 1, wherein transmitting communications received from the mobile communication device to the remote server to authenticate the mobile communication device includes:

forwarding an identity of the mobile communication device to the remote server;

forwarding a challenge from the remote server to the mobile communication device;

forwarding a challenge response from the mobile communication device to the remote server; and

the method further comprising;

receiving the policy from the remote server through the remote gateway resource in response to the remote server verifying that the challenge response received from the mobile communication device is correct.

5. The method as in claim 1, wherein routing the subsequent data traffic received from the mobile communication device in accordance with the received policy further comprises:

at the wireless access point;

receiving a wireless communication from the mobile communication device;

processing the received wireless communication to identify a destination address indicating an intended recipient of the received wireless communication; and

processing the received policy to identify which of multiple networks to forward data in the received wireless communication to the intended recipient.

6. The method as in claim 1, wherein transmitting the communications further comprises:

initiating authentication of the mobile communication device in accordance with EAP (Extensible Authentication Protocol).

7. The method as in claim 1, wherein receiving the policy further comprises:

at the wireless access point, receiving the policy through the remote gateway resource as part of an authentication access response, the authentication access response indicating to the wireless access point to provide the mobile communication device network access in accordance with the policy.

8. The method as in claim 1, wherein the message-processing hardware is the wireless access point communicatively coupled to the multiple different networks, the wireless access point providing multiple mobile communication devices access to the multiple different networks;

and

wherein the policy specifies which of the multiple different networks to route the subsequent data traffic received from the mobile communication device.

9. The method as in claim 1, wherein the mobile communication device is a first mobile communication device of multiple mobile communication devices communicating through the wireless access point to the multiple different networks, the multiple mobile communication devices further including a second mobile communication device;

wherein the policy is a first policy;

the method further comprising;

receiving a second policy from the remote server, the second policy specifying how to route subsequent data traffic from the second mobile communication device;

processing the second policy, the second policy indicating to forward subsequent data traffic received from the second mobile communication device through the remote gateway resource over the first network; and

transmitting the subsequent data traffic received from the second mobile communication device through the gateway resource to the first network as specified by the second policy.

10. The method as in claim 9, wherein the wireless access point transmits the subsequent data traffic received from the second mobile communication device to the remote gateway resource over a secured communication link.

11. The method as in claim 10, wherein each of the mobile communication devices including the first mobile communication device and the second mobile communication device uses a same SSID to access the first network and the second network.

12. The method as in claim 1, wherein the first network provides access to different content than the second network.

13. A method comprising:

via message processing hardware at a wireless access point, performing operations of;

providing notification of availability of the wireless access point to multiple mobile communication devices;

establishing connectivity between the wireless access point and each of the multiple mobile communication devices;

obtaining multiple policies, the multiple policies specifying how to route wireless data traffic from the mobile communication devices through the wireless access point to different target networks; and

in accordance with the multiple policies, routing data traffic received from the mobile communication devices through the wireless access point to the different target networks;

wherein routing the data traffic further comprises;

receiving communications from a first mobile communication device;

in accordance with routing information as specified by a first policy assigned to the first mobile communication device, transmitting data traffic received from the first mobile communication device to a remote gateway resource, the remote gateway resource transmitting the data traffic received from the first mobile communication device over a network;

receiving communications from a second mobile communication device; and

in accordance with routing information as specified by a second policy assigned to the second mobile communication device, transmitting data traffic received from the second mobile communication device over the network, bypassing the remote gateway resource.

14. The method as in claim 13, wherein the wireless access point is communicatively coupled to the different target networks, the multiple policies specifying how to route wireless data traffic from the mobile communication devices.

15. The method as in claim 14, wherein routing the data traffic further comprises:

receiving communications from a first mobile communication device;

in accordance with routing information as specified by a first policy assigned to the first mobile communication device, transmitting data traffic received from the first mobile communication device over a first network;

receiving communications from a second mobile communication device; and

in accordance with routing information as specified by a second policy assigned to the second mobile communication device, transmitting data traffic received from the second mobile communication device over a second network.

16. The method as in claim 13,

wherein obtaining the policies includes:

from the wireless access point providing wireless access to the first mobile communication device and the second mobile communication device;

i) communicating through the remote gateway resource with a remote server to retrieve the first policy, the first policy assigned to the first mobile communication device; and

ii) communicating through the remote gateway resource with the remote server to retrieve the second policy, the second policy assigned to the second mobile communication device.

17. The method as in claim 16, wherein the first policy notifies the wireless access point how to forward subsequent data traffic received from the first mobile communication device;

and

wherein the second policy notifies the wireless access point how to forward subsequent data traffic received from the second mobile communication device.

18. The method as in claim 13, wherein forwarding the subsequent data traffic received from the first mobile communication device through the gateway resource to the first network as specified by the first policy affords the first mobile communication device access to different content than respective content accessible by the second mobile communication device that bypasses the gateway resource to access the first network.

19. The method as in claim 13, wherein the wireless access point is operable to provide access to a first network through a first physical port of the wireless access point;

and

wherein the wireless access point is operable to provide access to a second network through a second physical port of the wireless access point.

20. A system comprising:

computer processor hardware; and

a hardware storage resource coupled to communicate with the computer processor hardware, the hardware storage resource storing instructions that, when executed by the computer processor hardware, causes the computer processor hardware to perform operations of;

transmitting communications received from a mobile communication device through a remote gateway resource to a remote server to authenticate the mobile communication device, the remote gateway resource providing the wireless access point access to a first network of the multiple different networks;

receiving a policy specifying how to route subsequent data traffic received from the mobile communication device; and

routing the subsequent data traffic received from the mobile communication device in accordance with the received policy;

wherein routing the subsequent data traffic received from the mobile communication device further includes;

at the wireless access point;

processing the received policy to identify a second network amongst the multiple different networks, the policy indicating to forward subsequent data traffic received from the mobile communication device over the second network; and

transmitting the subsequent data traffic received from the mobile communication device over a communication path to the second network as specified by the received policy, the communication path to the second network bypassing the remote gateway resource.

21. The computer system as in claim 20, wherein the computer processor hardware further performs operations of:

associating a network address of the mobile communication device with the received policy.

22. The computer system as in claim 21, wherein routing the subsequent data traffic further comprises:

detecting presence of the network address in the subsequent data traffic received from the mobile communication device;

mapping the network address to the received policy, the received policy indicating to transmit the subsequent data traffic from the mobile communication device to a particular network amongst multiple networks; and

transmitting the subsequent data traffic over the particular network.

23. The computer system as in claim 20, wherein routing the subsequent data traffic received from the mobile communication device in accordance with the received policy further comprises:

receiving a wireless communication from the mobile communication device;

processing the received wireless communication to identify a destination address indicating an intended recipient of the received wireless communication; and

processing the received policy to identify which of multiple networks to forward data in the received wireless communication to the intended recipient.

24. The computer system as in claim 20, wherein transmitting the communications further comprises:

initiating authentication of the mobile communication device in accordance with EAP (Extensible Authentication Protocol).

25. The computer system as in claim 20, wherein receiving the policy further comprises:

receiving the policy as part of an authentication access response indicating to provide the mobile communication device network access.

26. Computer-readable storage hardware having instructions stored thereon, the instructions, when carried out by computer processor hardware, causing the computer processor hardware to perform operations of:

providing notification of availability of a wireless access point to multiple mobile communication devices;

establishing connectivity between the wireless access point and each of the multiple mobile communication devices;

obtaining multiple policies, the multiple policies specifying how to route wireless data traffic from the mobile communication devices to different target networks; and

in accordance with the multiple policies, routing data traffic received from the mobile communication devices to the different target networks, each of which provides access to different content;

wherein routing the data traffic further comprises;

receiving communications from a first mobile communication device;

in accordance with routing information as specified by a first policy assigned to the first mobile communication device, transmitting data traffic received from the first mobile communication device to a remote gateway resource, the remote gateway resource transmitting the data traffic received from the first mobile communication device over a network;

receiving communications from a second mobile communication device; and

in accordance with routing information as specified by a second policy assigned to the second mobile communication device, transmitting data traffic received from the second mobile communication device over the network, bypassing the remote gateway resource.

27. The computer readable storage hardware as in claim 26, wherein the wireless access point is communicatively coupled to the different target networks, multiple policies specifying how to route wireless data traffic from the mobile communication devices over the different target networks.

28. The computer readable storage hardware as in claim 27, wherein the instructions cause the computer processor hardware to perform further operations of:

obtaining the multiple policies during authentication of the multiple mobile communication devices, the multiple policies obtained from an authentication server.