Security for mobile devices in a wireless network

• US 20060206933A1
• Filed: 03/10/2005
• Published: 09/14/2006
• Est. Priority Date: 03/10/2005
• Status: Active Grant

• Current Assignee: Guest-tek Interactive Entertainment Ltd.
• Original Assignee: STSN General Holdings, Inc.
• Inventors: DeHoop, Jan M., Ehlers, Richard L., Molen, Brett Thomas, Draper, Nichol Fife
• Granted Patent: US 8,255,681 B2
• Time in Patent Office: Days
• US Class Current: 726/14
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/73 Access point logical identity
• CPC Class Codes: H04W 88/16 Gateway arrangements

Abstract

A network and associated methods and apparatus are described. The network includes a wireless access node which is operable to receive first packets from a plurality of wireless computing devices attempting to access the network. Each of the first packets corresponds to one of a plurality of traffic types. At least one of the traffic types corresponds to an encrypted wireless protocol. The wireless access node is configured to associate one of a plurality of identifiers with each of the first packets. Each of the plurality of identifiers corresponds to one of the plurality of traffic types. The wireless access node is further configured to transmit all first packets received from the wireless computing devices to a gateway on the network regardless of destination addresses associated with the first packets. The gateway is operable to determine that a particular one of the first packets from a first one of the wireless computing devices is directed to a second computing device on the network. The gateway is further operable to prevent the particular first packet from reaching the second computing device in response to determining that the particular first packet is directed to the second computing device.

Claims

1. A network, comprising:

a wireless access node which is operable to receive first packets from a plurality of wireless computing devices attempting to access the network, each of the first packets corresponding to one of a plurality of traffic types, at least one of the traffic types corresponding to an encrypted wireless protocol, the wireless access node being configured to associate one of a plurality of identifiers with each of the first packets, each of the plurality of identifiers corresponding to one of the plurality of traffic types, the wireless access node further being configured to transmit all first packets received from the wireless computing devices to a gateway on the network regardless of destination addresses associated with the first packets;

the gateway which is operable to determine that a particular one of the first packets from a first one of the wireless computing devices is directed to a second computing device on the network, the gateway further being operable to prevent the particular first packet from reaching the second computing device in response to determining that the particular first packet is directed to the second computing device.

2. The network of claim 1 wherein at least some of the identifiers comprise service set identifiers (SSIDs) and correspond to virtual local area networks (VLANs).

3. The network of claim 1 wherein the plurality of traffic types includes Wi-Fi Protected Access (WPA) traffic, WPA2 traffic, AES traffic, WEP traffic, and VoIP traffic.

4. The network of claim 1 wherein the plurality of traffic types includes first traffic corresponding to a specific corporate entity.

5. The network of claim 1 further comprising a wired access node which is operable to receive second packets from a plurality of wired computing devices attempting to access the network, each of the second packets corresponding to one of a second plurality of traffic types each of which corresponds to one of the plurality of identifiers, the wired access node being configured to associate one of the identifiers with each of the second packets, the wired access node further being configured to transmit all second packets received from the wired computing devices to the gateway regardless of destination addresses associated with the second packets.

6. The network of claim 5 wherein the gateway is further operable to determine that a particular one of the second packets from one of the wired computing devices is directed to a specific one of the wired and wireless computing devices, the gateway further being operable to prevent the particular second packet from reaching the specific one of the wired and wireless computing devices in response to determining that the second particular packet is directed to the specific one of the wired and wireless computing devices.

7. The network of claim 1 further comprising a high-bandwidth connection to the Internet by which the gateway is operable to transmit at least some of the first packets to the Internet, the network further comprising at least one of a firewall, an intrusion detection system, and an intrusion prevention system, each of which is operable to protect the network from external packets from the Internet.

8. The network of claim 7 wherein at least one of the firewall, the intrusion detection system, and the intrusion prevention system is implemented on one of the gateway and an intervening network device on the network.

9. The network of claim 7 wherein at least one device on the network is operable to perform network address translation to facilitate transmission of the first packets to the Internet.

10. The network of claim 1 wherein the gateway is further operable to perform network address translation to facilitate transmission of at least some of the first packets on the network.

11. The network of claim 1 wherein the gateway is further operable to supply locally valid network address to at least some of the wireless computing devices to facilitate transmission of at least some of the first packets on the network.

12. The network of claim 1 wherein the gateway is further operable to process specific packets associated with a first one of the identifiers in accordance with a set of security options.

13. The network of claim 12 wherein the set of security options is determined with reference to input from a user associated with a specific computing device from which at least some of the specific ones of the specific packets originated.

14. The network of claim 13 wherein input from the user is obtained dynamically after the specific computing device connects to the network.

15. The network of claim 13 wherein input from the user is obtained prior to the specific computing device connecting to the network.

16. The network of claim 12 wherein the set of security options is determined with reference to at least one of a type of the specific computing device from which the specific first packets originated and a type of a specific access node by which the specific computing device connected to the network.

17. The network of claim 1 wherein the gateway is further operable to establish a secure connection between at least one of the wireless computing devices and at least one other computing device on the network.

18. The network of claim 17 wherein the gateway is further operable to process packets associated with the secure connection in accordance with a set of security options.

19. The network of claim 18 wherein the gateway is further operable to apply a different subset of the security options to packets originating from each of the computing devices associated with the secure connection.

20. The network of claim 1 wherein the wireless access node is deployed on a property local area network (LAN), the network further comprising a plurality of such property LANs, and a plurality of regional points-of-presence (POPs), each of the regional POPs forming a wide area network (WAN) with a subset of the property LANs and being operable to facilitate secure Internet access via a high-bandwidth connection for the wireless computing devices connected to the associated subset of property LANs, the gateway being deployed either on the property LAN with the wireless access node or on the associated POP, the network further comprising a central services network forming a WAN with all of the regional POPs, the central services network being operable to centrally monitor and manage operation of the regional POPs and the property LANs.