Patent Description:
<CIT> (<NUM>-<NUM>-<NUM>) discloses network traffic being diverted to a traffic processor when an attack is suspected. The traffic is diverted by a router to a traffic processor, triggered by a special programming rules of the routing table. The traffic is checked by the traffic processor and legitimate traffic is forwarded back to its original destination.

<CIT> (<NUM>-<NUM>-<NUM>) discloses controlling traffic between hosts in a meshed layer-<NUM> network. Forwarding traffic is based on an egress forwarding rule which adds a tag to traffic following a certain path from source to destination. Upon arriving at the destination, the destination address including tag is looked up and traffic is forwarded out only those ports specified in the egress forwarding rule. As such, egress restrictions may be placed on packet forwarding across multiple mesh network devices.

This summary is not intended to identify key factors or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

The present invention relates to a method for providing network isolation in a wireless network as well as a corresponding non-transitory machine readable medium and a computing device.

The following description and annexed drawings set forth certain illustrative aspects and implementations. These are indicative of but a few of the various ways in which one or more aspects may be employed. Other aspects, advantages, and novel features of the disclosure will become apparent from the following detailed description when considered in conjunction with the annexed drawings.

The claimed subject matter is now described with reference to the drawings, wherein like reference numerals are generally used to refer to like elements throughout. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide an understanding of the claimed subject matter. It may be evident, however, that the claimed subject matter may be practiced without these specific details. In other instances, structures and devices are illustrated in block diagram form in order to facilitate describing the claimed subject matter.

One or more computing devices and/or techniques for providing network isolation are provided. For example, routing rules are defined for nodes within a mesh of devices, such as a wireless mesh of devices utilizing a layer-<NUM> network layer with internet protocol (IP) routing. The routing rules specify whether a main routing table or an alternative routing table is to be used for looking up a route to use for routing a packet. For example, a higher priority routing rule may specify that packets, such as marked packets, received from downstream are to use the alternative routing table comprising an alternative route used to route packets upstream for evaluation by a backhaul device using isolation rules specifying which devices are allowed or not allowed to communication with one another. A lower priority routing rule may specify that packets, such as unmarked packets, received from upstream are to use the main routing table comprising a main route used to route packets downstream to a destination device.

A gateway may be configured with a same-virtual local area network (same-VLAN) routing rule that allows for same-VLAN communication (e.g., communication between devices within the same VLAN is allowed) and blocks communication between different VLANs (e.g., communication between devices within different VLANs is blocked). Using priority rules that have different priorities promotes efficient routing of packets to either the gateway or the backhaul node that are configured for selectively allowing or blocking such packets from reaching destinations, thus improving security by blocking packets that could otherwise compromise sensitive data, device operability, and/or security. In this way, security may be improved for the mesh of devices in an efficient manner by providing for selective device isolation such as within a layer-<NUM> network layer and/or by providing same-VLAN communication, which may otherwise by unavailable for the layer-<NUM> network layer. Otherwise, attempting to use packet filtering and/or firewalls to inhibit packets from reaching subnets of different VLANs is inefficient and prevents packets from doing inter-VLAN communication. Selectively providing isolation between certain devices at the layer-<NUM> network layer improves network security in an efficient manner because unauthorized communication, such as communication attempts by a malicious device (e.g., a malicious device attempting to send malicious instructions to a device within the network or attempting to extract sensitive data from the device), may be blocked.

An embodiment of network isolation is illustrated by an exemplary method <NUM> of <FIG>. A mesh of devices may comprise one or more devices (e.g., a device (1A) <NUM>, a device (1B) <NUM>, a device (2A) <NUM>, and a device (2B) of <FIG>), nodes (e.g., a first node <NUM>, a second node <NUM>, and a third node <NUM> of <FIG>), and/or a gateway (e.g., gateway <NUM> of <FIG>) with connectivity to a backhaul device (e.g., backhaul device <NUM> of <FIG>) such as a backhaul switch or router. In an example, the mesh of devices may comprise a wireless device mesh using a layer-<NUM> network layer supporting IP routing. In contrast to a layer-<NUM> network layer, the layer-<NUM> network layer utilizes switching and routing technology and uses logical paths for transmitting data from node to node. The layer-<NUM> network layer is responsible for logical addressing, internetworking, and routing and forwarding of IP. Routing operates at the layer-<NUM> network layer, where packets are sent to a specific next-hop IP address based upon a destination IP address. In an example, a wireless mesh of devices may utilize a layer-<NUM> network layer with IP routing. However, the layer-<NUM> network layer may not support VLAN tags, and thus isolation between devices may be unavailable. Packet filtering and firewalls to block packets on every mesh node to ensure packets cannot reach subnets of different VLANs may be used in an attempt to provide device isolation at the layer-<NUM> network layer, but such techniques are inefficient and do not allow for inter-VLAN communication. Accordingly, as provided herein, device isolation may be provided using IP routing rules and alternative routing tables used to route packets to the backhaul switch for evaluation using isolation rules that either selectively allow or block such packets.

At <NUM>, an isolation rule may be configured on node with a first routing rule and a second routing rule. In an example, the second routing rule may have a higher priority than the first routing rule, such that the second routing rule may be evaluated first for determining whether the second routing rule is applicable to a packet. The first routing rule specifies that a first main routing table is to be used for routing packets (e.g., unmarked packets) received from a device upstream of the node. The first main routing table comprises a main route used to reach a destination device using standard destination routing techniques. In this way, packets that are approved by the backhaul device (e.g., based upon an isolation rule allowing such communication) or by the gateway device (e.g., based upon a same-VLAN routing rule allowing such communication) are routed by the node back downstream to the destination device using the first routing rule and the first main routing table.

The second routing rule specifies that a first alternative routing table is to be used for packets received from a device downstream of the node. The first alternative routing table comprises an alternative route used to route packets upstream, as opposed to through the mesh of devices to the destination device, so that such packets can be evaluated by the backhaul device using isolation rules or by the gateway device using same-VLAN routing rules for providing selective isolation. In this way, the isolation rule applies to the node and/or any other node within the mesh of devices because packets may be evaluated using the first alternative routing table.

In an example, packets that are received from the device downstream of the node (e.g., received from a wireless device) may be marked, such as by a driver module (e.g., a wireless driver) associated with the node, to indicate that the first alternative routing table is to be used for routing (e.g., the mark may trigger the use/applicability of the second routing rule). The driver module may be instructed to not mark packets received the device upstream of the node (e.g., the absence of the mark may trigger the use/applicability of the first routing rule instead of the second routing rule). In an example, the node may store an indication of the device upstream of the node, and thus may use the indication to determine whether the packet was received from the device upstream of the node. If not, then the node may determine that the packet was received from the device downstream of the node. In another example, if the packet was received from a wired device, then an interface over which the packet was received may be evaluated to determine whether the packet was received from downstream or upstream (e.g., as opposed to marking the packet). In this way, one or more nodes (e.g., the first node <NUM>, the second node <NUM>, and the third node <NUM> of <FIG>) may be configured with routing rules specifying whether main routing tables with main routes used to reach destination devices downstream or alternative routing tables with alternative routes used to route packets upstream are to be used.

At <NUM>, the isolation rule may be configured on the gateway with a third routing rule and a fourth routing rule. In an example, the fourth routing rule may have a higher priority than the third routing rule, such that the fourth routing rule may be evaluated first for determining whether the fourth routing rule is applicable to a packet. The third routing rule specifies that a second main routing table is to be used for routing packets, received from a device upstream of the gateway such as the backhaul device, back downstream to the destination device. The third main routing table comprises a main route used to reach the destination device using standard destination routing techniques. In this way, packets that are approved by the backhaul device (e.g., based upon an isolation rule allowing such communication) or by the gateway device (e.g., based upon a same-VLAN routing rule allowing such communication) are be routed by the gateway back downstream to the destination device using the third routing rule and the second main routing table.

The fourth routing rule specifies that a second alternative routing table is to be used for packets received from a device downstream of the gateway. The second alternative routing table comprises an alternative route used to route packets upstream such as to the backhaul device, as opposed to through the mesh of devices to the destination device, so that such packets can be evaluated by the backhaul device using isolation rules for providing selective isolation. In an example, the gateway may be configured to evaluate an interface over which a packet has arrived for determining whether the packet was received from upstream or downstream. In this way, the isolation rule applies to the gateway because packets may be evaluated using the second alternative routing table.

In an example, the gateway may be configured with a same-VLAN routing rule specifying that packets are allowed to be routed by the gateway back through the mesh of devices to the destination device (e.g., without being routed to the backhaul device) when packets are being communicated between devices within a same VLAN, and that packets for communication between devices within different VLANs are to be blocked.

At <NUM>, the isolation rule may be configured in the backhaul device. For example, the backhaul device may either block or allow packets originating from a source device within the mesh of devices (e.g., a sender of a packet to the destination device) based upon an isolation rule specifying which devices are allowed or not allowed to be destination recipients for communication by the source device. For example, the isolation rule may specify that the packet, originating from the source device and having the destination device as a destination recipient, are to be blocked from being routed to the destination device. The isolation rule may specify that packets, originating from the source device and having a second device as the destination recipient, are allowed to be routed back downstream through the mesh of devices to the second device. In this way, the isolation rule may be provided in the node, other nodes within the mesh, the gateway, and the backhaul device (e.g., the isolation rule in the backhaul device provides for inter-VLAN communications).

In an example, the isolation rule may provide a guarantee that devices connected to the mesh of devices cannot communicate with one another, unless the isolation rule provides for such communication (e.g., a same-VLAN routing rule, implemented by the gateway, allowing for communication between devices within the same VLAN). For example, the gateway may send a packet to the backhaul device. Responsive to the backhaul device determining that a destination device is not in a backhaul network (e.g., the destination device is a device within the mesh of device), the backhaul device may send an address resolution protocol (ARP) message to the gateway asking who has the destination device. The gateway may send an ARP reply that the packet is to be routed back from the backhaul device to the gateway for providing inter-VLAN communication. In an example, the backhaul device may send the packet back to a VLAN port (e.g., an interface). In an example, the backhaul device may decide not to support inter-VLAN communication (e.g., based upon implementation of an isolation rule within the backhaul device), and thus may not send the packet back to the gateway. The packet may be distinguished, such as by the backhaul device, as either a new packet coming from the backhaul network or is an existing packet that initially came from the gateway. In this way, selective device isolation may be provided to the mesh of devices, such as for a wireless mesh of devices using a layer-<NUM> network layer.

<FIG> illustrate examples of a system <NUM> for providing network isolation. <FIG> illustrates a wireless mesh network comprising a first node <NUM>, a second node <NUM>, a third node <NUM>, a gateway <NUM>, and/or one or more devices. It may be appreciated that the wireless mesh network may comprise different or other nodes and/or devices than what is illustrated. A device (1A) <NUM> may be connected to the first node <NUM> through a wired connection such as using Ethernet connectivity ETH (<NUM>). A device (1B) <NUM> may be connected to the first node <NUM> through a wireless connection such as using a wireless local area network WLAN (<NUM>). A device (2A) <NUM> may be connected to the second node <NUM> through a wired connection such as using the Ethernet connectivity ETH (<NUM>). A device (2B) <NUM> may be connected to the second node <NUM> through a wireless connection such as using the wireless local area network WLAN (<NUM>). The first node <NUM> and the second node <NUM> may be connected to the third node <NUM> through wireless connections such as using the wireless local area network WLAN (<NUM>). The third node <NUM> may be connected to the gateway <NUM> through a wireless connection such as using the wireless local area network WLAN (<NUM>). The gateway <NUM> may be connected to a backhaul device <NUM> (e.g., a switch or router) over a wired connection such as using Ethernet connectivity ETH (<NUM>).

<FIG> illustrates IP routing rules and routing tables configured for use by nodes, such as the first node <NUM> and the third node <NUM>. First routing rules <NUM> may be defined for the first node <NUM>. The first routing rules <NUM> may comprise a first higher priority rule 220a specifying that packets received from the device (1A) <NUM> (e.g., received from downstream) are to use a first alternative routing table <NUM> specifying that such packets are to be routed upstream to the third node <NUM>. The first routing rules <NUM> may comprise a second higher priority rule 220b specifying that packets (e.g., marked packets received from the device (1B) <NUM>, and marked by a wireless driver of the first node <NUM>) are to use the first alternative routing table <NUM> specifying that such packets are to be routed upstream to the third node <NUM>. The first routing rules <NUM> may comprise a first lower priority rule 220c specifying that packets, received from upstream and having the device (1A) <NUM> as a destination recipient, are to use a first main routing table <NUM> that routes packets using standard destination based routing. The first routing rules <NUM> may comprise a second lower priority rule 220d specifying that packets, received from upstream and having the device (1B) <NUM> as the destination recipient, are to use the first main routing table <NUM> that routes packets using standard destination based routing. Similarly, second routing rules may be defined for the second node <NUM>, such as for routing packets associated with the device (2A) <NUM> and/or the device (2B) <NUM>, specifying whether to use a second main routing table or a second alternative routing table for routing.

Third routing rules <NUM> may be defined for the third node <NUM>. The third routing rules <NUM> may comprise a third higher priority rule 226a specifying that marked packets (e.g., packets received from downstream, and marked by a wireless driver of the third node <NUM>) are to use a third alternative routing table <NUM> specifying that such packets are to be routed upstream to the gateway <NUM>. The third routing rules <NUM> may comprise a third lower priority routing rule 226b specifying that packets received from upstream such as from the gateway <NUM>, originating from any device, and having any other device as a destination recipient are to use a third main routing table <NUM> that routes packets using standard destination based routing.

<FIG> illustrates gateway routing rules <NUM> that are defined for the gateway <NUM>. The gateway routing rules <NUM> may comprise a higher priority rule specifying that marked packets (e.g., packets received from any device downstream, and marked by a wireless driver of the gateway <NUM>) are to use a first alternative routing table <NUM> for a first VLAN, a second alternative routing table <NUM> for a second VLAN, and/or other alternative routing tables for VLANs. If an alternative routing table comprises an entry for a destination device (e.g., because the destination device is within the same VLAN as a sender of a packet), then the packet may be routed to the destination device based upon the entry. If not, then the packet may be routed by default to the backhaul device <NUM>. The gateway routing rules <NUM> may comprise a lower priority rule specifying that packets received from upstream such as from the backhaul device <NUM>, originating from any device, and having any other device as a destination recipient are to use a main routing table <NUM> that routes packets using standard destination based routing.

Isolation rules <NUM> may be defined for use when evaluating whether to block or allow packets for routing back through the mesh to destination recipients. For example, the device (1A) <NUM> may be allowed to communicate only with device (2A) <NUM>, device (2A) <NUM> may be allowed to communicate only with device (1A) <NUM>, device (1B) <NUM> may be allowed to communicate only with device (2B) <NUM>, and device (2B) <NUM> may be allowed to communicate only with device (1B) <NUM>. It may be appreciated that various custom and selective isolation rules may be specified (e.g., a device may be allowed to communicate with <NUM> devices, and may be blocked from communicating with <NUM> other devices).

<FIG> illustrates the device (1A) <NUM> originating a packet <NUM> with device (2A) <NUM> as a destination recipient. The device (1A) <NUM> may route the packet <NUM> over the wired connection to the first node <NUM>. The first node <NUM> may determine that the packet <NUM> was not received from upstream (e.g., not received from the third node <NUM> that is a device upstream of the first node <NUM>), and thus was received downstream. Accordingly, the first node <NUM> may utilize the first higher priority rule 220a to determine that the first alternative routing table <NUM> is to be used to route the packet <NUM>. The first alternative routing table <NUM> indicates that the packet <NUM> should be routed upstream to the third node <NUM>, and thus the first node <NUM> may route the packet <NUM> to the third node <NUM>. A wireless driver associated with the third node <NUM> may mark the packet <NUM> with a mark indicating that the packet <NUM> was received from downstream. Accordingly, the third node <NUM> may utilize the third higher priority rule 226a to determine that the third alternative routing table <NUM> is to be used to route the packet <NUM>. The third alternative routing table <NUM> indicates that the packet <NUM> should be routed upstream to the gateway <NUM>, and thus the third node <NUM> may route the packet <NUM> to the gateway <NUM>.

The gateway <NUM> may evaluate an interface over which the packet <NUM> was received to determine that the packet <NUM> was received from downstream. Accordingly, the gateway <NUM> may utilize the higher priority rule specifying that the first alternative routing table <NUM> is to be used to route the packet <NUM>. In an example, the first alternative routing table <NUM> may comprises an entry for the device (2A) <NUM> (e.g., because the device (A1) <NUM> and the device (2A) <NUM> are within the same VLAN) indicating that the packet <NUM> should be routed to the third node <NUM>. The third node <NUM> may route the packet <NUM> to the second node <NUM> using the third main routing table <NUM> based upon the third lower priority routing rule 226b. The second node <NUM> may route the packet to the device (2A) <NUM> using the second main routing table based upon a lower priority routing rule defined for the second node <NUM>. In this way, communication may be selectively allowed between certain devices using the isolation rules <NUM>.

<FIG> illustrates the device (1B) <NUM> originating a packet <NUM> with device (2A) <NUM> as the destination recipient. The device (1B) <NUM> may route the packet <NUM> over the wireless connection to the first node <NUM>, and thus a wireless driver associated with the first node <NUM> may mark the packet <NUM> as coming from downstream. Accordingly, the first node <NUM> may utilize the second higher priority rule 220b to determine that the first alternative routing table <NUM> is to be used to route the packet <NUM>. The first alternative routing table <NUM> indicates that the packet <NUM> should be routed upstream to the third node <NUM>, and thus the first node <NUM> may route the packet <NUM> to the third node <NUM>. A wireless driver associated with the third node <NUM> may mark the packet <NUM> with a mark indicating that the packet <NUM> was received from downstream. Accordingly, the third node <NUM> may utilize the third higher priority rule 226a to determine that the third alternative routing table <NUM> is to be used to route the packet <NUM>. The third alternative routing table <NUM> indicates that the packet <NUM> should be routed upstream to the gateway <NUM>, and thus the third node <NUM> may route the packet <NUM> to the gateway <NUM>. The gateway <NUM> may evaluate an interface over which the packet <NUM> was received to determine that the packet <NUM> was received from downstream. Accordingly, the gateway <NUM> may utilize the higher priority rule specifying that the second alternative routing table <NUM> is to be used to route the packet <NUM>. The second alternative routing table <NUM> indicates that the packet <NUM> should be routed upstream to the backhaul device <NUM> by default because the second alternative routing table <NUM> does not comprise an entry for device (2A) <NUM> because device (2A) <NUM> is in a different VLAN than device (1B) <NUM>, and thus the gateway <NUM> may route the packet <NUM> to the backhaul device <NUM>. The backhaul device <NUM> may block the packet <NUM> based upon the isolation rules <NUM> indicating that the device (1B) <NUM> is only allowed to communicate with device (2B) <NUM> and thus is isolated from communicating with device (2A) <NUM>. In this way, communication may be selectively isolated between certain devices using the isolation rules <NUM>.

<FIG> illustrate examples of a system <NUM> for providing network isolation. <FIG> illustrates a wireless mesh network comprising a first node <NUM>, a second node <NUM>, a third node <NUM>, a gateway <NUM>, and/or one or more devices. It may be appreciated that the wireless mesh network may comprise different or other nodes and/or devices. A device (1A) <NUM> may be connected to the first node <NUM> through a wired connection such as using Ethernet connectivity ETH (<NUM>). A device (1B) <NUM> may be connected to the first node <NUM> through a wireless connection such as using a wireless local area network WLAN (<NUM>). A device (2A) <NUM> may be connected to the second node <NUM> through a wired connection such as using the Ethernet connectivity ETH (<NUM>). A device (2B) <NUM> may be connected to the second node <NUM> through a wireless connection such as using the wireless local area network WLAN (<NUM>). The first node <NUM> and the second node <NUM> may be connected to the third node <NUM> through wireless connections such as using the wireless local area network WLAN (<NUM>). The third node <NUM> may be connected to the gateway <NUM> through a wireless connection such as using the wireless local area network WLAN (<NUM>). The gateway <NUM> may be connected to a backhaul device <NUM> (e.g., a switch or router) over a wired connection such as using Ethernet connectivity ETH (<NUM>).

The gateway <NUM> may be configured with same-virtual local area network routing rules <NUM> specifying that packet are allowed to be routed by the gateway <NUM> between devices within a same virtual local area network and that packets are not allowed to be routed by the gateway between devices within different virtual local area networks. For example, device (1A) <NUM> and device (2A) <NUM> may be within the same virtual local area network. The device (1A) <NUM> may originate a packet <NUM> having the device (2A) <NUM> as a destination recipient. The device (1A) <NUM> may route the packet <NUM> over the wired connection to the first node <NUM>. The first node <NUM> may determine that the packet <NUM> was not received from upstream (e.g., not received from the third node <NUM> that is a device upstream of the first node <NUM>), and thus was received downstream. Accordingly, the first node <NUM> may route the packet <NUM> to the third node <NUM> utilizing a first alternative routing table. A wireless driver associated with the third node <NUM> may mark the packet <NUM> with a mark indicating that the packet <NUM> was received from downstream. Accordingly, the third node <NUM> may route the packet <NUM> to the gateway <NUM> utilizing a second alternative routing table. The gateway <NUM> may evaluate an interface over which the packet <NUM> was received to determine that the packet <NUM> was received from downstream. Accordingly, the gateway <NUM> may evaluate the packet <NUM> utilizing the same-virtual local area network routing rules <NUM> to determine whether the packet <NUM> is allowed to be routed back downstream to the device (2A) <NUM>.

<FIG> illustrates the gateway <NUM> routing the packet <NUM> back downstream to the device (2A) <NUM> based upon the same-virtual local area network routing rules <NUM> indicating that such communication is allowed because the device (1A) <NUM> and the device (2A) <NUM> are within the same virtual local area network. Accordingly, the gateway <NUM> may route the packet <NUM>, in an unmarked state, downstream to the third node <NUM> utilizing a main routing table. Because the packet <NUM> was received from upstream and is not marked, the third node <NUM> may route the packet <NUM> to the second node <NUM>. Because the packet <NUM> was received from upstream and is not marked, the second node <NUM> may route the packet <NUM> to the device (2A) <NUM>.

The gateway <NUM> may block packets that are being communicated between devices within different virtual local area networks based upon the same-virtual local area network routing rules <NUM>. In an example, if the device (1A) <NUM> and the device (2A) <NUM> were in different virtual local area networks, then the gateway <NUM> may have blocked the packet based upon the same-virtual local area network routing rules <NUM>. In another example, if the device (1B) <NUM> is within a first virtual local area network and the device (2A) is within a second virtual local area network, then the gateway <NUM> may block a packet sent from the device (2A) <NUM> to the device (1B) <NUM> based upon the same-virtual local area network routing rules <NUM>.

<FIG> is an illustration of a scenario <NUM> involving an example non-transitory machine readable medium <NUM>. The non-transitory machine readable medium <NUM> may comprise processor-executable instructions <NUM> that when executed by a processor <NUM> cause performance (e.g., by the processor <NUM>) of at least some of the provisions herein. The non-transitory machine readable medium <NUM> may comprise a memory semiconductor (e.g., a semiconductor utilizing static random access memory (SRAM), dynamic random access memory (DRAM), and/or synchronous dynamic random access memory (SDRAM) technologies), a platter of a hard disk drive, a flash memory device, or a magnetic or optical disc (such as a compact disk (CD), a digital versatile disk (DVD), or floppy disk). The example non-transitory machine readable medium <NUM> stores computer-readable data <NUM> that, when subjected to reading <NUM> by a device <NUM> (e.g., a read head of a hard disk drive, or a read operation invoked on a solid-state storage device), express the processor-executable instructions <NUM>. In some embodiments, the processor-executable instructions <NUM>, when executed cause performance of operations, such as at least some of the example method <NUM> of <FIG>, for example. In some embodiments, the processor-executable instructions <NUM> are configured to cause implementation of a system, such as at least some of the example system <NUM> of <FIG> and/or at least some of the example system <NUM> of <FIG>, for example.

Rather, the specific features and acts described above are disclosed as example forms of implementing at least some of the claims.

As used in this application, the terms "component," "module," "system", "interface", and/or the like are generally intended to refer to a computer-related entity, either hardware, a combination of hardware and software, software, or software in execution. For example, a component may be, but is not limited to being, a process running on a processor, a processor, an object, an executable, a thread of execution, a program, and/or a computer. By way of illustration, both an application running on a controller and the controller can be a component. One or more components may reside within a process and/or thread of execution and a component may be localized on one computer and/or distributed between two or more computers.

Furthermore, the claimed subject matter may be implemented as a method, apparatus, or article of manufacture using standard programming and/or engineering techniques to produce software, firmware, hardware, or any combination thereof to control a computer to implement the disclosed subject matter. The term "article of manufacture" as used herein is intended to encompass a computer program accessible from any computer-readable device, carrier, or media. Of course, many modifications may be made to this configuration without departing from the scope of the claimed subject matter.

<FIG> and the following discussion provide a brief, general description of a suitable computing environment to implement embodiments of one or more of the provisions set forth herein. The operating environment of <FIG> is only one example of a suitable operating environment and is not intended to suggest any limitation as to the scope of use or functionality of the operating environment. Example computing devices include, but are not limited to, personal computers, server computers, hand-held or laptop devices, mobile devices (such as mobile phones, Personal Digital Assistants (PDAs), media players, and the like), multiprocessor systems, consumer electronics, mini computers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like.

Although not required, embodiments are described in the general context of "computer readable instructions" being executed by one or more computing devices. Computer readable instructions may be distributed via computer readable media (discussed below). Computer readable instructions may be implemented as program modules, such as functions, objects, Application Programming Interfaces (APIs), data structures, and the like, that perform particular tasks or implement particular abstract data types. Typically, the functionality of the computer readable instructions may be combined or distributed as desired in various environments.

<FIG> illustrates an example of a system <NUM> comprising a computing device <NUM> configured to implement one or more embodiments provided herein. In one configuration, computing device <NUM> includes at least one processor <NUM> and memory <NUM>. Depending on the exact configuration and type of computing device, memory <NUM> may be volatile (such as RAM, for example), non-volatile (such as ROM, flash memory, etc., for example) or some combination of the two. This configuration is illustrated in <FIG> by dashed line <NUM>.

In other embodiments, device <NUM> may include additional features and/or functionality. For example, device <NUM> may also include additional storage (e.g., removable and/or non-removable) including, but not limited to, magnetic storage, optical storage, and the like. Such additional storage is illustrated in <FIG> by storage <NUM>. In one embodiment, computer readable instructions to implement one or more embodiments provided herein may be in storage <NUM>. Storage <NUM> may also store other computer readable instructions to implement an operating system, an application program, and the like. Computer readable instructions may be loaded in memory <NUM> for execution by processor <NUM>, for example.

The term "computer readable media" as used herein includes computer storage media. Computer storage media includes volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions or other data. Memory <NUM> and storage <NUM> are examples of computer storage media. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, Digital Versatile Disks (DVDs) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by device <NUM>. Computer storage media does not, however, include propagated signals. Rather, computer storage media excludes propagated signals. Any such computer storage media may be part of device <NUM>.

Device <NUM> may also include communication connection <NUM> that allows device <NUM> to communicate with other devices. Communication connection <NUM> may include, but is not limited to, a modem, a Network Interface Card (NIC), an integrated network interface, a radio frequency transmitter/receiver, an infrared port, a USB connection, or other interfaces for connecting computing device <NUM> to other computing devices. Communication connection <NUM> may include a wired connection or a wireless connection. Communication connection <NUM> may transmit and/or receive communication media.

The term "computer readable media" may include communication media. Communication media typically embodies computer readable instructions or other data in a "modulated data signal" such as a carrier wave or other transport mechanism and includes any information delivery media. The term "modulated data signal" may include a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal.

Device <NUM> may include input device <NUM> such as keyboard, mouse, pen, voice input device, touch input device, infrared cameras, video input devices, and/or any other input device. Output device <NUM> such as one or more displays, speakers, printers, and/or any other output device may also be included in device <NUM>. Input device <NUM> and output device <NUM> may be connected to device <NUM> via a wired connection, wireless connection, or any combination thereof. In one embodiment, an input device or an output device from another computing device may be used as input device <NUM> or output device <NUM> for computing device <NUM>.

Components of computing device <NUM> may be connected by various interconnects, such as a bus. Such interconnects may include a Peripheral Component Interconnect (PCI), such as PCI Express, a Universal Serial Bus (USB), firewire (IEEE <NUM>), an optical bus structure, and the like. In another embodiment, components of computing device <NUM> may be interconnected by a network. For example, memory <NUM> may be comprised of multiple physical memory units located in different physical locations interconnected by a network.

Those skilled in the art will realize that storage devices utilized to store computer readable instructions may be distributed across a network. For example, a computing device <NUM> accessible via a network <NUM> may store computer readable instructions to implement one or more embodiments provided herein. Computing device <NUM> may access computing device <NUM> and download a part or all of the computer readable instructions for execution. Alternatively, computing device <NUM> may download pieces of the computer readable instructions, as needed, or some instructions may be executed at computing device <NUM> and some at computing device <NUM>.

Various operations of embodiments are provided herein. In one embodiment, one or more of the operations described may constitute computer readable instructions stored on one or more computer readable media, which if executed by a computing device, will cause the computing device to perform the operations described. The order in which some or all of the operations are described should not be construed as to imply that these operations are necessarily order dependent. Alternative ordering will be appreciated by one skilled in the art having the benefit of this description. Further, it will be understood that not all operations are necessarily present in each embodiment provided herein. Also, it will be understood that not all operations are necessary in some embodiments.

Further, unless specified otherwise, "first," "second," and/or the like are not intended to imply a temporal aspect, a spatial aspect, an ordering, etc. Rather, such terms are merely used as identifiers, names, etc. for features, elements, items, etc. For example, a first object and a second object generally correspond to object A and object B or two different or two identical objects or the same object.

Moreover, "exemplary" is used herein to mean serving as an example, instance, illustration, etc., and not necessarily as advantageous. As used herein, "or" is intended to mean an inclusive "or" rather than an exclusive "or". In addition, "a" and "an" as used in this application are generally be construed to mean "one or more" unless specified otherwise or clear from context to be directed to a singular form. Also, at least one of A and B and/or the like generally means A or B and/or both A and B. Furthermore, to the extent that "includes", "having", "has", "with", and/or variants thereof are used in either the detailed description or the claims, such terms are intended to be inclusive in a manner similar to the term "comprising".

Claim 1:
A method for providing network isolation in a wireless network comprising devices, a node and a gateway, the method comprising:
receiving, at the node, a packet;
responsive to determining that the packet was received from a device upstream of the node:
utilizing a first routing rule, having a first priority, to determine that a first main routing table is to be used for routing the packet downstream; and
utilizing a first main route, within the first main routing table, to route the packet downstream for reaching a destination device that is a destination recipient of the packet; and
responsive to determining that the packet was received from a device downstream of the node:
utilizing a second routing rule, having a second priority that is different from the first priority, to determine that a first alternative routing table is to be used for routing the packet upstream; and
utilizing a first alternative route, within the first alternative routing table, to route the packet upstream to the device upstream of the node; and
responsive to determining that the packet was received by the gateway from a device upstream of the gateway:
utilizing a third routing rule to determine that a second main routing table is to be used for routing the packet downstream; and
utilizing a second main route, within the second main routing table, to route the packet downstream for reaching the destination device; and
responsive to determining that the packet was received by the gateway from a device downstream of the gateway:
utilizing a fourth routing rule to determine that a second alternative routing table is to be used for routing the packet upstream; and
utilizing a second alternative route, within the second alternative routing table, to route the packet upstream to the device upstream of the gateway.