Wireless network having multiple security interfaces

A number of wireless networks are established by a network device, each wireless network having an identifier. Requests are received from client devices to establish wireless network sessions via the wireless networks using the identifiers. Network privileges of the client devices are segmented into discrete security interfaces based on the identifier used to establish each wireless network session.

BACKGROUND OF THE INVENTION

A. Field of the Invention

The principles of the invention relate generally to wireless computer networks, and more particularly, to wireless computer networks configured to include multiple security interfaces.

B. Description of Related Art

In recent years, it has been found that Wireless Local Area Networks (WLANs) offer an inexpensive and effective extension of a wired network or standard local area network (LAN).FIG. 1is a block diagram illustrating a conventional network100including both wired and wireless components. Using a wireless router or access point (AP)102, network100may include wired elements, such as server104and local client106and wireless elements, such as client devices108,110,112, and114connected to AP102via wireless network116. Recently, most deployments of WLANs have conformed to the various Institute of Electrical and Electronics Engineers (IEEE) 802.11x standards (e.g., 802.11b, a, and g) that operate over the unregulated 2.4 and 5 GHz frequency spectrums. A firewall118may be implemented to protect network100and act as a security gate to fend off unauthorized traffic coming from the Internet at large120.

In operation, client devices108-114may access wireless network116by selecting or otherwise identifying the Service Set Identifier (SSID) associated with network116. As is known in the art, traffic across network116may be encrypted using several available network layer security protocols, such as the Wired Equivalent Privacy (WEP) or Wi-Fi Protected Access (WPA) protocols. Assuming that one of these protocols is employed, client devices108-114must enter an encryption key or password prior to being granted access to network100.

Unfortunately, once granted, access to network116is granted identically to all client devices108-114in possession of network116's SSID and associated password, regardless of the individual security level associated with a client device's user. Accordingly, lower level (e.g., layer 2 of the OSI Network Model) segmentation of the wireless user base is rendered impossible, thereby requiring reliance upon higher level security procedures to provide security to network100.

SUMMARY OF THE INVENTION

One aspect consistent with principles of the invention is directed to method for providing wireless network functionality is provided. The method includes; establishing, by a network device, a number of wireless networks, each wireless network having an identifier; receiving, at the network device, requests from client devices to establish wireless network sessions via the wireless networks using the identifiers; and segmenting network privileges of the client devices into discrete security interfaces based on the identifier used to establish each wireless network session.

In a second aspect consistent with principles of the invention, a method for providing wireless network security may include mapping wireless network identifiers to predefined security policies; receiving a request from a client device to access a wireless network using one of the wireless network identifiers; establishing a wireless network session with the client device; receiving network traffic from the client device, the network traffic having a destination resource; and performing security processing on the network traffic based on the predefined security policies mapped to the wireless network identifier used to establish the wireless network session.

In a third aspect consistent with principles of the invention, an apparatus is provided. The apparatus may include a network device configured to provide discrete wireless network interfaces, each discrete wireless network interface having an identifier associated therewith, wherein the network device is configured to map the unique identifiers to security zones, wherein the network device is configured to establish wireless network sessions with client devices based on the identifiers, and wherein the network device is configured to segment security privileges of the client devices based on the security zone associated with the identifier used to establish each wireless network session.

DETAILED DESCRIPTION

The following detailed description of embodiments of the principles of the invention refers to the accompanying drawings. The same reference numbers in different drawings may identify the same or similar elements. Also, the following detailed description does not limit the invention. Instead, the scope of the invention is defined by the appended claims and equivalents.

As described herein, a network device provides access to one or more wireless networks via a number of unique identifiers. Each unique identifier is then associated with or mapped to a security zone, such that client devices access the wireless network via a unique identifier that is processed in accordance with the associated security zone.

System Overview

FIG. 2illustrates an exemplary system200in which embodiments of systems and methods consistent with the principles of the invention may be implemented. As illustrated, system200may include a network device202and a group of client devices204a,204b,204c, and204n(collectively “client devices204) connected to network device202by a number of wireless networks206,208,210, and212. Network device202may then map each of client devices204to one or more of a number of security zones214,216,218,220based upon the network206-212to which they are connected. In accordance with principles of the invention, zones214-220may also incorporate traditional wired devices or networks, as will be described in additional detail below. Network device202may also be connected to an untrusted network222, such as an external network or the Internet.

In accordance with principles of the invention, network device202may be configured to provide both wireless access point and network firewall functionality. More specifically, network device202may be configured to provide multiple discrete wireless networks and perform policy and firewall decisions between each network, thereby substantially improving the security of system200. As illustrated inFIG. 2, in one implementation consistent with principles of the invention, network device202may be configured to provide four discrete wireless networks206-212, each having a distinct SSID associated therewith. Furthermore, each wireless network206-212may be mapped to its own individual security zone214,216,218, or220. In this manner, each network206-212may be configured to provide different levels of security protection. By providing distinct networks206-212, network device202provides multiple security interfaces to network200, each of which are fully configurable from a security standpoint.

Although four distinct client devices204have been shown, it should be understood that the number and type of client devices204illustrated inFIG. 2, are provided for simplicity. In practice, a typical system may include any number and type of client devices204. In addition, although a four zone security system has been described, the present invention may also be implemented in a system having more or fewer than four distinct security zones, including multiple zones configured either physically or logically within the system. Furthermore, although four wireless networks206-212are shown in the exemplary implementation, more or fewer wireless networks may be implemented in accordance with principles of the invention. Client devices204may include devices, such as personal computers, laptops, or other devices capable of initiating, transmitting, and receiving data and/or voice communications via networks206-212, and222.

In one implementation consistent with principles of the invention, network device202may include any combination of hardware and software capable of transmitting and receiving wireless network traffic and for applying security policies to the transmitted and received wireless network traffic. As described in additional detail below, in one implementation consistent with principles of the invention, network device202may be configured to transmit and receive wireless network traffic using a number of different SSIDs. In this implementation, each SSID is associated with a security zone. The network device may then apply security policies for the traffic based on the security zone associated with the SSID in use.

Untrusted network222may include one or more networks, such as the Internet, an intranet, a local area network (LAN), a wide area network (WAN), or another type of network that is capable of transmitting data communications from a source device to a destination device.

FIG. 3is an exemplary configuration of network device202ofFIG. 2in an implementation consistent with the principles of the invention. It will be appreciated that client devices204may be similarly configured. As illustrated, network device202may include a bus310, processing logic320, an Application Specific Integrated Circuit (ASIC)330, a memory340, and a group of communication interfaces350. Bus310permits communication among the components of network device202.

Processing logic320may include any type of conventional processor or microprocessor that interprets and executes instructions. ASIC330may include one or more ASICs capable of performing network-related functions. More specifically, in one implementation, ASIC330may perform security and access point related functionality.

Memory340may include a random access memory (RAM) or another dynamic storage device that stores information and instructions for execution by processing logic320; a read only memory (ROM) or another type of static storage device that stores static information and instructions for use by processing logic320; and/or some other type of magnetic or optical recording medium and its corresponding drive. Communication interfaces350may include any transceiver-like mechanism that enables network device202to communicate with other devices and/or systems, such as client devices204and devices associated with networks206-212and222.

As will be described in detail below, network device202, consistent with the principles of the invention, may perform network communications-related operations. Network device202may perform these and other operations in response to processing logic320executing software instructions contained in a computer-readable medium, such as memory340. A computer-readable medium may be defined as one or more memory devices and/or carrier waves.

The software instructions may be read into memory340from another computer-readable medium or from another device via a communication interface350. The software instructions contained in memory340may cause processing logic320to perform processes that will be described later. Alternatively, hardwired circuitry may be used in place of or in combination with software instructions to implement processes consistent with the principles of the invention. Thus, systems and methods consistent with the principles of the invention are not limited to any specific combination of hardware circuitry and software.

Exemplary Processing

As described above, network device202enables the establishment of multiple wireless security zones and facilitates the exchange of network traffic between the available zones.FIG. 4is an exemplary flow diagram illustrating one implementation of processing for establishing a wireless network session and subsequent handling of network traffic using the established session. Network device202is initially configured to establish a number of wireless networks206-212, each network206-212having a discrete identifier associated therewith (act400). In one exemplary implementation, the identifiers include SSIDs. As is known in the art, network device202may be further configured to broadcast one or more of the SSIDs, so as to announce the existence of the network(s)206-212to compatible client devices204. Alternatively, network device202may be configured to require explicit identification of the SSIDs by the client devices204prior to negotiating a network session. This second method prevents identification of the network(s)206-212to client devices not otherwise privy to the network SSIDs.

Once the wireless networks206-212have been established, each network206-212is mapped to one of a number of security zones214-220through its associated SSID (act402). As will be described in additional detail below, each security zone may enforce differing levels of policy-based control, such that network traffic received from client devices204connected to network device202through different SSIDs are subjected to different security policies and other authentication criteria. For example, first security zone214may be configured to enable client devices204associated therewith access to trusted network resources (e.g., databases or folders within a corporate LAN) and prevent access to untrusted network resources (e.g., general web sites). Alternatively, second security zone216may be configured to enable client devices204associated therewith access only to untrusted network resources. In this manner, second zone216may be considered a guest zone, effectively partitioned from trusted network resources at the data link level (e.g., layer 2 of the OSI model).

Once wireless networks206-212have been mapped to security zones214-220, network device202is ready to receive connection requests from client devices (act404). For example, client device204aillustrated inFIG. 2may request access to network206by submitting or otherwise selecting the SSID associated with network206in act400. In response to the connection request, network device202may enforce any wireless network level authentication or privacy considerations associated with network206(e.g., WEP or WPA encryption keys, etc.) (act406). Provided that the network level (layer 3 of the OSI model) authentication or privacy information is properly provided by client device204a, network device202may establish a wireless network session with client device204a(act408).

Once a session has been established, network device202may receive network traffic from client device204abound for a particular network resource, such as another computer or server (e.g., a web server), a networked storage device, etc. via wireless network206(act410). As discussed above, the source zone for the received network traffic is determined based on the SSID used to establish the network session. In more general terms, receiving network traffic from client device204amay involve receiving a packet or other unit of data designating source and destination addresses and ports as well as an indication regarding the type of service or protocol requested (e.g., a packet's five-tuple). By examining information included within the packet (e.g., the destination IP address and/or port), network device202may identify the destination zone associated with the packet. The destination zone, in combination with the source zone of the traffic, is then used to identify the security policies to be applied. For example, client device204amay request access to a database connected to network device202by a wired network connection (e.g., an Ethernet connection) in security zone216. It should be understood that each network resource available to client device204ais also associated with one of security zones214-220or untrusted network222. Additionally, it should be understood that, in addition to a packet's five-tuple, any suitable packet information may be utilized to identify a destination zone and/or processing to be applied to the traffic.

Upon receipt of the network traffic, network device202may perform a security policy search (act412) and may apply any identified network security policies or other network processing based on the security zone associated with the client device204making the request and the relevant security zone of the requested network resource (act414). In the present example, security policies based on requests from first security zone214for resources in second security zone216are applied, since client device204ahas established a wireless network session with network device202via network206and the desired database resides in zone216.

Additional examples of security policies may include additional levels of encryption or authentication, such as establishment of a virtual private network (VPN) connection, an IPSec tunnel, or a similar encryption/authentication procedure. Furthermore, the policy processing may also perform additional functions, such as URL filtering or other content-based restrictions on network access. In addition to security-based processing, additional information processing, such as information translations may also be performed by network device202. For example, incoming packets may be network address translated or port translated so as to modify various pieces of information in outgoing or transmitted data packets.

At this point, it is determined whether the applied security policies permit the access to the requested resource (act416). If so, the access is permitted (act418). However, if the applied security policies do not permit access to the requested resource, access is denied (act420).

As is understood in the art, upon establishing a wireless session between a client device204and network device202, client device204is typically assigned an IP address associated with the network. In many implementations, this assignment is performed by a DHCP server (not shown) associated with network device202. In an implementation consistent with principles of the invention, the DHCP server may be configured to apply different ranges of IP addresses to client devices based on various criteria (e.g., media access control (MAC) addresses, physical location, type of device, etc.). For example, client device204aestablishing a network session may be assigned IP addresses in the 10.12.2.10-40 range, while client device204bmay be assigned IP address in the 10.12.2.41-100 range. In this manner, assigned IP addresses may be used to map devices into several security zones.

FIG. 5is another exemplary flow diagram illustrating one implementation of processing for establishing a wireless network session and subsequent handling of network traffic using the established session. InFIG. 5, the network device may be initially configured to establish a wireless network having a single SSID (act500).

Once the wireless network has been established, a DHCP server associated with the network device may be configured to assign unique IP address ranges based on various criteria associated with the respective client devices (act502). In one implementation consistent with principles of the invention, each IP address range may be mapped to one of a number of security zones (act504). As will be described in additional detail below, each security zone may enforce differing levels of policy-based control, such that network traffic received from client devices connected to network device through different IP address ranges are subjected to different security policies and other authentication criteria. For example, a first IP address range may be configured to enable client devices associated therewith access to trusted network resources (e.g., databases or folders within a corporate LAN) and prevent access to untrusted network resources (e.g., general web sites). Alternatively, a second IP address range may be configured to enable client devices associated therewith access only to untrusted network resources. In this manner, the second IP address range may be assigned to client devices having a “guest” status, effectively partitioning those client devices from trusted network resources at the data link level (e.g., layer 2 of the OSI model).

Once the various IP address ranges have been associated with the security zones, the network device is ready to receive a connection request from a client device (act506). For example, a client device may request access to the network by submitting or otherwise selecting the SSID associated with the network in act500. In response to the connection request, the network device may enforce any wireless network security associated with the network (e.g., WEP or WPA encryption keys, etc.) (act508). Provided that the network layer (layer 3 of the OSI model) security information is properly provided by client device, the network device may establish a wireless network session with client device (act510).

Once a session has been established, the network device may receive network traffic from the client device bound for a particular network resource, such as another computer or server (e.g., a web server), a networked storage device, etc. via the wireless network (act512). As described above, a source zone is assigned to the traffic based upon the IP address assigned to the client device. By examining the information in the packet, the network device may identify the destination zone associated with the traffic. For example, the client device having a first IP address within the first range of assigned IP addresses (mapped to a first zone) may request access to a database having an IP address within a second range of assigned IP addresses (mapped to a second zone) and connected to the network device by a wired network connection (e.g., an Ethernet connection). It should be understood that each network resource available to the client device is assigned a unique IP address within the various predetermined ranges of IP addresses, thereby designating the security zone associated with the network resource.

Upon receipt of the network traffic, the network device may perform a security policy search based on the identified source and destination security zones (act514) and may apply any identified network security policies (act516). In the present example, security policies based on requests from a client device assigned an IP address within a first range of IP addresses for access to a resource having an IP address in a second range of IP addresses are applied.

At this point, it is determined whether the applied security policies permit the network traffic to pass through to the requested resource (act518). If so, the traffic is passed through (act520). However, if the applied security policies do not permit the traffic to pass, access is denied (act522). By mapping discrete IP address ranges to individual security zones, information regarding a client device's security level may be associated with a packet throughout its passage through the network.

EXAMPLE

FIG. 6illustrates an exemplary system600in which embodiments of systems and methods consistent with the principles of the invention may be implemented. As illustrated, system600may include a network device602and client devices604and606connected to network device602by wireless connections608and610. Additionally, wired network resources612,614, and616are also connected to network device602by wired connections618and620. Each of client devices604and606and network resources612-616are associated with one of four security zones622,624,626, and628. In a manner consistent with principles of the invention, the security zone association of client devices604and606may be based on the wireless connection608or610to which the client devices are connected. Security zone associations for wired network resources612-616may be based on traditional security processing. Network device602may also be connected to an untrusted network630, such as an external network or the Internet.

In the present implementation, network device602receives two packets from client device604, a first packet bound for a database server612(represented by arrow632) and a second packet bound for a web server614(represented by arrow634). In accordance with principles of the invention, network device602, in response to the received packets, may perform a policy search relating to packets having a second zone624source and a fourth zone628destination. The policy search may reveal that client device604in second zone624may connect to database server612, and may not connect to web server614. Similarly, in response to a packet received from client device606in first zone622requesting an internet resource (represented by arrow636) in untrusted zone630, network device602may determine that such packets are permitted based on the source security zone associated with client device606to connect to network device602.

CONCLUSION

Implementations consistent with principles of the invention provide for enhanced wireless network security by segmenting client devices accessing a wireless network based on a number of discrete SSIDs. In this manner, systems consistent with principles of the invention provide substantially improved security at the lower and more secure levels, rather than relying solely upon higher level security for networked client devices.

The foregoing description of exemplary embodiments of the present invention provides illustration and description, but is not intended to be exhaustive or to limit the invention to the precise form disclosed. Modifications and variations are possible in light of the above teachings or may be acquired from practice of the invention.

Moreover, while a series of acts has been disclosed with regard toFIGS. 4 and 5the order of the acts may be varied in other implementations consist with the present invention. Furthermore, non-dependent acts may be implemented in parallel.

Further, certain portions of the invention may be implemented as “logic” that performs one or more functions. This logic may include hardware, such as an application specific integrated circuit (ASIC) or a field programmable gate array, software, or a combination of hardware and software. While aspects have been described in terms of processing messages or packets, these aspects may operate upon any type or form of data, including packet data and non-packet data. The term “data unit” may refer to packet or non-packet data.