Selective access point key caching

Patent metadata

Field	Value
Publication number	US-12170894-B2
Application number	US-202217657588-A
Country	US
Kind code	B2
Filing date	Mar 31, 2022
Priority date	Mar 31, 2022
Publication date	Dec 17, 2024
Grant date	Dec 17, 2024

Abstract

An example system includes a plurality of AP devices configured to provide a wireless network at a site, the plurality of AP devices including a first AP device configured to determine a set of roaming candidates within the site for client devices connected to the first AP device, wherein the set of roaming candidates includes one or more AP devices of the plurality of AP selected according to a selection criteria; in response to establishing a connection with a client device, cache a key associated with the client device in the memory of the first AP device; generate a packet with the key associated with the client device, and a list of APs that includes one or more identifiers of the one or more AP devices within the set of roaming candidates for the first AP device; and transmit the packet to the plurality of AP devices at the site.

First claim

What is claimed is:

1. A system comprising:
a plurality of access point (AP) devices configured to provide a wireless network at a site, the plurality of AP devices including a first AP device comprising one or more processors configured to:
determine a set of roaming candidates within the site for client devices connected to the first AP device, wherein the set of roaming candidates includes one or more AP devices of the plurality of AP devices selected according to one or more selection criteria;
in response to establishing a connection with a client device, cache a key associated with the client device in a memory of the first AP device;
generate a packet that includes the key associated with the client device and a list of AP devices, wherein the list of AP devices includes one or more identifiers of the one or more AP devices within the set of roaming candidates for the first AP device; and
transmit the packet to the plurality of AP devices at the site.

2. The system of claim 1 , wherein the one or more selection criteria comprise a signal strength of a signal received by the first AP device from another AP device being above a threshold signal strength value.

3. The system of claim 2 , wherein the threshold signal strength comprises a first signal strength for a session key obtained from an authentication, authorization, and accounting (AAA) server, and a second signal strength for a session key obtained via a fast roaming protocol.

4. The system of claim 2 , wherein the threshold signal strength is based on a number of the plurality of AP devices at the site.

5. The system of claim 1 , wherein the one or more selection criteria comprise inclusion in a list of roam neighbor AP devices generated according to a roaming pattern associated with the first AP device.

6. The system of claim 5 , further comprising a network management system configured to:
receive roaming data from the plurality of AP devices;
generate the roam neighbor list for the first AP device based on the roaming data; and
transmit the roam neighbor list to the first AP device.

7. The system of claim 1 , wherein the one or more processors are configured to encrypt the key according to a site key for the site.

8. The system of claim 1 , wherein the plurality of AP devices includes a second AP device comprising one or more processors configured to:
receive the packet from the first AP device;
determine that the list of AP devices in the packet includes an identifier of the second AP device as one of the roaming candidates for the first AP device;
based on the determination, cache the key of the client device included in the packet in a memory of the second AP device; and
in response to establishing a connection with the client device, generate a packet with the key of the client device and a list of AP devices, wherein the list of AP devices includes one or more identifiers of one or more AP devices within a second set of roaming candidates for the second AP device; and
transmit the packet to the plurality of AP devices at the site.

9. The system of claim 1 , wherein the plurality of AP devices includes a third AP device comprising one or more processors configured to:
receive the packet from the first AP device;
determine that the list of APs in the packet does not include an identifier of the third AP device as one of the roaming candidates for the first AP device; and
based on the determination, bypass insertion of the key into a key cache of the third AP.

10. The system of claim 1 , wherein to transmit the packet to the plurality of AP devices at the site, the one or more processors of the first AP device are configured to one of multicast or broadcast the packet to the plurality of AP devices at the site.

11. A method comprising:
determining, by one or more processors of a first access point (AP) device, a set of roaming candidates for client devices connected to the first AP device, wherein the set of roaming candidates includes one or more AP devices of a plurality of AP devices configured to provide a wireless network at a site, the one or more AP devices selected according to one or more selection criteria;
in response to establishing a connection with a client device, caching, by the one or more processors, a key associated with the client device in a memory of the first AP device;
generating, by the one or more processors, a packet that includes the key associated with the client device and a list of AP devices, wherein the list of AP devices includes one or more identifiers of the one or more AP devices within the set of roaming candidates for the first AP device; and
transmitting, by the one or more processors, the packet to the plurality of AP devices at the site.

12. The method of claim 11 , wherein the one or more selection criteria comprise a signal strength of a signal received by the first AP device from another AP device being above a threshold signal strength value.

13. The method of claim 12 , wherein the threshold signal strength comprises one of a first signal strength for a session key obtained from an authentication, authorization, and accounting (AAA server), and a second signal strength for a session key obtained via a fast roaming protocol, wherein the first signal strength is greater than the second signal strength.

14. The method of claim 12 , further comprising determining the threshold signal strength based, at least in part, on a number of the plurality of AP devices at the site.

15. The method of claim 11 , further comprising:
receiving, from a network management system, a list of roam neighbor AP devices for the first AP device, wherein the one or more selection criteria comprise inclusion in a list of roam neighbor AP devices generated according to a roaming pattern associated with the first AP device.

16. The method of claim 11 , further comprising encrypting the key according to a site key for the site.

17. The method of claim 11 , further comprising:
receiving, by a second AP device, the packet from the first AP device;
in response to determining that the list of AP devices in the packet includes an identifier of the second AP device as one of the roaming candidates for the first AP device, caching the key of the client device included in the packet in a memory of the second AP device; and
in response to establishing a connection with the client device, generating a packet with the key of the client device and a second list of AP devices, wherein the second list of AP devices includes one or more identifiers of one or more AP devices within a second set of roaming candidates for the second AP device; and
multicasting the packet to the plurality of AP devices at the site.

18. An access point (AP) device comprising:
memory; and
one or more processors coupled to the memory and configured to:
determine a set of roaming candidates for client devices connected to the AP device, wherein the set of roaming candidates includes one or more AP devices of a plurality of AP devices configured to provide a wireless network at a site, the one or more AP devices selected according to one or more selection criteria,
in response to establishment of a connection with a client device, cache a key associated with the client device in the memory,
generate a packet that includes the key associated with the client device and a list of AP devices, wherein the list of AP devices includes one or more identifiers of the one or more AP devices within the set of roaming candidates for the AP device, and
transmit the packet to the plurality o

Assignees

• Juniper Networks Inc

Inventors

• Thomas Jacob
• Dey Sanjoy

Classifications

• H04W8/12

  between location registers or mobility servers · CPC title

• H04W84/12

  WLAN [Wireless Local Area Networks] · CPC title

• H04W36/0038

  of security context information · CPC title

• H04L67/5681

  Pre-fetching or pre-delivering data based on network characteristics · CPC title

• H04L63/0892

  by using authentication-authorization-accounting [AAA] servers or protocols · CPC title