CN113785606B - Network device and method for policy-based wireless network access - Google Patents

Abstract

The present application relates to the field of wireless computer networks, and in particular to a network device and corresponding method for policy-based wireless network access. Accordingly, the present application provides a network device (100) for policy based wireless network (101) access, wherein the network device (100) is configured to: -obtaining a unique identifier (102) of a wireless network client (103); determining at least one authorization service (104) based on the unique identifier (102) and a policy (105); creating a virtual sub-network (106) having access to the at least one authorization service (104); -assigning the wireless network client (103) to the virtual sub-network (106).

Description

Network device and method for policy-based wireless network access

Technical field

The present invention relates to the field of wireless computer networks, and in particular to a network device for policy-based wireless network access and a corresponding method. In other words, the present invention relates to policy-based wireless access to a restricted set of services.

Background technique

In traditional wireless computer networks, a service set identifier (SSID) is a name associated with a wireless computer network (eg, wireless local area network (WLAN)). When a legacy wireless network client intends to join a wireless computer network, the legacy wireless network client joins the wireless computer network using an SSID associated with the wireless computer network. When a traditional wireless network client joins a wireless computer network, the entire network topology of the wireless computer network is exposed to the traditional wireless network client. Specifically, all services provided in a wireless computer network are visible to connected legacy wireless network clients. Traditional service access restrictions can be achieved, for example, by using a dedicated portal with service links, or by using two-factor or complex (e.g., token-based) authentication. Using a secure portal may require several steps, with access restrictions based on network filtering rules (e.g., firewall). In addition, in traditional wireless computer networks, different traditional network devices (for example, access points (APs)) named by the same SSID are mapped to different subnets, which is based on what the traditional wireless network client is connected to. The reason why APs provide different service sets to traditional wireless network clients. For example, as shown in Figure 5.

Traditional solutions lack dynamic services provided at the device's local subnet. Policy enforcement is achieved by a firewall that restricts traditional wireless network clients' view of the network through a set of rules. However, legacy wireless network clients can still observe the service's presence but are blocked by the firewall from connecting to it. However, the expectation is that only allowed services are visible and accessible.

Traditional solutions also do not support roaming for legacy wireless network clients. Currently, service separation is implemented in two ways:

1. Configure a security solution based on WPA pre-shared password on the wireless network. Configure a service set on one site A, and configure a different service set on site B. Devices roaming from one site to another will access a different set of services. On the same site, this separation is not feasible for non-identity-based authentication (such as pre-shared passwords).

2. Configure a WPA enterprise-based security solution on the wireless network. Traditional wireless network clients will access a set of services based on the domain group to which they belong, not tied to a specific site. This separation is achieved by providing traditional wireless network clients to specific VLAN groups, where the policy is enforced by the firewall.

Therefore, what is missing is a scheme that can isolate wireless network clients connected to the wireless network while using a single SSID in an efficient and effective manner.

Contents of the invention

In view of the above problems and shortcomings, the present invention aims to improve traditional network equipment. The present invention is specifically capable of determining which authorized service a wireless network client can access based on the wireless network client's unique identifier and policy. This can be done for several wireless network clients accessing the wireless network provided by a single SSID.

To do this, wireless network clients attempting to connect to the wireless network must be policy authenticated. This can be achieved, for example, through a public key infrastructure (PKI) certificate. Upon successful authorization on the network device, authorization and policy enforcement are triggered and the subnet assigned to the wireless network client is created.

Thereby hiding the topology of the wireless network provided by the network device. Additionally, no modifications to the wireless network client are required. Applications running on wireless network clients are scenario independent. No application modifications are required. This solution also enables flat service discovery, that is, only those services allowed by the wireless network client exist in the subnet assigned to the wireless network client. Furthermore, the present invention allows for policy-based security enforcement, for example at the domain name system (DNS) request level, or when connecting to a service.

The object of the invention is achieved by the solutions provided in the appended independent claims. Advantageous implementations of the invention are further defined in the dependent claims.

A first aspect of the present invention provides a network device for policy-based wireless network access, wherein the network device is configured to: obtain a unique identifier of a wireless network client; according to the unique identifier and the policy, Determine at least one authorized service; create a virtual subnet that can access the at least one authorized service; assign the wireless network client to the virtual subnet.

This is advantageous because the set of authorized services accessible to network devices can be provisioned and adapted through policy for each wireless network client, where the entire wireless network can be provisioned in a common manner (eg, through only one SSID).

Specifically, the authorized service may include any network service that is not affected by NAT traversal.

Specifically, the authorized service is a service that the wireless network client is authorized to use. Specifically, network clients are authorized based on policy.

In an implementation manner of the first aspect, the virtual subnet has exclusive access to the at least one authorization service.

This ensures that the virtual subnet restricts access to authorized services in a secure manner. Accessible authorized services can be selected based on policies and unique identifiers, for example, other services can be excluded from accessible services.

In another implementation of the first aspect, the unique identifier includes a passphrase combined with at least one of: a device unique ID or a username; or a certificate.

Specifically, the certificate is a public key infrastructure (PKI) certificate.

In another implementation manner of the first aspect, the network device is configured to provide the wireless network according to a network identifier so that the wireless network client can access the virtual subnet.

Specifically, the network identifier may be a service set identifier (SSID).

In another implementation manner of the first aspect, the network device is configured to create different virtual subnets for each wireless network client accessing the wireless network according to the policy.

In other words, a different virtual subnet for each wireless network client is created based on the policy.

In another implementation of the first aspect, each of the different virtual subnets is created based on the unique identifier of the respective wireless network client and the policy.

In another implementation of the first aspect, the policy is predefined indicating that the at least one authorization service corresponds to the unique identifier.

In another implementation of the first aspect, the network identifier of the wireless network is the same for all wireless network clients accessing the wireless network.

In another implementation manner of the first aspect, the virtual subnet is a virtual subnet in an independent isolation network.

Specifically, the isolated network is an independent L2 broadcast domain. Specifically, a subnet or virtual subnet is an L3 domain (ie, a network layer domain).

This is advantageous because the same subnet address range can be used within multiple independent networks. The advantage is that this scheme supports address overlap between different virtual subnets assigned to different wireless network clients.

In another implementation manner of the first aspect, only the wireless network clients assigned to the virtual subnet in the independent isolation network can access the virtual subnet.

Specifically, no other clients (eg, other wireless network clients) can access or access the independent isolated network. An independent isolated network may also be called an independent virtual subnet. However, at least one authorized service provided to the wireless network client can access the independent isolated network to communicate with the wireless network client.

In another implementation manner of the first aspect, the network device is further configured to provide a service discovery function to the wireless network client.

This ensures that the wireless network client can identify at least one authorized service provided to the wireless network client in the virtual subnet.

In another implementation of the first aspect, the service discovery function provides a service identifier of the at least one authorized service to the wireless network client.

Specifically, the service identifier may include an address (eg, IPv4 or IPv6 address), port, or protocol of at least one authorized service.

In another implementation of the first aspect, the service identifier provided to the wireless network client is related to the virtual subnet assigned to the wireless network client.

Specifically, the service identifier is associated with the domain of the virtual subnet (eg, the address range of the virtual subnet).

In another implementation of the first aspect, the at least one authorization service operates in a different network than the virtual subnet assigned to the wireless network client.

This ensures that the authorization service can operate on a different network or subnet than the virtual subnet, while wireless network clients can still access the authorization service.

In another implementation manner of the first aspect, the network device further includes a communication module, and the communication module can communicate with a user in a network different from the virtual subnet through the service identifier associated with the virtual subnet. The at least one authorized service communication provided in the network.

Specifically, the communication module includes address routing or address remapping.

In another implementation of the first aspect, the network device is an access point (AP).

A second aspect of the present invention provides a method for policy-based wireless network access, wherein the method includes the following steps: a network device obtains a unique identifier of a wireless network client; the network device obtains a unique identifier according to the unique identifier The code and policy determine at least one authorized service; the network device creates a virtual subnet that can access the at least one authorized service; the network device allocates the wireless network client to the virtual subnet.

Specifically, the authorized service may include any network service that is not affected by NAT traversal.

Specifically, the authorized service is a service that the wireless network client is authorized to use. Specifically, network clients are authorized based on policy.

In an implementation manner of the second aspect, the virtual subnet has exclusive access to the at least one authorization service.

In another implementation of the second aspect, the unique identifier includes a passphrase combined with at least one of: a device unique ID or a username; or a certificate.

Specifically, the certificate is a public key infrastructure (PKI) certificate.

In another implementation of the second aspect, the method further includes the network device providing the wireless network according to a network identifier so that the wireless network client can access the virtual subnet.

Specifically, the network identifier may be a service set identifier (SSID).

In another implementation manner of the second aspect, the method further includes: the network device creates a different virtual subnet for each wireless network client accessing the wireless network according to the policy.

In other words, a different virtual subnet for each wireless network client is created based on the policy.

In another implementation of the second aspect, each of the different virtual subnets is created based on the unique identifier of the respective wireless network client and the policy.

In another implementation of the second aspect, the policy is predefined indicating that the at least one authorization service corresponds to the unique identifier.

In another implementation of the second aspect, the network identifier of the wireless network is the same for all wireless network clients accessing the wireless network.

In another implementation manner of the second aspect, the virtual subnet is a virtual subnet in an independent isolation network.

Specifically, the isolated network is an independent L2 broadcast domain. Specifically, a subnet or virtual subnet is an L3 domain (ie, a network layer domain).

In another implementation manner of the second aspect, only the wireless network clients assigned to the virtual subnet in the independent isolation network can access the virtual subnet.

Specifically, no other clients (eg, other wireless network clients) can access or access the independent isolated network. An independent isolated network may also be called an independent virtual subnet. However, at least one authorized service provided to the wireless network client can access the independent isolated network to communicate with the wireless network client.

In another implementation manner of the second aspect, the method further includes: the network device providing a service discovery function to the wireless network client.

In another implementation of the second aspect, the service discovery function provides a service identifier of the at least one authorized service to the wireless network client.

Specifically, the service identifier may include an address (eg, IPv4 or IPv6 address), port, or protocol of at least one authorized service.

In another implementation of the second aspect, the service identifier provided to the wireless network client is related to the virtual subnet assigned to the wireless network client.

Specifically, the service identifier is associated with the domain of the virtual subnet (eg, the address range of the virtual subnet).

In another implementation of the second aspect, the at least one authorization service operates in a different network than the virtual subnet assigned to the wireless network client.

In another implementation of the second aspect, the method further includes that the communication module of the network device may communicate with a service provided in a network different from the virtual subnet through a service identifier associated with the virtual subnet. The at least one authorized service communicates.

Specifically, the communication module includes address routing or address remapping.

In another implementation of the second aspect, the network device is an access point (AP).

The second aspect and its implementations include the same advantages as the first aspect and its respective implementations.

It should be noted that all devices, components, units and modules described in this application can be implemented in software or hardware components or any type of combination thereof. All steps described in this application as being performed by various entities and functions described to be performed by the various entities are intended to indicate that the corresponding entities are suitable or used to perform the corresponding steps and functions. Although in the following description of specific embodiments, specific functions or steps performed by external entities are not reflected in the description of specific elements of the entity that perform specific steps or functions, it should be clear to skilled persons that these methods and functions can be implemented in corresponding hardware elements or software elements or any type of combination thereof.

Description of the drawings

In conjunction with the accompanying drawings, the following description of specific embodiments will illustrate various aspects of the invention and implementation methods thereof.

Figure 1 shows a schematic diagram of a network device provided by an embodiment of the present invention;

Figure 2 shows a schematic diagram of the operation mode of the network device provided by the embodiment of the present invention;

Figure 3 shows another schematic diagram of the operation mode of the network device provided by the embodiment of the present invention;

Figure 4 shows a schematic diagram of the method provided by the embodiment of the present invention;

Figure 5 shows the operating principle of a network device provided by the prior art.

Detailed ways

Figure 1 illustrates a network device 100 for policy-based wireless network 101 access. The network device 100 may be, for example, an AP, or a router including an AP. Wireless network 101 may be, for example, a WLAN. The network device 100 is configured to: obtain the unique identifier 102 of the wireless network client 103; determine at least one authorized service 104 according to the unique identifier 102 and according to the policy 105; create a virtual subnet 106 that can access the at least one authorized service 104; Wireless network client 103 is assigned to virtual subnet 106. The policy 105 may be pre-stored in the network device and may indicate which service 104 is provided to which wireless network client 103 .

Figure 2 shows a schematic diagram of the operation mode of the network device 100. As shown in Figure 2, network device 100 can implement a flattened view of services allowed in wireless network 101.

As shown in Figure 2, a wireless network client 103 wirelessly connects to a network device 100 (eg, an AP) associated with the SSID by submitting a unique identifier 102 (eg, a credential or certificate). The network device 100 provides an independent, uniquely identified subnet 106 to the authenticated wireless network client 103 . No other client can access this subnet 106 unless the subnet is explicitly exposed to the other clients. This subnet 106 is not directly routable from the network device 100 . Classless inter-domain routing (CIDR) on the same subnet can overlap.

Specifically, the network device 100 may provide the IP address of the subnet 106 and/or the wireless network client 103 by using a dynamic host configuration protocol (DHCP). Using DHCP, network device 100 can also provide local DNS addresses and/or local domains for service discovery. This resolves the hostname to a local subnet address. This also limits the wireless network client's 103 view of the network to authorized services only. Service discovery is based on a "whitelist", specifically based on the unique identifier 102 of the wireless network client 103.

In order to map services (accessible by network device 100) to subnet 106, where the service can only be accessed by authorized wireless network clients 103, the following service forwarding rules apply:

Wireless network client 103 connects to authorization service 104 using its local independent IP address (from subnet 106).

In order to realize the forwarding of the egress packet, the network device 100 converts the destination IP of the packet into a routable service IP. The source IP address can be tracked using network address translation (NAT) connections. To achieve forwarding of ingress packets, inverse transformation is applied.

Figure 3 shows another schematic diagram of the operation mode of the network device 100. Specifically, perform the following steps in the operation mode shown in Figure 3:

1. Wireless network client 103 (i.e., client device in Figure 3) connects to network device 100 (i.e., access point in Figure 3) using predefined connection settings.

2. The network device 100 authenticates the wireless network client 103, for example by delegating the authentication session to an external AAA server and/or by using an internally implemented WPA enterprise backend.

3. Based on the policy 105, the network device 100 obtains the list of allowed services from the enterprise service domain, provides a separate subnet 106 for the wireless client 103, adds the service discovery endpoint to the subnet, and populates the fields regarding all allowed services. information. Additionally, the network device 100 adds a local logical port for each allowed service 104 on the subnet 106 . All logical ports can be software defined network (SDN) ports, and network traffic to and from the logical ports can be intercepted and modified by SDN-controlled switches. Logical ports create the illusion of a limited and well-defined network topology from the wireless network client 103 perspective.

4. The network device 100 returns the service discovery domain (SSDP/DNS-SD), subnet 106 and its local IP address to the wireless network client 103.

5. The wireless network client 103 sends a service discovery request to the local discovery service 201. The wireless network client gets a response with local mapping service information (address, port, and protocol).

Figure 4 shows a schematic diagram of a method 400 provided by an embodiment of the present invention. The method includes the step of the network device 100 obtaining 401 the unique identifier 102 of the wireless network client 103. The method includes the step of the network device 100 determining 402 at least one authorized service 104 based on the unique identifier 102 and the policy 105 . The method includes the step of the network device 100 creating 403 a virtual subnet 106 to which at least one authorized service 104 can be accessed. The method includes the step of the network device 100 assigning 404 the wireless network client 103 to the virtual subnet 106 .

The invention has been described in connection with different embodiments and implementations as examples. However, a person skilled in the art will be able to understand and implement other variations in practicing the claimed invention, from a study of the drawings, the disclosure and the independent claims. In the claims and description, the word "comprising" does not exclude other elements or steps, and "a" does not exclude a plurality. A single element or other unit may fulfill the functions of several entities or items recited in the claims. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantageous implementations.

Claims (16)

1. A network device (100) for policy-based wireless network (101) access, characterized in that the network device (100) is configured to:

-obtaining a unique identifier (102) of a wireless network client (103);

determining at least one authorization service (104) from the unique identifier (102) and a policy (105);

creating a virtual sub-network (106) having access to the at least one authorization service (104);

-assigning the wireless network client (103) to the virtual sub-network (106);

wherein the virtual subnetwork (106) is a virtual subnetwork (106) in an independent isolated network, the isolated network is an independent L2 broadcast domain, and the virtual subnetwork (106) is an L3 network layer domain.

2. The network device (100) of claim 1, wherein the virtual sub-network (106) has exclusive access to the at least one authorization service (104).

3. The network device (100) of claim 1 or 2, wherein the unique identifier comprises a passphrase in combination with at least one of: a device unique ID or username; or a certificate.

4. The network device (100) according to claim 1 or 2, wherein the network device (100) is configured to provide the wireless network (101) according to a network identifier to enable the wireless network client (103) to access the virtual sub-network (106).

5. The network device (100) according to claim 1 or 2, wherein the network device (100) is configured to create a different virtual sub-network (106) for each wireless network client (103) accessing the wireless network (101) according to the policy (105).

6. The network device (100) of claim 5, wherein each of the different virtual subnets (106) is created from the unique identifier (102) of the respective wireless network client (103) and the policy (105).

7. The network device (100) according to claim 1 or 2, wherein the policy is predefined indicating that the at least one authorized service corresponds to the unique identifier.

8. The network device (100) according to claim 1 or 2, wherein the network identifier of the wireless network (101) is the same for all wireless network clients (103) accessing the wireless network (101).

9. The network device (100) of claim 1, wherein only the wireless network clients (103) assigned to the virtual sub-network in the independent isolated network may access the virtual sub-network.

10. The network device (100) according to claim 1 or 2, further being configured to provide a service discovery function (201) to the wireless network client (103).

11. The network device (100) according to claim 1 or 2, wherein a service discovery function (201) provides a service identifier of the at least one authorization service (104) to the wireless network client (103).

12. The network device (100) according to claim 1 or 2, wherein the service identifier provided to the wireless network client (103) is related to the virtual sub-network (106) allocated for the wireless network client (103).

13. The network device (100) according to claim 1 or 2, wherein the at least one authorization service (104) operates in a network different from the virtual sub-network (106) assigned to the wireless network client (103).

14. The network device (100) according to claim 1 or 2, wherein the network device (100) further comprises a communication module that can communicate with the at least one authorization service (104) provided in a network different from the virtual sub-network (106) by means of a service identifier associated with the virtual sub-network (106).

15. The network device (100) according to claim 1 or 2, wherein the network device (100) is an Access Point (AP).

16. A method (400) for providing policy-based wireless network (101) access, the method (400) comprising the steps of:

the network device (100) obtains (401) a unique identifier (102) of the wireless network client (103);

-the network device (100) determining (402) at least one authorization service (104) from the unique identifier (102) and policy (105);

-the network device (100) creating (403) a virtual sub-network (106) having access to the at least one authorization service (104);

-the network device (100) assigning (404) the wireless network client (103) to the virtual sub-network (106);

wherein the virtual subnetwork (106) is a virtual subnetwork (106) in an independent isolated network, the isolated network is an independent L2 broadcast domain, and the virtual subnetwork (106) is an L3 network layer domain.