SYSTEM AND METHOD FOR DETERMINING LEVELED SECURITY KEY HOLDER

• US 20130203384A1
• Filed: 02/07/2012
• Published: 08/08/2013
• Est. Priority Date: 02/07/2012
• Status: Active Grant

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Aruba Networks Incorporated (Hewlett-Packard Enterprise Company)
• Inventors: Narasimhan, Partha, Joshi, Venkatesh, Lo, Juei-Cheng
• Granted Patent: US 9,084,111 B2
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/71 Hardware identity
• CPC Class Codes: H04W 12/73 Access point logical identity
• CPC Class Codes: H04W 36/08 Reselecting an access point
• CPC Class Codes: H04W 48/20 Selecting an access point
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

The present disclosure discloses a network device and/or method for determination of leveled security key holders for a wireless client in a wireless network. The network device detects a roaming or connection pattern of one or more wireless clients in the wireless network based on requests received from the wireless clients. Furthermore, the network device determines one or more selecting rules for selecting an appropriate key holder for the wireless client among a plurality of network devices. Next, the network device prioritizes the one or more selecting rules, and selects the appropriate key holder based on the determined rules and their corresponding prioritization. Through selection of appropriate key holders, the disclosed method provides for better load balancing among possible leveled key holders, and shortens the latencies experienced by wireless clients during fast basic service set transition.

Claims

1. A method comprising:

detecting, by a network device in a wireless network, a roaming or connection pattern of one or more wireless clients in the wireless network based on requests received from the wireless clients;

determining, by the network device, one or more selecting rules for selecting a key holder for the wireless client among a plurality of network devices;

prioritizing, by the network device, the one or more selecting rules; and

selecting, by the network device, the key holder based on the determined rules and their corresponding priorities.

2. The method of claim 1, wherein the selected key holder stores security association information for the wireless client upon successful authentication to avoid re-authentication when the wireless client subsequently initiates a fast basic service set transition to another network device in the wireless network coupling to the appropriate key holder.

3. The method of claim 1, wherein the one or more selecting rules comprise:

a first selecting rule based on an initial association of a specific wireless client with the wireless network;

a second selecting rule based on at least one of a roaming pattern and a connection pattern of the specific wireless client;

a third selecting rule based on a random election among a plurality of network devices capable of servicing as the appropriate key holder for the specific wireless client; and

a fourth selecting rule based on connectivity of the specific wireless client.

4. The method of claim 3, wherein the first selecting rule is a default selecting rule.

5. The method of claim 3,

wherein the second selecting rule is associated with high priority in response to the specific wireless client spending more time near a second key holder than a first key holder based on at least one of the roaming pattern and a connection pattern;

wherein the first key holder is near a first location at which the specific wireless client initiates association with the wireless network; and

wherein the second key holder is located near a second location different from the first location, the second location being the current location of the specific wireless client.

6. The method of claim 5, wherein selecting the key holder comprises selecting the second key holder as the key holder for the wireless client.

7. The method of claim 5, further comprising:

detecting existence of the second key holder near the current location of the specific wireless client;

detecting a capability of the second key holder, wherein the capability comprising serving as the key holder for the specific wireless client; and

removing cached security association information associated with the specific wireless client from the first key holder in response to detecting the existence of the second key holder.

8. The method of claim 3,

wherein the plurality of network devices are capable of serving as the key holder for a plurality of wireless clients including the specific wireless client;

and

wherein the third selecting rule is associated with high priority in response to the plurality of wireless clients initiating association with the wireless network within a predetermined time period.

9. The method of claim 8, further comprising:

identifying a subset of possible network devices from the plurality network devices capable of serving as the key holder for the specific wireless client based on one or more of;

a total number of wireless clients serviced by a respective network device, and

a current load on the respective network device.

10. The method of claim 9, wherein selecting the key holder comprises selecting a random key holder among the subset of possible network devices capable of serving as the appropriate key holder for the specific client.

11. A network device comprising:

a processor;

a memory;

a detecting mechanism operating with the processor, the detecting mechanism to detect a roaming or connection pattern of one or more wireless clients in the wireless network based on requests received from the wireless clients;

a determining mechanism operating with the processor, the determining mechanism to determine one or more rules for selecting a key holder for the wireless client among a plurality of network devices;

a prioritizing mechanism operating with the processor, the prioritizing mechanism to prioritize the one or more selecting rules; and

a selecting mechanism operating with the processor, the selecting mechanism to select the key holder based on the determined rules and their corresponding priorities.

12. The network device of claim 11, wherein the selected key holder stores security association information for the wireless client upon successful authentication to avoid re-authentication when the wireless client subsequently initiates a fast basic service set transition to another network device in the wireless network coupling to the appropriate key holder.

13. The network device of claim 11, wherein the one or more selecting rules comprise:

a first selecting rule based on an initial association of a specific wireless client with the wireless network;

a second selecting rule based on at least one of a roaming pattern and a connection pattern of the specific wireless client;

a third selecting rule based on a random election among a plurality of network devices capable of servicing as the key holder for the specific wireless client; and

a fourth selecting rule based on connectivity of the specific wireless client.

14. The network device of claim 13, wherein the first selecting rule is a default selecting rule.

15. The network device of claim 13,

wherein the second selecting rule is associated with high priority in response to the specific wireless client spending more time near a second key holder than a first key holder based on at least one of the roaming pattern and the connection pattern;

wherein the first key holder is near a first location at which the specific wireless client initiates association with the wireless network; and

wherein the second key holder is located near a second location different from the first location, the second location being the current location of the specific wireless client.

16. The network device of claim 15, wherein the selecting mechanism selects the second key holder as the key holder for the wireless client.

17. The network device of claim 15,

wherein the detecting mechanism further to detect existence of the second key holder near the current location of the specific wireless client, and to detect a capability of the second key holder, the capability comprising serving as the key holder for the specific wireless client;

and

wherein the network device further comprises a removing mechanism operating with the processor, the removing mechanism to remove cached security association information associated with the specific wireless client from the first key holder in response to the detecting mechanism detects the existence of the second key holder.

18. The network device of claim 13,

wherein the plurality of network devices are capable of serving as the key holder for a plurality of wireless clients including the specific wireless client;

and

wherein the third selecting rule is associated with high priority in response to the plurality of wireless clients initiating association with the wireless network within a predetermined time period.

19. The network device of claim 18, further comprising an identifying mechanism operating with the processor, the identifying mechanism to identify a subset of possible network devices from the plurality network devices capable of serving as the key holder for the specific wireless client based on one or more of:

a total number of wireless clients serviced by a respective network device, and

a current load on the respective network device.

20. The network device of claim 19, wherein the selecting mechanism selects a random key holder among the subset of possible network devices capable of serving as the key holder for the specific client.

21. A non-transitory computer-readable storage medium storing embedded instructions that are executed by one or more mechanisms implemented within a network device to perform a plurality of operations comprising:

detecting at least one of a roaming pattern and a connection pattern of one or more wireless clients in the wireless network based on requests received from the wireless clients;

determining one or more mechanisms for selecting a key holder for the wireless client among a plurality of network devices;

prioritizing the one or more selecting rules; and

selecting the key holder based on the determined rules and their corresponding prioritization.