Granted Patent B2

US 8,826,413 · App. 12/649,532 · Granted Sep 2, 2014

Abstract

Claims (28)

1. A method for preventing a malicious wireless client device from using radio frequency resources, the method comprising:

processing incoming packets from a wireless client device at a firewall to determine whether the wireless client device is a malicious wireless client device that is transmitting undesirable traffic;

sending an instruction from the firewall to a wireless local area network infrastructure device when the wireless client device is determined to be a malicious wireless client device; and

transmitting, from the wireless local area network infrastructure device in response to the instruction, a deauthentication frame to remove the malicious wireless client device from the wireless local area network, and preventing the malicious wireless client device from rejoining the wireless local area network for a time period to prevent the malicious wireless client device from sending other packets during the time period;

starting an authentication process at the wireless local area network infrastructure device to attempt to authenticate the malicious wireless client device;

determining, at the wireless local area network infrastructure device, whether authentication of the malicious wireless client device was successful;

blocking the malicious wireless client device from joining the wireless local area network when the wireless local area network infrastructure device determines that authentication of the malicious wireless client device is not successful; and

allowing the malicious wireless client device to join the wireless local area network when the wireless local area network infrastructure device determines that authentication of the malicious wireless client device is successful.

2. A method according to claim 1 , wherein the step of processing incoming packets from a wireless client device at a firewall to determine whether the wireless client device is a malicious wireless client device, comprises:

processing incoming packets from the wireless client device at the firewall to determine whether the wireless client device is a malicious wireless client device; and

determining that the wireless client device is a malicious wireless client device when the incoming packets are multicast/broadcast traffic.

3. A method for predicatively communicating state information regarding existing firewall sessions between a first access point that a particular wireless client device is currently associated with and other access points in network of access points, comprising:

maintaining at, each access point in a network of access points, state information regarding existing firewall sessions associated with each wireless client device that is currently associated with that access point;

updating, at the first access point each time the first access point migrates session information to a neighbor access point, a list of predicted candidate access points based on roaming information of each wireless client device; and

communicating, from the first access point to the predicted candidate access points on the list of predicted candidate access points, state information regarding an existing firewall session associated with the particular wireless client device that the first access point has an active firewall session with;

predicting, at the first access point based on roaming patterns of other wireless client devices that have been associated with the first access point and then roamed away, that the particular wireless client device currently associated with first access point will also roam to one of the other access points on the list of predicted candidate access points, wherein the step of predicting occurs prior to the particular wireless client device roaming from the first access point to another access point on the list of predicted candidate access points so that state information regarding the existing firewall session associated with the particular wireless client device can also be maintained at selected access points of the network of access points that are in the list of predicted candidate access points.

4. A method according to claim 3 , wherein the step of updating, at a first access point each time the first access point migrates session information to a neighbor access point, a list of predicted candidate access points, comprises:

deriving roaming information learned by the first access point based on a roaming history of other wireless client devices that that have roamed away from the first access point; and

maintaining, the list of predicted candidate access points over time at the first access point based on roaming information learned by the first access point by updating the list of predicted candidate access points maintained in storage at the first access point based on roaming information learned by the first access point.

5. A method according to claim 3 , wherein the list of predicted candidate access points identifies particular ones of the other access points in the network of access points that the first access point has migrated existing firewall session information to when wireless client devices associated with the first access point have roamed to the other access points after being associated with the first access point, and wherein the list of predicted candidate access points identifies particular ones of the other access points in the network of access points that wireless client devices currently associated to the first access point are likely to roam to from the first access point.

6. A method according to claim 3 , further comprising:

requesting, from one of the other access points each time the wireless client device roams from the first access point to one of the other access points, existing firewall session information for that wireless client device from the first access point, wherein the existing firewall session information comprises session table entries for the wireless client device; and

sending requested existing firewall session information, from the first access point to the other access point that have sent a request for existing firewall session information to first access point.

7. A method according to claim 6 , further comprising:

determining, at the first access point based on a request from a second access point for the existing firewall session information, that the second access point is a potential candidate for wireless communication devices to roam to from first access point.

8. A method according to claim 3 , wherein the state information regarding an existing firewall session comprises:

state information used to characterize the state of each connection.

9. A method according to claim 8 , wherein the state information regarding an existing firewall session comprises one or more of: transmission control protocol (TCP) state information for the existing firewall session, user datagram protocol (UDP) state information state information for the existing firewall session, Internet Control Message Protocol (ICMP) state information for the existing firewall session, Dynamic Host Configuration Protocol (DHCP) state information for the particular wireless communication device for the existing firewall session, Internet Group Management Protocol (IGMP) state information the particular wireless communication device for the existing firewall session.

Assignments (13)