Transmitting traffic from bluetooth low energy clients associated with different universally unique identifiers

Example method includes: reporting, by a network device, a detection of a Bluetooth Low Energy (BLE) beacon message from a first BLE device deployed in a wireless local area network (WLAN) serving a plurality of tenants; receiving, by the network device, information about a first tenant assigned to the first BLE device from a server; determining, by the network device, a first universally unique identifier (UUID) uniquely corresponding to the first tenant; and configuring, by the network device, the first BLE device to broadcast a first plurality of BLE beacon messages using the first UUID, wherein a second and different BLE device deployed in the WLAN is configured to broadcast a second plurality of BLE beacon messages using a second UUID that is different from the first UUID, the second UUID uniquely corresponding to a second tenant different from the first tenant in the plurality of tenants.

BACKGROUND

MultiZone generally refers to a wireless local area network (WLAN) feature that allows management and data traffic to be separated between different zones that are served by the same access point (AP). Each zone can correspond to a unique tenant that may contract with a WLAN vendor to provide WLAN services to its clients. Traffic in different zones can be tunneled to different network controllers over the same AP. When the AP deployed in a multi-tenant environment also communicates with Bluetooth Low Energy (BLE) devices, those BLE devices currently are associated to a location in which they are deployed, rather than to a tenant which uses them. Therefore, every tenant in the same location needs to deploy its own BLE devices.

DETAILED DESCRIPTION

MultiZone generally refers to a WLAN feature that allows organizations to have multiple and separate secure networks while using the same AP. As used herein, ‘access point’ (AP) generally refers to receiving points for any known or convenient wireless access technology which may later become known. Specifically, the term AP is not intended to be limited to IEEE 802.11-based APs. APs generally function as an electronic device that is adapted to allow wireless devices to connect to a wired network via various communications standards.

As used herein, “network device” generally includes a device that is adapted to transmit and/or receive signaling and to process information within such signaling such as a station (e.g., any data processing equipment such as a computer, cellular phone, personal digital assistant, tablet devices, etc.), an access point, data transfer devices (such as network switches, routers, controllers, etc.) or the like. For example, a “network device may refer to a network controller that comprises a hardware or a combination of hardware and software that enables connection between client devices and computer networks. In some implementations, a network device may refer to a server computing device (e.g., on-premise server, private, public, or hybrid cloud server) that comprises a hardware or a combination of hardware and software that can process and/or display network-related information. In some implementations, a network device may refer to an access point acting as a virtual master network controller among a cluster of access points.

Conventionally, to have multiple secure networks in a single physical location, multiple APs were deployed to serve the multiple secure networks, which creates radio frequency (RF) interference that negatively impair network performance and increase the cost to the organizations. With MultiZone feature enabled, a single AP can include at least two virtual access points (VAPs) to communicate with at least two different network controllers using at least two different service set identifiers (SSIDs). A VAP may generally refer to any logical entity that resides within a physical access point, which appears to a client device as an independent access point with its own unique SSID. The data is encrypted from client devices in the at least two secure networks corresponding to the at least two SSIDs to the at least two network controllers. When the data is transmitted from the client devices through the single AP in the at least two secure networks, the data is still encrypted. Therefore, the networks are completely separate and secure for different client devices in the different networks corresponding to the different SSIDs even though the data traffic corresponding to the different networks is transmitted through the same AP.

Moreover, an AP may have multiple radios. One of these radios may be an integrated BLE radio. BLE generally refers to an enhancement to the Bluetooth standard (e.g., as specified by the Bluetooth Special Interest Group (SIG) standards), which allows for the wireless protocol to be applied with energy saving techniques that reduce power consumption. BLE radios may communicate with client devices via beacons, which can be BLE messages transmitted or heard by BLE-compatible devices. The BLE device could be a computer, a phone, a wireless AP, a tag, or any similar devices. The BLE beacon message may have a few basic components, including but not limited to, a Universally Unique Identifier (UUID), a Major value, a Minor value, etc. These components of the BLE beacon can be configured with information the operator wants to communicate to other BLE-compatible devices. In an example retail WLAN environment, the BLE beacon components may be interpreted as the followings: Retail Brand (UUID); Shop Location (Major); and Product Category (Minor). In general, in a WLAN environment with multiple tenants, each tenant may be associated with a unique UUID.

As used herein, a beacon sensor device (also referred to as “BLE device” or “BLE-compliant device”) may refer to any type of device capable of transmitting and receiving advertisements and responses. That is, a BLE-compliant device may be able to act in a limited role. For example, a BLE-compliant device may behave as a broadcaster, or as a non-connectable advertiser. As used herein, a broadcaster may refer to a beacon sensor device that is able to send advertisements but is not able to initiate or facilitate connections between itself and a network device. A BLE-compliant device may behave as an observer. As used herein, an observer may refer to a beacon sensor device that able to scan for advertisements but is unable to initiate or facilitate connections between itself and a network device. A BLE-compliant device may behave as a peripheral device. As used herein, a peripheral device may refer to a beacon sensor device that transmits advertisements and is able to facilitate connections between itself and a network device. A BLE-compliant device operating as a peripheral device may operate as a slave in a single link-layer connection. Finally, a BLE-compliant device may behave as a central device. As used herein, a central device may refer to a beacon sensor device that is able to both scan for advertisements and initiate connections. Additionally, a BLE-compliant device behaving as a central device may operate as a master in either a single or a multiple link-layer connection.

A BLE device according to the present disclosure may behave as multiple BLE devices. In some examples, the BLE device may behave as multiple beacon sensor devices operating in peripheral mode, which allows the BLE device to advertise multiple UUIDs and facilitate connections to the BLE device via the multiple UUIDs. As previously mentioned, each UUID may correspond to a unique tenant in a multi-tenant WLAN networking environment. Moreover, a BLE device may behave as multiple beacon sensor devices using different advertisement data frame formats. In some examples, the beacon sensor device may cycle through each of the formats, thus allowing regular transmission of each format of advertisement data frame.

According to examples of the present disclosure, multiple UUIDs broadcasted by the BLE devices deployed in a multi-tenant WLAN networking environment are mapped uniquely with a plurality of virtual access points (VAPs) that are configured on a single AP. Thus, the single AP communicating with multiple network controllers in the multi-tenant WLAN networking environment can transmit tenant-specific BLE beacon data to the particular network controller corresponding to the tenant over a secure tunnel that is established between the VAP and the particular network controller.

FIGS. 1A-1Billustrate one example of networking environment with multiple BLE devices deployed to serve multiple tenants by a single access point. Specifically,FIG. 1Ashows a floor plan that includes at least an access point AP110deployed in a multi-tenant WLAN networking environment serving two distinct tenants, such as Tenant A180and Tenant B185. AP110includes at least one BLE radio that is capable of communicating with BLE-compliance devices using Bluetooth wireless communication protocols. In this example, Tenant A180and Tenant B185may occupy different geographical areas on the floor plan. Each geographical area can have multiple BLE devices deployed. For example, a first plurality of BLE devices, including BLE Device1150, may be deployed in a first geographical area that correspond to Tenant A180. Each of the first plurality of BLE devices may broadcast BLE beacon messages that include UUID1160. On the other hand, a second plurality of BLE devices, including BLE Device2155, may be deployed in a second geographical area that correspond to Tenant B185. Each of the second plurality of BLE devices may broadcast BLE beacon messages that include UUID2165.

For ease of illustration, assuming that Client A170overhears the beacon sent by BLE Device1150that advertises UUID1160. BLE Device1150is capable of being connected to the BLE radio of AP110using a Bluetooth wireless communication protocol and/or a Wi-Fi radio of AP110using a wireless communication protocol compliant with IEEE 802.11 standards. Furthermore, assuming that Client B175has established a Bluetooth connection to BLE Device2155that advertises UUID2165. BLE Device2155is also capable of being connected to the BLE radio of AP110using the Bluetooth wireless communication protocol.

Referring now toFIG. 1Bthat illustrates how the example system herein transmits traffic from BLE clients associated with different universally unique identifiers (UUIDs) on separate secure networks through a single access point. To achieve this, the example system may perform the followings: (1) setting up a BLE device; (2) relaying information between the BLE devices to management devices, e.g., in a cloud infrastructure, by a single AP; and (3) looking up client device's information including its geographical positions.

First, a BLE device (e.g., BLE Device1150) may boot up and start advertising BLE beacons using its default UUID. When an AP (e.g., AP110) that is physically located in proximity to the BLE device receives the BLE beacon messages on its BLE radio, the AP (e.g., AP110) may configure the BLE device with one or more UUIDs. Each UUID may correspond to a unique VAP configured on the AP. Each VAP on the AP corresponds to a unique tenant in a multi-tenant WLAN networking environment.

To determine which UUIDs to configure on the BLE device, the AP may relay information between the BLE devices to management devices in a cloud infrastructure. For example, the AP may report the beacon messages it receives from the BLE device to an analytics and location engine (ALE) server residing in a cloud infrastructure. The ALE may collect presence data, including but not limited to, real-time client locations, traffic flow, dwell time, zone analytics, etc., about WLAN-enabled client devices and/or BLE devices while protecting personal privacy. This data is then integrated with third-party analytics that translate it into actionable business intelligence. Although in this example, the ALE server resides in a cloud infrastructure, the ALE server may be deployed in the WLAN environment, e.g., at a central campus, or any other alternative deployments.

Subsequently, the BLE device transmitting beacon messages including the default UUIDs is placed on a floor map (e.g., as illustrated inFIG. 1Aby the ALE server in the cloud infrastructure. Based on the location of the BLE device determined by the ALE server, the BLE device is assigned to one or more tenants by the ALE server in the cloud architecture. The tenant assignment information may be transmitted to the AP. The AP may have multiple VAPs configured with a unique UUID mapped to each VAP, whereby each VAP also uniquely corresponds to a particular tenant. Upon receiving the tenant assignment information associated with the BLE device, the AP can enable the VAPs associated with the one or more tenants assigned to the BLE device to create a secure tunnel between the AP and a tenant-specific network controller. Note that multiple VAPs may be enabled on the AP depending on the number of tenants and their SLAs in the multi-tenant WLAN networking environment. Also, the AP may report additional BLE devices from which it receives BLE beacon messages to the ALE server in the cloud infrastructure through established secure tunnels. Furthermore, the AP can configure the BLE device with the UUID(s) mapped to the VAP(s) based on the received tenant assignment information. The BLE device may then advertise the configured UUID(s) corresponding to the assigned tenant(s) instead of the default UUID preconfigured by a manufacture of the BLE device.

A BLE-enabled client device may join the multi-tenant WLAN networking environment, and receive one or more BLE beacon messages from one or more BLE devices deployed in the multi-tenant WLAN networking environment. Further, the client device may be installed with a mobile application. The mobile application may report the UUIDs in the BLE beacon messages the client device receives, and select a tenant from a plurality of tenants in the multi-tenant WLAN networking environment. Based on the tenant selected by the client device, the ALE server in the cloud infrastructure may locate the client device, and identify a plurality of BLE devices that broadcast the UUID corresponding to the selected tenant. In some examples, the mobile application may request a location of the client device, and the ALE server may transmit a response including the location upon identifying the plurality of BLE devices that broadcast the UUID of the selected tenant. In some examples, if the client is located out of boundary of a region associated with the selected tenant on the floor plan, the mobile application may issue an error or warning to alert a user of the client device.

In the example illustrated inFIG. 1B, when a BLE device (e.g., BLE Device1150) boots up in the multi-tenant WLAN networking environment, the BLE device may start transmitting BLE beacon messages using a default UUID pre-configured by a manufacture. Then, AP110may receive the BLE beacon messages transmitted by BLE Device1150on its BLE radio. Thereafter, AP110may report the BLE beacon messages it receives from BLE Device1150to an ALE server145in cloud platform140. ALE server145may determine the location of BLE Device1150based on the BLE beacon messages and a pre-configured floor map that is accessible by ALE server145. Next, ALE server145may assign BLE Device1150to Tenant A180based on the determined location of BLE Device1150. Similarly, AP110may detect BLE beacon messages transmitted by BLE Device2155and report them to ALE server145. ALE server145may assign BLE Device2155to Tenant B185based on the determined location of BLE Device2155. ALE server145can then transmit this tenant assignment information to AP110.

AP110may maintain a map115either internally in its memory or externally on a separate storage. Map115can store a mapping between (a) a plurality of UUIDs that are configured for beacon messages transmitted by the BLE radio of AP110and (b) a plurality of VAPs that are configured on AP110. Each VAP may be uniquely associated with a tenant in a multi-tenant WLAN networking environment. For example, VAP1advertising SSID1on the Wi-Fi radios of AP110may be associated with Tenant A180, and VAP2advertising SSID2on the Wi-Fi radios of AP110may be associated with Tenant B185.

Based on the tenant assignment information received from ALE server145, AP110may select a particular VAP (e.g., VAP1) corresponding to Tenant A180for communication with BLE Device1150. Then, AP110can look up a UUID (e.g., UUID1160) corresponding to the particular VAP from map115. Moreover, AP110can configure BLE Device1150with UUID1160based on the map lookup results. Likewise, AP110can further configure BLE Device2155corresponding to VAP2with UUID2165based on the map lookup results. Subsequently, BLE Device1150may start broadcasting BLE beacon messages including UUID1160, and BLE Device2155may start broadcasting BLE beacon messages including UUID2165.

Furthermore, a separate network controller may be identified for each tenant. In the example inFIG. 1B, Controller2130may correspond to Tenant A180, whereas Controller1120may correspond to Tenant B185. Also, AP110can establish a separate secure tunnel with each identified network controller.

In addition, there may be multiple BLE-enabled client devices, such as Client A170and Client B175, in the multi-tenant WLAN networking environment. In this example, Client A170receives BLE beacon messages with UUID1160from BLE Device1150. Likewise, Client B175receives BLE beacon messages with UUID2165from BLE Device2155.

When AP110receives traffic flow, such as FlowA135, originated from Client A170where the traffic may contain the beacon information about BLE devices including but not limited to BLE Device1150, AP110can forward FlowA135to Controller2130via a first established secure tunnel. Note that Client A170and BLE Device1150communicate with each other using beacon messages that include UUID1160, which is unique to Tenant A180, and that Controller2130is assigned in the WLAN to manage network traffic for Tenant A180.

Similarly, when AP110receives traffic flow, such as FlowB125, originated from Client B175where the traffic may contain the beacon information about BLE devices including but not limited to BLE Device2155, AP110can forward FlowB125to Controller1120via a second established secure tunnel. Note that Client B175and BLE Device2155communicate with each other using beacon messages that include UUID2165, which is unique to Tenant B185, and that Controller1120is assigned in the WLAN to manage network traffic for Tenant B185. Both Controller1120and Controller2130may communicate with cloud platform140, including ALE server145, in order to provide various network services to the client devices that are connected to each tenant's separate and secure network.

Note that although one UUID is configured on the BLE device in this example, multiple UUIDs can be configured on the BLE device as shown in other examples illustrated in later sections. Depending on the service model, the Service Level Agreement (SLA), one tenant (e.g., Tenant A180) can have more BLE devices configured than another tenant (e.g., Tenant B185) in the multi-tenant WLAN networking environment. For example, the SLA between an IT organization and Tenant A180may specify a higher location accuracy level than the SLA between the IT organization and Tenant B185. Therefore, more BLE devices deployed in the multi-tenant WLAN networking environment may be configured for the UUID uniquely associated with VAP1, i.e., the VAP corresponding to Tenant A180, to provide enhanced location accuracy per the SLA between the IT organization and Tenant A180.

In some examples, a plurality of BLE devices located in a particular geographical region may be configured with a particular UUID that is associated with a particular VAP for a particular tenant. The geographical regions corresponding to the different UUIDs assigned to different tenants may not overlap with each other. However, in other examples, the geographical regions corresponding to the different UUIDs assigned to the different tenants may have overlapping regions. In some examples, the geographical region corresponding to one UUID assigned to one tenant may be within the boundary of the geographical region corresponding to another UUID assigned to another tenant. In the example illustrated inFIG. 1A, the geographical region to the left side of the floor plan may correspond to UUID1160that is associated with Tenant A180, whereas the geographical region to the right side of the floor plan may correspond to UUID2165that is associated with Tenant B185.

FIGS. 2A-2Billustrate another example networking environment with multiple BLE devices deployed to serve multiple tenants by a single access point. Like inFIGS. 1A-1B,FIGS. 2A-2Bincludes at least a BLE-enabled access point AP210deployed in a multi-tenant WLAN networking environment serving two distinct tenants, such as Tenant A280and Tenant B285. However, in this example, Tenant A280and Tenant B285may occupy overlapping geographical areas on the floor plan. For example, the geographical area enclosed by ABCD may be associated with Tenant B285, whereas the geographical area enclosed by ABEFGD may be associated with Tenant A280. A first set of BLE devices in the network, including BLE Device1250, BLE Device2255, BLE Device3251, BLE Device4252, and BLE Device5253, may be deployed in a first geographical area (e.g., ABEFGD) that corresponds to Tenant A280. A second set of BLE devices in the network, including BLE Device1250to BLE Device7258, may be deployed in a second geographical area (e.g., ABCD) that corresponds to Tenant B285. Because the first geographical area ABEFGD and the second geographical area ABCD overlap with each other, one or more BLE devices may broadcast a plurality of UUIDs that correspond to a plurality of VAPs assigned to different tenants. For example, within the overlapped region ABEGFD, each of BLE Device1250, BLE Device2255, BLE Device3251, BLE Device4252, and BLE Device5253may broadcast at least one beacon message including UUID1260and at least one beacon message including UUID2265. In some examples, a BLE device may broadcast beacon messages including UUID1260during a first period of time and beacon messages including UUID2265during a second and different period of time. In some examples, the BLE device may broadcast a first beacon message including UUID1260and a second beacon message including UUID2265simultaneously. In the example illustrated inFIG. 2A, because BLE Device6257and BLE Device7258are located inside the second geographical region (e.g., ABCD) but not the first geographical region (e.g., ABEFGD), BLE Device6257and BLE Device7258may broadcast beacon messages including UUID2265but not UUID1260.

FIG. 2Billustrates how the example system herein transmits traffic from BLE-enabled client devices associated with different UUIDs on separate secure networks through a single access point. In this example, when a BLE device (e.g., BLE Device1250) boots up in the multi-tenant WLAN networking environment, AP210receives beacon messages transmitted by BLE Device250and reports to ALE server245in cloud platform240. ALE server245may look up a location of BLE Device250on a pre-configured floor map, determine a tenant assignment for BLE Device250, and transmit the tenant assignment for BLE Device250to AP210. In this example, BLE Device250is assigned to both Tenant A280and Tenant B285because it is located within the overlapping region of the two tenants.

Then, based on the tenant assignment, BLE device250may be configured with two UUIDs (e.g., UUID1260and UUID2265) by AP210following the process previously described in relation toFIG. 1B. Here, UUID1260corresponds to Tenant A280and UUID2265corresponds to Tenant B285.

AP210may further select VAP1assigned to Tenant A280(which corresponds to UUID1260) for transmitting traffic flows to and from Client A270, and VAP2assigned to Tenant B285(which corresponds to UUID2265) for transmitting traffic flows to and from Client B275. In some examples AP210may look up the UUID corresponding to a particular VAP from a MAP215. Furthermore, Controller2230may be assigned to manage network traffic for Tenant A280, whereas Controller1220may be assigned to manage network traffic for Tenant B285. AP210can establish a separate secure tunnel with each of Controller1220and Controller2230.

Unlike inFIGS. 1A-1B, in this example, multiple BLE-enabled client devices in the multi-tenant WLAN networking environment may be associated with different tenant-specific networks. For example, Client A270may be associated with a first secure network of Tenant A280, and Client B275may be associated with a second secure network of Tenant B285. Furthermore, both Client A270and Client B275may communicate with the same BLE Device1250via the Bluetooth wireless communication protocol. However, Client A270may transmit and/or receive BLE beacon messages with UUID1260to and from BLE Device1250, whereas Client B275may transmit and/or receive BLE beacon messages with UUID2265from BLE Device1150.

Both Controller1220and Controller2230may communicate with cloud platform240, including ALE server245, in order to provide various network services to the client devices that are connected to each tenant's separate and secure network.

In some examples, certain network services may be provided in one geographical region associated with one tenant but not another. For example, the multi-tenant WLAN networking environment may provide location tracking information for a first set of client devices located within a first geographical region and connected to a first secure network managed by a first network controller assigned to a first tenant. Meanwhile, location tracking information may not be provided to a second and different set of client devices located within a second geographical region and connected to a second and different secure network managed by a second network controller and different assigned to a and different second tenant. Note that the second geographical region may be the same as or different from the first geographical region. Moreover, the second geographical region may or may not overlap with the first geographical region. In addition, the second geographical region may be a portion of the first geographical region.

In some examples, the example system may increase or decrease a service level (e.g., stop location tracking) when client devices are located within a region with an arbitrary boundary that may correspond a region with heightened security. The system may do so by associated a plurality of BLE devices located within the arbitrary boundary on the floor map with a unique tenant identifier by ALE server245, assign a separate UUID to those identified plurality of BLE devices located within the arbitrary boundary, and manage traffic associated with the separate UUID by particular network controller. The particular network controller may apply heightened security policies to the traffic transmitted to and from client devices communicatively coupled to the plurality of BLE devices.

In some examples, when a security threat is detected in a particular secure network managed by a particular network controller that is associated with a particular tenant, the example system may stop certain BLE devices from broadcasting beacon messages containing the UUID associated with the tenant, thereby shutting down the BLE network associated with the tenant exposed to the security threat. In the example illustrated inFIG. 2A, assuming that a security threat is detected by Controller2230associated with Tenant A280, AP210may configure BLE Device1250, BLE Device2255, BLE Device3251, BLE Device4252, and BLE Device5253to stop broadcasting BLE beacon messages with UUID1260. Meanwhile, all BLE devices inFIG. 2Amay continue broadcasting BLE beacon messages with UUID2265.

In some examples, a new tenant may be configured over an existing floor plan dynamically without shutting down any existing secure networks. For example, a new VAP (e.g., VAP3) may be later configured on AP210. A mapping between VAP3and UUID3may be added to map215. Moreover, a network administrator may assign a new geographical region to be associated with the new tenant. For example, inFIG. 2A, the new geographical region may include BLE Device1250, BLE Device2255, BLE Device6257. Accordingly, upon the addition of the new tenant, AP210may configure BLE Device1250and BLE Device2255to broadcast at least a BLE beacon message with UUID1260, a BLE beacon message with UUID2265, and a BLE beacon message with UUID3. Further, upon the addition of the new tenant, AP210may configure BLE Device6257to broadcast at least a BLE beacon message with UUID2265, and a BLE beacon message with UUID3. Other BLE devices in the network do not change their operations. Thus, BLE Device3251, BLE Device4252, and BLE Device5253keep broadcasting at least a BLE beacon message with UUID1260and a BLE beacon message with UUID2265. Likewise, BLE Device7258keeps broadcasting BLE beacon messages with UUID2265.

Processes of Transmitting Traffic from BLE Clients Associated with Different UUIDs

FIG. 3is a flowchart of an example process of transmitting traffic from BLE devices associated with different UUIDs. During operations, a network device (e.g., an AP) may report a detection of a Bluetooth Low Energy (BLE) beacon message from a first BLE device deployed in a wireless local area network (WLAN) serving a plurality of tenants (operation310). Further, the network device may receive information about a first tenant assigned to the first BLE device from a server (operation320). Then, the network device may determine a first universally unique identifier (UUID) uniquely corresponding to the first tenant (operation330). Moreover, the network device may configure the first BLE device to broadcast a first plurality of BLE beacon messages using the first UUID. In addition, a second and different BLE device deployed in the WLAN is configured to broadcast a second plurality of BLE beacon messages using a second UUID that is different from the first UUID. Here, the second UUID may uniquely correspond to a second tenant that is different from the first tenant in the plurality of tenants.

In some examples, the server may maintain a floor plan that includes a plurality of BLE devices deployed in the WLAN, whereas a first subset of the plurality of BLE devices located within a first geographical region are assigned to the first tenant, and whereas a second subset of the plurality of BLE devices located within a second geographical region are assigned to the second tenant. In one example, the first subset and the second subset may include non-overlapping BLE devices if the first geographical region and the second geographical region do not overlap with each other. In another example, the first subset and the second subset may include a set of overlapping BLE devices if the first geographical region and the second geographical region overlap with each other. In yet another example, the first subset belongs to the second subset if the first geographical region is located within the second geographical region.

In some examples, the network device may further identify a first network controller that manages a first network associated with the first tenant and a second network controller that manages a second network associated with the second tenant respectively. Further, the network device may establish a first secure tunnel from the network device to the first network controller and a second secure tunnel from the network device to the second network controller respectively. Also, the network device may transmit traffic associated with the first tenant to the first network controller via the first secure tunnel and traffic associated with the second tenant to the second network controller via the second secure tunnel respectively.

In some examples, the network device may configure at least a first VAP and a second VAP, whereas traffic associated with the first tenant is transmitted via the first VAP and traffic associated with the second tenant is transmitted via the second VAP respectively.

In some examples, the network device may determine the first UUID uniquely corresponding to the first tenant by: identifying the first VAP uniquely associated with the first tenant; and retrieving a mapping between the first VAP and the first UUID from a map.

In some examples, the network device may provide location tracking service for a first set of client devices located within a first geographical region and connected to a first secure network managed by a first network controller assigned to the first tenant, but not a second set of client devices located within a second geographical region and connected to a second secure network managed by a second network controller assigned to the second tenant.

In some examples, when a security threat is detected in a first secure network associated with the first tenant, the network device may configure a first set of BLE devices including the first BLE device to stop broadcasting BLE beacon messages containing the first UUID, whereas the first set of BLE devices are assigned to the first tenant.

In some examples, the network device may provide a network service at a first service level to a first plurality of client devices connected to the first BLE device using the first UUID; and provide the network service at a second service level that is different from the first service level to a second plurality of client devices connected to the second BLE device using the second UUID.

Network Device to Transmit Traffic from BLE Clients Associated with Different UUIDs

FIG. 4is a block diagram of an example network device to transmitting traffic from BLE devices associated with different UUIDs. As used herein, a network device may be implemented, at least in part, by a combination of hardware and programming. For example, the hardware may comprise at least one processor (e.g., processor410) and the programming may comprise instructions, executable by the processor(s), stored on at least one machine-readable storage medium (e.g.,420). In addition, a network device may also include embedded memory and a software that can be executed in a host system and serve as a driver of the embedded memory. As used herein, a “processor” may be at least one of a central processing unit (CPU), a semiconductor-based microprocessor, a graphics processing unit (GPU), a field-programmable gate array (FPGA) configured to retrieve and execute instructions, other electronic circuitry suitable for the retrieval and execution instructions stored on a machine-readable storage medium, or a combination thereof.

The at least one processor410may fetch, decode, and execute instructions stored on storage medium420to perform the functionalities described below in relation to receiving instructions430, transmitting instructions440, determining instructions450, configuring instructions460, and reporting instructions470. In other examples, the functionalities of any of the instructions of storage medium420may be implemented in the form of electronic circuitry, in the form of executable instructions encoded on a machine-readable storage medium, or a combination thereof. The storage medium may be located either in the computing device executing the machine-readable instructions, or remote from but accessible to the computing device (e.g., via a computer network) for execution. In the example ofFIG. 4, storage medium420may be implemented by one machine-readable storage medium, or multiple machine-readable storage media.

Although network device400includes at least one processor410and machine-readable storage medium420, it may also include other suitable components, such as additional processing component(s) (e.g., processor(s), ASIC(s), etc.), storage (e.g., storage drive(s), etc.), or a combination thereof.

As used herein, a “machine-readable storage medium” may be any electronic, magnetic, optical, or other physical storage apparatus to contain or store information such as executable instructions, data, and the like. For example, any machine-readable storage medium described herein may be any of Random Access Memory (RAM), volatile memory, non-volatile memory, flash memory, a storage drive (e.g., a hard drive), a solid state drive, any type of storage disc (e.g., a compact disc, a DVD, etc.), and the like, or a combination thereof. Further, any machine-readable storage medium described herein may be non-transitory. In examples described herein, a machine-readable storage medium or media may be part of an article (or article of manufacture). An article or article of manufacture may refer to any manufactured single component or multiple components.

Specifically, instructions430-470may be executed by processor410to: report a detection of a Bluetooth Low Energy (BLE) beacon message from a first BLE device deployed in a wireless local area network (WLAN) serving a plurality of tenants; receive information about a first tenant assigned to the first BLE device from a server, determine a first universally unique identifier (UUID) uniquely corresponding to the first tenant; configure the first BLE device to broadcast a first plurality of BLE beacon messages using the first UUID, wherein a second and different BLE device deployed in the WLAN is configured to broadcast a second plurality of BLE beacon messages using a second UUID that is different from the first UUID, the second UUID uniquely corresponding to a second tenant different from the first tenant in the plurality of tenants; maintain a floor plan that includes a plurality of BLE devices deployed in the WLAN, wherein a first subset of the plurality of BLE devices located within a first geographical region are assigned to the first tenant, and wherein a second subset of the plurality of BLE devices located within a second geographical region are assigned to the second tenant; etc.

In addition, instructions430-470may be executed by processor410further to: identify a first network controller that manages a first network associated with the first tenant and a second network controller that manages a second network associated with the second tenant; establish a first secure tunnel from the network device to the first network controller and a second secure tunnel from the network device to the second network controller respectively; transmit traffic associated with the first tenant to the first network controller via the first secure tunnel and traffic associated with the second tenant to the second network controller via the second secure tunnel respectively; etc.

Moreover, instructions430-470may be executed by processor410further to: configure at least a first VAP and a second VAP on the network device, wherein traffic associated with the first tenant is transmitted via the first VAP and traffic associated with the second tenant is transmitted via the second VAP; identify the first VAP as being uniquely associated with the first tenant and the second VAP as being uniquely associated with the second tenant; retrieve a mapping between the first VAP and the first UUID from a map; provide location tracking service for a first set of client devices located within a first geographical region and connected to a first secure network managed by a first network controller assigned to the first tenant, but not a second set of client devices located within a second geographical region and connected to a second secure network managed by a second network controller assigned to the second tenant; configure a first set of BLE devices including the first BLE device to stop broadcasting BLE beacon messages containing the first UUID, wherein the first set of BLE devices are assigned to the first tenant in response to a security threat being detected in a first secure network associated with the first tenant; provide a network service at a first service level to a first plurality of client devices connected to the first BLE device using the first UUID; provide the network service at a second service level that is different from the first service level to a second plurality of client devices connected to the second BLE device using the second UUID; etc.