Granted Patent B2

US 9,131,372 · App. 12/525,456 · Granted Sep 8, 2015

Inventors: Rainer Falk (Eching, DE); Florian Kohlmayer (Starnberg, DE)

Assignee: Unify GmbH & Co. KG

H04W12/06H04W84/22

Abstract

Claims (39)

1. A method for providing a wireless local area network in which communication devices comprising stationary communication devices as well as mobile communication devices are connected in a form of a mesh as a subnet, said subnet being connected to an infrastructure network and adapted to exchange authentication messages with at least one authentication communication device arranged in the infrastructure network that performs an authentication function, the method comprising:

attempting to establish a first link from a first communication device of the communication devices to a second communication device of the communication devices, at least one of the first and second communication devices having a connection to at least one authentication communication device of the at least one authentication communication device;

testing at least one property correlating to connections that the first and second communication devices have to any of the at least one authentication communication device for fulfillment of at least one criterion for assigning an authenticator role to be assigned as part of authentication to one of the first communication device and the second communication device by a process comprising:

upon a determination that the first communication device has connections to a plurality of authentication communication devices that perform an authentication function and the second communication device has connections to a plurality of authentication communication devices that perform the authentication function, forming an intersection of authentication communication devices to which both the first and second communication devices have a connection,

assigning the authenticator role to the first communication device or the second communication device based upon which of the first communication device and the second communication device has a connection with one of the authentication communication devices of the intersection that has the at least one property that best fulfills the at least one criterion; and

upon a determination that the intersection is empty such that there is no authentication communication device that has a connection with each of the first and second communication devices:

assigning the authenticator role to the first communication device or the second communication device based upon which of (i) a first connection of the first communication device to one of the at least one authentication communication device and (ii) a second connection of the second communication device to a different one of the at least one authentication communication device that has the at least one property that best fulfills the at least one criterion;

the first communication device comparing the at least one authentication communication device to which the second communication device is connected with the at least one authentication communication device connected to the first communication device, the at least one authentication communication device to which the second communication device is connected being made known to the first communication device prior to the comparing of the at least one authentication communication device performed by the first communication device via an announcement message that is sent to make the at least one authentication communication device to which the second communication device is connected known to the first communication device prior to the comparing of the at least one authentication communication device performed by the first communication device; and

the second communication device comparing the at least one authentication communication device to which the first communication device is connected to the at least one authentication communication device connected to the second communication device, the at least one authentication communication device to which the first communication device is connected being made known to the second communication device prior to the comparing of the at least one authentication communication device performed by the second communication device via an announcement message that is sent to make the at least one authentication communication device to which the first communication device is connected made known to the second communication device prior to the comparing of the at least one authentication communication device performed by the second communication device.

2. The method of claim 1 wherein the at least one criterion is comprised of a lowest number of hops along a route forming a connection to the at least one authentication communication device performing the authentication function and the at least one property is comprised of a metric defining a number of hops to an authentication communication device.

3. The method of claim 1 wherein the at least one criterion comprises at least one value that is determinable based on data of a routing log.

4. The method of claim 1 wherein the at least one criterion is a minimum number of hops along a route forming a connection to the at least one authentication communication device performing the authentication function.

5. The method of claim 1 wherein the at least one criterion comprises a value indicating a best quality of a physical property.

6. The method of claim 1 wherein the at least one criterion comprises a value indicating a minimum capacity for a connection to any of the at least one authentication communication device.

7. The method of claim 1 wherein the at least one criterion comprises a power supply for the subnet or the infrastructure network.

8. The method of claim 1 wherein the at least one criterion comprises a minimum processor use.

9. The method of claim 1 further comprising:

upon a determination that the testing shows that the at least one property for the first connection and the second connection coincide, assigning the authenticator role based on a comparison of Media Access Control (“MAC”) addresses of the first communication device and the second communication device.

10. The method of claim 1 further comprising:

upon determining that results of the testing cannot be determined, assigning the authenticator role based on a comparison of Media Access Control (“MAC”) addresses of the first communication device and the second communication device.

11. The method of claim 9 wherein the authenticator role is assigned to which of the first communication device and the second communication device has a smaller MAC address.

12. The method of claim 1 wherein an adaptation of an authentication method takes place based on results of the testing.

13. The method of claim 10 wherein the authenticator role is assigned to which of the first communication device and the second communication device that has a smaller MAC address.

14. The method of claim 12 wherein the adaptation of the authentication method comprises a selection of an authentication method defined in accordance with Extensible Authentication Protocol (“EAP”).

15. The method of claim 3 wherein the routing log is a mesh routing log.

16. The method of claim 5 wherein the physical property is a signal quality and wherein the value indicating best quality of the physical property is a value indicating superior signal quality.

17. The method of claim 1 wherein the at least one authentication communication device comprises at least one mesh key distributor and at least one authentication server.

18. An arrangement providing a Wireless Local Area Network (“WLAN”) comprising:

communication devices having a memory, comprising a first communication device and a second communication device;

at least one authentication communication device communicatively connectable to at least one of the first communication device and the second communication device;

the arrangement being configured such that:

establishment of a first link from a first communication device of the communication devices to a second communication device of the communication devices is attemptable;

at least one property correlating to connections that the first and second communication devices have to any of the at least one authentication communication device for fulfillment of at least one criterion for assigning an authenticator role to be assigned as part of authentication to one of the first communication device and the second communication device for establishment of the link is testable by a process comprising:

upon a determination that the first communication device has connections to a plurality of authentication communication devices that perform an authentication function and the second communication device has connections to a plurality of authentication communication devices that perform the authentication function, forming an intersection of authentication communication devices to which both the first and second communication devices have a connection,

assigning the authenticator role to the first communication device or the second communication device based upon which of the first communication device and the second communication device has a connection with one of the authentication communication devices of the intersection that has the at least one property that best fulfills the at least one criterion; and

upon a determination that the intersection is empty such that there is no authentication communication device that has a connection with each of the first and second communication devices:

assigning the authenticator role to the first communication device or the second communication device based upon which of (i) a first connection of the first communication device to one of the at least one authentication communication device and (ii) a second connection of the second communication device to a different one of the at least one authentication communication device that has the at least one property that best fulfills the at least one criterion;

the first communication device configured to compare the at least one authentication communication device to which the second communication device is connected with the at least one authentication communication device connected to the first communication device, the at least one authentication communication device to which the second communication device is connected being made known to the first communication device prior to the comparing of the at least one authentication communication device performed by the first communication device via an announcement message that is sent to make the at least one authentication communication device to which the second communication device is connected known to the first communication device prior to the comparing of the at least one authentication communication device performed by the first communication device; and

the second communication device configured to compare the at least one authentication communication device to which the first communication device is connected to the at least one authentication communication device connected to the second communication device, the at least one authentication communication device to which the first communication device is connected being made known to the second communication device prior to the comparing of the at least one authentication communication device performed by the second communication device via an announcement message that is sent to make the at least one authentication communication device to which the first communication device is connected made known to the second communication device prior to the comparing of the at least one authentication communication device performed by the second communication device.

Assignments (11)

Priority Claims (1)

Continuity (1)