Communication management and policy-based data routing

• US 10,097,587 B2
• Filed: 11/15/2016
• Issued: 10/09/2018
• Est. Priority Date: 07/29/2014
• Status: Active Grant

• Current Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Original Assignee: Time Warner Cable Enterprises LLC (Charter Communications Incorporated)
• Inventors: Manroa, Arun, Zhang, Qiang
• Primary Examiner(s): Su, Sarah
• Application Number:
  US15/351,948
• Publication Number:
  US 20170063934A1
• Time in Patent Office: 693 Days
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 48/16 Discovering, processing access restriction or access information
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

A network environment includes a wireless access point providing access to a corresponding network. One or more mobile communication devices communicate with the wireless access point to access the network. In response to receiving a request from a mobile communication device to establish the wireless communication link, the wireless access point conveys communications between the mobile communication device and a remote server to authenticate the mobile communication device. During authentication, the wireless access point receives a policy assigned to the mobile communication device. The policy specifies how to route subsequent received data traffic from the mobile communication device. Subsequent to authentication, the wireless access point routes the subsequent data traffic received from the mobile communication device in accordance with the received policy.

Claims

1. A method comprising:

via message processing hardware associated with a wireless access point that selectively provides access to multiple different networks including a first network and a second network, performing operations of;

establishing a wireless communication link between the wireless access point and a mobile communication device, the wireless access point coupled to communicate with the multiple different networks;

retrieving a policy assigned to the mobile communication device during authentication of the mobile communication device to use the wireless access point, the policy specifying how to route subsequent data traffic received from the mobile communication device, the policy indicating that the mobile communication device is authorized use of the first network of the multiple different networks; and

routing the subsequent data traffic received from the mobile communication device over the first network in accordance with the policy assigned to the mobile communication device;

wherein the wireless access point includes a first physical port connecting the wireless access point over a first communication path to the first wireless network;

wherein the wireless access point includes a second physical port connecting the wireless access point over a second communication path to the second wireless network; and

wherein routing the subsequent data traffic received from the mobile communication device over the first network in accordance with the policy assigned to the mobile communication device includes;

in response to detecting that the policy indicates to forward data traffic from the mobile communication device over the first network, transmitting the subsequent data traffic through the first physical port to the first network in lieu of transmitting the subsequent data traffic through the second physical port.

2. The method as in claim 1, wherein the mobile communication device is a first mobile communication device amongst multiple mobile communication devices in wireless communication with the wireless access point, the wireless access point providing the multiple mobile communication devices access to the multiple different networks;

and

wherein each of the mobile communication devices including the first mobile communication device and a second mobile communication device uses a same SSID to access the multiple different networks.

3. The method as in claim 1 further comprising:

during the authentication, forwarding an identity of the mobile communication device from the wireless access point to a remote authentication server;

forwarding a challenge received from the remote authentication server to the mobile communication device, the challenge requesting credentials from the mobile communication device;

forwarding a challenge response received from the mobile communication device to the authentication server, the challenge response including the requested credentials provided by the mobile communication device; and

receiving an acknowledgment from the authentication server indicating that the authentication server verified that the challenge response received from the mobile communication device is correct and that the mobile communication device has been authenticated and is authorized to use the wireless access point to access the multiple different networks.

4. The method as in claim 3, wherein forwarding the identity of the mobile communication device includes forwarding the identity of the mobile communication device through a remote gateway resource, the remote gateway resource providing access to a first network of the multiple different networks;

and

wherein forwarding the challenge response received from the mobile communication device to the authentication server includes forwarding the challenge response through the remote gateway resource to the authentication server.

5. The method as in claim 4 further comprising:

in response to receiving the acknowledgment, providing the mobile communication device access to the first network via communications through the remote gateway resource.

6. The method as in claim 1, wherein the subsequent data traffic includes a communication transmitted from the mobile communication device to a particular destination;

and

wherein the routing of the subsequent data traffic includes transmitting the communication over the first network to the particular destination.

7. The method as in claim 1, wherein the first communication path is a bypass communication path with respect to the second communication path.

8. The method as in claim 1, wherein the second network provides access to different content than the first network.

9. The method as in claim 1, wherein the second network provides access to different content than the first network.

10. The method as in claim 1, wherein the mobile communication device is a first mobile communication device, the method further comprising:

providing tunneled routing of the subsequent data traffic to the first network through the first physical port of the wireless access point; and

in accordance with a policy assigned to a second mobile communication device, providing non-tunneled routing of communications from the second mobile communication device to the second network through the second physical port of the wireless access point.

11. The method as in claim 10, wherein the first physical port is a bypass communication path with respect to the second physical port.

12. The method as in claim 1, wherein the wireless access point transmits the subsequent data to the first network based on an intended first specified destination as indicated by a destination address of the subsequent data traffic.

13. The method as in claim 12, wherein the subsequent data traffic is first data traffic transmitted from the mobile communication device to the wireless access point, the method further comprising:

receiving second data traffic from the mobile communication device, the second data traffic indicating an intended second recipient as indicated by a destination address in the second data traffic; and

in accordance with the policy, transmitting the second data traffic to the second network based on the intended second recipient as indicated by the destination address of the second data traffic.

14. A method comprising:

via message processing hardware associated with a wireless access point that selectively provides access to multiple different networks including a first network and a second network, performing operations of;

establishing a wireless communication link between the wireless access point and a mobile communication device, the wireless access point coupled to communicate with the multiple different networks;

retrieving a policy assigned to the mobile communication device during authentication of the mobile communication device to use the wireless access point, the policy specifying how to route subsequent data traffic received from the mobile communication device, the policy indicating that the mobile communication device is authorized use of the first network of the multiple different networks; and

routing the subsequent data traffic received from the mobile communication device over the first network in accordance with the policy assigned to the mobile communication device;

the method further comprising;

identifying a network address assigned to the mobile communication device; and

associating the network address of the mobile communication device to the policy; and

wherein routing the subsequent data traffic includes;

i) detecting presence of the network address in the subsequent data traffic received from the mobile communication device; and

ii) mapping the detected network address to the policy assigned to the mobile communication device, the policy indicating to transmit the subsequent data traffic over a bypass path to the first network, the bypass path bypassing a gateway resource.

15. A method comprising:

via message processing hardware associated with a wireless access point that selectively provides access to multiple different networks, performing operations of;

establishing a wireless communication link between the wireless access point and a mobile communication device;

retrieving a policy assigned to the mobile communication device during authentication of the mobile communication device to use the wireless access point, the policy specifying how to route subsequent data traffic received from the mobile communication device;

routing the subsequent data traffic received from the mobile communication device in accordance with the policy assigned to the mobile communication device; and

in accordance with the retrieved policy, bypassing a gateway resource via transmission of the subsequent data traffic over a second network, the bypassing being an alternative to conveying the subsequent data traffic through a remote gateway resource to a first network.

16. The method as in claim 15, wherein the wireless access point provides multiple mobile communication devices access to multiple different networks including the first network and the second network.

17. The method as in claim 16, wherein the wireless access point is operable to communicate the subsequent data traffic to the first network through a remote gateway resource, the method further comprising:

prior to routing the subsequent data traffic, performing the authentication of the mobile communication device via communications from the wireless access point through the remote gateway resource.

18. A system comprising:

computer processor hardware; and

a hardware storage resource coupled to communicate with the computer processor hardware, the hardware storage resource storing instructions that, when executed by the computer processor hardware, cause the computer processor hardware to;

establish a wireless communication link between a wireless access point and a mobile communication device, the wireless access point coupled to communicate with multiple different networks;

retrieve a policy assigned to the mobile communication device during authentication of the mobile communication device to use the wireless access point, the policy specifying how to route subsequent data traffic received from the mobile communication device, the policy indicating that the mobile communication device is assigned use of the first network of the multiple different networks; and

route the subsequent data traffic received from the mobile communication device over the first network in accordance with the policy assigned to the mobile communication device;

wherein execution of the instructions further cause the computer processor hardware to;

in accordance with the retrieved policy, bypass a gateway resource via transmission of the subsequent data traffic over a second network, the bypassing being an alternative to conveying the subsequent data traffic through a remote gateway resource to a first network.

19. The system as in claim 18, wherein execution of the instructions further cause the computer processor hardware to:

identify a network address assigned to the mobile communication device; and

associate the network address of the mobile communication device to the policy.

20. The system as in claim 19, wherein execution of the instructions further cause the computer processor hardware to:

detect presence of the network address in the subsequent data traffic received from the mobile communication device; and

map the detected network address to the policy assigned to the mobile communication device, the policy indicating to transmit the subsequent data traffic over a bypass path other than through a gateway resource.

21. The system as in claim 18, wherein the wireless access point provides multiple mobile communication devices access to multiple different networks including the first network and the second network.