Virtual access point for configuration of a LAN

A technique is disclosed for setting up and configuring a LAN. More particularly, secure communications may be configured between an access point (AP) and a client device. Virtual AP technology is utilized to assist the configuration of the network. In particular, at least two wireless networks are provided in a single A, a configuration LAN and an operational LAN, by utilizing virtual AP technology. The configuration LAN is utilized to provide communication between the AP and the client devices that is related to network setup, configuration, modification, etc. and the operational LAN provides normal LAN data communication. The configuration LAN may be provided in a relatively insecure manner that eases setup of that communication channel and the operational LAN may be provided in a more fully secure communication channel. Different types of service set identifiers (SSIDs) may be provided for configuration LANs and operational LANs so as to more easily identify the type of LAN through its SSID.

TECHNICAL FIELD OF THE INVENTION

This invention relates to connections between a wireless local area network (WLAN) client device and a wireless LAN access point (AP), and more particularly for setting up and configuring WLAN systems and devices.

BACKGROUND

Wireless local area networks are most often provided in an AP/Client arrangement. In order to provide proper data communications between the AP and the client device, a proper communication protocol must generally be setup and configured between the devices. The need for creating a secure communication channel has added to the complexity of the setup and configuration of the communication channel between the AP and the client device. Typical security precautions involve both the AP and the client device being provided with some matching configurations. The security mechanisms hinder the ease of setup of the AP and the client device for typical users and often require manual setup steps of both the AP and the client device. Further, once a secure network has been configured, modifications or changes to the network are additionally difficult. For example, once a secure network is configured, modifications or changes may require making the network temporarily insecure and/or unavailable for use.

In order to ease the setup and configuration process various techniques have been utilized in the past. One group of techniques relates to out of band communication methods. In such techniques, communication channels outside the typical communication channel are utilized. For example, in wireless LANs (WLAN) (such as for example communications under the IEEE 802.11 standards) techniques that utilize USB flash drive and/or cable technology, or RFID technology to communicate configuration information between the AP and the client device have been proposed.

Other techniques have included in-band communication using the WLAN channel to exchange configuration information. Such techniques are known, for example, the Broadcom SecureEZSetup or Athero JumpStart techniques. However, such in band communication techniques still typically include certain dedicated hardware such as buttons, switches, or LEDs that the user must evaluate or set. Additionally, the level of security afforded by such mechanisms may be lower than desired.

In general, it would be desirable to provide a more cost efficient, more secure and more user friendly method for setting up and configuring communication channels between AP and client devices, particularly for wireless protocols.

SUMMARY OF THE INVENTION

A method and system are disclosed for setting up and configuring a LAN. More particularly, secure communications may be configured between an access point and a client device. Virtual AP technology is utilized to assist the configuration of the network. In particular, at least two wireless networks are provided in a single AP, a configuration LAN and an operational LAN, by utilizing virtual AP technology. The configuration LAN is utilized to provide communication between the AP and the client devices that is related to network setup, configuration, modification, etc. and the operational LAN provides normal LAN data communication. The configuration LAN may be provided in a relatively open manner that eases setup of that communication channel and the operational LAN may be provided in a more fully secure communication channel. Different service set identifiers (SSIDs) may be provided for configuration LANs and operational LANs so as to more easily identify the type of LAN through its SSID.

In one embodiment, a method of connecting a client device to an access point is provided. The method may include utilizing a configuration LAN to provide an initial connection between the client device and the access point and switching to an operational LAN to provide a connection between the client device and the access point after the configuration LAN connection is established. The configuration LAN and the operational LAN are configured as separate LANs and the operational LAN is more secure than the configuration LAN.

In another embodiment, a network access point is disclosed. The network access point may include a configuration LAN interface wherein the configuration LAN interface communicates configuration traffic for establishing a connection with a client device, the configuration traffic having limited logical boundaries to which it may be transmitted. The network access point may further include an operational LAN interface, wherein the operational LAN interface communicates communication traffic of an operational LAN to the client device, the operational LAN and the configuration LAN being separate LANs operating through the network access point. In addition the operational LAN may be a more secure LAN as compared to the configuration LAN.

In another embodiment, an information handling system is disclosed. The information handling system may include a wireless access point, a configuration LAN and an operational LAN. The configuration LAN may process configuration and setup settings for connecting the wireless access point and a client device. The configuration LAN and the operational LAN are both transmitted through the wireless access point wherein the operational LAN processes normal LAN traffic between the wireless access point and the client device. Further logical boundaries are provided within the information handling system limiting the configuration LAN traffic to only a portion of the information handling system.

In still another embodiment, a LAN identifier format is disclosed. The format may comprise a plurality of characters of which a subset of characters identify whether the LAN is at least one of a configuration LAN or an operational LAN.

In still another embodiment, a method of identifying a wireless LAN is disclosed. The method may include generating or receiving a multi-character service set identifier value and utilizing at least a portion of the multi-character service set identifier value to identify whether the wireless LAN is at least one of a configuration LAN or an operational LAN. The method may be performed in either of an access point or a client device.

DETAILED DESCRIPTION OF THE INVENTION

As described in more detail below, a technique is disclosed herein for disclosed for setting up and configuring a WLAN. More particularly, secure communications may be configured between an AP and a client device by utilizing Virtual Access Point (virtual AP) technology. Virtual AP technology is known to allow the creation of multiple service set identifiers (SSID) on a single AP. For example, typical WLANs have a unique SSID for each basic service set (BSS) such that all access points and devices attempting to connect to the specific LAN utilize the same SSID. However, virtual AP technology provides multiple SSIDs on a single AP thus creating multiple wireless virtual LANs (VLANs). Such techniques have been used to allow multiple ISPs to share a single AP, and to address QoS, load balancing, and bandwidth allocation issues. Typically a client will be provided access to only one VLAN and not the others

According to the techniques described herein, virtual AP technology may be used to aid in the configuration and setup of an AP and client device. In particular, at least two wireless networks may be provided for in a single AP, a configuration LAN and an operational LAN utilizing virtual AP technology. The configuration LAN is utilized to provide communication between the AP and the client devices that is related to network setup, configuration, modification, etc. and the operational LAN provides normal LAN data communication. The configuration LAN may be provided in a relatively insecure manner that eases setup of that communication channel and the operational LAN may be provided in a more fully secure communication channel. The techniques described herein beneficially balance cost, security and ease of use variables.

More particularly, the configuration LAN and the operational LAN may each be provided with its own SSID and security settings. The creation of the virtual APs and VLANs may be accomplished in firmware and as mentioned above may utilize a common AP, thus minimizing the need for additional hardware and the associated costs of such hardware. Though described herein with reference to an AP that is configured into two virtual networks, it will be recognized that the techniques described herein may be utilized with regard to APs that are configured to support more than two networks. Further to aid in the understanding of the concepts described herein, the techniques described below are discussed with reference to a WLAN (such as the various common IEEE 802.11 standards), however, with the benefit of this disclosure it will be recognized that the concepts described herein are not limited to WLAN applications and may be utilized in other LAN applications.

In one embodiment, a configuration WLAN may be utilized between a wireless AP and a wireless client in which the AP has SSID broadcasting open (or enabled) and no security protocols turned on. In this manner the configuration WLAN would be clearly visible and relatively easy to connect to even for users that are not technically savvy as the user would not have to at this point negotiate through the typically more complex techniques, settings and the like. In this manner an initial association and authentication may occur between the AP and the client device. At this point, the AP and the wireless device may communicate the appropriate settings and security parameters to implement connectivity between the AP and the client device through the operational WLAN. When such data has been communicated, the configuration WLAN connection between the AP and the client device may be disassociated and the operational WLAN (with its increased security provisions) may be associated between the AP and the client device. For example, the operational WLAN may have SSID broadcasting disabled, may utilize security encryption/key protocols, etc. In this manner initial communication may be established through the configuration WLAN which to a user provides an improved ease of use experience and then after the association of the client and the AP, communication may then be transferred to the operational WLAN. Firmware may automatically accomplish the transfer to from the configuration WLAN to the operational WLAN in a manner that is seamless to the user. In this manner a client and an AP may be associated in a manner that allows even unsophisticated users a desirable ease of use experience yet results in a final operating communication mode that is relatively secure.

The configuration WLAN is advantageous in that it is an in-band communication technique for initial setup and configuration. Further, the configuration WLAN may be available for both initial network configuration and also for subsequent network modifications, additions, etc. Thus, the configuration WLAN may continue to be utilized to add additional clients. So as not to limit the available overall communication resources for normal data communications between the AP and client devices, the configuration WLAN may operate at relatively low speeds. This reduces the system load imposed by the configuration WLAN and maximizes the bandwidth available for the operation WLAN.

Because the configuration WLAN is provided in a less secure manner that is more easily open and available to users (and thus potentially more open to abuses and security breaches), the configuration WLAN is configured to have limited functionality for configuration purposes only. For example, the configuration WLAN may be provided so that all network traffic on the configuration WLAN terminates at the AP. Thus, the configuration WLAN can not be utilized to access the internet, other backbone resources of the network that the AP is connected to, other clients that are connected to the AP, etc. In this manner, overall network security is maintained. Thus, the configuration WLAN is relatively easy to “see” and connect to but because it has limited functional capabilities the network is still relatively secure. Though described above with reference to the configuration WLAN terminating at the AP, this is just one example of how the configuration network may be limited to a logically bounded area. For example, the logically bounded area of the configuration network could be broader and include a router, switch, or other network resource that is coupled to the AP. Thus, all network traffic would be terminated at such router, switch or other network resource. In such an example, the network is constructed in a manner such that there are some logical boundaries at which configuration WLAN traffic is terminated, thus providing a level of security to the overall system outside the bounds of the logical boundaries of the configuration WLAN.

As shown inFIG. 1the LAN100may include an AP110that is connected to network resources120which may include routers, switches, servers, network clients, computers, or any other network resources. The AP110may include one or more antennae111for communicating with one or more clients112,114, and116. As mentioned above, although a WLAN is shown inFIG. 1to aid the understanding of the techniques described herein, it will be recognized that the techniques will be applicable to a wide variety of types of LANs.

FIG. 2illustrates in more detail an AP110which supports both a configuration WLAN and an operational WLAN. As shown inFIG. 2, the AP110may include logic and firmware210for supporting both an operational WLAN interface220and a configuration WLAN interface230. Both the operational interface WLAN220and the configuration interface WLAN230may be coupled to the WLAN radio hardware240of the AP110. Communications received by the WLAN radio240may thus include both configuration WLAN communications and operational WLAN communications. As the configuration WLAN and the operational WLAN utilize different SSIDs, communications for the configuration WLAN may be processed through the configuration WLAN interface and communications for the operational WLAN may be processed through the operational WLAN interface. Firmware or software may be provided within the access point so as to properly direct communication traffic to either the configuration WLAN interface or the operation WLAN interface depending upon the type of communication traffic. Operational WLAN communications may be provided to an Ethernet interface260for further communication to the network resources120. Though illustrated as an Ethernet connected AP, it will be recognized that the AP110may be connected to the other network resources through any of a wide range of communication protocols and the Ethernet connection is merely representative and not required to take advantage of the techniques described herein. For example, the AP could also be connected to other network resources through other connections such as power line networking, phone line networking, coaxial cable networking, fiber, etc.

FIG. 2further illustrates an example of a LAN in which three client devices112,114and116are communicating with the AP110. More or fewer clients may be used asFIG. 2is merely meant to illustrate the use of both an operational WLAN and a configuration WLAN. As shown inFIG. 2, client devices112and114are communicating (as indicated by the dashed lines) in an operational WLAN mode through the WLAN radio hardware240and the operation WLAN interface220. Client devices112and114would have previous been connected to the LAN through a setup and configuration process (for example, using the configuration WLAN) and have now been switched over to the operational WLAN. The client device116is shown as communicating with the configuration WLAN mode through the WLAN radio hardware240and the configuration WLAN interface230. Thus client device116is attempting to establish a connection with the LAN. As shown with respect toFIGS. 1 and 2the AP may be a designated access point device. However, it will be recognized that the access point functionality may be embedded in other devices of an information handling system, such as for example, routers, switches, servers, computers, etc. and the designation as an AP is not limited to stand alone AP devices. Furthermore, though shown inFIG. 2has utilizing common WLAN radio hardware, separate dedicated radio hardware could be provide for each of the operation LAN and the configuration LAN.

FIG. 3illustrates an exemplary flowchart of the setup and configuration process utilizing a configuration WLAN and the ultimate establishment of communications over an operational WLAN. As shown inFIG. 3, the flowchart illustrates the activity flow405in an AP and the activity flow410in client device. At the AP side, after power is turned on at step412, the AP initializes both the operational WLAN and the configuration WLAN settings within the AP at steps414and416. The initialization of the configuration WLAN settings at step416may include starting to broadcast the SSID for the configuration WLAN. The AP is then merely waiting at a configuration request step418for a client device to request connection to the LAN through a configuration request.

On the client side, after the client is powered on and is not already connected to an operational WLAN at step420, the WLAN service within the client is activated by initializing the wireless configuration service at step422. At step424, the client device is waiting to detect a broadcasted configuration SSID. In one example, the detection of a broadcasted SSID may be performed as a background service of a client side operating system (for example a Microsoft Windows operating system) that activates whenever the wireless hardware is turned on. Alternatively, such functionality may be provided within the client side wireless software/hardware. When the client device detects a configuration SSID provided by an AP, control in the client device then moves to step426. At step426, a decision is made as to whether to configure the client device for the LAN associated with the detected configuration SSID. If a decision is made not to associate with the detected SSID (such as a user not selecting the detected LAN), control passes to step427in which the detected SSID is ignored and control then returns to step424again as shown. When the decision is made at step426to connect to a detected LAN, control moves to step428at which point the association with a configuration WLAN that is identified by the selected configuration SSID is made. At this point, the client device initiates communication with the AP as indicated by communication line430to establish a connection with the AP according to the protocol for the communication standard that is being utilized.

When a communication connection between the AP and client device has been established, the AP device and client device may then communicate further as shown by communication line432to setup a temporary secure channel as shown by steps434and436(e.g. Diffie-Hellman based protocol). When a secure channel is established further communication438may occur to complete the mutual authentication process as shown in steps440and442(e.g. PIN verification). Steps434,436,440and442provide a mechanism to temporarily create and authenticate a temporarily secure communication channel even though the channel is initiated in an open environment. Any of a variety of methods may be used that allow a software configurable secure channel to be temporarily established and authenticated and the techniques for the use of a configuration WLAN and operational WLAN as described herein are not limited to any particular technique. One such technique that may be utilized is disclosed in pending U.S. patent application no. 2005/0160287 entitled METHOD TO DEPLOY WIRELESS ROUTER filed Jul. 21, 2005 by Mehta et al., the disclosure of which is expressly incorporated herein by reference; however, other techniques may be used.

If the AP detects that the temporarily secure communication channel has been established and authenticated, control moves from AP step444to AP step448. If the client device detects that the temporarily secure communication channel has been established and authenticated, control moves from client step446to AP step452. If either the AP or client device determine that authentication was not successful, then control returns to the AP step418and the client step427as shown and the process repeats as described above.

After a secure and authenticated channel has been established, the AP may then send to the client device the settings for the operational WLAN including the operation SSID and other associated security encryption codes/keys, and the like. This is indicated at the AP step448, communication line450and client device452in which the settings for the operational WLAN are sent from and to the AP and client device respectively.

After the AP has sent the setting for the operational WLAN, the AP may then disassociate the configuration WLAN from the client device as indicated in step454. The AP configuration WLAN of the AP device may then have control returned to step418to await the next configuration request. At this point the AP device may await further communications from the client device over the operation WLAN. On the client side, after the operational WLAN settings are received at step452, control moves to step454where configuration WLAN disassociation communication456is provided from the AP. At this point the client device also disassociates from the configuration WLAN. Next, at step458the settings for the configuration WLAN are removed from the setting profiles in the client and replaced with the settings for the operational WLAN. Finally, at step460the client device associates with the operational WLAN by providing the operation SSID and security settings to the AP according to the protocol of the standard under which the AP and client device are operating.

The techniques described herein may be utilized in a system in which the configuration LAN and the operational LAN both communicate according to the same technology standard. Thus, in one example and operational WLAN and a configuration WLAN may both communicate according to an 802.11 standard. However, the operational LAN and the configuration LAN may communicate according to different technology protocols also. Thus, for example, the operational communications may occur according to one standard and the configuration communication may occur according to another standard. In one example the configuration communication may occur according to an 802.11 protocol while the operation LAN may communicate according to a Wi-Max or Cellular protocol. In such configurations, reference to “an access point” may refer to a single access point device that conforms to both standards or may refer to two separate devices (one for each standard) that operate together and together may be viewed to form “an access point.”

The SSID data formats that are utilized for the techniques described above may be formats such as known in the current art. For example, the SSID may be a 32 character string such as commonly used in WLANs. When utilizing an operational LAN and configuration LAN, however, it may be beneficial to utilize the knowledge of such a system to define a particular format for the SSID characters (this would avoid potential duplicate SSIDs). For example, with a standard 32 character string SSID, the particular characters may include identifiers that designate the SSID as a configuration SSID or an operational SSID. In this manner, the SSID may be more readily identified by client devices as a potential configuration SSID. One example of such a technique is shown inFIG. 4. As shown inFIG. 4, the 32 characters available for use as an SSID400may be split into a MODE field402, a manufacturer field404, and a serial number field406. In the MODE field, the characters may be set to a designator value that such as either “config” or “op” to designate the SSID as belonging to a configuration LAN or operational LAN respectively. In this manner, the type of LAN may be more readily identified by the SSID data itself. Further within the processes and steps described above, the client devices may be designed to automatically only seek SSIDs having the configuration SSID designation when initially searching for a configuration SSID to begin the establishment of a network connection. Other processes may also take advantage of identifying within the SSID itself whether the SSID relates to an operational LAN or a configuration LAN. Although described herein with reference to a mode field located at the beginning of the SSID characters, it will be recognized that the mode field could be located in other portions of the SSID character string. In addition, in one alternative SSIDs may be considered to default to one type of SSID (configuration or operational) and the MODE field need only be populated for the other type of SSID.

As described above the connection to an operational LAN is achieved through first connecting to a configuration LAN. It will be recognized that such techniques may also be utilized in LAN systems that allow a user to bypass the configuration LAN steps. Thus, the systems described above may allow for a client device to bypass the configuration LAN step when the user knows the operational LAN settings. Alternatively, if a connection becomes disconnected, a client may re-connect to the operation LAN through use of the previously determined operation LAN settings without having to perform the configuration LAN steps described herein.

Further modifications and alternative embodiments of this invention will be apparent to those skilled in the art in view of this description. It will be recognized, therefore, that the present invention is not limited by these example arrangements. Accordingly, this description is to be construed as illustrative only and is for the purpose of teaching those skilled in the art the manner of carrying out the invention. It is to be understood that the forms of the invention herein shown and described are to be taken as the presently preferred embodiments. Various changes may be made in the implementations and architectures. For example, equivalent elements may be substituted for those illustrated and described herein, and certain features of the invention may be utilized independently of the use of other features, all as would be apparent to one skilled in the art after having the benefit of this description of the invention. For example, the various communication protocols described herein (such as 802.11a/b/g/n, WPAN, 802.16 (or Wi-MAX), Cellular technologies, etc.) are merely exemplary and it will be recognized that other current and future standards may equally utilized the techniques described herein. Furthermore, the prioritization classes described herein are merely exemplary and other classes of traffic and/or other levels of priority may be utilized while still providing the benefits of the concepts disclosed herein.