Patent Description:
Wireless devices (e.g., WLAN (wireless local area network) or Wi-Fi devices) are increasingly adopting randomized MAC (media access control) addresses. This poses a problem for many parts of WLAN (e.g., Wi-Fi) infrastructure that may use a MAC address of a wireless device as a unique identifier for the wireless device.

Different users may have different expectations or requirements for privacy. Some users may prioritize privacy above other considerations. For example, an end user in a public area may not wish to allow their presence to be tracked, while an end user at home may see value in allowing a device to be recognized and tracked so that other features, such as parental controls, can operate as expected.

<CIT> provides a prior art example of Wi-Fi privacy in a wireless station using media access control address randomization. <CIT> provides a prior art example of handling unique identifiers for stations. <CIT> provides a prior art example of systems and methods for obtaining permanent MAC addresses.

Because many users take advantage of the current systems, they will experience a perceived loss of utility when they are forced to log in every time because the access point <NUM> or a supervising system will not recognize the station <NUM>. These users may view the ability to use a stored, randomized MAC address as still providing them with privacy when it really does not.

Therefore, it is desirable to improve upon methods and systems for handling unique identifiers for stations.

The invention shall be specified by the appended set of claims. In the following, any method, system and/or apparatus referred to as embodiments but nevertheless do not fall within the scope of the appended claims are to be understood as examples helpful in understanding the invention.

An aspect of the present disclosure provides a method for an access point to provide one or more features to a station. The method comprises outputting a unique identifier request to the station prior to associating with the station, wherein the unique identifier request includes a request that the station respond with a unique identifier that is to be used by the access point for the station, establishing a secure connection with the station, receiving a unique identifier response from the station via the secure connection, determining that the station supports creating and delivering the unique identifier based on an indication provided within the unique identifier response, determining that the unique identifier response provides the unique identifier to be used for the station, wherein the unique identifier is different from a media access control (MAC) address of the station, and providing access to the one or more features to the station based on the unique identifier received in the unique identifier response.

In an aspect of the present disclosure, the method is such that establishing the secure connection with the station comprises exchanging one or more encryption keys with the station.

In an aspect of the present disclosure, the method is such that establishing the secure connection comprises a pre-association security negotiation.

In an aspect of the present disclosure, the unique identifier comprises any of a universal unique identifier, a random number, a pseudorandom number, a preconfigured identifier, or any combination thereof.

In an aspect of the present disclosure, the method further comprises associating the station with the access point.

In an aspect of the present disclosure, the method further comprises after associating the station with the access point, providing to the station network information specifying a network or network access for the station.

In an aspect of the present disclosure, the method is such that providing access to the one or more features to the station based on the unique identifier received in the unique identifier response comprise providing one or more benefits associated with a retail business or an online business.

An aspect of the present disclosure provides an access point for providing access to one or more features to a station. The access point comprises a memory storing one or more computer-readable instructions and a processor configured to execute the one or more computer-readable instructions to output a unique identifier request to the station prior to associating with the station, wherein the unique identifier request includes a request that the station respond with a unique identifier that is to be used by the access point for the station, establish a secure connection with the station, receive a unique identifier response from the station via the secure connection, determine that the station supports creating and delivering the unique identifier based on an indication provided within the unique identifier response, determine that the unique identifier response provides the unique identifier to be used for the station, wherein the unique identifier is different from a media access control (MAC) address of the station, and provide access to the one or more features to the station based on the unique identifier received in the unique identifier response.

In an aspect of the present disclosure, establishing the secure connection with the station comprises exchanging one or more encryption keys with the station.

In as aspect of the present disclosure, establishing the secure connection comprises a pre-association security negotiation.

In an aspect of the present disclosure, the processor is further configured to execute the one or more computer-readable instructions to associate the station with the access point.

In an aspect of the present disclosure, the processor is further configured to execute the one or more computer-readable instructions to after associating the station with the access point, provide to the station network information specifying a network or network access for the station.

In an aspect of the present disclosure, providing access to the one or more features to the station based on the unique identifier received in the unique identifier response comprise providing one or more benefits associated with a retail business or an online business.

An aspect of the present disclosure provides a non-transitory computer-readable medium of an access point storing one or more computer-readable instructions for providing access to one or more features to a station, the one or more computer-readable instructions when executed by a processor of the access point, cause the access point to perform one or more operations of any one or more of the above method steps.

It is desirable to improve upon methods and systems for handling unique identifiers for stations. Methods, systems, and computer readable media can be operable to facilitate an exchange of messages between an access point and a station, wherein the access point requests a unique identifier from the station. The station may either respond with a message declining to provide a unique identifier or respond with a message including a unique identifier to be used by the access point for the station. The response from the station may include additional limitations on the use of the unique identifier by the access point. The access point may enforce different policies against a station depending upon how the station responds to the unique identifier request.

Described herein is an addition of a new message to <NUM> that explicitly allows an access point to ask a station for a unique identifier that it wishes to make known. The message cannot force a station to disclose information since some stations may choose to have decreased performance to preserve their privacy, but it allows a station to share information which is not in the standard today.

<FIG> is a block diagram illustrating an example network environment <NUM> operable to facilitate management of a unique identifier for a station. In embodiments, video, voice, and/or data services may be delivered to one or more stations <NUM> over one or more signal paths. Stations <NUM> may include a laptop, mobile device, tablet, computer, set-top box (STB), gaming device, wearable device, and any other device operable to receive video, voice, and/or data services. It should be understood that various data, multimedia, and/or voice services may be delivered to the stations <NUM>, including but not limited to streaming video, streaming audio, file transfer, email, telephony services, and others.

Multiple services may be delivered to stations <NUM> over one or more local wireless networks <NUM>. The local wireless network(s) <NUM> may include a wireless local area network (WLAN), personal area network (PAN), mobile hotspot network, and others. The local network <NUM> may be provided at a subscriber premise by one or more access points <NUM>. An access point <NUM> may be, for example, a CPE (customer premise equipment) device and may include any device configured to facilitate communications between a Wide Area Network (WAN) and one or more stations <NUM>, such as a modem, multimedia terminal adapter (MTA), embedded MTA (EMTA), gateway device, network extender, or other access device. An access point <NUM> may be integrated with other devices. For example, an access point <NUM> may include a broadband access modem (e.g., a modem may reside within a gateway device, STB, or other devices). It should be understood that delivery of the multiple services over the local network(s) <NUM> may be accomplished using a variety of standards and formats. It will be appreciated by those skilled in the relevant art that stations <NUM> may be capable of interacting and communicating with each other and/or with an access point <NUM> over various wireless communication standards (e.g., Wi-Fi, Bluetooth, etc.).

In embodiments, an access point <NUM> may be connected to a broadband access network <NUM> and may route communications between one or more stations <NUM> and a WAN (wide-area network) <NUM> through the connection to the broadband access network <NUM>. Note that the broadband access network may itself be wired or wireless.

In general, and according to wireless communication standards, a station <NUM> will constantly probe for a new network if the station <NUM> is not currently connected. Typically, the probe messages contain, among other fields, a MAC (media access control) address for the station <NUM>. A coordinated network may track movements of an end user by tracking the probe messages received at different access points if the network has knowledge of the MAC address of the end user's device.

To offer additional privacy to an end user, MAC randomization may be utilized. Randomized MAC addresses may be facilitated by using MAC addresses from the local MAC address space. A local MAC address can be identified if a "local" bit is set (e.g., second bit of the first byte of the MAC address). Use of a local MAC address space minimizes the chance of a device choosing a MAC address that might already be in use by another device. Use of this MAC address space also suggests to a receiving device (e.g., access point) that it has received a randomized MAC (rMAC) address which may influence actions that it takes with respect to that station.

Different device vendors have chosen to make use of randomized MAC addresses in different ways. For example, when a station is unassociated, the station may be configured to use a randomized MAC address that changes periodically when sending probe requests (e.g., rMAC is changed with each probe request, rMAC is changed after a specific time interval, etc.). A station may be configured to use an rMAC as a default option or as an option selected by an end user. When a station is associating with an SSID (service set identifier) provided by an access point, the station may be configured to use the same rMAC consistently for a given SSID, use a new rMAC for each association to an SSID, or may change an rMAC after a certain time interval (e.g., a new rMAC for each day, week, etc.). After a station has completed association, the station may be configured to use the same rMAC or may be configured to periodically change the rMAC used by the station after some event, such as the loss and reacquisition of that association. The association of a station <NUM> with an access point <NUM> may include the process of the station <NUM> joining a service set (e.g., SSID) or network that is provided by the access point <NUM>.

In embodiments, the access point <NUM> may be configured to provide various features such as parental controls, device steering, and others depending upon the ability of the access point <NUM> to consistently identify a station <NUM> across association events. Additionally, infrastructure systems may use past behavior to provide improved steering and other services to a station <NUM>, which would not be available if the station <NUM> cannot be recognized when it returns to the infrastructure ESS (extended service set)/BSS (basic service set).

To allow flexibility, a secured communication exchange (e.g., action frame exchange) is defined herein to allow an access point <NUM> to ask a station <NUM> for an additional, unique identifier. The communication exchange may include a unique identifier request that is output from the access point <NUM>, and received by a station <NUM>, and a unique identifier response that is transmitted from the station <NUM>, to the access point <NUM>, in response to unique identifier request. An access point <NUM> may enforce different policies against a station <NUM> depending upon how the station <NUM> responds to the unique identifier request. The communication exchange between the access point <NUM> and station <NUM> may be secured and kept private. The unique identifier request and unique identifier response messages may be wireless communications (e.g., <NUM> messages).

In embodiments, the request for a unique identifier may include an identification of type of network (e.g., network associated with an SSID) provided by the access point <NUM> (e.g., private data network, private guest network, hotspot network, public network, etc.) and/or an indication as to whether the network provided by the access point <NUM> is encrypted or not encrypted. The station <NUM> may be configured to respond to the unique identifier request based upon the type of network identified by the request and/or whether encryption is enabled. For example, the station <NUM> may apply a filter to the identification of the network type within the request to determine whether to respond. Based on the information within the request, the station <NUM> may determine the encryption on the information it provides. In embodiments, the unique identifier request may include an identification of a network encryption type.

In embodiments, a unique identifier response may include an indication whether the station <NUM> is providing the access point <NUM> with a unique identifier. For example, the station <NUM> may be configured to determine whether to provide a unique identifier based upon the type of network and/or encryption provided by the access point <NUM>. The unique identifier response may include an identification of a length of a unique identifier to be associated with the station <NUM> and may include the unique identifier that is to be associated with the station <NUM>. In embodiments, the unique identifier response may include an optional field for an identifier duration value. If no identifier duration value is included, the access point <NUM> may use the unique identifier for the station <NUM> for a default duration of time (e.g., only during the current association of the station <NUM> with the access point <NUM>, permanently, etc.). Alternatively, the identifier duration value may indicate that the unique identifier is to be used for the station <NUM> only for the duration of the current association between the station <NUM> and the access point <NUM>, upon which the access point <NUM> will store the unique identifier for the station <NUM> until the current association between the station <NUM> and the access point <NUM> ends. As another example, the identifier duration value may include a specific duration (e.g., time in seconds) for which the access point <NUM> stores the unique identifier for the station <NUM>. In embodiments, the unique identifier response may include an optional field in which vendor specific options may be included.

When, during a first association between an access point <NUM> and a station <NUM>, the access point <NUM> is authorized to permanently store the unique identifier for the station <NUM>, the access point <NUM> may continue to store and/or use the unique identifier for the station <NUM>. After the first association has ended, and during a second or subsequent association between the station <NUM> and the access point <NUM>, the station <NUM> may be using a different identifier (e.g., rMAC) than one that was used by the station <NUM> during the first association between the access point <NUM> and the station <NUM>. However, during the second or subsequent association, the station <NUM> may be using the same unique identifier (e.g., a unique identifier provided to the access point <NUM> through a unique identifier response) as the one that was used by the station <NUM> during the first association. In embodiments, during the second association between the access point <NUM> and the station <NUM>, the access point <NUM> may recognize that the station <NUM> is using the same unique identifier as one that was previously used by the station during a previous association. In response, the access point <NUM> may use authorization(s) and/or behaviors, and/or enable one or more services or features that were used and/or enabled during a previous association between the access point <NUM> and the station <NUM>. During the second or subsequent associations between the access point <NUM> and the station <NUM>, the access point <NUM> may use these authorization(s) and/or permissions, and/or enable these services or features without requesting corresponding authorization(s) and/or permission(s) from the station <NUM> during the second/subsequent association(s) between the access point <NUM> and the station <NUM>.

In embodiments, a station <NUM> may be configured with one or more requirements and/or limitations to be placed on an associated unique identifier. For example, the station <NUM> may decline to provide a unique identifier to an access point <NUM> when a type of network and/or an encryption status of a network with which the station <NUM> is associated do not meet certain criteria. Based on the network type and/or encryption status of a network, the station <NUM> may respond to a unique identifier request with a unique identifier response that does not include a unique identifier. Alternatively, if the network type and/or encryption status of the network meet certain criteria, the station <NUM> may generate a unique identifier response that provides the access point <NUM> with a unique identifier for the station <NUM> but limits the use or duration for which the access point <NUM> may use/store the unique identifier (e.g., a use limitation may be included in the unique identifier response).

In embodiments, a station <NUM> may generate a unique identifier based upon an algorithm with which the station <NUM> is configured and/or based upon a user input of a unique identifier or criteria for generating a unique identifier. For example, an end user may input a unique identifier to be used by the station <NUM>, or the station <NUM> may be configured to generate a random unique identifier based upon a key. The unique identifier provided by the station <NUM> may be an identifier other than a MAC address of the station <NUM> or it may be the MAC address of the station <NUM>.

The action frame may be available to an access point <NUM> after a station <NUM> has become associated. The action frame and response may be encrypted, assuming that the association is with a secure SSID so that the unique identifier provided by the station <NUM> within a response is protected from a person who is receiving the wireless transmission. A station <NUM> may consider only responding to the unique identifier request if the SSID is secure. For example, the station <NUM> may be configured to disregard a unique identifier request when the station <NUM> is associated with a network that is not secure (e.g., a public network or unencrypted network).

It should be understood that various requirements for and/or restrictions on the form of a unique identifier may be implemented. For example, a unique identifier may be required to be from a local MAC address space, or to take a certain form such as the UUID form popularized by Microsoft. A scenario may exist where only a specific configuration may be accepted by an access point as a unique identifier. In embodiments, an access point <NUM> may be able to ask any station <NUM> for a permanent unique identifier (e.g., a permanent MAC address, serial number, or other identifier).

A station <NUM> may present a local MAC address or an otherwise randomized MAC address while probing or after association. For some access points <NUM> and associated network services, a local MAC address that may change with each ESS association may restrict the services that an access point <NUM> can offer without additional authentication. An access point may use the unique identifier request message to request that an associated station <NUM> provide an identifying value that can be used across association events to consistently identify the particular station <NUM>, even if its MAC address changes. The unique identifier request message may also include vendor specific information. Since the unique identifier request message is sent after a secure association is in place and PMF has been negotiated between the requesting access point <NUM> and the target station <NUM>, then the unique identifier in the unique identifier response will be secure and kept private.

A station <NUM> may receive a unique identifier request message from its associated access point <NUM> after a secure association is in place. The station <NUM> may respond with a unique identifier response that declines to provide the requesting access point <NUM> with a unique identifier, for example, if the station <NUM> does not trust the access point <NUM>. The station <NUM> may respond with a unique identifier and also indicate the amount of time that the access point <NUM> may expect that unique identifier to be valid in an identifier duration field. If the station <NUM> does not indicate an identifier duration for the unique identifier, then the access point <NUM> may consider the unique identifier to be permanent. The unique identifier response may also include vendor specific information. An access point <NUM> might restrict access to the DS (downstream) in an implementation specific manner based on the unique identifier response or lack thereof from the station <NUM>.

<FIG> shows an example format for a unique identifier request <NUM>. The unique identifier request <NUM> may be transmitted from an access point <NUM> of <FIG> to a station <NUM> of <FIG> after the station <NUM> is associated with the access point <NUM>. The unique identifier request <NUM> may be, for example, a secured action frame. The unique identifier request <NUM> may include a requesting network type field <NUM> and an encryption enabled field <NUM>. A value (e.g., <NUM> byte) within the requesting network type field <NUM> may be used to identify a type of network with which a station is associated (e.g., value of <NUM> = private data network; <NUM> = private guest network; <NUM> = hotspot network; etc.). A value (e.g., <NUM> byte) within the encryption enabled field <NUM> may be used to identify whether or not the network with which a station is associated is encrypted or not (e.g., value of <NUM> = not encrypted; <NUM> = encrypted; etc.).

<FIG> shows an example format for a unique identifier response <NUM>. The unique identifier response <NUM> may be transmitted from a station <NUM> to an access point <NUM> in response to receiving a unique identifier request from the access point <NUM>. The unique identifier response <NUM> may be, for example, a secured action frame. The unique identifier response <NUM> may include a response code field <NUM>, an optional identifier length field <NUM>, an optional unique identifier field <NUM>, an optional identifier duration field <NUM>, and/or an optional vendor specific information field <NUM>. A value (e.g., <NUM> byte) within the response code field <NUM> may be used to identify whether a station is providing a unique identifier to be used by the access point for the station (e.g., a value of <NUM> = decline to provide a unique identifier; <NUM> = unique identifier is provided, etc.). A value (e.g., <NUM> byte) within the identifier length field <NUM> may be used to identify the length of a unique identifier that is provided. A unique identifier to be used by the access point for the station may be provided within the unique identifier field <NUM>. A value (e.g., <NUM> bytes) within the identifier duration field <NUM> may be used to identify a duration for which the access point is to use the unique identifier provided for the station (e.g., <NUM> = use unique identifier only for current association; <NUM>-FFFF = a time in seconds for which the unique identifier is to be used, etc.). If the identifier duration field <NUM> is left blank, the access point may use the unique identifier for a default duration (e.g., permanently or some other specific duration of time). The vendor specific information field <NUM> may be used to provide any additional information or parameters associated with the station.

<FIG> shows an example format for a unique identifier request <NUM> that includes an ID (identifier) query action field. The unique identifier request <NUM> may be transmitted from an access point <NUM> of <FIG> to a station <NUM> of <FIG> after the station <NUM> is associated with the access point <NUM>. The unique identifier request <NUM> may include a category field <NUM>, an ID query action field <NUM>, and an optional vendor specific information field <NUM>. In embodiments, an ID query action field may be included within the unique identifier request and/or unique identifier response. Two action frame formats are defined to allow an access point <NUM> to query a station <NUM> for a unique identifier. An ID query action field, in the octet field immediately after the category field differentiates the formats. The ID query may be sent whether or not the station <NUM> provided a local MAC address.

The ID query request frame uses the action frame body format. It is transmitted from an access point to a station to request that the station provide a unique identifier that the access point may store and use for future identification of the station. The format of the action field in the ID query request frame is shown in <FIG>. The vendor specific information field <NUM> is optionally present and may include one or more vendor-specific elements.

<FIG> shows an example format for a unique identifier response <NUM> that includes an ID query action field. The unique identifier response <NUM> may be transmitted from a station <NUM> to an access point <NUM> in response to receiving a unique identifier request from the access point <NUM>. The unique identifier response <NUM> may include a category field <NUM>, an ID query action field <NUM>, an ID query response field <NUM>, an optional identifier length field <NUM>, an optional unique identifier field <NUM>, an optional identifier duration <NUM>, and an optional vendor specific information field <NUM>. The ID query response frame uses the action frame body format. The unique identifier response <NUM> is transmitted from a station to an access point in response to a request that the station provide a unique non-transitory identifier.

An embodiment of the format of the action field in the ID query response frame is shown in <FIG>. A value in the ID query response field may be used to identify whether the station declines to provide a unique identifier, or the station is providing a unique identifier. The station has the option to indicate that it will not provide a unique identifier value or that it will. When the ID query response field value is <NUM>, the identifier length field, unique identifier field, identifier duration field and vendor specific information field are not present. When the ID query response field value is <NUM>, the identifier length field, unique identifier field, identifier duration field and vendor specific information field are optionally present. The identifier length field indicates the length of the response in octets. The unique identifier field provides the identification value that the requesting access point may use to identify this station without regard to the MAC address used by the station in the MAC header. The unique identifier field <NUM> may have one or more minimal requirements (e.g., <NUM> octets, large enough to allow the use of a UUID, etc.). A value within the identifier duration field may be used to identify a duration for which the access point is to use the unique identifier provided for the station (e.g., <NUM> = use unique identifier only for current association; <NUM>-<NUM> = a time in minutes for which the unique identifier is to be used, etc.). A station may indicate that the unique identifier is permanent by not including this field while including a unique identifier in the unique identifier response <NUM>. Otherwise, the lifetime of the unique identifier is as indicated.

The station capabilities information elements exchanged during association may include an extended capability bit to indicate whether a station can support an ID query action frame. For example, the extended capability bit may be set to <NUM> to indicate that a station can support an ID query action frame. At a higher layer, a user may direct a station to not share a permanent or semi-permanent identifier, so a station may still decline to provide a unique identifier even though it indicates support for the message. The vendor specific information field is optionally present when the ID query response field is <NUM> or <NUM> and includes one or more vendor-specific elements.

<FIG> is a block diagram illustrating an example access point <NUM> operable to facilitate management of a unique identifier for a station <NUM>. The access point <NUM> may include a subscriber interface <NUM>, a network interface <NUM>, a unique identifier exchange module <NUM>, and a unique identifier data store <NUM>. The station <NUM> may include a LAN interface <NUM> and a unique identifier exchange module <NUM>.

In embodiments, communications may be output to and/or received from one or more stations <NUM> through a subscriber interface <NUM>. Wireless communications and messages, comprising data, video, and/or voice communications, may be output from and/or received through the subscriber interface <NUM>. It should be understood that the subscriber interface <NUM> may be configured to receive and/or output communications using various communication techniques, protocols, and standards (e.g., Wi-Fi). In embodiments, communications may be output to and/or received from one or more upstream networks (e.g., broadband access network <NUM> of <FIG>, WAN <NUM> of <FIG>, etc.) through the network interface <NUM>.

In embodiments, the unique identifier exchange module <NUM> may generate and output unique identifier request messages. The unique identifier exchange module <NUM> may receive unique identifier response messages from stations <NUM>, and the unique identifier exchange module <NUM> may ignore or store unique identifiers provided by unique identifier response messages according to various limitations and/or use/storage requirements retrieved from the unique identifier response messages. For example, the unique identifier exchange module <NUM> may store unique identifiers for one or more stations <NUM> within the unique identifier data store <NUM> (e.g., an association between a unique identifier and a station from which the unique identifier is received may be stored). The unique identifier provided by a unique identifier response that is received from a station may be stored as an identifier to be used to identify the specific station.

The unique identifier exchange module <NUM> may facilitate the use of unique identifiers for one or more stations to enable or disable one or more services or features provided to the stations <NUM> by the access point <NUM> (e.g., parental controls, device tracking, etc.). For example, when a station <NUM> provides a unique identifier for use by the access point <NUM>, the access point <NUM> may enable one or more features or services offered to the station by the access point, wherein the one or more services require the use of a consistent and unique identifier of the station. When a station <NUM> declines to provide a unique identifier for use by the access point <NUM>, the access point <NUM> may disable one or more features or services offered to the station by the access point, wherein the one or more services require the use of a consistent and unique identifier of the station.

In embodiments, a station <NUM> may transmit communications to and receive wireless communications from an access point <NUM> through the LAN interface <NUM>.

The unique identifier exchange module <NUM> may receive unique identifier request messages from the access point <NUM> and generate and output unique identifier response messages. In embodiments, the unique identifier exchange module <NUM> may retrieve and/or generate a unique identifier for the station <NUM>, and the unique identifier exchange module <NUM> may populate a unique identifier response message with the unique identifier for the station and/or one or more other field values (e.g., identifier duration value, vendor specific information, etc.). The unique identifier exchange module <NUM> may be configured with parameters and requirements (e.g., network type and/or encryption status requirements) for responding to a unique identifier request message.

<FIG> is a flowchart illustrating an example process <NUM> operable to facilitate managing a unique identifier recovered from a unique identifier response that is received from a station. The process <NUM> can begin after a station (e.g., station <NUM> of <FIG>) is associated with an access point (e.g., access point <NUM> of <FIG>). The unique identifier response/request messages may be facilitated by a unique identifier exchange module <NUM> of <FIG> and/or a unique identifier exchange module <NUM> of <FIG>. The process <NUM> can begin at <NUM>, when a unique identifier request is output to a station <NUM>. When the station <NUM> has been associated with the access point <NUM>, the access point <NUM> may generate and transmit a unique identifier request (e.g., unique identifier request <NUM> of <FIG> or <NUM> of <FIG>) to the station <NUM>. The unique identifier request comprises a request that the station respond with a unique identifier that is to be used by the access point for the station.

At <NUM>, a unique identifier response may be received from the station. For example, the access point <NUM> may receive the unique identifier response (e.g., unique identifier response <NUM> of <FIG> or <NUM> of <FIG>) from the station <NUM>, and the unique identifier response may include an indication that the station either is or is not providing a unique identifier that is to be used for the station. The indication may be provided within a response code field <NUM> of <FIG> or ID query response field <NUM> of <FIG>.

At <NUM>, a determination may be made whether the unique identifier response provides a unique identifier to be used for the station. In embodiments, the access point <NUM> may make this determination based upon whether a unique identifier is present within the unique identifier response or based upon whether the unique identifier response provides an indication whether a unique identifier is provided by the response.

If, at <NUM>, the determination is made that a unique identifier is provided by the unique identifier response, the process <NUM> may proceed to <NUM>. At <NUM>, the access point <NUM> may store the unique identifier for the station <NUM>. For example, the access point <NUM> (e.g., unique identifier exchange module <NUM> of <FIG>) may retrieve the unique identifier from the unique identifier response and store the unique identifier (e.g., within the unique identifier data store <NUM> of <FIG>) as the identifier to be used for the station <NUM>. It will be appreciated that the access point <NUM> may then provide a variety of features (e.g., parental controls, end user tracking, etc.) to an end user by utilizing the stored association between the station and the unique identifier that is retrieved from the unique identifier response. For example, the access point <NUM> may enable, for the station <NUM>, one or more features that are offered to stations for which a unique identifier is known.

If, at <NUM>, the determination is made that a unique identifier is not provided by the unique identifier response, the process <NUM> may proceed to <NUM>. At <NUM>, the station <NUM> may be flagged as a station without a unique identifier. The access point may flag the station <NUM> as having declined or as being unable to provide a unique identifier other than an identifier that is already known (e.g., a MAC address of the station <NUM>) to the access point <NUM>. Alternatively, the access point <NUM> may simply do nothing in response to the determination that a unique identifier is not provided by the unique identifier response.

<FIG> is a flowchart illustrating an example process <NUM> operable to facilitate managing a unique identifier recovered from a unique identifier response that is received from a station that supports an exchange of unique identifier messages. The process <NUM> can begin after a station (e.g., station <NUM> of <FIG>) is associated with an access point (e.g., access point <NUM> of <FIG>). Unique identifier response/request messages may be facilitated by a unique identifier exchange module <NUM> of <FIG> and/or a unique identifier exchange module <NUM> of <FIG>. The process <NUM> can begin at <NUM>, when a unique identifier request is output to a station <NUM>. When the station <NUM> has been associated with the access point <NUM>, the access point <NUM> may generate and transmit a unique identifier request (e.g., unique identifier request <NUM> of <FIG> or <NUM> of <FIG>) to the station <NUM>. The unique identifier request may include a request that the station respond with a unique identifier that is to be used by the access point for the station.

At <NUM>, a unique identifier response may be received from the station. For example, the access point <NUM> may receive the unique identifier response (e.g., unique identifier response <NUM> of <FIG> or <NUM> of <FIG>) from the station <NUM>, and the unique identifier response may include an indication whether the station <NUM> supports the creation and delivery of a unique identifier to the access point <NUM> (e.g., the indication may be provided within a response code field <NUM> of <FIG>, an ID query action field <NUM> of <FIG>, an ID query response field <NUM> of <FIG>, or other field of the response). The unique identifier response may include an indication that the station either is or is not providing a unique identifier that is to be used for the station. The indication may be provided within a response code field <NUM> of <FIG> or ID query response field <NUM> of <FIG>.

At <NUM>, a determination may be made whether the station supports the creation and delivery of a unique identifier to the access point. For example, the access point <NUM> may determine whether the station <NUM> can provide a unique identifier (other than a known identifier such as a MAC address) based upon an indication provided within the unique identifier response. In embodiments, this determination may be made based upon the value of a capability bit. For example, if the capability bit is not set, the access point <NUM> may not ask the station <NUM> for a unique identifier.

If, at <NUM>, the determination is made that the station does not support the creation and delivery of a unique identifier, the process <NUM> may proceed to <NUM>. At <NUM>, the station <NUM> may be flagged as a station without a unique identifier. The access point <NUM> may flag the station <NUM> as being unable to provide a unique identifier other than an identifier that is already known (e.g., a MAC address of the station <NUM>) to the access point <NUM>. Alternatively, the access point <NUM> may simply do nothing in response to the determination that the station cannot provide a unique identifier.

If, at <NUM>, the determination is made that the station is capable of creating and delivering a unique identifier, the process <NUM> may proceed to <NUM>. At <NUM>, a determination may be made whether the unique identifier response provides a unique identifier to be used for the station. In embodiments, the access point <NUM> may make this determination based upon whether a unique identifier is present within the unique identifier response or based upon whether the unique identifier response provides an indication whether a unique identifier is provided by the response.

<FIG> is a flowchart illustrating an example process <NUM> operable to facilitate managing a unique identifier recovered from a unique identifier response that is received from a station, wherein the unique identifier response includes an identifier duration field. The process <NUM> can begin after a station (e.g., station <NUM> of <FIG>) is associated with an access point (e.g., access point <NUM> of <FIG>). Unique identifier response/request messages may be facilitated by a unique identifier exchange module <NUM> of <FIG> and/or a unique identifier exchange module <NUM> of <FIG>. The process <NUM> can begin at <NUM>, when a unique identifier request is output to a station <NUM>. When the station <NUM> has been associated with the access point <NUM>, the access point <NUM> may generate and transmit a unique identifier request (e.g., unique identifier request <NUM> of <FIG> or <NUM> of <FIG>) to the station <NUM>. The unique identifier request may include a request that the station respond with a unique identifier that is to be used by the access point for the station.

If, at <NUM>, the determination is made that a unique identifier is provided by the unique identifier response, the process <NUM> may proceed to <NUM>. At <NUM>, a determination may be made whether an identifier duration is provided within the unique identifier response. In embodiments, the unique identifier response may include an identifier duration field (e.g., identifier duration field <NUM> of <FIG> or identifier duration field <NUM> of <FIG>). If the identifier duration field has a value of zero (<NUM>) or is otherwise left blank, the access point <NUM> (e.g., the unique identifier exchange module <NUM>) may determine that no identifier duration is provided. If the identifier duration field has a value other than zero (<NUM>), the access point <NUM> (e.g., the unique identifier exchange module <NUM>) may determine that an identifier duration is provided.

If, at <NUM>, the determination is made that no identifier duration is provided by the unique identifier response, the process <NUM> may proceed to <NUM>. At <NUM>, the access point <NUM> may store the unique identifier for the station <NUM> for a default duration. For example, the access point <NUM> may store the unique identifier for the station for a default duration, the default duration being the duration of a current association between the station <NUM> and the access point <NUM>, permanently storing the unique identifier at the access point <NUM>, or some other duration of time that is set as the default duration. In embodiments, the access point <NUM> (e.g., unique identifier exchange module <NUM> of <FIG>) may retrieve the unique identifier from the unique identifier response and store the unique identifier (e.g., within the unique identifier data store <NUM> of <FIG>) as the identifier to be used for the station <NUM>. It will be appreciated that the access point <NUM> may then provide a variety of features (e.g., parental controls, end user tracking, etc.) to an end user by utilizing the stored association between the station and the unique identifier that is retrieved from the unique identifier response. For example, the access point <NUM> may enable, for the station <NUM>, one or more features that are offered to stations for which a unique identifier is known.

If, at <NUM>, the determination is made that an identifier duration is provided by the unique identifier response, the process <NUM> may proceed to <NUM>. At <NUM>, the access point <NUM> may store the unique identifier for the station <NUM> for the specific duration that is provided by the unique identifier response. For example, a value within the identifier duration field of the unique identifier response may indicate a duration of time (e.g., number of seconds, minutes, etc.) for which the unique identifier is to be used by the access point <NUM>, and the access point <NUM> may only use the unique identifier for the station for the indicated duration of time. In embodiments, the access point <NUM> (e.g., unique identifier exchange module <NUM> of <FIG>) may retrieve the unique identifier from the unique identifier response and store the unique identifier (e.g., within the unique identifier data store <NUM> of <FIG>) as the identifier to be used for the station <NUM>. It will be appreciated that the access point <NUM> may then provide a variety of features (e.g., parental controls, end user tracking, etc.) to an end user by utilizing the stored association between the station and the unique identifier that is retrieved from the unique identifier response. For example, the access point <NUM> may enable, for the station <NUM>, one or more features that are offered to stations for which a unique identifier is known.

<FIG> is a flowchart illustrating an example process <NUM> operable to facilitate managing a unique identifier recovered from a unique identifier response that is received from a station, wherein the access point permanently stores the unique identifier when an identifier duration response is not provided. The process <NUM> can begin after a station (e.g., station <NUM> of <FIG>) is associated with an access point (e.g., access point <NUM> of <FIG>). Unique identifier response/request messages may be facilitated by a unique identifier exchange module <NUM> of <FIG> and/or a unique identifier exchange module <NUM> of <FIG>. The process <NUM> can begin at <NUM>, when a unique identifier request is output to a station <NUM>. When the station <NUM> has been associated with the access point <NUM>, the access point <NUM> may generate and transmit a unique identifier request (e.g., unique identifier request <NUM> of <FIG> or <NUM> of <FIG>) to the station <NUM>. The unique identifier request may include a request that the station respond with a unique identifier that is to be used by the access point for the station.

If, at <NUM>, the determination is made that a unique identifier is not provided by the unique identifier response, the process <NUM> may proceed to <NUM>. At <NUM>, the station <NUM> may be flagged as a station without a unique identifier. The access point <NUM> may flag the station <NUM> as having declined or as being unable to provide a unique identifier other than an identifier that is already known (e.g., a MAC address of the station <NUM>) to the access point <NUM>. Alternatively, the access point <NUM> may simply do nothing in response to the determination that a unique identifier is not provided by the unique identifier response.

If, at <NUM>, the determination is made that a unique identifier is provided by the unique identifier response, the process <NUM> may proceed to <NUM>. At <NUM>, a determination may be made whether an identifier duration response is provided within the unique identifier response. In embodiments, the unique identifier response may include an identifier duration field (e.g., identifier duration field <NUM> of <FIG> or identifier duration field <NUM> of <FIG>). If the identifier duration field <NUM> is left off the unique identifier response, the access point <NUM> may determine that no identifier duration response is provided. If the identifier duration field <NUM> is included within the unique identifier response, the access point <NUM> may determine that an identifier duration response is provided.

If, at <NUM>, the determination is made that no identifier duration response is provided, the process <NUM> may proceed to <NUM>. At <NUM>, the access point may store/use the unique identifier for the station for some duration. For example, the access point may not delete or terminate use of the unique identifier for a specific duration of time or after the current association between the access point and the station is ended. In embodiments, the access point <NUM> (e.g., unique identifier exchange module <NUM> of <FIG>) may retrieve the unique identifier from the unique identifier response and store the unique identifier (e.g., within the unique identifier data store <NUM> of <FIG>) as the identifier to be used for the station <NUM>. It will be appreciated that the access point <NUM> may then provide a variety of features (e.g., parental controls, end user tracking, etc.) to an end user by utilizing the stored association between the station and the unique identifier that is retrieved from the unique identifier response. For example, the access point <NUM> may enable, for the station <NUM>, one or more features that are offered to stations for which a unique identifier is known.

If, at <NUM>, the determination is made that an identifier duration response is provided, the process <NUM> may proceed to <NUM>. At <NUM>, a determination may be made whether a specific duration is provided by the identifier duration response. For example, if the identifier duration response includes a value of zero (<NUM>) or some other default value, the access point <NUM> may determine that no specific duration is provided, and if the identifier duration response includes any other value, the access point <NUM> may determine that a specific duration is provided.

If, at <NUM>, the determination is made that no specific identifier duration is provided by the identifier duration response, the process <NUM> may proceed to <NUM>. At <NUM>, the access point <NUM> may store the unique identifier for the station <NUM> for a default duration. For example, the default duration may be the duration of a current association between the station <NUM> and the access point <NUM>, in which case, the access point <NUM> will delete or otherwise stop using the unique identifier for the station after the current association between the station and the access point is ended. In embodiments, the access point <NUM> (e.g., unique identifier exchange module <NUM> of <FIG>) may retrieve the unique identifier from the unique identifier response and store the unique identifier (e.g., within the unique identifier data store <NUM> of <FIG>) as the identifier to be used for the station <NUM>. It will be appreciated that the access point <NUM> may then provide a variety of features (e.g., parental controls, end user tracking, etc.) to an end user by utilizing the stored association between the station and the unique identifier that is retrieved from the unique identifier response. For example, the access point <NUM> may enable, for the station <NUM>, one or more features that are offered to stations for which a unique identifier is known.

If, at <NUM>, the determination is made that a specific identifier duration is provided by the identifier duration response, the process <NUM> may proceed to <NUM>. At <NUM>, the access point <NUM> may store the unique identifier for the station <NUM> for the specific duration that is provided by the identifier duration response. For example, a value within the identifier duration field of the unique identifier response may indicate a duration of time (e.g., number of seconds, minutes, etc.) for which the unique identifier is to be used by the access point <NUM>, and the access point <NUM> may only use the unique identifier for the station for the indicated duration of time. In embodiments, the access point <NUM> (e.g., unique identifier exchange module <NUM> of <FIG>) may retrieve the unique identifier from the unique identifier response and store the unique identifier (e.g., within the unique identifier data store <NUM> of <FIG>) as the identifier to be used for the station <NUM>. It will be appreciated that the access point <NUM> may then provide a variety of features (e.g., parental controls, end user tracking, etc.) to an end user by utilizing the stored association between the station and the unique identifier that is retrieved from the unique identifier response. For example, the access point <NUM> may enable, for the station <NUM>, one or more features that are offered to stations for which a unique identifier is known.

<FIG> is a flowchart illustrating an example process <NUM> operable to facilitate generating a response to a unique identifier request. The process <NUM> can begin after a station (e.g., station <NUM> of <FIG>) is associated with an access point (e.g., access point <NUM> of <FIG>). Unique identifier response/request messages may be facilitated by a unique identifier exchange module <NUM> of <FIG> and/or a unique identifier exchange module <NUM> of <FIG>. The process <NUM> can begin at <NUM>, when a unique identifier request is received at a station <NUM>, wherein the unique identifier request is output to the station <NUM> from an access point <NUM>. When the station <NUM> has been associated with the access point <NUM>, the access point <NUM> may generate and transmit a unique identifier request (e.g., unique identifier request <NUM> of <FIG> or <NUM> of <FIG>) to the station <NUM>. The unique identifier request may include a request that the station respond with a unique identifier that is to be used by the access point for the station.

At <NUM>, a network type may be identified from the unique identifier request. In embodiments, the unique identifier request may include an indication of the type of network provided by the access point <NUM> and with which the station <NUM> is currently associated (e.g., the indication may be provided within a requesting network type field <NUM> of <FIG>, a category field <NUM> of <FIG>, an ID query action field <NUM> of <FIG>, etc.). The unique identifier request may also include an indication as to whether the network is encrypted or unencrypted (e.g., the indication may be provided within an encryption enabled field <NUM> of <FIG>, a category field <NUM> of <FIG>, an ID query action field <NUM> of <FIG>, etc.). From the unique identifier request, the station <NUM> (e.g., the unique identifier exchange module <NUM>) may determine the type of network (e.g., private network, public network, hotspot network, etc.) with which the station is associated and/or whether the network is encrypted or unencrypted.

At <NUM>, a determination may be made whether a unique identifier generation feature is enabled for the identified network type and/or encryption status. For example, the station <NUM> (e.g., the unique identifier exchange module <NUM>) may determine whether to provide the access point <NUM> with a unique identifier based upon the identification of the network type and/or the indication whether the network is encrypted or unencrypted. The station <NUM> may be configured with, for example, a filter to only allow the station <NUM> to provide an access point <NUM> with a unique identifier when the network with which the station <NUM> is associated is of a certain type and/or utilizing a certain encryption status or level. For example, the station <NUM> may be configured to only provide an access point with a unique identifier when the network with which the station is associated is a private network and/or an encrypted network.

If, at <NUM>, the determination is made that the unique identifier generation feature is not enabled for the identified network type and/or encryption status, the process <NUM> may proceed to <NUM>. At <NUM>, a unique identifier response may be generated, wherein the unique identifier response does not include a unique identifier for the station. For example, the station may generate a unique identifier response having a value of a certain field (e.g., a response code field <NUM> of <FIG> or ID query response field <NUM> of <FIG> may be given a value of zero (<NUM>)) that indicates to the access point <NUM> that the station <NUM> is declining the option to provide the access point <NUM> with a unique identifier for the station <NUM>. Alternatively, the station <NUM> may generate a unique identifier response that provides the access point <NUM> with a unique identifier for the station <NUM> but limits the use or duration for which the access point <NUM> may use/store the unique identifier (e.g., a use limitation may be included in an identifier duration field <NUM> of <FIG> or <NUM> of <FIG> or in some other field of the unique identifier response).

If, at <NUM>, the determination is made that the unique identifier generation feature is enabled for the identified network type and/or encryption status, the process <NUM> may proceed to <NUM>. At <NUM>, a unique identifier response may be generated, wherein the unique identifier response includes a unique identifier for the station. For example, the station <NUM> may be configured to generate a unique identifier (e.g., random generation, preconfigured identifier, user input identifier, etc.) to be used by the access point <NUM>. In embodiments, the station <NUM> may populate one or more other fields of the unique identifier response with values to indicate additional requirements/limitations of the use of the unique identifier by the access point <NUM> (e.g., identifier duration values, vendor specific options, etc.).

At <NUM>, the unique identifier response generated by the station <NUM> may be output to the access point <NUM> from which the unique identifier request was received.

<FIG> is a flowchart illustrating an example process <NUM> operable to facilitate managing a unique identifier recovered from a unique identifier response that is received from a station following a second or subsequent association between an access point and the station. The process <NUM> can begin after a station (e.g., station <NUM> of <FIG>) is associated with an access point (e.g., access point <NUM> of <FIG>). The association between the access point <NUM> and the station <NUM> may be an association that occurs after a previous association between the access point <NUM> and the station <NUM> has ended. It should be understood that during the current association between the access point <NUM> and the station <NUM>, the station <NUM> may be using a different identifier (e.g., rMAC) than the station <NUM> used during a previous association with the access point <NUM>, but the station <NUM> may, during the current association, use the same unique identifier (e.g., the unique identifier provided in a unique identifier response) as the one used by the station <NUM> during a previous association with the access point <NUM>. The unique identifier response/request messages may be facilitated by a unique identifier exchange module <NUM> of <FIG> and/or a unique identifier exchange module <NUM> of <FIG>. The process <NUM> can begin at <NUM>, when a unique identifier request is output to a station <NUM>. When the station <NUM> has been associated with the access point <NUM>, the access point <NUM> may generate and transmit a unique identifier request (e.g., unique identifier request <NUM> of <FIG> or <NUM> of <FIG>) to the station <NUM>. The unique identifier request comprises a request that the station respond with a unique identifier that is to be used by the access point for the station.

If, at <NUM>, the determination is made that a unique identifier is provided by the unique identifier response, the process <NUM> may proceed to <NUM>. At <NUM>, a determination may be made whether the provided unique identifier is already stored at the access point <NUM>. In embodiments, the access point <NUM> may have stored the unique identifier for the station <NUM> during a previous association between the station <NUM> and the access point <NUM>, wherein the previous association has ended. For example, the unique identifier provided within the unique identifier response that is received by the access point <NUM> at <NUM> may be the same unique identifier as one that was provided by the station <NUM> during a previous association with the access point <NUM> (e.g., a unique identifier provided within a unique identifier response that was received during a previous association between the access point <NUM> and the station <NUM>).

If, at <NUM>, the determination is made that the unique identifier is not already stored at the access point, the process <NUM> may proceed to <NUM>. At <NUM>, the access point <NUM> may store the unique identifier for the station <NUM>. For example, the access point <NUM> (e.g., unique identifier exchange module <NUM> of <FIG>) may retrieve the unique identifier from the unique identifier response and store the unique identifier (e.g., within the unique identifier data store <NUM> of <FIG>) as the identifier to be used for the station <NUM>. It will be appreciated that the access point <NUM> may then provide a variety of features (e.g., parental controls, end user tracking, etc.) to an end user by utilizing the stored association between the station and the unique identifier that is retrieved from the unique identifier response. For example, the access point <NUM> may enable, for the station <NUM>, one or more features that are offered to stations for which a unique identifier is known.

If, at <NUM>, the determination is made that the unique identifier is already stored at the access point, the process <NUM> may proceed to <NUM>. At <NUM>, the access point <NUM> may use authorization(s) and/or behavior(s) used during a previous association between the access point <NUM> and the station <NUM>. For example, the access point <NUM> may use authorization(s) and/or behaviors, and/or enable one or more services or features that were used and/or enabled during a previous association between the access point <NUM> and the station <NUM>. In embodiments, during the current association between the access point <NUM> and the station <NUM>, the access point <NUM> may use authorization(s) and/or behaviors, and/or enable one or more services or features that were used and/or enabled during a previous association between the access point <NUM> and the station <NUM> without requesting corresponding authorization(s) and/or permission(s) from the station <NUM> during the current association between the access point <NUM> and the station <NUM>.

<FIG> is a block diagram of a hardware configuration <NUM> operable to facilitate management of a unique identifier for a station. The hardware configuration <NUM> can include a processor <NUM>, a memory <NUM>, a storage device <NUM>, and an input/output device <NUM>. Each of the components <NUM>, <NUM>, <NUM>, and <NUM> can, for example, be interconnected using a system bus <NUM>. The processor <NUM> can be capable of processing instructions for execution within the hardware configuration <NUM>. In one implementation, the processor <NUM> can be a single-threaded processor. In another implementation, the processor <NUM> can be a multi-threaded processor. The processor <NUM> can be capable of processing instructions stored in the memory <NUM> or on the storage device <NUM>.

The memory <NUM> can store information within the hardware configuration <NUM>. In one implementation, the memory <NUM> can be a computer-readable medium. In one implementation, the memory <NUM> can be a volatile memory unit. In another implementation, the memory <NUM> can be a non-volatile memory unit.

In some implementations, the storage device <NUM> can be capable of providing mass storage for the hardware configuration <NUM>. In one implementation, the storage device <NUM> can be a computer-readable medium. In various different implementations, the storage device <NUM> can, for example, include a hard disk device, an optical disk device, flash memory or some other large capacity storage device. In other implementations, the storage device <NUM> can be a device external to the hardware configuration <NUM>.

The input/output device <NUM> provides input/output operations for the hardware configuration <NUM>. In one implementation, the input/output device <NUM> can include one or more of a network interface device (e.g., an Ethernet card), a serial communication device (e.g., an RS-<NUM> port), one or more universal serial bus (USB) interfaces (e.g., a USB <NUM> port), one or more wireless interface devices (e.g., an <NUM> card) for outputting video, voice, and/or data services to a station <NUM> of <FIG> (e.g., television, STB, computer, mobile device, tablet, telephone, wearable, etc.). In embodiments, the input/output device can include driver devices configured to send communications to, and receive communications from one or more networks (e.g., local network <NUM> of <FIG>, broadband access network <NUM> of <FIG>, WAN <NUM> of <FIG>, etc.).

<FIG> is a flowchart illustrating an example process <NUM> operable to facilitate receiving an unsolicited unique identifier response from a station. The process <NUM> begins prior to a station (for example, a station <NUM> of <FIG>) being associated with an access point (for example, access point <NUM> of <FIG>). The unique identifier response may be facilitated by a unique identifier exchange module <NUM> of station <NUM> of <FIG>. The process <NUM> can begin at <NUM>, when a secure connection (such as any of a secured protected link, secured communication path, secure tunnel, any other secure connection, or any combination thereof) is established between the access point and the station. Establishing the secure connection can comprise any of exchanging one or more encryption keys between the access point <NUM> and the station <NUM>, a pre-association security negotiation (PASN) such that a PASN tunnel can be established between the access point <NUM> and the station <NUM>, performing a robust secure network (RSN) association between the station <NUM> and the access point <NUM>, or any combination thereof. In one or more embodiments, the station <NUM> can initiate the secure connection with the access point <NUM>.

At step <NUM>, after the secure connection has been established, such as at step <NUM>, (for example, after the station has validated that the infrastructure (such as the access point or the network) is trusted or known and/or determined unilaterally that a unique identifier for the station is available or stored at the station, after establishing a PASN tunnel, any other type of secure connection, or any combination thereof) or after establishing a secure connection via an association (for example, an RSN association), the access point device can receive an unsolicited unique identifier response (for example, a unique identifier response <NUM> of <FIG> or <NUM> of <FIG>) from the station via the secure connection. The unique identifier response comprises a unique identifier, for example, any of a universal unique identifier (UUID), a random number, a pseudorandom number, a preconfigured identifier (such as an identifier that is stored on or otherwise configured for the station <NUM>, including but not limited to an identifier assigned by a system administrator, a membership identifier, an employee identifier, any other identifier unique for a business or entity, or any combination thereof), or any combination thereof, that is to be used by the access point for the station. In one or more embodiments, the station can determine that the unique identifier of or associated with the station should be sent to the access point device based on a network parameter. Sending the unique identifier over the secure connection ensures that the unique identifier is not intercepted by an unauthorized, malicious, or otherwise unintended device, network, or system.

For example, a network parameter can comprise a network identifier or information associated with the establishment of the secure connection. The station can identify the network indicated by the network identifier and then confirm or verify that the network is actually the network indicated by the network identifier (for example, not a spoofing attempt) based on the ability to establish the secure connection. As an example, a user with a station can transition to a particular network location, such as a store with a network identifier of "STORE-A NETWORK". The station can detect that the network (or the Wi-Fi connection) claims to be the network associated with the particular network location (for example, "STORE-A NETWORK"). The station can confirm that the network identified as "STORE-A NETWORK" is correct or not subject of a vicious or malicious activity as part of a validation, such as by performing PASN. The station can send a unique identifier associated with the user and the particular network location (such as a store shopper identifier number) to the network so that the user can be provided with an enhanced or improved network experience, for example, so that the station can receive notices (such as coupons) customized for the user, any other service or feature, or any combination thereof.

Steps <NUM>, <NUM>, and <NUM> are similar to or the same as steps <NUM>, <NUM>, and <NUM> as discussed with reference to <FIG>. At step <NUM>, the access point can provide one or more features and/or one or more services associated with the received unique identifier from the station. For example, the unique identifier exchange module <NUM> of the access point <NUM> can facilitate the use of one or more unique identifiers so as to enable or disable one or more features provided to corresponding one or more stations <NUM>. The one or more features can comprise any of one or more services provided by a business, an entity, and/or a network, access to a particular network (such as a public network, a private network, a secured network, a password controlled network, etc.), access to one or more benefits associated with a business or entity, receipt of push notices or messages (such as advertisements, coupons, rewards, rebates, certificates, and/or subscriptions), any other type of notice, message, or alert, or any combination thereof. As an example, the access point <NUM> can provide one or more benefits associated with a business (such as a retail business or an online business) or entity, for example, one or more frequent shopper benefits to a user of a station <NUM> based on the unique identifier received via the unsolicited unique identifier response from the station <NUM>. As an alternative, if no unique identifier is received by the access point <NUM>, the access point <NUM> can disable a service or prevent access to a service by a user of the corresponding station <NUM>.

In one or more embodiments, step <NUM> can occur prior to or after associating the station <NUM> to access point <NUM> or even if no association ever occurs. For example, the network or access point can determine that the station has been transitioned to within a range or a proximity of the network or access point such that the network can push one or more notices (such as a notice customized for the user of the station, the station, or both) to the station using one or more network protocols, one or more types of digital communications, etc. As an example, when the user transitions the station to within range of the STORE-A NETWORK, customized coupons can be sent to the station via a text message even though the station is not associated with the network or the user can be identified as present at the particular network location, such as the user is put on a list (for example, a seating waiting list at a restaurant). As another example, the user can transition the station to a network location that comprises a router provided by an internet service provider, such as a home, a residence, an office, etc., that has a private Wi-Fi network and a public/community Wi-Fi network. This access point or network does not determine the identity of the user and/or the station until the station provides the unique identifier. Once the router receives the unique identifier, the access point or network can determine the services or features associated with the station, for example, whether certain features or services are enabled or disable, or allowed or disallowed, for the station. The access point or network can determine that the station is associated with a user or a user profile. The user or the user profile can be associated with one or more features such that the one or more features provided by the access point to the station is based on the user or the user profile. The access point can provide one or more features based on this determination that the station is associated with a user profile such that the access point can enforce different policies against the station based on the user profile. For example, the access point can determine that the station is associated with a resident or employee and based on this determination the access point can allow or permit the station to connect to the private network instead of the public network.

In one or more embodiments, after associating the access point <NUM> and the station <NUM>, the access point <NUM> can provide network information to the station <NUM>. For example, the network information can comprise information specifying a network or a network access for the station <NUM>. In one or more embodiments, the network information can be provided prior to or without associating the access point <NUM> and the station <NUM>.

In one or more embodiments, after step <NUM>, any one or more of steps <NUM>, <NUM>, <NUM>, <NUM>, and <NUM> of <FIG>, steps <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, and <NUM> of <FIG>, and steps <NUM>, <NUM>, <NUM>, <NUM>, <NUM> of <FIG> can be performed. While the steps of <FIG> and <NUM> are presented in a certain order, the present disclosure contemplates that any one or more steps can be performed simultaneously, substantially simultaneously, repeatedly, or not at all (omitted).

<FIG> is a flowchart illustrating an example process <NUM> operable to facilitate communicating a unique identifier via a secure connection. The process <NUM> begins prior to a station (for example, a station <NUM> of <FIG>) associating with an access point (for example, access point <NUM> of <FIG>). The unique identifier response and/or unique identifier request may be facilitated by a unique identifier exchange module <NUM> of <FIG> and/or a unique identifier exchange module <NUM> of station <NUM> of <FIG>. The process <NUM> can begin at <NUM>, when a unique identifier request is output to a station <NUM> from an access point <NUM>.

At step <NUM>, a secure connection (such as any of a secured protected link, secured communication path, secure tunnel, any other secure connection, or any combination thereof) is established between the access point and the station. For example, a secure tunnel, such as a pre-association security negotiation (PASN) tunnel, can be established between the access point and the station. For example, the station <NUM> can determine based on the unique identifier request from the access point <NUM> that a secure connection should be established or is required between the access point <NUM> and the station <NUM> so that a unique identifier associated with the station <NUM> can be sent to the access point <NUM> via the secure connection. Based on this determination, the station <NUM> can initiate the secure connection with the access point <NUM> and once the secure connection is established the station <NUM> can send the unique identifier to the access point <NUM>. Sending the unique identifier over the secure connection ensures that the unique identifier is not intercepted by an unauthorized, malicious, or otherwise unintended device, network, or system.

At step <NUM>, prior to the station <NUM> associating with the access point <NUM> and after the secure connection has been established (for example, after the station has validated that the infrastructure (such as the access point or the network) is trusted or known and/or determined unilaterally that a unique identifier for the station is available or stored at the station), the access point can receive the unique identifier response (for example, a unique identifier response <NUM> of <FIG> or <NUM> of <FIG>) from the station via the secure connection, for example, as discussed with reference to step <NUM> of <FIG>. The unique identifier response comprises a unique identifier that is to be used by the access point for the station. In one or more embodiments, the station can determine that the unique identifier of or associated with the station should be sent to the access point based on the unique identifier request from the access point <NUM>, the establishment of the secure connection, or both.

Steps <NUM>, <NUM>, and <NUM> are similar to or the same as steps <NUM>, <NUM>, and <NUM> as discussed with reference to <FIG>. At step <NUM>, the access point can provide one or more features associated with the received unique identifier from the station, for example, as discussed with reference to step <NUM> of <FIG>. As an example, the unique identifier exchange module <NUM> of the access point <NUM> can facilitate the use of one or more unique identifiers so as to enable or disable one or more services and/or one or more features provided to corresponding one or more stations <NUM>. As an example, the access point <NUM> can provide one or more benefits associated with a business (such as a retail business or an online business) or entity, for example, one or more frequent shopper benefits, to a user of a station <NUM> based on the unique identifier received via the unsolicited unique identifier response from the station <NUM>. As an alternative, if no unique identifier is received by the access point <NUM>, the access point <NUM> can disable a service or prevent access to a service by a user of the corresponding station <NUM>. For example, at step <NUM>, the access point <NUM> can associate the station <NUM> with the access point <NUM>, determine that the station <NUM> should be within the network and facilitate connectivity to the network, determining that the station <NUM> should not be within the network, provide access to a service or feature associated with an application or a network resource, such as a frequent shopper service, provide an enabled or disabled access to any one or more services or one or more features, or any combination thereof.

In one or more embodiments, after step <NUM>, any one or more of steps <NUM>, <NUM>, <NUM>, <NUM>, and <NUM> of <FIG>, steps <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, and <NUM> of <FIG>, and steps <NUM>, <NUM>, <NUM>, <NUM>, <NUM> of <FIG> can be performed. While the steps of <FIG> and <NUM>-<NUM> are presented in a certain order, the present disclosure contemplates that any one or more steps can be performed simultaneously, substantially simultaneously, repeatedly, or not at all (omitted).

Those skilled in the art will appreciate that the invention improves upon methods and systems for handling unique identifiers for stations. Methods, systems, and computer readable media can be operable to facilitate an exchange of messages between an access point and a station, wherein the access point requests a unique identifier from the station. The station may either respond with a message declining to provide a unique identifier or respond with a message including a unique identifier to be used by the access point for the station. The response from the station may include additional limitations on the use of the unique identifier by the access point. The access point may enforce different features, such as different policies, against a station depending upon how the station responds to the unique identifier request.

The subject matter of this disclosure, and components thereof, can be realized by instructions that upon execution cause one or more processing devices to carry out the processes and functions described above. Such instructions can, for example, comprise interpreted instructions, such as script instructions, e.g., JavaScript or ECMAScript instructions, or executable code, or other instructions stored in a computer readable medium.

Implementations of the subject matter and the functional operations described in this specification can be provided in digital electronic circuitry, or in computer software, firmware, or hardware, including the structures disclosed in this specification and their structural equivalents, or in combinations of one or more of them. Embodiments of the subject matter described in this specification can be implemented as one or more computer program products, i.e., one or more modules of computer program instructions encoded on a tangible program carrier for execution by, or to control the operation of, data processing apparatus.

A computer program (also known as a program, software, software application, script, or code) can be written in any form of programming language, including compiled or interpreted languages, or declarative or procedural languages, and it can be deployed in any form, including as a stand-alone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.

The processes and logic flows described in this specification are performed by one or more programmable processors executing one or more computer programs to perform functions by operating on input data and generating output thereby tying the process to a particular machine (e.g., a machine programmed to perform the processes described herein).

Computer readable media suitable for storing computer program instructions and data include all forms of non-volatile memory, media and memory devices, including by way of example semiconductor memory devices (e.g., EPROM, EEPROM, and flash memory devices); magnetic disks (e.g., internal hard disks or removable disks); magneto optical disks; and CD ROM and DVD ROM disks.

Claim 1:
A method (<NUM>) for an access point (<NUM>) to provide one or more features to a station (<NUM>), the method (<NUM>) comprising:
outputting (<NUM>) a unique identifier request to the station (<NUM>) prior to associating with the station (<NUM>), wherein the unique identifier request includes a request that the station (<NUM>) respond with a unique identifier that is to be used by the access point (<NUM>) for the station (<NUM>);
establishing (<NUM>), in response to outputting the unique identifier request, a secure connection with the station (<NUM>);
receiving (<NUM>) a unique identifier response from the station (<NUM>) via the secure connection;
determining that the station (<NUM>) supports creating and delivering the unique identifier based on an indication provided within the unique identifier response;
determining (<NUM>) that the unique identifier response provides the unique identifier to be used for the station (<NUM>), wherein the unique identifier is different from a media access control (MAC) address of the station (<NUM>); and
providing (<NUM>) access to the one or more features to the station (<NUM>) based on the unique identifier received in the unique identifier response.