Handling wireless client devices associated with a role indicating a stolen device

Example method includes: receiving, by a network device, a connection request to a wireless local area network (WLAN) from a client device; determining, by the network device, that the client device is associated with a particular role indicating that the client device is stolen; and performing, by the network device, a set of special handling operations that facilitates maintaining an active connection between the client device and the WLAN, collecting and reporting information about the client device to an investigation agency.

BACKGROUND

The high resale value of wireless devices (e.g., smartphones), along with the personal information contained on such devices, make them a prime target for criminals and identity thieves. According to the consumer guides by Federal Communications Commission (FCC), to protect a wireless device, a user is advised to install and maintain anti-theft software application, which can locate the device from any computer or device connected to the internet; lock the device to restrict access; wipe sensitive data from the device; trigger the device to emit a loud noise to help the police locate it. In the event a wireless device is stolen, the user may attempt to locate the device by calling it or by using the anti-theft software application's geo-locator. The user shall immediately report the theft to the police, including the make and model, manufacture serial number, and IMEI or MEID or ESN number, and report to the cellular service provider. Cellular service provider may be able to use the IMEI or MEID or ESN number to disable the stolen wireless device and block access to the information it carries.

DETAILED DESCRIPTION

Law enforcement agencies and cellular service providers generally have procedures in place in the event a user of a wireless client device reports that the wireless client device is stolen. For example, the user may be required to report information about the stolen wireless client device, including the make and model, the manufacture serial number, the International Mobile Equipment Identity (IMEI), mobile equipment identifier (MEID), and/or electronic serial numbers (ESN) number, to the police department and/or the cellular service provider. The cellular service provider may be able to use the IMEI or MEID or ESN number to disable the stolen wireless client device and/or block access to the information it carries in the cellular network. The police department may maintain a national registry of stolen devices.

However, when the stolen device carries wireless local area network (WLAN) authentication credentials, existing mechanisms in the WLAN to handle such stolen devices are inadequate. For example, current solutions merely use the knowledge of stolen device identifiers for WLAN access controls. If a wireless client device is reported by a user to a network administrator as being stolen, the network administrator will associate the media access control (MAC) address uniquely corresponding to the stolen wireless client device with a flag indicating that the wireless client device is stolen. Thereafter, if any network device in the WLAN receives a connection request from the wireless client device previously flagged as stolen, the wireless client device's access to the WLAN will be denied. Nevertheless, a simple denial-of-service would not be sufficient to safeguard the wireless client device. The examples herein describe enhanced handling by the network devices in WLAN that can gather information that facilitates law enforcement agencies to investigate the thefts, leverage available external resources (e.g., national registries), and collaborate with external government and/or private organizations/agencies to provide comprehensive safeguard of wireless client devices.

As used herein, “network device” generally includes a device that is adapted to transmit and/or receive signaling and to process information within such signaling such as a station (e.g., any data processing equipment such as a compute cellular phone, personal digital assistant, tablet devices, etc.), an access point, data transfer devices (such as network switches, routers, controllers, etc.) or the like. For example, a “network device may refer to a network controller that comprises a hardware or a combination of hardware and software that enables connection between client devices and computer networks. In some implementations, a network device may refer to a server computing device (e.g., on-premise server, private, public, or hybrid cloud server) that comprises a hardware or a combination of hardware and software that can process and/or display network-related information. In some implementations, a network device may refer to an access point acting as a virtual master network controller among a cluster of access points.

As used herein, “access point” (AP) generally refers to receiving points for any known or convenient wireless access technology which may later become known. Specifically, the term AP is not intended to be limited to IEEE 802.11-based APs. APs generally function as an electronic device that is adapted to allow wireless devices to connect to a wired network via various communications standards.

FIG. 1is a block diagram of an example networking environment for handling wireless client devices associated with a role indicating a stolen device.FIG. 1includes at least a wireless local area network (WLAN)100, a cloud infrastructure130, and a server140. WLAN100and server140can be connected via cloud infrastructure130.

WLAN100generally refers to a wireless computer network that links two or more devices using a wireless communication protocol (e.g., a protocol as specified in IEEE 802.11 standards) within a coverage area, thereby providing client devices with the ability to move around within the coverage area while remaining connected to the network. In this example, WLAN100may include at least a network controller110, an access point (AP)120and a client device150. AP120and network controller110may be connected via a wired connection. Client device150may be connected to AP120via a wireless or wired connection. Further, client device150is associated with user155and may store sensitive personal data of user155.

Cloud130generally refers to a cloud infrastructure that enables ubiquitous access to shared pools of configurable system resources and higher-level services, which can be rapidly provisioned with reduced management effort over the Internet. Cloud130may be operated by a third-party vendor to enable organizations deployed with WLAN100to focus on their core businesses instead of information technology (IT) infrastructure and maintenance.

Server140may be any type of computing system that responds to requests across any network to provide a network and/or data service. Specifically, server140may provide network access control and/or authentication services for WLAN100. Server140may access a database145to retrieve access control policies and rules associated with WLAN100. In some examples, database145may be an intrinsic component of server140. In other examples, database145may be external but accessible to server140. Access control policies and rules may be stored in a number of tables, including table180. In some examples, table180may include at a list of wireless client devices that are reported as being stolen to a network administrator (e.g., Admin165). In Table180, the wireless client devices may be uniquely identified by an identifier, including but not limited to, a MAC address, a manufacture serial number, IMEI number, MEID number, ESN number, etc.

In some examples, Admin165may represent an external entity, such as a law enforcement agency. Further, the law enforcement agency (e.g., Admin165) may maintain a separate database (e.g., database160) that includes identifiers of wireless client devices that are reported by a user (or owner of the device) as being stolen in a national or global registry. In this scenario, Table180may be synchronized periodically by server140with the separate database maintained by the external entity (e.g., database160maintained by the law enforcement agency).

In some examples, table180may include information about wireless client devices that are connected to or have been connected to WLAN100regardless of whether they have been reported as stolen. If a particular wireless client device (e.g., Client Device150) is reported by a user (e.g., user155) as being stolen, then server140can look up an entry corresponding to the particular wireless client device in table180and flag the particular wireless client device as being stolen. Similarly, server140can periodically receive updates from any database (e.g., database160) from external entity that may store stolen device information, retrieve the device identifier from the received information, determine whether a record corresponding to the retrieved identifier exists in table180, and if so, flag the record as associated with a wireless client device that is stolen. In some examples, table180may use a different wireless client device identifier (e.g., a MAC address) than the wireless client device identifier (e.g., IMEI, MEID, ESN, etc.) used by the external entity's database (e.g., database160). Further, server140may convert the wireless client device identifier from a first type (e.g., IMEI, MEID, ESN, etc.) used by the external entity's database to a second type (e.g., MAC address) stored in table180.

In normal circumstances, when client device155connects to WLAN100, client device155transmits an association request to AP120. Then, AP120transmits an association response back to client device155. Next, client device155transmits an authentication request to AP120, which is forwarded to network controller110. Network controller110may be connected to an authentication server (e.g., server140) either locally or remotely (possibly via cloud infrastructure130). In some examples, network controller110may inquire server140to determine an appropriate user role for user155of client device150and/or corresponding WLAN resource access level for client device150. For example, when the user role indicates that user155is an employee, client device150may have full access to resources in WLAN100; whereas when the user role indicates that user155is a guest, client device150may have limited access to resources in WLAN100. If the user role of user155indicates that access to WLAN100is granted, AP120may subsequently transmit an authentication response to client device150. Thereafter, client device150can access resources in WLAN100subject to network policies associated with the user role.

According to examples of the present disclosure, after user155reports that client device150is stolen to a network administrator of WLAN100, the network administrator may flag the record corresponding to client device150in table180as being stolen. As such, client device150is associated with a special user role indicating that client device150is stolen. Note that this special user role is device-specific. Thus, if user155owns multiple client devices, the other client devices may continue using the network credential of user155to log on to WLAN100with the user role (e.g., an employee) associated with user155, and be provided with appropriate WLAN resource access based on the user role. However, if client device150attempts to connect to WLAN100using the network credential of user155after client device150is flagged as being stolen, network controller110may transmit the authentication request to server140as usual. But server140may determine that client device150has been assigned to the special user role indicating that client device150is stolen. Therefore, server140may notify network controller110of the special user role, for example, in an authentication response. Network controller110may maintain a local cache that stores a list of unique device identifiers that are associated with the special user role indicating stolen devices, for example, in table170. Upon receiving such information from server140, network controller110may update table170to include the unique device identifier (e.g., MAC address) associated with client device150. Thus, if client device150later tries to connect to WLAN100through a different AP, network controller110can determine that client device150is associated with the special user role (i.e., a stolen client device) without forwarding the authentication request to server140via cloud infrastructure130.

In some example, the special user role is associated with a set of special firewall policies created for the stolen devices. The set of special firewall policies govern how AP120may handle traffic to and from client device150after it is reported as being stolen. Therefore, instead of denying services to client device that is reported as being stolen, AP120may redirect client device150to a captive portal that requests a current user of client device150to complete a device registration process, in order to gather more information about the current user. The information gathered through the device registration process by the captive portal may be shared with external entities (e.g.; law enforcement agencies) for further investigations.

In some examples, the set of special firewall policies may allow client device150to be associated with AP120, but with a basic set of WLAN access, e.g., The Hypertext Transfer Protocol (HTTP) access. The basic set of WLAN access can keep the current user of client device150engaged with WLAN100without compromising network security of WLAN100and user data privacy and integration of user155.

In some examples, network controller110may notify an analytics and location engine (ALE) in WLAN100to start monitoring and tracking locations of client device150. Specifically, because client device150is associated with the special user role indicating that it is stolen, the monitoring and tracking of client device location may be performed with higher frequency and/or accuracy for client device150than other client devices of WLAN100. In one example, a larger than default number of APs in the radio frequency (RF) neighborhood of AP120are notified by the ALE to report signals received from client device150when client device150is authenticated to WLAN100with the special user role associated with stolen devices, Therefore, the ALE can collect more signal data associated with client device150than other client devices whose locations are tracked by the ALE. The location and analytical information gathered by the ALE may also be shared with external entities (e.g., law enforcement agencies) for further investigations.

In some examples, network controller110may initiate deep packet inspection (DPI) to start monitoring traffic transmitted to and from client device150upon its connection to WLAN100. DPI allows network controller110to determine a type of application that client device150uses, a type of traffic (e.g., voice, video, etc.) that client device150transmits, etc. Traffic information gathered via DPI by network controller110may also be shared with external entities (e.g., law enforcement agencies) for further investigations.

In some examples, network controller110may initiate aggressive monitoring of network traffic to and from client device150that is associated with the special user role indicating a stolen device. Specifically, network controller110may notify a plurality of APs located in the RF neighborhood of AP120to increase scanning frequency on a particular wireless communication channel on which client device150is associated with AP120. The plurality of APs can report signals from client device150that they detect during the more frequent channel scanning on the particular wireless communication channel, thereby enable network controller110to perform heightened surveillance on client device150.

In some examples, network controller110may install a client-side application on client device150after client device150is authenticated to WLAN100. The client-side application can be a lightweight background agency application that is capable of monitoring local parameters of client device150, collecting usage statistics of client device150, reporting locally collected device data to network devices in WLAN100, etc. Because the client-side application is constantly being executed in a background of client device150, the client-side application can periodically transmit packets to AP120in WLAN100at a particular interval to ensure that client device150will not enter into a power save mode. Therefore, the ALE in WLAN100can track the location of client device150continuously. Note that normal wireless client devices may be allowed to enter into a power save mode, and the ALE will refrain from sending packets to client devices in the power save mode. In some examples, network controller110may instruct AP120to set a bit in a traffic indication message (TIM) information element in a beacon and adjust a delivery traffic indication message (DTIM) interval value associated with client device150to prevent client device150from entering into the power save mode, Note that the DTIM interval value remains unchanged for other client devices associated with AP120and correspond to other user roles as determined by server140.

In some examples, when client device150attempts to join WLAN100, client device150may transmit a probe request that includes a service set identifier (SSID) that does not match any SSID associated with WLAN100, or a probe request that does not include any SSID. Particularly, network connection information previously stored on client device150may be deleted after client device150is stolen. However, network controller110in WLAN100may allow connection to WLAN100using the SSID in the probe request received from client device150. In some examples, the probe request received from client device150may not include any SSID at all. In other words, once client device150is identified as associated with the special role indicating that it is a stolen device, network controller110can impersonate any network with any SSID that client device150attempts to connect to. By allowing connection to WLAN despite of a mismatched SSID or a missing SSID in the probe request received from client device150, network devices (e.g., network controller110and AP120) can effectively keep client device150connected to and remain active in WLAN100.

FIG. 2is a sequence diagram of example communication exchanges for handling wireless client devices associated with a role indicating a stolen device. For illustration purposes,FIG. 2includes at least a client device200, an AP210, a network controller220, and a server230. AP210and network controller220are both network devices operating in a WLAN. AP210may provide network access to wireless client devices in the WLAN, whereas network controller220manages AP210and/or any client devices that serviced by AP210. In this example, assuming that client device200has been reported as being stolen by its user. Accordingly, a unique device identifier (e.g., MAC address) corresponding to client device200has been flagged by a network administrator in a table accessible by server230. Server230may perform authentication and/or authorization for a WLAN. AP210periodically broadcast beacon frames on its wireless operating channel. For example, at time point t1, AP210may broadcast a beacon frame240, which includes a service set identifier (SSID) corresponding to the WLAN. After beacon frame240is received by client device200, at time point t2, client device200may transmit a probe request242to AP210in order to connect to the WLAN. In some examples, probe request242may include a SSID. In some examples, the SSID may be a null value, because network configurations may be deleted after client device200is stolen. In some examples, the SSID in probe request242may be a value that is different from the SSID in beacon frame240. In some examples, the SSID in probe request242may be the same as the SSID in beacon frame240. Nevertheless, regardless whether the SSID in probe request242is null or matches the SSID in beacon frame240, at time point t3, AP210will transmit a probe response244to client device200in response to the receipt of probe request242from client device200.

Thereafter, client device200may transmit an association request246to AP210. In some examples, association request246may include a SSID corresponding to the WLAN. In some examples, the SSID may be a null value, because network configurations may be deleted after client device200is stolen. In some examples, the SSID in association request246may be a value that is different from the SSID advertised and broadcasted by AP210in beacon frame240. In some examples, the SSID in association request246may be the same as the SSID in beacon frame240. Nevertheless, regardless whether the SSID in association request246is null or matches the SSID in beacon frame240, at time point t5, AP210will transmit an association response248to client device200to establish a wireless association with client device200.

Next, client device200may transmit an authentication request250at time point is to AP210. AP210may forward authentication request250to network controller220. In some examples, network controller220may maintain a local cache that is synchronized270periodically with a database that is maintained by authentication server230. The local cache and the database store information about stolen devices in the WLAN that have been reported to the network administrator. Thus, network controller220may check its local cache to determine whether client device200is flagged as a stolen device. If so, network controller220may proceed to perform a set of special handling operations256.

In some examples, as illustrated inFIG. 2, network controller220may transmit a request252to server230at time point t7, whereas request252may include at least a unique device identifier (e.g., MAC address) corresponding to client device200and other authentication information, such as a user credential. Server230will determine a role associated with client device200and an access control level for client device200based on preconfigured network policies and rules that are applicable to the determined role. In some examples when server230determines that client device200is flagged as being stolen, server230can assign a special user role to client device200, and transmit the information about the special user role to network controller220in an authentication response254at time point t8.

At time point t9, network controller220receives authentication response254indicating that client device200is associated with the special user role indicating that client device200is a stolen device. Therefore, network controller220may perform a set of special handling operations256.

For example, according to the set of special handling operations256, at time point t9, network controller220may apply a set of special firewall policies created for stolen devices that are assigned with the special user role. The set of special firewall policies govern how AP210may handle traffic to and from client device200. In some examples, rather than denying services to client device200, at time point t10, network controller220may transmit instructions258to AP210to redirect client device200to a captive portal to complete a device registration in order to gather more information about the current user. The information gathered through the device registration process by the captive portal may be shared with external entities (e.g., law enforcement agencies) for further investigations.

Furthermore, according to the set of special handling operations256, at time point t10, network controller220may transmit instructions258to AP210to allow client device200to be associated with AP210, but with a basic set of WLAN access, e.g., The Hypertext Transfer Protocol (HTTP) access. The basic set of WLAN access can keep the current user of client device200engaged with the WLAN without compromising network security of WLAN and user data privacy and integration of the device owner.

Also, according to the set of special handling operations256, at time point t9, network controller220may notify an analytics and location engine (ALE) in the WLAN to start monitoring and tracking locations of client device200. Specifically, because client device200is associated with the special user role indicating that it is stolen, the monitoring and tracking of client device location may be performed with higher frequency and/or accuracy for client device200than other client devices in the WLAN. In one example, a larger than default number of APs in the radio frequency (RF) neighborhood of AP210are notified by the ALE to report signals received from client device200, such that the ALE can collect more signal data associated with client device200than other client devices in the WLAN. The location and analytical information gathered by the ALE may also be shared with external entities (e.g., law enforcement agencies) for further investigations.

Furthermore, according to the set of special handling operations256, a time point t10, network controller220may transmit instructions258to AP210, instructing AP210to perform deep packet inspection (DPI) to monitor data traffic transmitted to and from client device200. Traffic information gathered via DPI by network controller220may also be shared with external entities (e.g., law enforcement agencies) for further investigations.

In some examples, according to the set of special handling operations256, at time point t9, network controller220may initiate aggressive monitoring of network traffic to and from client device200that is associated with the special user role. Specifically, network controller220may notify a plurality of APs located in the RF neighborhood of AP210to increase the scanning frequency or the dwelling time on a particular wireless communication channel on which client device200is associated with AP210. The plurality of APs can report signals from client device200that they detect on the particular wireless communication channel during the aggressive monitoring. Analytics information based signal data gathered via aggressive monitoring by network controller220may be shared with external entities (e.g., law enforcement agencies) for further investigations.

In some examples, according to the set of special handling operations256, at time point t10, network controller220may transmit instructions258to AP210to install a client-side application on client device200. The client-side application is capable of monitoring local parameters of client device200, collecting usage statistics of client device200, reporting locally collected device data to network devices in the WLAN, etc. Because the client-side application is constantly being executed in a background thread of client device200, the client-side application can transmit packets to AP210at a particular interval to ensure that client device200does not enter into a power save mode.

In some examples, according to the set of special handling operations256, at time point t10, network controller220may transmit instructions258to AP210to set a bit in a traffic indication message (TIM) information element in a beacon and adjust a DTIM interval value associated with client device200to prevent client device200from entering into the power save mode. Note that the DTIM interval value remains unchanged for other client devices associated with AP210and correspond to other user roles as determined by server230.

At time point t11, AP210executes instructions258received from network controller220to perform heightened surveillance that allow stolen client device200to maintain an active connection280to AP210, while collecting information about stolen client device200, which can be reported to external entities (e.g., law enforcement agencies).

Processes of Handling Wireless Client Devices Associated with a Role Indicating a Stolen Device

FIG. 3is a flowchart of an example process of handling wireless client devices associated with a role indicating a stolen device. During operations, a network device may receive a connection request to a wireless local area network (WLAN) from a client device (operation310). Then, the network device may determine that the client device is associated with a particular role indicating that the client device is stolen (operation320). Furthermore, the network device may perform a set of special handling operations that facilitates maintaining an active connection between the client device and the WLAN, collecting and reporting information about the client device to an investigation agency.

In some examples, the network device may include a network controller that has a cache storage storing a plurality of client device identifiers corresponding to reported stolen devices. The plurality of client device identifiers may include a particular identifier uniquely identifying the client device. For example, the particular identifier may include at least one of: a media access control (MAC) address, a manufacture serial number, an International Mobile Equipment Identity (IMEI), a mobile equipment identifier (MEID), and an electronic serial numbers (ESN).

In some examples, the set of special handling operations may include instructing an access point in the WLAN to redirect the client device associated with the particular role indicating that the client device is stolen to a captive portal to complete a device registration. The information about the client device gathered by the captive portal may be shared with the investigation agency.

In some examples, the set of special handling operations may include instructing an access point in the WLAN to allow connection from the client device while granting the client device limited access to network resources in the WLAN. The limited access is granted to the client device to maintain the active connection between the client device and the WLAN.

In some examples, the set of special handling operations may include notifying a location engine in the WLAN to start tracking locations of the client device at a higher frequency than a frequency previously used before the client device is associated with the particular role indicating that the client device is stolen.

In some examples, the set of special handling operations may include notifying a location engine in the WLAN to start collecting signal information related to the client device from a higher number of access points (APs) than a number of APs previously used before the client device is associated with the particular role indicating that the client device is stolen.

In some examples, the set of special handling operations may include notify an access point that the client device is associated with to perform deep packet inspection (DPI) to monitor data traffic transmitted to and from the client device. The traffic information gathered via the DPI is shared with the investigation agency.

In some examples, the set of special handling operations may include instructing a plurality of access points within a radio frequency (RF) neighborhood of an access point, with which the client device is associated on a particular wireless communication channel, to increase a scanning time or a scanning frequency on the particular wireless communication channel.

In some examples, the set of special handling operations may include instructing an access point that the client device is associated with to install an application on the client device. The application may be executed in a background process of the client device to collect and report information about the client device to the investigation agency. Further, the application may transmit a packet to the access point from the client device at a predetermined interval to prevent the client device from entering into a power save mode.

In some examples, the set of special handling operations may include instructing an access point that the client device is associated with to set a bit in a traffic indication message (TIM) information element in a beacon and adjust a delivery traffic indication message (DTIM) interval value corresponding to the client device to prevent client device from entering into a power save mode.

In some examples, the network device may further transmit a connection response allowing the client device to be connected with the WLAN, whereas the connection request received from the client device comprises a first service set identifier (SSID) value that is different from a second SSID value broadcasted in a beacon frame by an access point in the WLAN. In some examples; the first SSID may include a null value.

Network Device to Handle Wireless Client Devices Associated with a Role Indicating a Stolen Device

FIG. 4is a block diagram of an example network device to handle wireless client devices associated with a role indicating a stolen device. As used herein, a network device may be implemented, at least in part; by a combination of hardware and programming. For example, the hardware may comprise at least one processor (e.g., processor410) and the programming may comprise instructions, executable by the processor(s), stored on at least one machine-readable storage medium (e.g.,420). In addition, a network device may also include embedded memory and a software that can be executed in a host system and serve as a driver of the embedded memory. As used herein, a “processor” may be at least one of a central processing unit (CPU), a semiconductor-based microprocessor, a graphics processing unit (GPU), a field-programmable gate array (FPGA) configured to retrieve and execute instructions, other electronic circuitry suitable for the retrieval and execution instructions stored on a machine-readable storage medium, or a combination thereof.

The at least one processor410may fetch, decode, and execute instructions stored on storage medium420to perform the functionalities described below in relation to receiving instructions430, transmitting instructions440, determining instructions450, special handling instructions460, and reporting instructions470. In other examples, the functionalities of any of the instructions of storage medium420may be implemented in the form of electronic circuitry, in the form of executable instructions encoded on a machine-readable storage medium, or a combination thereof. The storage medium may be located either in the computing device executing the machine-readable instructions, or remote from but accessible to the computing device (e.g., via a computer network) for execution. In the example ofFIG. 4, storage medium420may be implemented by one machine-readable storage medium, or multiple machine-readable storage media.

Although network device400includes at least one processor410and machine-readable storage medium420, it may also include other suitable components, such as additional processing component(s) (e.g., processor(s), ASIC(s), etc.), storage (e.g., storage drive(s), etc.), or a combination thereof.

As used herein, a “machine-readable storage medium” may be any electronic, magnetic, optical, or other physical storage apparatus to contain or store information such as executable instructions, data, and the like. For example, any machine-readable storage medium described herein may be any of Random Access Memory (RAM), volatile memory, non-volatile memory, flash memory, a storage drive (e.g., a hard drive), a solid state drive, any type of storage disc (e.g., a compact disc, a DVD, etc.), and the like, or a combination thereof. Further, any machine-readable storage medium described herein may be non-transitory. In examples described herein, a machine-readable storage medium or media may be part of an article (or article of manufacture), An article or article of manufacture may refer to any manufactured single component or multiple components.

Specifically, instructions430-470may be executed by processor410to: receiving a connection request to a wireless local area network (WLAN) from a client device; determining that the client device is associated with a particular role indicating that the client device is stolen; performing a set of special handling operations that facilitates maintaining an active connection between the client device and the WLAN, collecting and reporting information about the client device to an investigation agency; instructing an access point in the WLAN to redirect the client device associated with the particular role indicating that the client device is stolen to a captive portal to complete a device registration, wherein information about the client device gathered by the captive portal is shared with the investigation agency; instructing an access point in the WLAN to allow connection from the client device while granting the client device limited access to network resources in the WLAN, the limited access being granted to the client device to maintain the active connection between the client device and the WLAN; notifying a location engine in the WLAN to start tracking locations of the client device at a higher frequency than a frequency previously used before the client device is associated with the particular role indicating that the client device is stolen; notifying a location engine in the WLAN to start collecting signal information related to the client device from a higher number of access points (APs) than a number of APs previously used before the client device is associated with the particular role indicating that the client device is stolen; etc.

Moreover, instructions430-470may be executed by processor410to: notifying an access point that the client device is associated with to perform deep packet inspection (DPI) to monitor data traffic transmitted to and from the client device, wherein traffic information gathered via the DPI is shared with the investigation agency; instructing a plurality of access points within a radio frequency (RF) neighborhood of an access point, with which the client device is associated on a particular wireless communication channel, to increase a scanning time or a scanning frequency on the particular wireless communication channel; instructing an access point that the client device is associated with to install an application on the client device, the application being executed in a background process of the client device to collect and report information about the client device to the investigation agency; instructing an access point that the client device is associated with to set a bit in a traffic indication message (TIM) information element in a beacon and adjust a delivery traffic indication message (DTIM) interval value corresponding to the client device to prevent client device from entering into a power save mode; transmitting a connection response allowing the client device to be connected with the WLAN, wherein the connection request received from the client device comprises a first service set identifier (SSID) value that is different from a second SSID value broadcasted in a beacon frame by an access point in the WLAN; etc.