SYSTEM AND METHOD FOR MANAGING NETWORK RESOURCE IMPACT OF MIGRANT WI-FI USERS
A method, apparatus and system providing migrant or unauthenticated users associating with a Wi-Fi Access Point (WAP) with a minimal amount of address, data and other managed Wi-Fi network resources until such time as the migrant or unauthenticated users actually authenticate themselves.
1 . A method for limiting network resource consumption by unauthenticated user devices (UUDs), the method comprising:
receiving, by a gateway (GW) associated with a wireless local area network (WLAN), data packets or data frames from one or more UUDs;
assigning to each UUD a common internal address with L2 aware Network Assigned Translation (NAT); and
forwarding only authentication related traffic associated with any unauthenticated UD.
2 . The method of claim 1 , further comprising forwarding toward one or more access points configuration information adapted to cause said one or more access points to forward all UUD traffic directly to the GW.
3 . The method of claim 1 , wherein said common internal address with L2 aware NAT is assigned to a UUD in response to receiving a DHCP packet from said UUD.
4 . The method of claim 1 , wherein said common internal address has associated with it a limited NAT port allocation, said limited NAT port allocation configured to support communications associated with authentication of the UUD.
5 . The method of claim 1 , further comprising allocating to an authorized user device (AUD) a larger number of NAT outside ports.
6 . The method of claim 5 , wherein said AUD retains the internal IP address assigned to it prior to authentication.
7 . The method of claim 1 , wherein said common internal address is the same for each UUD.
8 . The method of claim 1 , wherein said common internal address comprises one of a small number of internal addresses.
9 . The method of claim 8 , wherein said common internal address is assigned to UUD according to any of round robin selection, type of user device, capability of user device and identity of user device.
10 . The method of claim 1 , further comprising forwarding all traffic associated with any authenticated UD (AUD).
11 . The method of claim 1 , wherein said UUDs communicate with said GW via an open Service Set Identifier (SSID) of said access point.
12 . The method of claim 1 , wherein said authentication related traffic associated with any UUD comprises traffic between said access point and an authentication server.
13 . The method of claim 12 , wherein said authentication related traffic associated with any UUD comprises a DHCP request.
14 . A system providing external network access to authenticated user devices, comprising:
a gateway device disposed between a private network and a public network for routing data there between;
the gateway device configured to communicate with one or more wireless local area network (WLAN) access points via said private network, each access point being configured to operate as a bridge;
the gateway device configured to assign a common internal address with L2 aware NAT to each unauthenticated user device communicating with the gateway device via an access point;
the gateway device configured to forward only authentication related traffic associated with an unauthenticated UD.
15 . A gateway (GW) associated with a wireless local area network (WLAN), comprising a processor configured for limiting network resource consumption by unauthenticated user devices (UUDs), comprising:
receiving, by the GW, data packets or data frames from one or more UUDs;
assigning to each UUD a common internal address with L2 aware NAT; and
forwarding only authentication related traffic associated with any unauthenticated UD.
16 . The method of claim 15 , further comprising forwarding toward one or more access points configuration information adapted to cause said one or more access points to forward all UUD traffic directly to the GW.
17 . A tangible and non-transitory computer readable storage medium storing instructions which, when executed by a computer, adapt the operation of the computer to provide a method of limiting network resource consumption by unauthenticated user devices (UUDs) at a gateway (GW) associated with a wireless local area network (WLAN) access point, the method comprising:
receiving, by the GW, data packets or data frames from one or more UUDs;
assigning to each UUD a common internal address with L2 aware NAT; and
forwarding only authentication related traffic associated with any unauthenticated UD.
18 . A non-transitory computer program product wherein computer instructions, when executed by a processor in a telecom network element, adapt the operation of the telecom network element to provide a method of limiting network resource consumption by unauthenticated user devices (UUDs) at a gateway (GW) associated with a wireless local area network (WLAN) access point, the method comprising:
receiving, by the GW, data packets or data frames from one or more UUDs;
assigning to each UUD a common internal address with L2 aware NAT; and
forwarding only authentication related traffic associated with any unauthenticated UD.