Patent ID: 7188364

Claim:
In a system for segregating traffic amongst a plurality of stations that are associated with an access point, a method for joining a personal virtual local area network (VLAN) served by said access point, comprising steps of: providing a control channel for authentication of a requester by a creator of said personal VLAN; using said control channel to relay authentication protocol messages between said creator and said requester; if said creator can authenticate said requester, then said creator sharing a security association it holds with said requester; using said security association shared among members of said personal VLAN to identify frames originating from said members, wherein: if a received frame carries a null virtual LAN ID (VID) or is untagged, then using its source MAC address to determine a preliminary VLAN classification of said received frame; and if said received frame carries a VID, then using said VID as said preliminary VLAN classification instead; using said preliminary VLAN classification to index into a table of security associations giving an authentication code key; said received frame carrying an authentication code computed over a frame payload thereof using a message digest algorithm agreed upon by both said creator and said requester at authentication time and having been recorded in said table of security associations; a receiver of said received frame re-computing an authentication code, using said authentication code key, over said payload of said received frame; comparing said re-computed authentication code with said received authentication code; wherein if said re-computed authentication code and said received authentication code match, then said preliminary VLAN classification becomes a final VLAN classification; using said final VLAN classification as a value of a VLAN classification parameter of any corresponding data request primitives; decrypting said received frame using said security association; and submitting said decrypted frame to a forwarding and learning process; otherwise, discarding said received frame.