Systems and methods for managing network connectivity with netreach

A system for micro-segmented networking is provided. A system controller is programmed to a) store a plurality of micro-segmented network accounts and a plurality of subscriber accounts, b) receive a request from a user device to activate a first micro-segmented network associated with a first subscriber account, c) authenticate the first subscriber account based on the subscriber information, d) activate the first micro-segmented network, including a plurality of device slots for a plurality of devices, e) transmit, to the user device, first device slot authentication information for a first device slot of the plurality of device slots; f) receive, from a first device connecting to the wireless network, the first device slot authentication information; g) authenticate the first device slot authentication information; and h) in response to authenticating the first device slot authentication information, connect the first device to the first micro-segmented network.

BACKGROUND

The field of the invention relates generally to managing computer networks, and more specifically, to systems and methods for on-boarding new devices and managing resource allocation for devices on the network.

Traditionally, network services have been set-up to allocate resources and provide connection to devices to the IP address associated with the device. However, there are certain underserved/unserved markets where a traditional product deployment model does not suit or scale. The issues range from the limits on average revenue per user (ARPU) to constraints and physical considerations for being able to deliver service to each customer. The market segment classified as Class C & D deployments are for residences that have multi-dwelling unit-style, or a single-unit cluster layout and the goal is to be able to deliver a viable internet service without requiring a customer premises equipment (CPE) for each subscriber. Furthermore, in many areas, the infrastructure may not be capable of supporting running fiber or optical cables to every dwelling. In addition, most devices connect to networks via Wi-Fi as devices with cellular connections can be expensive.

In some situations, different devices connected through the same access point (AP) may require or support different connection attributes. Accordingly, it would be useful for different devices to be able to connect to the same AP using different connection attributes based on subscriptions or other account management features associated with the device.

BRIEF DESCRIPTION

In an embodiment, a system for micro-segmented networking is provided. The system includes a system controller including at least one processor in communication with at least one memory device. The system controller is in communication with a wireless network. The system controller is programmed to store a plurality of micro-segmented network accounts and a plurality of subscriber accounts. Each subscriber account of the plurality of subscriber accounts is associated with a micro-segmented network of the plurality of micro-segmented network accounts. The system controller is also programmed to receive a request from a user device to activate a first micro-segmented network associated with a first subscriber account. The request includes subscriber information associated with the first subscriber account. The system controller is further programmed to authenticate the first subscriber account based on the subscriber information. In addition, the system controller is programmed to activate the first micro-segmented network, including a plurality of device slots for a plurality of devices, Moreover, the system controller is programmed to transmit, to the user device, first device slot authentication information for a first device slot of the plurality of device slots. Furthermore, the system controller is programmed to receive, from a first device connecting to the wireless network, the first device slot authentication information. Additionally, the system controller is programmed to authenticate the first device slot authentication information. In response to authenticating the first device slot authentication information, the system controller is programmed to connect the first device to the first micro-segmented network.

In another embodiment, a method for micro-segmented networking is provided. The method is implemented by a computer device comprising at least one processor in communication with at least one memory device. The computer device is in communication with a wireless network. The method includes storing a plurality of micro-segmented network accounts and a plurality of subscriber accounts. Each subscriber account of the plurality of subscriber accounts is associated with a micro-segmented network of the plurality of micro-segmented network accounts. The method also includes receiving a request from a user device to activate a first micro-segmented network associated with a first subscriber account. The request includes subscriber information associated with the first subscriber account. The method further includes authenticating the first subscriber account based on the subscriber information. In addition, the method includes activating the first micro-segmented network, including a plurality of device slots for a plurality of devices. Moreover, the method includes transmitting, to the user device, first device slot authentication information for a first device slot of the plurality of device slots. Furthermore, the method includes receiving, from a first device connecting to the wireless network, the first device slot authentication information. Additionally, the method includes authenticating the first device slot authentication information. In response to authenticating the first device slot authentication information, the method includes connecting the first device to the first micro-segmented network.

DETAILED DESCRIPTION

As used herein, the term “database” may refer to either a body of data, a relational database management system (RDBMS), or to both, and may include a collection of data including hierarchical databases, relational databases, flat file databases, object-relational databases, object oriented databases, and/or another structured collection of records or data that is stored in a computer system.

Further, as used herein, the terms “software” and “firmware” are interchangeable and include any computer program storage in memory for execution by personal computers, workstations, clients, servers, and respective processing elements thereof.

The present embodiments are described below with respect to several components of a conventional cable and/or wireless/Wi-Fi networks. Optical networks though, are also contemplated within the scope of the present embodiments. Such optical networks may include, without limitation, an Optical Network Terminal (ONT) or Optical Line Termination (OLT), and an Optical Network Unit (ONU), and may utilize optical protocols such as EPON, RFOG, or GPON. Other types of communication systems our further contemplated, including communication systems capable of x-hauling traffic, satellite operator communication systems, MIMO communication systems, microwave communication systems, short and long haul coherent optic systems, etc. X-hauling is defined herein as any one of or a combination of front-hauling, backhauling, and mid-hauling.

In these additional embodiments, the MTS may include, without limitation, a termination unit such as an ONT, an OLT, a Network Termination Unit, a Satellite Termination Unit, a Cable MTS (CMTS), or other termination systems collectively referred to herein as “Modem Termination Systems (MTS)”. Similarly, the modem described above may include, without limitation, a cable modem (CM), a satellite modem, an Optical Network Unit (ONU), a DSL unit, etc., which are collectively referred to herein as “modems.” Furthermore, the DOCSIS protocol may be substituted with, or further include protocols such as EPON, RFoG, GPON, Satellite Internet Protocol, without departing from the scope of the embodiments herein.

The present embodiments relate generally to managing computer networks, and more specifically, to systems and methods for on-boarding new devices and managing resource allocation for devices on the network. For ease of explanation, the following description may generically refer to these several innovative embodiments as “the NetReach system.” The NetReach system herein enables the user, consumer, and/or customer to easily add devices to a customized, private computer network to ensure that the features of the devices are properly used by the network. In particular, the present embodiments may include one or more of a device to be connected to the network, a device already connected to the network, a gateway, an access point (AP), and/or controller, and a set of network messages.

In one example of use, an individual in an area of use for the NetReach system can use the following steps to gain network access. First, the individual buys a use card. The card includes a code that allows for network access for a period of time for a specific number of devices. The individual then accesses an existing Wi-Fi network. This can be a mesh network associated with the NetReach system or another Wi-Fi network. The individual uses the Wi-Fi network to access a portal for the NetReach system. The address of the portal can be provided on the purchased use card. The individual gets the code from the card. In some embodiments, the code is protected being behind a scratch-off portion of the use card. The individual enters the code into the portal. The portal then provisions for specific number of devices to access the network using a specially created private network. The individual can then load the NetReach application onto their device. The portal and/or a NetReach server provide access information for the specific number of devices. The access information can include an SSID and password for each device. When a device connects to the Wi-Fi using the provided SSID and password, the device is provided with a software defined network (SDN) and/or a virtual private network for access.

In the present NetReach system, a series of micro-segmented networks are used to connect devices to a network and provide network connectivity. In the NetReach system, each micro-segmented network is associated with a subscriber. The micro-segmented network contains multiple connected devices, where the devices are visible to each other on the micro-segmented network and devices on other micro-segmented networks are not visible. Furthermore, the micro-segmented networks are access point agnostic, wherein a first device on the micro-segmented network may be connected through a first access point and a second device on the same micro-segmented network is connected through a second access point. In this system, the capabilities of the micro-segmented network and the devices on the micro-segmented network are set by one or more subscriber attributes. Subscriber attributes can include, but are not limited to, quality of service (QoS), bandwidth, data caps, up/down, operations support systems (OSS) attributes, business support systems attributes, and security models. The subscription and the micro-segmented networks are configured by a NetReach system controller.

The NetReach architecture described herein can provide internet service to subscribers in the form of a Wi-Fi subscription to a set of subscriber-owned devices. The Wi-Fi network around the subscriber's service area is hosted through a mesh of NetReach Access Points (AP's) that are shared across subscribers. One unique feature of the NetReach architecture is that the NetReach AP's host SSID's (Service Set IDentifier) are shared across subscribers, however the micro-segmentation capabilities within the NetReach AP's ensure that the traffic of each subscriber's device-set is isolated from each other. Each device connecting to the network is first authenticated with a device/subscriber-specific credential and upon successful authentication, it is added to the subscriber's micro-segmented network as long as it conforms to the business rules associated with the subscriber's rate plan.

In the NetReach architecture, each NetReach AP incorporates the multiple capabilities. First the AP's form a mesh and operate in a mesh architecture and have a persistent management channel with a cloud orchestrator or controller. Furthermore, each SSID is part of an extended service set (ESS) that is setup and managed from the cloud. In addition, an AP can be part of more than one ESS simultaneously. Moreover, each AP incorporates an SDN (Software-Defined Networking) logical switch to which the Wi-Fi layer access point is bridged to. The AP can support dhcp-relay with support for DHCP Option 82 along with Subscriber-Id sub-option 6 (RFC3993). The AP can also support multicast-to-unicast mode of transmission and Proxy ARP (Address Resolution Protocol). The Wi-Fi module on the AP can support 802.1Q VLAN tagging and Wi-Fi Multimedia (WMN). This NetReach architecture is described in greater detail below with respect toFIG.5.

When a subscriber first registers for service (likely through an app on a mobile device), the subscriber will be assigned to a specific ESS that is operational in the subscriber's service area. There is a many-to-one relation between an ESS and subscriber, i.e., an ESS may serve multiple subscribers, however a given subscriber can only receive service from a single ESS. If the subscriber moves outside the range of the ESS, they will not be able to receive their service (this is similar to a user moving away from their own Wi-Fi network in their home). Upon initial registration of the subscriber, a unique VLAN will be assigned to that subscriber within that ESS (via all AP's that serve that ESS) and any device that the subscriber connects will be put into that VLAN. When a subscriber wants to connect a new device, they request a new credential/password for the new device through their app and then manually enter the password on that new device.

When a device attempts to associate to the Wi-Fi network, the device uses the provisioned password to authenticate to the network. The AP delegates the initial part of the authentication to the NetReach Authentication Service (NR-AS), which can be hosted on a NetReach server and/or a system controller, and which determines the password used by the device and resolves that to the specific subscriber. The NR-AS notifies the gateway of the mesh network which in turn updates the relevant AP's and pushes the appropriate configuration (DHCP lease info, VLAN assignment, temporal MAC association, SDN flow rules) to the AP's.

Each subscriber and their devices are identified by a subscriber specific VLAN and IP subnet. This allows the NetReach system to assign specific bandwidth and priority rules to the VLAN or groups of VLAN based on the subscription of the subscriber.

Additionally, the WMM feature can be used to provide different levels of service based on the subscriber. The WFA WMM specification defines four access categories (Background, Best Effort, Video, Voice). However, WMM does not specify or guarantee any throughput associated with the access categories. The AP determines how it treats traffic in each access category. The NetReach system sets appropriate CWmin and CWmax values for each access category and can create a mapping between access category and subscription access. This can allow the NetReach system to provide different levels of access, such as based on subscription type. For example, with two levels of subscription tiers—free, paid, the following mapping can be created:

This ensures that traffic for all VLAN's that are associated with a free tier subscription is treated with Background characteristics while traffic for VLAN's associated with a paid tier subscription is prioritized compared to the free tier. Note that this classification will only apply to downstream traffic from the AP to the device. There is no assumption or expectation that a device support WMM or that it even uses any WMM access categories. Even if a device specifies a specific WMM access category, the request may be stripped out by the AP and replaced with the appropriate access category based on the subscription tier of the device prior to further processing of the packet. This one-way prioritization is sufficient to create separate traffic-queues based on the subscription tiers. Furthermore, the additional access categories can be used to create additional subscription tiers as necessary.

In the first example, the subscriber gains access to a subscription through one of a plurality of different methods. In the first method, the subscriber purchases an access card that include an access code. In this method, the code may be hidden beneath a scratch-off portion. In the exemplary embodiment, the code provides network access for a period of time. In this method, the code/card could be purchased from a store. The subscriber can then submit the code as described herein. In some embodiment, the code is provided alphanumerically and/or in a scannable bar code or QR code. In the second method, the subscriber is able to pay online, such as through the online portal. In a third method, the subscriber is able to pay a monthly fee for access, such as by automatic billing to a bank account and/or a payment card.

The subscriber is able to connect to the NetReach portal, such as via a mobile computing device. The NetReach portal allows the user to set-up their subscription, such as by entering the card provided access code. The NetReach portal sets-up the subscriber's account and allows the subscriber to add network capable devices to the account. The account has access for a finite number of devices and the subscriber can pick which devices that they wish to add. Devices can include, but are not limited to, smart phones, tablets, laptop computers, smart TVs, Internet of Things (IoT) devices, and/or any other computer devices capable of interacting with the network as described herein.

In a further example, the subscription can have additional attributes, such as, but not limited to, quality of service (QoS), bandwidth, data caps, up/down, operations support systems (OSS) attributes, business support systems attributes, and security models. For example, an employer allows employees to work from home with work-provided computers and phones. The employer can also use the NetReach system to provide improved access to the employee, but only for their work-provided devices. While the employee may have their own router and corresponding home network, the work-provided devices are connected to the work-provided NetReach network. The work-provided devices are put in their own micro-segmented network and are not visible to the other devices in the employee's home or on the employee's home network. In addition, the work-provided network may limit the device's access to different web locations. For example, the work-provided network may only allow access to the work servers and not access to entertainment web-sites. In some embodiments, the NetReach network can control the DNS access for the devices on the network. Furthermore, the bandwidth, QoS, and other attributes of the work-provided network can be different than those of the home network, even though the devices of both networks are connecting through the same router/access point. In addition, the employer could pay for the subscription to provide the work-provided network.

In another example, fifteen students are sharing a dorm with Wi-Fi access through an access point. One of those students is working an internship at a company. The company wants the student to have better reception. The company pays for the student to get 25 down/10 up access through a NetReach network. The student, when using that network, gets that level of access, while the other students connecting to that access point have to compete for the rest of the Wi-Fi capability.

In a further example, a medical Internet of Things (IoT) device could be connected via a NetReach network. The NetReach network provides the device with network access to report any issues and/or report in on how the patient is doing. This secures the medical IoT device on its own network, and makes sure that it can communicate via the network without having to connect to the patient's home network. This allows the subscription for access to be paid for by a third party, such as the insurance, rather than the individual patient.

In an exemplary embodiment, the NetReach management device is the gateway of the network. In other embodiments, the NetReach management device is a part of the access network, such as by a modem termination system (MTS). In these configurations, the NetReach management device may manage all messages from and to the outside networks. In some embodiments, the NetReach management device is outside of the network. This NetReach management device may then provide information to the gateway and/or APs to allow them to connect to subscribed devices and provide network access based on their corresponding subscriptions.

FIG.1illustrates a NetReach architecture100configured for adding and managing devices in accordance with at least one embodiment. In an exemplary embodiment, NetReach architecture100includes a mesh network102. In this example, mesh network102is depicted, by way of example and not in a limiting sense, a local area network (LAN) and includes a gateway104with access to one or more outside networks106. Outside networks106may include, but are not limited to, the Internet, another LAN, an access network, and a wide area network (WAN). One of the advantages of the NetReach architecture100as described herein is that the systems and methods described herein can provide additional services with existing architecture.

Mesh network102includes a plurality of access points110. Access points110connect to various devices, including device A112, device B114, device C116, and user device118to mesh network102. Access point110allows device A112, device B114, device C116, and/or user device118to connect using wired and/or wireless connections. In the exemplary embodiment, the plurality of access points110cover an area, such as a residential area, to provide Wi-Fi access to individuals in the area of coverage. When a device is attached to the mesh network102via Wi-Fi, the devices messages are routed from one AP110to another AP110in the mesh network102until the messages reach a gateway104with access to outside networks106, such as through a fiber backend.

In some embodiments, gateway104is also an access point110. In other embodiments, the access points110are separate from gateway104. The mesh network102includes multiple access points110. Access points110can include, but are not limited to, a Wi-Fi router, a Wi-Fi extender, a hub, a router, a switch, and/or any other network device that allows devices to connect to the mesh network102. In some embodiments, a plurality of access points110are provided around a neighborhood to provide Wi-Fi access to the neighborhood, where the plurality of access points110are not associated with any specific dwelling or family. In at least one embodiment, the plurality of access points110are attached to power poles or other utility poles.

Access points110can include a WAP (Wireless Application Protocol) module and incorporate the Wi-Fi hardware and the associated AP software, such as host ADP (access point daemon). The Wi-Fi chipset and software could include Wi-Fi5or higher with support for 802.1Q tagging, WMM (Wi-Fi Multimedia), multicast-to-unicast conversion, and support a minimum of 8 virtual SSID's. To ensure that traffic for each multi-segmented network is enforced, the AP110can include one or more virtual switches. The virtual switches are software defined switches, such as OpenVSwitch, to which the Access Point110bridges each device that connects to it. A virtual port interface is created for each device that connects to the AP110and the traffic is managed by the rules enforced in the virtual switch.

Devices A112, B114, and C116may include, but are not limited to, IoT devices, such as, but not limited to, IP cameras, smart home devices, smart televisions, smart speakers, and/or medical IoT devices, user computing devices, such as, but not limited to, smart phones, tablets, a personal digital assistant (PDA), and/or laptop computers, and/or any other computer devices capable of interacting with mesh network102as described herein. User devices118may include, but are not limited to, smart phones, tablets, laptop computers, a personal digital assistant (PDA), and/or any other computer devices capable of interacting with mesh network102as described herein. User devices118may connect to access point110by wired and/or wireless connections, based on the user device118itself. Some user devices118may be associated with the mesh network102and are connected to the mesh network102on a regular basis. Other user devices118may connect to mesh network102occasionally.

In at least one embodiment, a system controller108controls a plurality of micro-segmented networks associated with a plurality of subscribers. All device A's112are a part of a first micro-segmented network associated with subscriber A. Device B's114are a part of a second micro-segmented network associated with subscriber B. Device C's116are a part of a third micro-segmented network associated with subscriber C. User device118represents a device that is not currently associated with any micro-segmented network. Each micro-segmented network allows the devices on that network to see each other and to communicate with the outside network106and potentially the Internet120. The system controller108is the component responsible for resolving the password used by a device while it is associating and authenticating with the network and determine the device eligibility, subscriber information, and subscription tier. The system controller108can be implemented as a distributed service with a local component to speed up the authentication.

Each micro-segmented network contains multiple connected devices, where the devices are visible to each other on the micro-segmented network and devices on other micro-segmented networks are not visible. Furthermore, the micro-segmented networks are access point110agnostic, wherein a first device on the micro-segmented network may be connected through a first access point and a second device on the same micro-segmented network is connected through a second access point.

The capabilities of the micro-segmented network and the devices on the micro-segmented network are set by one or more subscriber attributes. The subscription and the micro-segmented networks are configured by a NetReach system controller. Each micro-segmented network is capable of different levels of connectivity, based on both the subscriber's attributes. Subscriber attributes can include, but are not limited to, quality of service (QoS), bandwidth, data caps, up/down, operations support systems (OSS) attributes, business support systems attributes, and security models. For example, the first micro-segmented network can provide a first set of bandwidth and quality of service (QoS) attributes, while the second micro-segmented network can provide a second, different set of bandwidth and quality of service (QoS) attributes. Other attributes can include, but are not limited to, operations support systems (OSS) attributes, business support systems attributes, data caps, and security models.

In the exemplary embodiment, the system controller108stores the connection and identification data for each device that is a part of a micro-segmented network. The system controller108shares the connection and identification data with the gateway104and potentially the access points110. In some embodiments, the micro-segmented networks are managed by the gateway104. In other embodiments, the access points110manage the micro-segmented networks.

In some embodiments, the micro-segmented network controls the access that its devices have to the outside network106and/or the Internet120. In at least one example, the micro-segmented network is associated with a workplace, where the devices are also associated with the workplace. The micro-segmented network can provide secure access to one or more servers and/or websites associated with the workplace, but not allow access to entertainment sites. In some further embodiments, the DNS is controlled and/or limited for the devices on the micro-segmented network. This can allow the system controller108to control the locations and IP addresses that the devices on the micro-segmented network are allowed to access.

In some embodiments, the different access points110of the mesh network102could be in different locations. For example, two access points110could be located in a first residential area, while another three access points110are in a second residential area, where the two residential areas are distant enough from each other that their wireless coverage doesn't overlap.

In at least some embodiments, the system controller108is associated with a cable network operator. In these embodiments, the cable network operator organizes the different subscription levels of service and provides the network access. The cable network operator sets operator system rules and business system rules to organize the micro-segmented networks and subscriptions described herein.

In some further embodiments, the system controller108and provide access at the program level. Based on IP addresses and ports, the system controller108can restrict which messages are transmitted by each device on the micro-segmented network. The rules can be set so that only certain ports and/or certain IP addresses can be accessed. For example, for a work micro-segmented network, only programs such as Word, Excel, and Outlook are allowed to access the Internet120, and those programs are only allowed to access specific websites. In still additional embodiments, individual ports can be monitored to ensure that the data from different applications is monitored and properly treated. For example, in one micro-segmented network, a video conferencing application can be prioritized over a word processing program or email program to ensure good video quality.

In the exemplary embodiment, gateways104capture inbound traffic from the outside network106. This allows the gateway to effectively create a new SSID. The gateways104use software defined networks (SDN)s to create the individual micro-segmented networks. The gateways104identify each device, such as device A112, device B114, and device C116, during onboarding and assign each device to the correct micro-segmented network. The gateways104also identify each device to the back-end systems, including the access points110and the system controller108, for example. Since the gateways104receive all of the inbound traffic, they are able to properly route to the correct device in each of the micro-segmented networks. The gateways104can each track multiple micro-segmented networks in the mesh network102, where each micro-segmented network includes multiple devices.

Furthermore, the gateways104are capable of determining the metering and provisioning for each device as described further herein. When a new device connects to the mesh network106using an SSID and password provided by the system controller108, the gateway104can identify the device, secure it, authenticate it, and provide a custom network experience to the device based on the attributes of its micro-segmented network.

FIG.2illustrates a timing diagram of a process200for activating a subscriber account for the mesh network102(shown inFIG.1). In the exemplary embodiment, user device118includes an app205for communicating with the system controller108. In some embodiments, the app205is a web-browser, and the user device118can access a website to communicate with the system controller108. In the exemplary embodiment, user device205connects to the mesh network102via access points110, which can provide wired and/or wireless connections. In some embodiments, the gateway104and the access point110are separate devices. In other embodiments, the gateway104and the access point110are in the same device.

In the exemplary embodiment, the mesh network102includes a plurality of access points110in communication with one or more devices, such as device A112, device B114, and device C116(all shown inFIG.1).

In step S215, the user device205connects to the mesh network102and transmits a request to connect with the system controller108. The user device205is associated with a subscriber. The access points110forward the request to the gateway104, which in turn routes the message to the system controller108. The request information may include subscription information, such as subscriber payment information that allows the subscriber to create and/or update their subscription. In step S220, the system controller108analyzes the information in the request to determine if the request is valid. If the request is valid, then the system controller108updates the subscriber information including subscription. For example, the request can include a code giving the subscriber five days of access for up to five devices. The code can be provided as an alphanumeric code or as a scanned bar code or QR code. If the subscriber already has access then the code would extend their access by five days, for example. In addition to limited time use codes, the user can also set-up accounts that allow for a recurring subscription to be paid from an account, such as a payment card account and/or a banking account.

If the subscription is new or had previously expired, in step S225, the system controller108instructs the gateway104to set-up a micro-segmented network for the subscriber. The subscriber's micro-segmented network will only allow access for devices that the subscriber specifically sets up with the system controller118, as shown in process300(shown inFIG.3).

In some embodiments, in step S230, the gateway104informs the access points110on the mesh network102of the micro-segmented network for the subscriber. In step S235, the access point110informs the user device118, via the app205of the updates to the subscription from the system controller108. In some embodiments, the user can use process200to upgrade and/or change the subscription. In at least one embodiment, process200can be used to add more time for the subscription.

In a further embodiment, a micro-segmented network could be configured for a school. The students are provided with access to the school micro-segmented network. The access could be provided via cards with codes or other methodology as described herein. The students could each have their own micro-segmented network where they can add or remove their devices. The micro-segmented networks then provide the students' devices with network access, but only to reach the school system servers and resources.

In some embodiments, the user device118and/or app205is capable of directly connecting to the system controller108, such as through a cellular connection. In other embodiments, the system controller108is always reachable by user devices118and any other device that attaches to the mesh network102.

In some further embodiments, there is a system controller108associated with each mesh network102. Furthermore, there is also a NetReach server that provides the capability to handle the billing for the subscriptions. This NetReach server is in communication with the plurality of system controllers108and provides information about whether or not the different subscriptions are valid and how long the subscriptions last. In these embodiments, the NetReach server can determine which mesh network102that the user is associated with and communicate with the corresponding system controller108to set-up the corresponding micro-segmented network.

FIG.3illustrates a timing diagram of a process300for adding a device to the subscriber account the mesh network102(shown inFIG.1). In process300, the subscriber associated with the user device118has set-up a subscription with the system controller108, and the system controller108has set-up a micro-segmented network for the subscriber.

In step S305, the user device118, via the app205, has requested an access code for connecting a first device, device A112. The request is forwarded through the access points110and gateway104of the mesh network102to the system controller108. In step S310, the system controller108determines which code to provide. In at least one embodiment, the code is a pre-shared key (PSK) which will only be associated with device A112. The system controller108stores a PSK for each potential device that may be added to each micro-segmented network. For example, for the first micro-segmented network associated with the first subscriber, there may be the capability to connect up to five devices. For each of those five device slots, the system controller108creates and/or stores a PSK. The PSK is uniquely associated with the corresponding device. In some embodiments, the system controller108generates the PSKs when the subscription is activated, as illustrated in process200(shown inFIG.2). In other embodiments, the system controller108generates the PSK on demand. In step S315, the system controller108transmits the PSK for the first device, which is forwarded to the user device118.

In step S320, a user, such as the subscriber, attempts to connect device A112to the mesh network102and the micro-segmented network associated with the subscriber. The user enters the SSID for the mesh network102and the PSK provided by the system controller108as the password for the network. The SSID is the same for all devices on the mesh network102; however, each password is unique for each device.

In some embodiments, the connection sequence is performed by the access point110. In other embodiment, the connection sequence is performed by the gateway104. In at least one embodiment, the system controller108provides the IP addresses and the preassigned PSK for each potential device on each micro-segmented network. In some of these embodiments, the IP addresses and preassigned PSKs are stored in each access point110and the gateway104. In other of these embodiments, the IP addresses and the preassigned PSKs are just stored in the gateway104. The IP addresses and preassigned PSKs can be shared to the individual access points110as needed. While, the IP address and preassigned PSK for each device slot is known, the MAC address is not known until the device connects and is onboarded into the micro-segmented network.

In the exemplary embodiment, step S320initiates the WPA four-way handshake. When the user enters the PSK on device A112, device A112attempts to authenticate with the host APD on the access point110. During step S325, which is where the access point110and/or the gateway104initiates the message2exchange of the WPA four-way handshake, the access point110and/or gateway104grabs the values provided by the device A112and transmits those values to the system controller108, as shown in step S330. The values can include, but are not limited to, anonce, snonce, device A MAC address, access point MAC address, SSID, and PSK. In some embodiments, the entire access request message is forwarded to the system controller108. In step S335, the system controller108uses the provided information to look-up the device. The system controller108knows the neighborhood based on the SSID and/or the access point MAC address. The system controller108also knows all of the PSKs of all of the devices that are configured to be in that neighborhood. The system controller108uses the PSK that was provided in the password field on device A112to look up the corresponding micro-segmented network. If the values correspond to a known device, in step S340, the system controller108returns the vlan and deviceID for the host APD to continue the authentication process. The system controller108also transmits an update to the AP110and/or gateway104including the MAC address for device A112, so that the AP110and/or gateway104can perform internal associations.

In step S345, the AP110and/or the gateway104completes the authentication process/four way handshake. The APs110and/or gateway104defines the micro-segmented network to include device A112. Furthermore, the APs110and/or gateway104can define each micro-segmented network to be on a different subnet, so that each micro-segmented network can be considered a discrete network. When the authentication is complete, an authentication success message is transmitted to device A112, in step S350.

Next device A112gets an IP address assigned to it for the micro-segmented network. Then in step S355, device A112can access the Internet120based on the attributes and limitations of its micro-segmented network. Attributes can include, but are not limited to, quality of service (QoS), bandwidth, data caps, up/down, operations support systems (OSS) attributes, business support systems attributes, and security models

Additional devices can be added to the micro-segmented network based on the number of available device slots allowed by the system controller108.

Devices can be removed from the micro-segmented network, by having a user device118access the system controller108and remove the device from micro-segmented network via the app205. The system controller108then notifies the APs110and/or the gateway104, that the device has been removed. The APs110and/or the gateway104informs the device that it has been removed. The APs110and/or the gateway104update their internal tables so that the device can no longer connect, as it has no credentials. The device will attempt to reconnect and then give up after a predetermined number of tries.

Any device web-capable device could be added to a micro-segmented network, as long as there is a slot available for that device. For example, user device118could be added to any of the first, second, or third micro-segmented networks.

In at least some embodiments, the system controller108meters the connections provided by the micro-segmented networks to ensure that each subscriber's micro-segmented network receives the appropriate network capacity. For example, a first subscriber and a second subscriber could both have 25 down and 10 up access. The system controller108monitors the behavior of the gateway104and/or the APs110to ensure that the two micro-segmented networks each receive the appropriate network bandwidth. Furthermore, the system controller108can also monitor the two micro-segmented networks to ensure that they don't exceed those parameters to the detriment of others on the mesh network102.

In some embodiments, the NetReach architecture100(shown inFIG.1) allows the user to travel to different locations on the network. For example, two mesh networks102at two locations could be associated with the same cable network provider. For this example, device A112is registered with a micro-segmented network on the first mesh network102. If device A112travels to and then attempts to connect to the second mesh network102, the system controller108can access a database of devices for approved micro-segmented networks and recognize device A112based on device A's SSID and password.

In some further embodiments, there is a system controller108associated with each mesh network102. Furthermore, there is also a NetReach server that provides the capability to handle the billing for the subscriptions. This NetReach server is in communication with the plurality of system controllers108and provides information about whether or not the different subscriptions are valid and how long the subscriptions last. In these embodiments, the NetReach server is contacted by the user to set-up the individual devices in the mesh network102and the micro-segmented network. The NetReach server provides the necessary login information for device A112, including the SSID and password.

In some embodiments, micro-segmented networks may include one or more policies that describe the operation of the micro-segmented network. In these embodiments, the policies can dictate how the devices on the micro-segmented network will behave as well as how the micro-segmented network will behave. These policies can be for the device A112, the mesh network102, the access points110, and/or the gateway104. For example, a policy may describe that only traffic from specific ports of device A112may be transported over the micro-segmented network or that only traffic to and from specific sites on the Internet120or outside network106may be accessed. Other policies may include, but are not limited to, bandwidth considerations, number of devices that can be active on the same time, restricted network locations, allowed network locations, security protocols, OSS and BSS rules, and/or any other policies desired.

In the exemplary embodiment, each device has a device specific password that is provided by the system controller108. After the device is connected as shown in process300, the device specific password is tied to the corresponding device's MAC.

In some additional embodiments, additional authentication elements for the device can be provided including digital certificates and private keys that can be used to authenticate the device112when it connects or reconnects to the mesh network102and its assigned micro-segmented network.

FIG.4is a schematic illustration depicting an exemplary micronetwork architecture400. In an exemplary embodiment, architecture1500may be implemented within the context of a larger networking system such as those described above with respect to the co-pending applications incorporated by reference herein. Accordingly, architecture400may further include several elements that are similar in structure and/or functionality to such micronetworking systems, including without limitation, a micronetwork infrastructure402, a micronetwork manager404, a home network406including a gateway408, managed services micronetworks410, and home owner micronetworks412. Architecture400may further function with respect to an access and core network414and partner/service provider subsystems416.

In an exemplary embodiment, architecture400further includes a service API layer418and a virtualized microservices layer420between micronetwork infrastructure402and access/core network414, and an MSO API layer422for interfacing with partner/service provider subsystems416.

In the exemplary embodiment depicted inFIG.4, micronetwork infrastructure402represents an intelligent services layer configured to provide service information and/or guidance to the SDN or micronetwork controller to establish flow rules dynamically at the SDN switch. The intelligent services layer may include one or more advanced services424, such as machine learning (ML) or neural network (NN) powered applications, business logic (e.g., conditional billing), AI-enabled services, security services, and/or device (e.g., IoT) fingerprinting. These services are described by way of example, and are not intended to represent an exhaustive list.

In an exemplary embodiment, virtualized microservices layer420represents a virtualized control layer for the microservices of one or more of an SDN controller426, a DHCP server428, an identity server430, and an AAA server432. In at least one embodiment, one or more of the microservices of virtualized microservices layer420may be cloud services, or operate from the cloud. Gateway408may thus include one or more of a modem434, a virtual switch (VSwitch)436, a micronetwork application layer438, an AP440, a router442, and an ethernet444. In this example the several managed services micronetworks410of home network406correspond to the respective environments of the several third party providers of partner/service provider subsystems416.

FIG.5is a schematic illustration depicting an exemplary functional diagram500for a NetReach deployment utilizing a micronetwork configuration. As illustrated inFIG.5, the NetReach deployment configuration of diagram500is similar, in several aspects, to architecture400,FIG.4. Accordingly, where common or similar components of diagram500utilize the same naming convention as relevant components of architecture400, the person of ordinary art will understand that these common components share a similar structure and/or functionality.

Thus, in the embodiment depicted inFIG.5, diagram500similarly includes a micronetwork infrastructure502, a service API layer504, and a virtualized microservices layer506, all of which may operatively communicate with external APIs508, which may in include one or more registration APIs510. Also similar to architecture400, an intelligent services layer of micronetwork infrastructure502may include one or more advanced services512, such as OSS/BSS applications, business rules/logic, security services, etc., and virtualized microservices layer506may include an SDN controller514and a DHCP server516.

Diagram500though, depicts an exemplary scenario of NetReach deployment within a Cloud environment similar to the examples described above. Accordingly, in the exemplary embodiment depicted inFIG.5, micronetwork management functionality is performed by a Cloud orchestrator518logically disposed between service API layer504and virtualized microservices layer506. Further to this example, virtualized microservices layer506may additionally include one or more of a Cloud NetReach authentication server (AS)520, an AP/ESS manager522, and a credential manager524.

Also in this NetReach deployment example, a local server layer526may be disposed remotely from micronetwork infrastructure502, Cloud orchestrator518, and the several Cloud-based elements of virtualized microservices layer506. As described above, local server layer526may include one or more local counterparts to virtualized microservices layer506, including but not limited to, a local DHCP server528, a local NetReach AS530, and one or more control applications532. As may be further seen from diagram500, an individual gateway device is not needed at the local level to establish and manage multiple VLANs532for various respective subscribers.

That is, local server layer526may communicate with one or more NetReach APs, namely, CloudReach AP534in the exemplary embodiment depicted inFIG.5, and each such NetReach/CloudReach AP534is enabled to individually manage one or more subscriber devices536within each single VLAN532established for each subscriber connecting to the particular NetReach/CloudReach AP534. Accordingly, each NetReach/CloudReach AP534may include a virtual switch538, as well as a device AP (e.g., a Wi-Fi layer AP)540for direct communication to and from individual subscriber devices536. In the Cloud-based embodiment depicted inFIG.5, NetReach/CloudReach AP534may further include a MC2UC Proxy ARP542.

Thus, according to diagram500, multiple NetReach/CloudReach APs534may be advantageously configured to form a mesh, and thereby operate in a mesh architecture. In the exemplary embodiment, each such NetReach/CloudReach AP534may be further configured to have a persistent management channel Cloud orchestrator518, and each SSID within the mesh architecture may then be a portion of an ESS that is established and managed from the Cloud. In some embodiments, an individual AP may be a part of more than one ESS simultaneously.

In an exemplary embodiment, each AP534may further incorporate an SDN logical switch to which Wi-Fi layer device AP540is bridged. In some embodiments, AP534supports DHCP-relay with support for DHCP Option 82 along with Subscriber-Id sub-option 6 (RFC3993). In at least one embodiment, AP534supports multicast-to-unicast modes of transmission and Proxy ARP (e.g., Proxy ARP542). In an exemplary embodiment, a Wi-Fi module on the AP (e.g., device AP540) supports 802.1Q VLAN tagging and WMM.

In an exemplary embodiment, AP534thus functions as the WAP module, and incorporates the relevant Wi-Fi hardware and associated AP software (e.g., hostapd). In the exemplary embodiment, the relevant Wi-Fi chipset and software (not separately shown) may be Wi-Fi5or higher, and with support for 802.1Q tagging, WMM, multicast-to-unicast conversion, and at least 8 virtual SSIDs.

In an exemplary embodiment, virtual switch538may be a software defined switch (e.g., OpenVSwitch, or OVS) to which the particular AP534bridges each STA (e.g., subscriber devices536) connecting to that AP. A virtual port interface (see e.g.,FIG.6, below) may then be created for each STA that connects to the AP, with the traffic therebetween being managed by rules enforced in virtual switch538.

In an exemplary embodiment, NetReach AS520may function as the component responsible for resolving a password used by a subscriber device536while the device is associating and authenticating with the network, and also for determining the device eligibility, subscriber information, and/or relevant subscription tier. In some embodiments, Cloud NetReach AS520is implemented as a distributed service having a local component (e.g., local NetReach AS530) to speed the authentication process.

In an embodiment, credential manager524may function as the component responsible for managing the subscriber account, and for integration with the OSS/BSS applications of advanced services512. AP/ESS manger522, on the other hand, may virtually serve as the functional equivalent of a wireless controller for managing the AP(s)534and ESS/SSIDs. Exemplary bridge and port configurations are described further below with respect toFIG.6.

FIG.6is a schematic illustration depicting an exemplary trust domain configuration600utilizing a HostAP and an OpenVSwitch (OVS). In the embodiment depicted inFIG.6, configuration600illustrates one exemplary network bridge and port scenario enabling the HostAP and the OVS to segment connecting STAs into separate trust domains, i.e., micronetworks, according to the embodiments described herein.

In this illustrative example, configuration600includes a hostapd sub-configuration, or setup,602, as well as the bridges and ports used therein, and an OVS setup604. In exemplary operation of configuration600, at the start of hostapd, hostapd setup602sets up an AP mode (e.g., ap_iface) on a particular wireless interface specified in a hostap.conf file. In an embodiment, hostapd setup602further creates an internal bridge on which it creates a controlled port for each STA that associates with the AP. Accordingly, in the case where the HostAP is configured to enable dynamic_vlan in a hostap.conf file, the HostAP may then be further advantageously configured to create an internal switch for each VLAN, as well as for each STA that is associated with the particular VLAN, which connects the controlled port of the STA to the corresponding VLAN switch.

In further exemplary operation, the HostAP is further enabled to determine the VLAN of a STA according to several mechanisms, including without limitation, a radius server, a “vlan_file” config option in hostap.conf, and/or a “wpa_psk_file” option in hostapd.conf. In some embodiments, where the wpa_psk_file contains a specific VLAN for a STA, the wpa_psk_file option may be configured to take precedence over other options/mechanisms. According to this particular NetReach setup, the configuration in the wpa_psk_file may be used as a sole source to assign each STA to a particular VLAN. Once traffic from a STA comes on the specific VLAN switch, the HostAP may then add a VLAN tag to the traffic packets, and then outputs the VLAN-tagged packet on a “vlan_tagged_interface” configuration option defined in the hostap.conf file.

In some embodiments, the HostAP creates a virtual sub-interface on the interface specified by the “vlan_tagged_interface”, and may then bridge that VLAN-specific sub-interface to the internal VLAN switch on which the STAs are connected.

In further exemplary operation, for OVS setup604, configuration may further create a linux “veth” pair prior to starting the HostAP or the OVS. In this example, the VLAN-tagged traffic is more readily ingested and managed. Under this sub-configuration, one port of the veth pair may be connected to the HostAP by specifying that port as the “vlan_tagged_interface” in the hostap.conf file, and the other port of the veth pair may be added to an OVS VLAN bridge (ovs vlan_br), thereby enabling the outbound traffic from STAs to appear on the OVS VLAN bridge as being VLAN-tagged. The OVS VLAN bridge (brhapd) thus functions to advantageously “bridge” the VLANs on all APs in an AP group through VXLAN tunnels (vxlan port), thereby ensuring that the normal MAC learning and STP logic functions on a per-VLAN basis. According to exemplary configuration600, only one VXLAN tunnel thus needs to be created between each AP pair in the AP group, and irrespective of the number of VLANs that are actually created.

In further exemplary operation of configuration600, the OVS VLAN bridge may be connected to an OVS micronetworks bridge (brmn001) through an OVS patch-port pair. According to this embodiment, the OVS micronetworks bridge contains the OVS flow rules that enforce the micro-segmentation logic, and thereby further ensure that traffic is isolated per micronetwork/VLAN. In some embodiments, the OVS micronetworks bridge may be further advantageously configured to perform several additional tasks, including without limitation, connection tracking, VLAN tag handling, etc., prior to egress through the OVS LOCAL port.

The computer-implemented methods and processes described herein may include additional, fewer, or alternate actions, including those discussed elsewhere herein. The present systems and methods may be implemented using one or more local or remote processors, transceivers, and/or sensors (such as processors, transceivers, and/or sensors mounted on vehicles, stations, nodes, or mobile devices, or associated with smart infrastructures and/or remote servers), and/or through implementation of computer-executable instructions stored on non-transitory computer-readable media or medium. Unless described herein to the contrary, the various steps of the several processes may be performed in a different order, or simultaneously in some instances.

Additionally, the computer systems discussed herein may include additional, fewer, or alternative elements and respective functionalities, including those discussed elsewhere herein, which themselves may include or be implemented according to computer-executable instructions stored on non-transitory computer-readable media or medium.

In the exemplary embodiment, a processing element may be instructed to execute one or more of the processes and subprocesses described above by providing the processing element with computer-executable instructions to perform such steps/sub-steps, and store collected data (e.g., policies, usage categories, device settings, connectivity categories, etc.) in a memory or storage associated therewith. This stored information may be used by the respective processing elements to make the determinations necessary to perform other relevant processing steps, as described above.

The aspects described herein may be implemented as part of one or more computer components, such as a client device, system, and/or components thereof, for example. Furthermore, one or more of the aspects described herein may be implemented as part of a computer network architecture and/or a cognitive computing architecture that facilitates communications between various other devices and/or components. Thus, the aspects described herein address and solve issues of a technical nature that are necessarily rooted in computer technology.

Furthermore, the embodiments described herein improve upon existing technologies, and improve the functionality of computers, by more reliably protecting the integrity and efficiency of computer networks and the devices on those networks at the server-side, and by further enabling the easier and more efficient identification of devices and network traffic at the server-side and the client-side. The present embodiments therefore improve the speed, efficiency, and reliability in which such determinations and processor analyses may be performed. Due to these improvements, the aspects described herein address computer-related issues that significantly improve the efficiency of transmitting messages in comparison with conventional techniques. Thus, the aspects herein may be seen to also address computer-related issues such as dynamic network settings for different devices on network between electronic computing devices or systems, for example.

Exemplary embodiments of systems and methods for category based network device and traffic identification and routing are described above in detail. The systems and methods of this disclosure though, are not limited to only the specific embodiments described herein, but rather, the components and/or steps of their implementation may be utilized independently and separately from other components and/or steps described herein.

Although specific features of various embodiments may be shown in some drawings and not in others, this is for convenience only. In accordance with the principles of the systems and methods described herein, any feature of a drawing may be referenced or claimed in combination with any feature of any other drawing.

The computer-implemented methods discussed herein may include additional, less, or alternate actions, including those discussed elsewhere herein. The methods may be implemented via one or more local or remote processors, transceivers, servers, and/or sensors, and/or via computer-executable instructions stored on non-transitory computer-readable media or medium.

Additionally, the computer systems discussed herein may include additional, less, or alternate functionality, including that discussed elsewhere herein. The computer systems discussed herein may include or be implemented via computer-executable instructions stored on non-transitory computer-readable media or medium.