Access enforcement at a wireless access point
A first set of access rules is received from an access configuration service. The first set of access rules specifies addresses of devices authorized for a first user. A second set of access rules is received from the access configuration service. The second set of the access rules specifies addresses of devices authorized for a second user. At a wireless access point, a network packet associated with the first user is received. The first set of access rules is applied to filter the network packet.
1. A wireless access point system, comprising:
hardware processing circuitry;
one or more hardware memories storing instructions that when executed configure the hardware processing circuitry to perform operations comprising:
receiving an access rule specifying a device authorized for access by a source;
receiving a packet;
determining the packet is from the source; and
routing the packet according to the access rule based on the determination,
wherein the packet is addressed to a second device, and wherein the routing of the packet comprises determining, based on the access rule, that the second device is not permitted for access by the source, and dropping the packet in response to the determination.
2. The system of claim 1 , wherein the access rule specifies a plurality of devices authorized for access by the source, and wherein the packet is addressed to a second device of the plurality of devices, and routing the packet according to the access rule comprises forwarding the packet to the second device based on the access rule.
3. The system of claim 1 , wherein the access rule specifies the device is authorized for access by specifying an Internet Protocol or MAC addresses of the device.
4. The system of claim 1 , the operations further comprising receiving a device identifier, and requesting access rules for the device identifier from a server, wherein the receiving of the access rules is in response to the requesting.
5. The system of claim 1 , the operations further comprising receiving an updated access rule indicating an additional device authorized for access by the source.
6. The system of claim 1 , the operations further comprising generating one or more messages advertising the device authorized for access by the first source.
7. A wireless access point system, comprising:
hardware processing circuitry;
one or more hardware memories storing instructions that when executed configure the hardware processing circuitry to perform operations comprising:
receiving an access rule specifying a device authorized for access by a source;
receiving a packet;
determining the packet is from the source; and
routing the packet according to the access rule based on the determination,
wherein the packet is addressed to a second device, and wherein the routing of the packet comprises determining, based on the access rule, that the second device is permitted for access by the source, and forwarding the packet to the second device based on the determination.
8. A non-transitory computer readable storage medium comprising instructions that when executed by hardware processing circuitry, configure the hardware processing circuitry to perform operations comprising:
receiving, by an access point, an access rule specifying a device authorized for access by a source;
receiving, by the access point, a packet;
determining, by the access point, the packet is from the source; and
routing, by the access point, the packet according to the access rule based on the determination,
wherein the packet is addressed to a second device, and wherein the routing of the packet comprises determining, based on the access rule, that the second device is not permitted for access by the source, and dropping the packet in response to the determination.
9. The non-transitory computer readable storage medium of claim 8 , wherein the access rule specifies a plurality of devices authorized for access by the source, and wherein the packet is addressed to a second device of the plurality of devices, and routing the packet according to the access rule comprises forwarding the packet to the second device based on the access rule.
10. The non-transitory computer readable storage medium of claim 8 , wherein the access rule specifies the device is authorized for access by specifying an Internet Protocol or MAC addresses of the device.
11. The non-transitory computer readable storage medium of claim 8 , the operations further comprising receiving a device identifier, and requesting access rules for the device identifier from a server, wherein the receiving of the access rules is in response to the requesting.
12. The non-transitory computer readable storage medium of claim 8 , the operations further comprising receiving an updated access rule indicating an additional device authorized for access by the source.
13. The non-transitory computer readable storage medium of claim 8 , the operations further comprising generating one or more messages advertising the device authorized for access by the first source.
14. A non-transitory computer readable storage medium comprising instructions that when executed by hardware processing circuitry, configure the hardware processing circuitry to perform operations comprising:
receiving, by an access point, an access rule specifying a device authorized for access by a source;
receiving, by the access point, a packet determining, by the access point, the packet is from the source; and
routing, by the access point, the packet according to the access rule based on the determination,
wherein the packet is addressed to a second device, and wherein the routing of the packet comprises determining, based on the access rule, that the second device is permitted for access by the source, and forwarding the packet to the second device based on the determination.
15. A method, comprising:
receiving, by an access point, an access rule specifying a device authorized for access by a source;
receiving, by the access point, a packet;
determining, by the access point, the packet is from the source;
routing, by the access point, the packet according to the access rule based on the determination; and
generating one or more messages advertising the device authorized for access by the source.
16. The method of claim 8 , wherein the access rule specifies a plurality of devices authorized for access by the source, and wherein the packet is addressed to a second device of the plurality of devices, and routing the packet according to the access rule comprises forwarding the packet to the second device based on the access rule.
17. The method of claim 8 , further comprising receiving a device identifier, and requesting access rules for the device identifier from a server, wherein the receiving of the access rules is in response to the requesting.