Patent ID: 8719918

Claim:
A method for distributed security control in a communication network system, said communication network comprising a network controller, one or more second network devices, and one or more user equipment, the method comprising: dynamically establishing, at said network controller, a network security control mechanism by, acquiring one or more address pair combinations of network layer addresses and data link layer addresses, said acquiring being based on detecting Dual Host Configuration Protocol (DHCP) acknowledgement messages sent from at least one DHCP server of at least one address allocating server to said one or more user equipment, and dynamically changing a security checking rule and a network security checking parameter for checking a validity of a data package from said one or more user equipment on said one or more second network devices, the network security checking parameter comprising said one or more address pair combinations of network layer addresses and data link layer addresses; and sending, via a Control and Provisional Wireless Access Points (CAPWAPI protocol message, said network security mechanism to one or more wireless termination devices associated with said one or more second network devices, said one or more wireless termination devices checking the validity of said data package from said one or more user equipment according to said network security control mechanism and discarding said data package if said data package is not in accord with said network security control mechanism.