Remote access point clustering for user authentication in wireless networks

Patent metadata

Field	Value
Publication number	US-2020280851-A1
Application number	US-201916290451-A
Country	US
Kind code	A1
Filing date	Mar 1, 2019
Priority date	Mar 1, 2019
Publication date	Sep 3, 2020
Grant date	—

Abstract

A method is provided that includes receiving, at a first access point in a local area network, a request from a client device to access a wireless local area network. The method also includes creating authentication credentials for the client device based on an identification of the client device, and transmitting the authentication credentials for the client device to a second access point, wherein the first access point and the second access point share a secure block chain application. The method also includes allowing the client device to roam from the first access point to the second access point without requesting new authentication credentials. A system and a non-transitory, computer-readable medium storing instructions to perform the above method are also provided.

First claim

What is claimed is:

1 . A computer-implemented method, comprising:
receiving, at a first access point in a local area network, a request from a client device to access a wireless local area network; creating authentication credentials for the client device based on an identification of the client device; transmitting the authentication credentials for the client device to a second access point, wherein the first access point and the second access point share a secure block chain application; and allowing the client device to roam from the first access point to the second access point without requesting new authentication credentials.

2 . The computer-implemented method of claim 1 , wherein receiving a request from the client device comprises receiving a user ID and a password from the client device at a first access by the client device, and receiving a self-signed certificate from a public key in the client device at a second, subsequent access by the client device.

3 . The computer-implemented method of claim 1 , wherein creating authentication credentials for the client device comprises generating a set of shared keys.

4 . The computer-implemented method of claim 1 , wherein creating authentication credentials for the client device comprises forming a distributed ledger accessible by multiple access points including the first access point and the second access point, and storing the authentication credentials in the distributed ledger.

5 . The computer-implemented method of claim 1 , wherein transmitting the authentication credentials for the client device comprises transmitting the authentication credentials to multiple access points running the secure block chain application in the wireless local area network.

6 . The computer-implemented method of claim 1 , further comprising adding a time to live to a self-signed certificate from a public key in the client device, wherein the time to live is configured to last for a selected period of time ranging from a few minutes to several hours.

7 . The computer-implemented method of claim 1 , further comprising validating the authentication credentials by the secure block chain application in at least the first access point and in the second access point.

8 . The computer-implemented method of claim 1 , further comprising validating a transaction with the client device by the secure block chain application in at least the first access point and in the second access point, and creating a non-invertible cryptographic record of the transaction.

9 . The computer-implemented method of claim 1 , wherein the first access point and the second access point reside in a remote branch network, and allowing the client device to roam comprises validating the authentication credentials for the client device in the second access point.

10 . The computer-implemented method of claim 1 , wherein the first access point and the second access point reside in a remote branch network, and the computer-implemented method further comprises downloading to the client device, from one of the first access point or the second access point, a network policy associated with the authentication credentials.

11 . A system, comprising:
a memory storing instructions; and one or more processors configured to execute the instructions to:
receive, at a first access point in a local area network, a request from a client device to access a wireless local area network;
create authentication credentials for the client device based on an identification of the client device;
transmit the authentication credentials for the client device to a second access point, wherein the first access point and the second access point share a secure block chain application; and
allow the client device to roam from the first access point to the second access point without requesting new authentication credentials.

12 . The system of claim 11 , wherein to create authentication credentials for the client device, the one or more processors execute instructions to generate a set of shared keys.

13 . The system of claim 11 , wherein to transmit the authentication credentials for the client device, the one or more processors execute instructions to transmit the authentication credentials to multiple access points running the secure block chain application in the wireless local area network.

14 . The system of claim 11 , wherein to receive a request from the client device the one or more processors execute instructions to receive a user ID and a password from the client device at a first access by the client device, and to receive a self-signed certificate from a public key in the client device at a second, subsequent access by the client device.

15 . The system of claim 11 , wherein the one or more processors further execute instructions to add a time to live to a self-signed certificate from a public key in the client device, and wherein the time to live is configured to last for a selected period of time ranging from a few minutes to several hours.

16 . The system of claim 11 , wherein to create authentication credentials for the client device the one or more processors further execute instructions to form a distributed ledger accessible by multiple access points including the first access point and the second access point, and to store the authentication credentials in the distributed ledger.

17 . The system of claim 11 , wherein the one or more processors further execute instructions to validate the authentication credentials by the secure block chain application in at least the first access point and in the second access point.

18 . A non-transitory, computer-readable medium storing instructions which, when executed by a processor, cause a computer to perform a method, the method comprising:
receiving, at a first access point in a local area network, a request from a client device to access a wireless local area network; creating authentication credentials for the client device based on an identification of the client device; transmitting the authentication credentials for the client device to a second access point, wherein the first access point and the second access point share a secure block chain application; and allowing the client device to roam from the first access point to the second access point without requesting new authentication credentials.

19 . The non-transitory, computer-readable medium of claim 18 wherein, in the method, creating authentication credentials for the client device comprises generating a set of shared keys.

20 . The non-transitory, computer-readable medium of claim 18 wherein, in the method, transmitting the authentication credentials for the client device comprises transmitting the authentication credentials to multiple access points running the secure block chain application in the wireless local area network.

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Sethi Aseem
• Wagle Manoj

Classifications

• H04L9/50

  using hash chains, e.g. blockchains or hash trees · CPC title

• H04W12/041

  Key generation or derivation · CPC title

• H04L9/3239

  involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD · CPC title

• H04L2209/80

  Wireless · CPC title

• H04L9/3268

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title