Abstract: Methods, apparatuses and systems facilitating automated detection of rogue wireless access points in a wireless network environment. The present invention, in one embodiment, integrates automated detection of rogue access points into wireless network systems. As discussed more fully below, the present invention can be applied to a variety of wireless network system architectures.

Abstract: Methods, apparatuses and systems enabling a distributed wireless network security system. In one embodiment, the present invention provides a wireless network system where security policies are automatically distributed and uniformly implemented across wireless network access points. Embodiments of the present invention address the situation where a malicious user moves to a different access point within a wireless network environment after failing to properly authenticate and/or associate at a first access point. Embodiments of the present invention enable an integrated, multi-layer network security system, wherein a security mechanism at one layer (e.g., link layer security mechanisms) can set policies based on information gleaned from operation of a security mechanism at another layer (e.g., application layer authentication servers).

Abstract: A wireless discovery and communication mechanism to facilitate configuration, management and performance tasks associated with wireless network environments. In certain embodiments, access elements transmit and receive neighbor messages on a periodic basis to neighboring access elements. The neighbor messages can include configuration and/or protocol information to allow the access elements or associated devices to discover each other over the air. The present invention can be applied to a variety of wireless network architectures, such as a plurality of distributed, substantially autonomous access points, or to a hierarchical wireless network system comprising central control elements, each supervising and controlling one or more access elements as described more fully below.

Abstract: Methods, apparatuses and systems facilitating location or containment of rogue or unauthorized access points on wireless computer network environments. Embodiments of the present invention support one to a plurality of rogue containment methodologies. A first rogue containment type involves identification of the physical connection of the rogue access point to the wired network infrastructure and, thus, allows for disabling of that physical connection to contain the rogue access point. Other rogue containment methods involve wireless techniques for containing the effect of rogue access points. In some embodiments, the present invention provides methods, apparatuses and systems facilitating network location of rogue access points to determine whether one or more rogue containment methodologies should be applied. As discussed below, the rogue location and containment functionality described herein can be applied to a wide variety of wireless network system architectures.

Abstract: In a fixed channel wireless network system with a limited number of channels, assignment of the fixed channels between remote client elements and access elements is made systematically according to a set of criteria accounting for network loading and interference, then channel assignments are dynamically updated according to a priority to maintain optimal network performance with changing conditions of load and interference. The channel utilization problem is address at a system level rather than at a local level by treating the system as a three dimensional color mapping problem. All noise is treated as having a source in virtual access elements with an appropriate performance metric. The performance metric is used to select a channel set that minimize chances of interference and maximize user performance. Specifically, there are several parameter matrices which are managed and updated by a central resource management element, namely signal strength between elements, interference, and load.

Abstract: Methods, apparatuses and systems facilitating the configuration of transmit power and coverage areas corresponding to access points in a wireless network environment. The present invention in one embodiment facilitates the dynamic configuration of coverage boundaries across a plurality of access points, improving the performance of the wireless network environment.

Abstract: Methods, apparatuses and systems directed to wireless discovery mechanism that facilitates the deployment and configuration of managed access elements in a wireless network system. In one embodiment, the present invention can be utilized to achieve a viral wireless discovery and configuration mechanism wherein un-configured access elements discovery network devices with which to exchange configuration information through wireless messages transmitted by configured access elements. Once configured, the newly installed access elements may then provide wireless messages to other un-configured access elements which receive configuration information in the same manner. In other embodiments, the wireless discovery mechanism can be used alternatively, as a supplement to, or as part of an enhancement to Layer 2 and 3 discovery mechanisms.

Abstract: Methods, apparatuses and systems enabling real-time analysis of coverage and other performance attributes of distributed or networked systems, such as wireless computer network environments. In one embodiment, the present invention utilizes information obtained from monitoring wireless communications in a wireless network system from remote client elements to access elements in relation to at least one attribute, such as signal strength and signal-to-noise ratio (SNR). Although the present invention has application to a variety of wireless network architectures, in one embodiment, the present invention is implemented in a wireless Local Area Network (WLAN) system having a hierarchical architecture comprising a central control element associated with at least one access element.

Abstract: Methods, apparatuses and systems directed to refreshing signal information in an infrastructure wireless node location mechanism. The wireless node location mechanism selectively terminates connections with wireless clients to refresh signal strength information used to compute an estimated location for the wireless clients. The wireless node location mechanism terminates the connection between a WLAN and a given wireless node, causing in typical WLAN protocol implementations, the mobile station to transmit frames or packets on all available operating channels in a given band. This allows access points and other WLAN elements, operating on different frequency channels, to detect frames transmitted by the mobile station and provide refreshed signal strength information to a wireless node location mechanism.

Abstract: A wireless node location mechanism that employs a differential signal strength metric to reduce the errors caused by variations in wireless node transmit power, errors in signal strength detection, and/or direction-dependent path loss. As opposed to using the absolute signal strength or power of an RF signal transmitted by a wireless node, implementations of the location mechanism compare the differences between signal strength values detected at various pairs of radio receivers to corresponding differences characterized in a model of the RF environment. One implementation searches for the locations in the model between each pair of radio receivers where their signal strength is different by an observed amount.

Abstract: A distributed network is provided with mobile user devices, a virtual “Virtual Private Network” (VPN) server, and a plurality of physical VPN servers, wherein the virtual VPN server allows all mobile user devices to be configured with a single VPN server address, namely that of the virtual VPN server. The plurality of physical VPM servers all recognize and intercept network traffic sent to the virtual VPN server address, so that traffic can be distributed throughout the network. Specifically, each real VPN server responds to network traffic sent by a mobile user device to the address of the virtual VPN server and communicates with the mobile user device using the virtual VPN server address in preference to the individually assigned address of the real VPN server.

Abstract: A wireless node RF Fingerprinting location mechanism that uses multiple antenna patterns to enhance the accuracy of wireless node location in an RF environment. In one implementation, substantially non-overlapping antenna pattern diversity is used to provide a degree of sectorization in computing the estimated location of a wireless node.

Abstract: Methods, apparatuses and systems directed to securing a wireless network environment from eavesdropping and other unauthorized activities. One implementation prevents or disrupts meaningful access to information contained in WLAN RF signals that escape from a given physical space during operation of the wireless network. One implementation utilizes overlay RF signals transmitted on one or more operating channels of the WLAN to overpower or mask the internal RF signals escaping from a defined security line or perimeter. One implementation monitors the RF energy escaping to dynamically adjust the power of the overlay signal as required. Implementations of the invention can secure the outer perimeter of an office within a building, or even the outer perimeter of an entire building.

Abstract: In a wireless Local Area Network (WLAN) system, a hierarchical architecture is provided which employs a protocol which divides protocol processing functions between a plurality of substantially identical access elements in which reside time-critical protocol functions, such as acknowledgment and retransmission of packets, and a centralized control element which provides control and management functions related to dynamic configuration of wireless networks, such as processing of network management messages (e.g., authentication and association), load control, channel control, and handoff, processing of physical layer information, and processing of channel characteristics, propagation, interference or noise, for the plurality of access elements on the WLAN without loss of information about the wireless characteristics of the access elements.

Abstract: In a wireless Local Area Network (WLAN) system, a hierarchical architecture is provided which employs a protocol which divides protocol processing functions between a plurality of substantially identical access elements in which reside time-critical protocol functions, such as acknowledgment and retransmission of packets, and a centralized control element which provides control and management functions related to dynamic configuration of wireless networks, such as processing of network management messages (e.g., authentication and association), load control, channel control, and handoff, processing of physical layer information, and processing of channel characteristics, propagation, interference or noise, for the plurality of access elements in the WLAN without loss of information about the wireless characteristics of the access elements.

Abstract: A wireless node location mechanism that dynamically adapts to changes to a surrounding physical environment that affect the propagation of radio signals. The wireless node location mechanism assesses radio signals from transmitters associated with a wireless node location infrastructure to adjust one or more parameters used to estimate location of a wireless node. In one implementation, path loss exponents are re-computed based on the signals transmitted between infrastructure radio transceivers. These path loss exponents are used, in one implementation, to compute the distance between a wireless node and a given infrastructure radio transceiver and, ultimately, to determine the location of the wireless node based on triangulation. In one implementation, path loss exponents are computed on demand based on the signals observed between infrastructure radios that detect the wireless node whose location is to be estimated.

Abstract: Methods, apparatuses, and systems directed to a wireless node location mechanism that uses a signal strength weighting metric to improve the accuracy of estimating the location of a wireless node based on signals detected among a plurality of radio transceivers. In certain implementations, the wireless node location mechanism further incorporates a differential signal strength metric to reduce the errors caused by variations in wireless node transmit power, errors in signal strength detection, and/or direction-dependent path loss. As opposed to using the absolute signal strength or power of an RF signal transmitted by a wireless node, implementations of the present invention compare the differences between signal strength values detected at various pairs of radio receivers to corresponding differences characterized in a model of the RF environment.

Abstract: Methods, apparatuses and systems directed to a wireless network interface supporting directional antenna diversity. Directional diversity, in one embodiment, makes use of antennas with higher gain and non-overlapping patterns to provide communication over a greater area and select the best antenna to receive signals transmitting wireless frames or packets. Certain embodiments optimize wireless network systems using Orthogonal Frequency Division Multiplexed (OFDM) signals where spatial diversity protection provided by spatially-separated, omni-directional antennas is not required. In other embodiments, use and selection of directional antennas allows for sectorization resulting in performance gains such as extended coverage areas, noise reduction, enhanced efficiency, and increased throughput.

Abstract: Methods, apparatuses and systems directed to optimizing vector models for use in modeling RF propagation in desired physical environments. In one embodiment, the present invention can operate on pre-existing vector models. In other implementations, the present invention facilitates the conversion of raster images of buildings and other physical locations to vector formats for use in connection with the computational modeling of radio-frequency (RF) propagation. According to certain embodiments, the present invention is implemented within the context of a location diagram editing application that supports a line recognition filter, a snap filter and a merge filter which a user may individually select and configure. As discussed more fully below, the line recognition filter operates on the vector objects to adjust near-vertical lines (as defined by a configurable threshold angle) to vertical, and near-horizontal lines to horizontal.