Remote access point clustering for user authentication in wireless networks

Patent metadata

Field	Value
Publication number	US-11689918-B2
Application number	US-201916290451-A
Country	US
Kind code	B2
Filing date	Mar 1, 2019
Priority date	Mar 1, 2019
Publication date	Jun 27, 2023
Grant date	Jun 27, 2023

Abstract

A method is provided that includes receiving, at a first access point in a local area network, a request from a client device to access a wireless local area network. The method also includes creating authentication credentials for the client device based on an identification of the client device, and transmitting the authentication credentials for the client device to a second access point, wherein the first access point and the second access point share a secure block chain application. The method also includes allowing the client device to roam from the first access point to the second access point without requesting new authentication credentials. A system and a non-transitory, computer-readable medium storing instructions to perform the above method are also provided.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
retrieving, by a first access point from a server hosting a Local Area Network (LAN), an address of a block chain contract;
for a first access to the LAN by a client device, receiving, at the first access point in the LAN, a request from the client device to access a wireless LAN, wherein receiving the request from the client device comprises receiving a user ID and a password from the client device;
responsive to the request from the client device, accessing the block chain contract based on the address to activate a function to register the client device by creating authentication credentials for the client device based on an identification of the client device and registering the client device as a transaction in the block chain, wherein the transaction comprises at least the authentication credentials and a public key of a public-private key pair associated with the client device,
wherein the private key and the public key are sent from the server to the client device and a controller, respectively, wherein the controller is within the LAN and is coordinating between a plurality of access points within the LAN, wherein the public key is accessible by the plurality of access points and enables the plurality of access points to verify the private key stored in the client device and avoid re-validating the client device, using the server, when roaming through the plurality of access points;
storing the address of the block chain contract in a database accessible, via the controller, by the plurality of access points to allow the access points to access the block chain contract; and
allowing the client device to roam from the first access point to a second access point of the plurality of access points when a link between the first access point and the server is down without requesting new authentication credentials, wherein allowing the client device to roam from the first access point to the second access point comprises accessing, by the second access point, the transaction in order to validate the client device.

2. The computer-implemented method of claim 1 , wherein registering the client device as the transaction comprises forming a distributed ledger accessible by the plurality of access points, and storing the authentication credentials in the distributed ledger.

3. The computer-implemented method of claim 1 , further comprising transmitting the authentication credentials for the client device to the plurality of access points.

4. The computer-implemented method of claim 1 , further comprising adding a time to live to a self-signed certificate from the public key of the public-private key pair associated with the client device, wherein the time to live is configured to last for a selected period of time ranging from a few minutes to several hours.

5. The computer-implemented method of claim 1 , further comprising validating the authentication credentials by a block chain engine running in at least the first access point and in the second access point.

6. The computer-implemented method of claim 1 , further comprising creating a non-invertible cryptographic record of the transaction.

7. The computer-implemented method of claim 1 , wherein the first access point and the second access point reside in a remote branch network, and allowing the client device to roam comprises validating the authentication credentials for the client device in the second access point.

8. The computer-implemented method of claim 1 , wherein the first access point and the second access point reside in a remote branch network, and the computer-implemented method further comprises downloading to the client device, from one of the first access point or the second access point, a network policy associated with the authentication credentials.

9. A system, comprising: a memory storing instructions; and one or more processors configured to execute the instructions to:
retrieve, by a first access point from a server hosting a Local Area Network (LAN), an address of a block chain contract;
for a first access to the LAN by a client device, receive, at the first access point in the LAN, a request from the client device to access a wireless LAN, wherein receiving the request from the client device comprises receiving a user ID and a password from the client device;
responsive to the request from the client device, access the block chain contract based on the address to activate a function to register the client device by creating authentication credentials for the client device based on an identification of the client device and register the client device as a transaction in the block chain,
wherein the transaction comprises at least the authentication credentials and a public key of a public-private key pair associated with the client device,
wherein the private key and the public key are sent from the server to the client device and a controller, respectively, wherein the controller is within the LAN and is coordinating between a plurality of access points within the LAN, wherein the public key is accessible by the plurality of access points and enables the plurality of access points to verify the private key stored in the client device and avoid re-validating the client device, using the server, when roaming through the plurality of access points;
store the address of the block chain contract in a database accessible, via the controller, by the plurality of access points to allow the access points to access the block chain contract; and
allow the client device to roam from the first access point to a second access point of the plurality of access points when a link between the first access point and the server is down without requesting new authentication credentials, wherein allowing the client device to roam from the first access point to the second access point comprises accessing, by the second access point from the client device, the transaction in order to validate the client device.

10. The system of claim 9 , wherein the one or more processors further execute instructions to transmit the authentication credentials to the plurality of access points.

11. The system of claim 9 , wherein the one or more processors further execute instructions to add a time to live to a self-signed certificate from the public key of the public-private key pair associated with the client device, and wherein the time to live is configured to last for a selected period of time ranging from a few minutes to several hours.

12. The system of claim 9 , wherein to register the client device, the one or more processors further execute instructions to form a distributed ledger accessible by the plurality of access points, and to store the authentication credentials in the distributed ledger.

13. The system of claim 9 , wherein the one or more processors further execute instructions to validate the authentication credentials by a block chain engine running in at least the first access point and in the second access 4 point.

14. A non-transitory, computer-readable medium storing instructions which, when executed by a processor, cause a computer to perform a method, the method comprising:
retrieving, by a first access point from a server hosting a Local Area Network (LAN), an address of a block chain contract;
for a first access to a LAN by a client device, receiving, at the first access point in the LAN, a request from the client device to access a wireless LAN, wherein receiving the request from the client device comprises receiving a user ID and a password from the client device;
responsive to the request from the client d

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Sethi Aseem
• Wagle Manoj

Classifications

• H04L9/085

  Secret sharing or secret splitting, e.g. threshold schemes · CPC title

• H04L9/3268

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title

• H04L9/0637

  Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM] · CPC title

• H04W84/12

  WLAN [Wireless Local Area Networks] · CPC title

• H04W12/041

  Key generation or derivation · CPC title