Methods, devices and systems for dynamic network access administration

• US 9,763,094 B2
• Filed: 01/31/2014
• Issued: 09/12/2017
• Est. Priority Date: 01/31/2014
• Status: Expired due to Fees

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Thelen, Christian Oliver, Gooding, Ted Ray, Daley, Robert Sean
• Primary Examiner(s): LYNCH, SHARON S
• Application Number:
  US14/170,474
• Publication Number:
  US 20150223068A1
• Time in Patent Office: 1,320 Days
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

Methods and devices for providing access to a wireless network through a network access point secured with a network password may include receiving a request to provide access to the wireless network for a device on the network access point. A virtual access point may be established to provide access to the wireless network for the device in response to receiving the request to provide access for the device on the network access point. A virtual access point password may be established for the device and associated with a unique identifier of the device. The virtual access point password may be different from the network password. The device may be provided with access to the network when an entered password matches the virtual access point password and the device identifier matches the unique identifier of the device associated with the virtual access point password.

Claims

1. A method of providing access to a wireless network through a network access point secured with a network password, the method comprising:

receiving in the network access point a request to provide access to the wireless network for a guest device;

establishing, by the network access point, a virtual access point to provide access to the wireless network for the guest device in response to receiving the request to provide access for the guest device;

creating, by the network access point, a virtual access point password for the guest device that is associated with a unique device identifier of the guest device, wherein the virtual access point password is different from the network password, wherein the virtual access point password and the unique device identifier are each unique to only the guest device and the virtual access point for the network access point;

limiting, by the network access point, use of the virtual access point password to gain access to the wireless network via the virtual access point to only the guest device by binding the virtual access point password with the unique device identifier of the guest device in a database accessible to the virtual access point; and

providing the guest device with access to the wireless network when an entered password matches the virtual access point password and a guest device identifier of the guest device matches the unique device identifier of the guest device.

2. The method of claim 1, wherein the unique device identifier of the guest device includes a medium access control (MAC) address of the guest device.

3. The method of claim 1, wherein establishing the virtual access point comprises:

determining whether a limit of available virtual access points has been reached; and

establishing the virtual access point with a virtual access point identifier in response to determining that the limit of available virtual access points has not been reached.

4. The method of claim 1, wherein:

the received request includes information associated with the guest device;

creating the virtual access point password for the guest device comprises creating the virtual access point password for the guest device and associating the virtual access point password with a virtual identifier of the guest device based on the information associated with the guest device; and

providing the guest device with access to the wireless network comprises providing provisional access to the wireless network during a first access attempt when the entered password matches the virtual access point password and the information associated with the guest device matches the virtual identifier of the guest device.

5. The method of claim 4, further comprising:

receiving in the network access point a second password from a second guest device for which access has not been requested and obtaining information associated with the second guest device in a second guest device access attempt;

determining whether the second password received from the second guest device matches either the network password of the network access point or the virtual access point password;

informing an administrator of the wireless network about the second guest device access attempt in response to recognizing that the second password received from the second guest device does not match the network password of the network access point or the virtual access point password;

receiving in the network access point a message from the administrator requesting the network access point to provide the second guest device with access to the wireless network;

creating, by the network access point, a second virtual access point password for the second guest device that is-associated with a second virtual identifier of the second guest device based on the information associated with the second guest device, wherein the second virtual access point password is different from the network password and from the virtual access point password for the guest device, wherein the second virtual access point password and the second virtual identifier are each unique to only the second guest device; and

limiting, by the network access point, use of the second virtual access point password to gain access to the wireless network via the virtual access point to only the second guest device by binding the second virtual access point password with the second virtual identifier of the second guest device in the database.

6. The method of claim 4, further comprising:

establishing a virtual access point identifier associated with the virtual access point;

providing the virtual access point identifier and the virtual access point password to the guest device;

storing the virtual access point identifier and the virtual access point password in the database accessible to the virtual access point;

obtaining the unique device identifier of the guest device during the first access attempt by the guest device using the virtual access point identifier and the virtual access point password; and

storing the unique device identifier of the guest device in association with the virtual access point identifier and the virtual access point password in the database accessible to the virtual access point,

wherein, when the unique device identifier is obtained, providing the guest device with access to the wireless network comprises providing the guest device with access to the wireless network in subsequent access attempts when the guest device accesses the virtual access point using the virtual access point identifier, when the entered password matches the virtual access point password and when the guest device identifier of the guest device matches the unique device identifier of the guest device stored in association with the virtual access point password.

7. The method of claim 6, wherein establishing the virtual access point to provide access to the wireless network for the guest device in response to receiving the request to provide access for the guest device comprises:

establishing the virtual access point when the information associated with the guest device matches the virtual identifier of the guest device during the first access attempt; and

establishing the virtual access point when the guest device identifier matches the unique device identifier of the guest device stored in association with the virtual access point password during subsequent access attempts after the first access attempt.

8. The method of claim 6, wherein:

establishing the virtual access point comprises establishing a restriction on access to the wireless network for the guest device; and

providing the guest device with access to the wireless network in subsequent access attempts when the entered password matches the virtual access point password and the guest device identifier matches the unique device identifier of the guest device stored in association with the virtual access point password comprises providing the guest device with access to the wireless network subject to the restriction when the entered password matches the virtual access point password and the guest device identifier matches the unique device identifier of the guest device stored in association with the virtual access point password.

9. A network access point for providing access to a wireless network secured with a network password, the network access point comprising:

a processor configured to access processor readable instructions stored on a non-transitory computer readable medium to perform operations comprising;

receiving a request to provide access to the wireless network for a guest device;

establishing a virtual access point to provide access to the wireless network for the guest device in response to receiving the request to provide access for the guest device;

creating a virtual access point password for the guest device that is associated with a unique device identifier of the guest device, wherein the virtual access point password is different from the network password, wherein the virtual access point password and the unique device identifier are each unique to only the guest device and the virtual access point for the network access point;

limiting use of the virtual access point password to gain access to the wireless network via the virtual access point to only the guest device by binding the virtual access point password with the unique device identifier of the guest device in a database accessible to the virtual access point; and

providing the guest device with access to the wireless network when an entered password matches the virtual access point password and a guest device identifier of the guest device matches the unique device identifier of the guest device.

10. The network access point of claim 9, wherein the processor is configured with processor-executable instructions to perform operations such that the unique device identifier of the guest device includes a medium access control (MAC) address of the guest device.

11. The network access point of claim 9, wherein the processor is configured with processor-executable instructions to perform operations such that establishing the virtual access point comprises:

determining whether a limit of available virtual access points has been reached; and

establishing the virtual access point with a virtual access point identifier in response to determining that the limit of available virtual access points has not been reached.

12. The network access point of claim 9, wherein:

the received request includes information associated with the guest device;

the processor is configured with processor executable instructions to perform operations such that;

creating the virtual access point password for the guest device comprises creating the virtual access point password for the guest device and associating the virtual access point password with a virtual identifier of the guest device based on the information associated with the guest device; and

providing the guest device with access to the wireless network comprises providing provisional access to the wireless network during a first access attempt when the entered password matches the virtual access point password and the information associated with the guest device matches the virtual identifier of the guest device.

13. The network access point of claim 12, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

receiving in the network access point a second password from a second guest device for which access has not been requested and obtaining information associated with the second guest device in a second guest device access attempt;

determining whether the second password received from the second guest device matches either the network password of the network access point or the virtual access point password;

informing an administrator of the wireless network about the second guest device access attempt in response to recognizing that the second password received from the guest device does not match the network password of the network access point or the virtual access point password;

receiving in the network access point a message from the administrator requesting the network access point to provide the second guest device with access to the network;

creating, by the network access point, a second virtual access point password for the second guest device that is associated with a second virtual identifier of the second guest device based on the information associated with the second guest device, wherein the second virtual access point password is different from the network password and from the virtual access point password for the guest device, wherein the second virtual access point password and the second virtual identifier are each unique to only the second guest device; and

limiting use of the second virtual access point password to gain access to the wireless network via the virtual access point to only the second guest device by binding the second virtual access point password with the second virtual identifier of the second guest device in the database.

14. The network access point of claim 12, wherein the processor is configured with processor-executable instructions to perform operations further comprising:

establishing a virtual access point identifier associated with the virtual access point;

providing the virtual access point identifier and the virtual access point password to the guest device;

storing the virtual access point identifier and the virtual access point password in the database accessible to the virtual access point;

obtaining the unique device identifier of the guest device during the first access attempt by the guest device using the virtual access point identifier and the virtual access point password; and

storing the unique device identifier of the guest device in association with the virtual access point identifier and the virtual access point password in the database accessible to the virtual access point,

wherein the processor is configured with processor-executable instructions to perform operations when the unique device identifier is obtained such that providing the guest device with access to the wireless network comprises providing the guest device with access to the wireless network in subsequent access attempts when the guest device accesses the virtual access point using the virtual access point identifier, when the entered password matches the virtual access point password and when the guest device identifier of the guest device matches the unique device identifier of the guest device stored in association with the virtual access point password.

15. The network access point of claim 14, wherein the processor is configured with processor-executable instructions to perform operations such that establishing the virtual access point to provide access to the wireless network for the guest device in response to receiving the request to provide access for the guest device comprises:

establishing the virtual access point when the information associated with the guest device matches the virtual identifier of the guest device during the first access attempt; and

establishing the virtual access point when the guest device identifier matches the unique device identifier of the guest device stored in association with the virtual access point password during subsequent access attempts after the first access attempt.

16. The network access point of claim 14, wherein the processor is configured with processor-executable instructions to perform operations such that:

establishing the virtual access point comprises establishing a restriction on access to the wireless network for the guest device; and

providing the guest device with access to the wireless network in subsequent access attempts when the entered password matches the virtual access point password and the guest device identifier matches the unique device identifier of the guest device stored in association with the virtual access point password comprises providing the guest device with access to the wireless network subject to the restriction when the entered password matches the virtual access point password and the guest device identifier matches the unique device identifier of the guest device stored in association with the virtual access point password.

17. An apparatus for providing access to a wireless network through a network access point secured with a network password, the apparatus comprising:

means for receiving in the network access point a request to provide access to the wireless network for a guest device;

means for establishing, by the network access point, a virtual access point to provide access to the wireless network for the guest device in response to receiving the request to provide access for the guest device;

means for creating, by the network access point, a virtual access point password for the guest device that is associated with a unique device identifier of the guest device, wherein the virtual access point password is different from the network password, wherein the virtual access point password and the unique device identifier are each unique to only the guest device and the virtual access point for the network access point;

means for limiting, by the network access point, use of the virtual access point password to gain access to the wireless network via the virtual access point to only the guest device by binding the virtual access point password with the unique device identifier of the guest device in a database accessible to the virtual access point; and

means for providing the guest device with access to the wireless network when an entered password matches the virtual access point password and a guest device identifier matches the unique device identifier of the guest device.

18. The apparatus of claim 17, wherein the unique identifier of the guest device includes a medium access control (MAC) address of the guest device.

19. The apparatus of claim 17, wherein the means for establishing the virtual access point comprises:

means for determining whether a limit of available virtual access points has been reached; and

means for establishing the virtual access point with a virtual access point identifier in response to determining that the limit of available virtual access points has not been reached.

20. The apparatus of claim 17, wherein:

the received request includes information associated with the guest device;

the means for creating the virtual access point password for the guest device comprises means for creating the virtual access point password for the guest device and associating the virtual access point password with a virtual identifier of the guest device based on the information associated with the guest device; and

the means for providing the guest device with access to the wireless network comprises means for providing provisional access to the wireless network during a first access attempt when the entered password matches the virtual access point password and the information associated with the guest device matches the virtual identifier of the guest device.

21. The apparatus of claim 20, further comprising:

means for receiving in the network access point a second password from a second guest device for which access has not been requested and obtaining information associated with the second guest device in a second guest device access attempt;

means for determining whether the second password received from the second guest device matches either the network password of the network access point or the virtual access point password;

means for informing an administrator of the wireless network about the second guest device access attempt in response to recognizing that the second password received from the second guest device does not match the network password of the network access point or the virtual access point password;

means for receiving in the network access point a message from the administrator requesting the network access point to provide the second guest device with access to the wireless network;

means for creating, by the network access point, a second virtual access point password for the second guest device that is associated with a second virtual identifier of the second guest device based on the information associated with the second guest device, wherein the second virtual access point password is different from the network password and from the virtual access point password for the guest device, wherein the second virtual access point password and the second virtual identifier are each unique to only the second guest device; and

means for limiting use of the second virtual access point password to gain access to the wireless network via the virtual access point to only the second guest device by binding the second virtual access point password with the second virtual identifier of the second guest device in the database.

22. The apparatus of claim 20, further comprising:

means for establishing a virtual access point identifier associated with the virtual access point;

means for providing the virtual access point identifier and the virtual access point password to the guest device;

means for storing the virtual access point identifier and the virtual access point password in the database accessible to the virtual access point;

means for obtaining a unique device identifier of the guest device during the first access attempt by the guest device using the virtual access point identifier and the virtual access point password; and

means for storing the unique device identifier of the guest device in association with the virtual access point identifier and the virtual access point password in the database accessible to the virtual access point,

wherein the means for providing the guest device with access to the wireless network comprises means providing the guest device with access to the wireless network when the guest device accesses the virtual access point using the virtual access point identifier, when the entered password matches the virtual access point password and when the guest device identifier matches the unique device identifier of the guest device stored in association with the virtual access point password.

23. The apparatus of claim 22, wherein the means for establishing the virtual access point to provide access to the wireless network for the guest device in response to receiving the request to provide access to the wireless network comprises:

means for establishing the virtual access point when the information associated with the guest device matches the virtual identifier of the guest device during the first access attempt; and

means for establishing the virtual access point when the guest device identifier matches the unique device identifier of the guest device stored in association with the virtual access point password during subsequent access attempts after the first access attempt.

24. The apparatus of claim 22, wherein:

the means for establishing the virtual access point comprises means for establishing a restriction on access to the wireless network for the guest device; and

the means for providing the guest device with access to the wireless network in subsequent access attempts when the entered password matches the virtual access point password and the guest device identifier matches the unique identifier of the guest device stored in association with the virtual access point password comprises means for providing the guest device with access to the wireless network subject to the restriction when the entered password matches the virtual access point password and the guest device identifier matches the unique device identifier of the guest device stored in association with the virtual access point password.

25. A non-transitory computer readable medium having stored thereon processor-executable instructions configured to cause a processor to perform operations comprising:

receiving in a network access point a request to provide access to a wireless network for a guest device;

establishing, by the network access point, a virtual access point to provide access to the wireless network for the guest device in response to receiving the request to provide access for the guest device;

establishing creating, by the network access point, a virtual access point password for the guest device that is associated with a unique device identifier of the guest device, wherein the

virtual access point password is different from the network password, wherein the virtual access point password and the unique device identifier are each unique to only the guest device and the virtual access point for the network access point;

limiting, by the network access point, use of the virtual access point password to gain access to the wireless network via the virtual access point to only the guest device by binding the virtual access point password with the unique device identifier of the guest device in a database accessible to the virtual access point; and

providing the guest device with access to the wireless network when an entered password matches the virtual access point password and a guest device identifier of the guest device matches the unique device identifier of the guest device.

26. The non-transitory computer readable medium of claim 25, wherein:

the received request includes information associated with the guest device;

the stored processor executable instructions are configured to cause the processor to perform operations such that;

creating the virtual access point password for the guest device comprises creating the virtual access point password for the guest device and associating the virtual access point password with a virtual identifier of the guest device based on the information associated with the guest device; and

providing the guest device with access to the wireless network comprises providing provisional access to the wireless network during a first access attempt when the entered password matches the virtual access point password and the information associated with the guest device matches the virtual identifier of the guest device.

27. The non-transitory computer readable medium of claim 26, wherein the stored processor-executable instructions are configured to cause the processor to perform operations further comprising:

receiving in the network access point a second password from a second guest device for which access has not been requested and obtaining information associated with the second guest device in a second guest device access attempt;

determining whether the second password received from the second guest device matches either the network password of the network access point or the virtual access point password;

informing an administrator of the wireless network about the second guest device access attempt in response to recognizing that the second password received from the second guest device does not match the network password of the network access point or the virtual access point password;

receiving in the network access point a message from the administrator requesting the network access point to provide the second guest device with access to the wireless network;

creating, by the network access point, a second virtual access point password for the second guest device that is associated with a second virtual identifier of the second guest device based on the information associated with the second guest device, wherein the second virtual access point password is different from the network password and from the virtual access point password for the guest device, wherein the second virtual access point password and the second virtual identifier are each unique to only the second guest device; and

limiting, by the network access point, use of the second virtual access point password to gain access to the wireless network via the virtual access point to only the second guest device by binding the second virtual access point password with the second virtual identifier of the second guest device in the database.

28. The non-transitory computer readable medium of claim 26, wherein the stored processor-executable are configured to cause the processor to perform operations further comprising:

establishing a virtual access point identifier associated with the virtual access point;

providing the virtual access point identifier and the virtual access point password to the guest device;

storing the virtual access point identifier and the virtual access point password in the database accessible to the virtual access point;

obtaining the unique device identifier of the guest device during the first access attempt by the guest device using the virtual access point identifier and the virtual access point password; and

storing the unique device identifier of the guest device in association with the virtual access point identifier and the virtual access point password in the database accessible to the virtual access point,

wherein the stored processor-executable are configured to cause a processor to perform operations when the unique device identifier is obtained such that providing the guest device with access to the wireless network comprises providing the guest device with access to the wireless network in subsequent access attempts when the guest device accesses the virtual access point using the virtual access point identifier, when the entered password matches the virtual access point password and when the guest device identifier of the guest device matches the unique device identifier of the guest device stored in association with the virtual access point password.

29. The non-transitory computer readable medium of claim 28, wherein the stored processor-executable instructions are configured to cause the processor to perform operations such that establishing the virtual access point to provide access to the wireless network for the guest device in response to receiving the request to provide access for the guest device comprises:

establishing the virtual access point when the information associated with the guest device matches the virtual identifier of the guest device during the first access attempt; and

establishing the virtual access point when the guest device identifier matches the unique device identifier of the guest device stored in association with the virtual access point password during subsequent access attempts after the first access attempt.

30. The non-transitory computer readable medium of claim 28, wherein the stored processor-executable instructions are configured to cause the processor to perform operations such that:

establishing the virtual access point comprises establishing a restriction on access to the wireless network for the guest device; and

providing the guest device with access to the wireless network in subsequent access attempts when the entered password matches the virtual access point password and the guest device identifier matches the unique device identifier of the guest device stored in association with the virtual access point password comprises providing the guest device with access to the wireless network subject to the restriction when the entered password matches the virtual access point password and the guest device identifier matches the unique device identifier of the guest device stored in association with the virtual access point password.