Advertising multiple service set identifiers

Patent metadata

Field	Value
Publication number	US-10492069-B2
Application number	US-201415500585-A
Country	US
Kind code	B2
Filing date	Sep 30, 2014
Priority date	Sep 30, 2014
Publication date	Nov 26, 2019
Grant date	Nov 26, 2019

Abstract

Described herein are techniques for selecting a subset of access points. In an example, a wireless access point stores a plurality of unique keys, each unique key being associated with a respective device. The access point advertises a first service set identifier, the first service set identifier requiring authentication of a device requesting connection at a remotely located authentication server. The access point monitors a connection to the remotely located authentication server, and, in response to the connection going down, advertising a second service set identifier, the second service set identifier requiring authentication of a device requesting connection using the unique key associated with the device requesting connection.

First claim

What is claimed is:

1. A method comprising, by a processor of a wireless access point:
storing, at the wireless access point, a plurality of unique keys, each unique key being associated with a respective device;
advertising a first service set identifier, the first service set identifier requiring authentication, at a remotely located authentication server, of a device requesting connection to a first wireless network associated with the first service set identifier at a remotely located authentication server;
monitoring a connection to the remotely located authentication server; and
in response to the connection to the remotely located authentication server going down, advertising a second service set identifier, the second service set identifier requiring authentication, at the wireless access point, of the device requesting connection to a second wireless network associated with the second service set identifier, wherein the wireless access point authenticates the device by using the unique key associated with the device requesting connection to the second wireless network.

2. The method of claim 1 , wherein the connection to the remotely located authentication server is a wide area network connection.

3. The method of claim 1 , wherein the wireless access point is located at a first site on a local area network, the remotely located authentication server is located at a second site outside of the local area network, and the device requesting connection is located at the first site.

4. The method of claim 1 , wherein only one of the first service set identifier and the second service set identifier is advertised at any given time.

5. The method of claim 1 , wherein in response to the connection to the remotely located authentication server going down, the device stops advertising the first service set identifier.

6. The method of claim 1 , further comprising:
while the second service set identifier is being advertised, monitoring the connection to the remotely located authentication server; and
in response to the connection to the remotely located authentication server coming back up, stopping the advertising of the second service set identifier and starting to advertise the first service set identifier.

7. The method of claim 6 , wherein the connection to the remotely located authentication server is determined to be back up when the authentication server can be reached and the connection is stable.

8. The method of claim 1 , further comprising:
receiving first authentication information from the device requesting connection when the first service set identifier is being advertised, the first authentication information deriving from a first supplicant profile stored on the device requesting connection; and
receiving second authentication information from the device requesting connection when the second service set identifier is being advertised, the second authentication information deriving from a second supplicant profile stored on the device requesting connection.

9. The method of claim 1 , wherein the unique keys are Dynamic Pre-Shared Keys or Private Pre-Shared Keys.

10. The method of claim 1 , wherein the remotely located authentication server is a Remote Authentication Dial-In User Service (RADIUS) server, a Microsoft Active Directory server, a Lightweight Directory Access Protocol server, or a Terminal Access Controller Access-Control System server.

11. A system comprising:
a communication interface; and
a processor to:
receive, via the communication interface, a request for registration of a device to access a network;
generate a first supplicant profile for connection to a first wireless network, the first supplicant profile requiring authentication of the device, at a remotely located authentication server, to connect to the first wireless network;
generate a second supplicant profile for connection to a second wireless network, the second supplicant profile including a unique key for authenticating the device, at a local access point, to connect to the second wireless network:
share, via the communication interface, the first and second supplicant profiles with the device; and
share, via the communication interface, the unique key and identification information of the device with the local access point configured to provide access to the first and second wireless network based on the remotely located authentication server authenticating the device and to, in response to a connection from the local access point to the remotely located authentication server going down, provide access to the second wireless network based on the local access point authenticating the device via the unique key, the unique key being unique to the device and not shared with any other devices registered with the access point.

12. The system of claim 11 , wherein the first and second supplicant profiles are sent to the device using Group Policy Object feature in an Active Directory environment.

13. The system of claim 11 , wherein the unique key of the second supplicant profile is a Dynamic Pre-Shared Key or a Private Pre-Shared Key.

14. The system of claim 11 , the processor to share, via the communication interface, the unique key and identification information of the device with all access points at a site that are configured to provide access to the first and second wireless networks.

15. A non-transitory computer-readable storage medium storing instructions for execution by a processor of an access point that provides access to a local area network, the instructions when executed causing the processor to:
store a plurality of unique keys, each unique key being associated with a respective device;
in a first mode, advertise a first service set identifier, the first service set identifier requiring authentication, of a device requesting connection at a remote authentication server located outside the local area network, of a device requesting connection to a first wireless network associated with the first service set identifier; and
in response to the remote authentication server becoming unreachable or unresponsive, switch to a second mode and advertise a second service set identifier, the second service set identifier requiring authentication, at the access point, of the device requesting connection to a second wireless network associated with the second service set identifier, wherein the access point authenticates the device by using the unique key associated with the device requesting connection to the second wireless network.

16. The storage medium of claim 15 , wherein the unique keys are Dynamic Pre-Shared Keys or Private Pre-Shared Keys.

17. The storage medium of claim 15 , wherein a wireless network corresponding to the second service set identifier has limited access relative to a wireless network corresponding to the first service set identifier.

18. The storage medium of claim 17 , wherein the wireless network corresponding to the second service set identifier provides access only to the local area network.

19. The storage medium of claim 18 , wherein the wireless network corresponding to the second service set identifier provides access only to certain devices on the local area network.

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Gupta Anil
• Hoxha Mili
• Sen Souvik

Classifications

• H04L69/40

  for recovering from a failure of a protocol instance or entity, e.g. service redundancy protocols, protocol state redundancy or protocol service redirection (management of faults, events, alarms or notifications in data switching networks H04L41/06) · CPC title

• H04L63/0892

  by using authentication-authorization-accounting [AAA] servers or protocols · CPC title

• H04L9/32

  including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials} · CPC title

• G06Q30/02

  Marketing; Price estimation or determination; Fundraising · CPC title

• G06F21/31

  User authentication · CPC title