Group isolation in wireless networks
Methods and Systems here may be used for managing a wireless network including associating a first and second wireless access device to an access point (AP), assigning the first and second wireless access device to respective first and second isolation groups, providing local communication via the AP within the isolation group, and prohibiting local communication via the AP between the first and second isolation groups.
1. An electronic device, comprising:
one or more antenna nodes configured to couple to one or more antennas;
an interface circuit, communicatively coupled to the one or more antenna nodes, configured to wirelessly communicate with a second electronic device and a third electronic device, wherein the electronic device is configured to:
establish a connection with the second electronic device;
assign the second electronic device to an isolation group;
receive, associated with the third electronic device, a packet or a frame addressed to the second electronic device;
when the third electronic device is assigned to the isolation group, routing the packet or frame addressed to the second electronic device, wherein the routing provides direct communication between the third electronic device and the second electronic device within the isolation group via the electronic device; and
when the third electronic device is not assigned to the isolation group, prohibiting direct communication between the third electronic device and the second electronic device via the electronic device.
2. The electronic device of claim 1 , wherein the electronic device comprises an access point.
3. The electronic device of claim 1 , wherein, when the third electronic device is not assigned to the isolation group, the electronic device is configured to drop the packet or the frame.
4. The electronic device of claim 1 , wherein, when the third electronic device is not assigned to the isolation group, the electronic device is configured to route the packet or the frame addressed to the second electronic device to a computer or a server in a network.
5. The electronic device of claim 1 , wherein a set of one or more electronic devices assigned to the isolation group have different network or other access permissions than a second set of one or more electronic devices assigned to a different isolation group.
6. The electronic device of claim 1 , wherein, when the third electronic device is not assigned to the isolation group, the electronic device does not provide, to the third electronic device, information that specifies one or more electronic devices in the isolation group that are connected to the electronic device.
7. The electronic device of claim 1 , wherein the electronic device has a single service set identification (SSID) and a single virtual local area network (VLAN).
8. The electronic device of claim 1 , wherein the assignment is based at least in part on information comprising one of: an access control list that specifies the second electronic device, a pre-share key associated with the second electronic device, a dynamically generated pre-share key associated with the second electronic device, a media access control (MAC) address of the second electronic device, a username and a password, or a credential associated with a third-party website.
9. The electronic device of claim 8 , wherein the information is stored on the electronic device.
10. The electronic device of claim 1 , wherein the electronic device is configured to receive, associated with a controller or an authentication, authorization and accounting (AAA) server, information that specifies the isolation group.
11. The electronic device of claim 1 , wherein the isolation group has an associated single service set identification (SSID) or a single virtual local area network (VLAN) that is different from a second SSID or a second VLAN associated with a different isolation group.
12. A non-transitory computer-readable storage medium for use in conjunction with an electronic device, the computer-readable storage medium storing program instructions that, when executed by the electronic device, cause the electronic device to perform one or more operations comprising:
establishing a connection with a second electronic device;
assigning the second electronic device to an isolation group;
receiving, associated with a third electronic device, a packet or a frame addressed to the second electronic device;
when the third electronic device is assigned to the isolation group, routing the packet or frame addressed to the second electronic device, wherein the routing provides direct communication between the third electronic device and the second electronic device within the isolation group via the electronic device; and
when the third electronic device is not assigned to the isolation group, prohibiting direct communication between the third electronic device and the second electronic device via the electronic device.
13. The non-transitory computer-readable storage medium of claim 12 , wherein the electronic device comprises an access point.
14. The non-transitory computer-readable storage medium of claim 12 , wherein, when the third electronic device is not assigned to the isolation group, the operations comprise dropping the packet or the frame.
15. The non-transitory computer-readable storage medium of claim 12 , wherein, when the third electronic device is not assigned to the isolation group, the operations comprise routing the packet or the frame addressed to the second electronic device to a computer or a server in a network.
16. The non-transitory computer-readable storage medium of claim 12 , wherein a set of one or more electronic devices assigned to the isolation group have different network or other access permissions than a second set of one or more electronic devices assigned to a different isolation group.
17. The non-transitory computer-readable storage medium of claim 12 , wherein the operations comprise receiving, associated with a controller or an authentication, authorization and accounting (AAA) server, information that specifies the isolation group.
18. The non-transitory computer-readable storage medium of claim 12 , wherein the isolation group has an associated single service set identification (SSID) or a single virtual local area network (VLAN) that is different from a second SSID or a second VLAN associated with a different isolation group.
19. A method for selectively providing direct communication within an isolation group, comprising:
by an electronic device:
establishing a connection with a second electronic device;
assigning the second electronic device to the isolation group;
receiving, associated with a third electronic device, a packet or a frame addressed to the second electronic device;
when the third electronic device is assigned to the isolation group, routing the packet or frame addressed to the second electronic device, wherein the routing provides the direct communication between the third electronic device and the second electronic device within the isolation group via the electronic device; and
when the third electronic device is not assigned to the isolation group, prohibiting direct communication between the third electronic device and the second electronic device via the electronic device.
20. The method of claim 19 , wherein the method comprises routing the packet or the frame addressed to the second electronic device to a computer or a server in a network.