Combined security and QOS coordination among devices

1. A computer-implemented method to provide security and wireless network service, the method comprising:

establishing a wireless link between a wireless interface of a wireless access point (WAP) and an endpoint;

exchanging network traffic with the endpoint through the wireless link;

authenticating a security routine executed by a processor of the endpoint;

establishing, through the wireless link and the WAP, and in response to authentication of the security routine, a secure channel that shares the wireless link with the network traffic;

recurrently receiving an indication of a security status the endpoint through at least the secure channel, wherein each indication of the security status comprises at least one of an indication of commencement of execution of an application by a processor of the endpoint and an indication of cessation of execution of the application by the processor of the endpoint;

monitoring performance of the wireless link;

deriving a change to a setting associated with a characteristic of the wireless link based on the performance of the wireless link;

deriving a command based on the security status, wherein the command comprises at least one of a change to the setting to increase a data transfer rate of the wireless link in response to commencement of execution of the application and a change to the setting to decrease the data transfer rate of the wireless link in response to cessation of execution of the application; and

transmitting the command to the endpoint to change the setting through at least the secure channel.

2. A computer-implemented method to provide security and wireless network service, the method comprising:

establishing a first wireless link between a wireless interface of a first wireless access point (WAP) and a first endpoint;

exchanging network traffic with the first endpoint through the first wireless link;

exchanging, through the first wireless link, messages associated with a first secure channel that shares the first wireless link with the network traffic;

recurrently receiving indications of a security status of the first endpoint through at least the first secure channel, wherein each indication of the security status comprises at least one of an indication of commencement of execution of an application by a processor of the first endpoint and an indication of cessation of execution of the application by the processor of the first endpoint;

deriving a first command based on the security status, wherein the first command comprises at least one of a change to the first setting to increase a data transfer rate of the first wireless link in response to commencement of execution of the application and a change to the first setting to decrease the data transfer rate of the first wireless link in response to cessation of execution of the application; and

transmitting the first command to the first endpoint to change a first setting associated with a characteristic of the first wireless link through at least the first secure channel.

3. The computer-implemented method of claim 2 , further comprising:

routing the network traffic through the first WAP between the first wireless link and a firewall, wherein the firewall is incorporated into or is coupled to the first WAP; and

exchanging the messages associated with the first secure channel between a security routine of the endpoint and the firewall.

4. The computer-implemented method of claim 3 , further comprising:

authenticating, at the firewall, the security routine of the first endpoint; and

conditioning establishment of the first secure channel on the authentication of the security routine.

5. The computer-implemented method of claim 2 , further comprising:

monitoring performance of the first wireless link; and

deriving the change of the first setting based on the performance of the first wireless link.

6. The computer-implemented method of claim 5 , further comprising:

deriving, at the first WAP, a change to a second setting associated with a characteristic of a second wireless link established between the first WAP and a second endpoint, wherein the change to the second setting is based on the change to the first setting; and

transmitting a second command to the second endpoint to change the second setting through at least a second secure channel established through the second wireless link.

7. The computer-implemented method of claim 5 , further comprising:

deriving a change to a second setting associated with a characteristic of a second wireless link established between a second WAP and a second endpoint, wherein the change to the second setting is based on the change to the first setting; and

transmitting a second command to the second endpoint to change the second setting through a second secure channel established through the second WAP and the second wireless link.

8. The computer-implemented method of claim 2 , further comprising:

deriving a pattern of use of the first wireless link by an application of the first endpoint, wherein the pattern of use recurs on at least one of a time of day and a day of a week; and

transmitting the first command to the first endpoint in response to reaching the at least one of the time of day and the day of a week.

9. A non-transitory machine-readable medium with instructions stored thereon that, when executed by a processor, cause the processor to:

establish a first wireless link between a wireless interface of a first wireless access point (WAP) and a first endpoint;

exchange network traffic with the first endpoint through the first wireless link;

exchange, through the first wireless link, messages associated with a first secure channel that shares the first wireless link with the network traffic;

recurrently receive indications of a security status of the first endpoint through at least the first secure channel, wherein each indication of the security status comprises at least one of an indication of commencement of execution of an application by a processor of the first endpoint and an indication of cessation of execution of the application by the processor of the first endpoint;

derive a first command based on the security status, wherein the first command comprises at least one of a change to the first setting to increase a data transfer rate of the first wireless link in response to commencement of execution of the application and a change to the first setting to decrease the data transfer rate of the first wireless link in response to cessation of execution of the application; and

transmit the first command to the first endpoint to change a first setting associated with a characteristic of the first wireless link through at least the first secure channel.

10. The non-transitory machine-readable medium of claim 9 , wherein the instructions further cause the processor to:

route the network traffic through the first WAP between the first wireless link and a firewall, wherein the firewall is incorporated into or is coupled to the first WAP; and

exchange the messages associated with the first secure channel between a security routine of the endpoint and the firewall.

11. The non-transitory machine-readable medium of claim 10 , wherein the instructions further cause the processor to:

authenticate, at the firewall, the security routine of the first endpoint; and

condition establishment of the first secure channel on the authentication of the security routine.

12. The non-transitory machine-readable medium of claim 9 , wherein the instructions further cause the processor to monitor performance of the first wireless link and derive the change of the first setting based on the performance of the first wireless link.

13. The non-transitory machine-readable medium of claim 12 , wherein the instructions further cause the processor to:

derive a change to a second setting associated with a characteristic of a second wireless link established between the first WAP and a second endpoint, wherein the change to the second setting is based on the change to the first setting; and

transmit a second command to the second endpoint to change the second setting through a secure channel established through the second wireless link.

14. The non-transitory machine-readable medium of claim 12 , wherein the instructions further cause the processor to:

derive a change to a second setting associated with a characteristic of a second wireless link established between a second WAP and a second endpoint, wherein the change to the second setting is based on the change to the first setting; and

transmit a second command to the second endpoint to change the second setting through a second secure channel established through the second WAP and the second wireless link.

15. The non-transitory machine-readable medium of claim 9 , wherein the instructions further cause the processor to:

derive a pattern of use of the first wireless link by an application of the first endpoint, wherein the pattern of use recurs on at least one of a time of day and a day of a week; and

transmit the first command to the first endpoint in response to reaching the at least one of the time of day and the day of a week.

16. An apparatus to provide security and wireless network service, the apparatus comprising:

a processor of a first wireless access point (WAP);

a wireless interface of the first WAP coupled to the processor; and

a storage of the first WAP coupled to the processor to store instructions, that when executed by the processor cause the processor to:

establish a first wireless link between the wireless interface and a first endpoint;

exchange network traffic with the first endpoint through the first wireless link;

exchange, through the first wireless link, messages associated with a first secure channel that shares the first wireless link with the network traffic;

recurrently receive indications of a security status of the first endpoint through at least the first secure channel, wherein each indication of the security status comprises at least one of an indication of commencement of execution of an application by a processor of the first endpoint and an indication of cessation of execution of the application by the processor of the first endpoint;

derive the first command based on the security status, wherein the first command comprises at least one of a change of the first setting to increase a data transfer rate of the first wireless link in response to commencement of execution of the application and a change to the first setting to decrease the data transfer rate of the first wireless link in response to cessation of the application; and

transmit a first command to the first endpoint to change a first setting associated with a characteristic of the first wireless link through at least the first secure channel.

17. The apparatus of claim 16 , wherein the processor is further caused to:

route the network traffic through the first WAP between the first wireless link and a firewall, wherein the firewall is incorporated into or is coupled to the first WAP; and

exchanging the messages associated with first secure channel between a security routine of the endpoint and the firewall.

18. The apparatus of claim 17 , wherein the processor is further caused to:

authenticate, at the firewall, the security routine of the first endpoint; and

condition establishment of the first secure channel on the authentication of the security routine.

19. The apparatus of claim 16 , wherein the processor is further caused to monitor performance of the first wireless link and derive the change of the first setting based on the performance of the first wireless link.

20. The apparatus of claim 19 , wherein the processor is further caused to:

derive a change to a second setting associated with a characteristic of a second wireless link established between the first WAP and a second endpoint, wherein the change to the second setting is based on the change to the first setting; and

transmit a second command to the second endpoint to change the second setting through a secure channel established through the second wireless link.

21. The apparatus of claim 19 , wherein the processor is further caused to:

derive a change to a second setting associated with a characteristic of a second wireless link established between a second WAP and a second endpoint, wherein the change to the second setting is based on the change to the first setting; and

transmit a second command to the second endpoint to change the second setting through a second secure channel established through the second WAP and the second wireless link.

22. The apparatus of claim 16 , wherein the processor is further caused to:

derive a pattern of use of the first wireless link by an application of the first endpoint, wherein the pattern of use recurs on at least one of a time of day and a day of a week; and

transmit the first command to the first endpoint in response to reaching the at least one of the time of day and the day of a week.