Abstract: Methods, apparatuses, and systems directed to facilitating the application of pre-allocation policies in a wireless network environment. According to one implementation of the present invention, a central controller, or other control point in a wireless network infrastructure, applies one or more policies that limit the number of resource pre-allocations a given wireless client may establish with one or more wireless access points. In one implementation, the central controller provides a pre-allocation list to a wireless client that is requesting pre-allocation. By limiting a wireless client's ability to pre-allocate resources, the central controller optimally manages the resources of the wireless network. In alternative embodiments, the central controller can terminate pre-allocations between a wireless client and one or more wireless access points to enforce pre-allocation policy on the wireless network infrastructure.

Abstract: Methods, apparatuses, and systems directed to facilitating roaming and client handoffs in wireless networks. In one implementation, the present invention is directed to a coordination mechanism facilitating handoffs of wireless clients in a wireless network infrastructure. In one implementation, the coordination mechanism minimizes the use of group- or multi-casting to provide a scalable wireless network roaming infrastructure.

Abstract: In a fixed channel wireless network system with a limited number of channels, assignment of the fixed channels between remote client elements and access elements is made systematically according to a set of criteria according for network loading and interference, then channel assignments are dynamically updated according to a priority to maintain optimal network performance with changing conditions of load and interference. The channel utilization problem is addressed at a system level rather than at a local level by treating the system as a three dimensional color mapping problem. All noise is treated as having a source in virtual access elements with an appropriate performance metric. The performance metric is used to select a channel set that minimize chances of interference and maximize user performance. Specifically, there are several parameter matrices which are managed and updated by a central resource management element, namely signal strength between elements, interference, and load.

Abstract: A packet aggregation system. In particular implementations, a method includes accessing one or more transmit queues, each corresponding to a wireless client associated with a given wireless mesh access point of a plurality of mesh access points. The method further includes selecting a mesh access point of the plurality of mesh access points and selecting a transmit queue corresponding to a wireless client associated with the selected mesh access point. The method further includes aggregating packets that are destined for the selected wireless client, up to a size limit, taking into account the path to the selected mesh point as well as quality of service constraints, and composing and transmitting the aggregated packet to the selected mesh access point.

Abstract: Methods, apparatuses and systems facilitating deployment and configuration of managed access points in hierarchical wireless network systems. An embodiment of the invention facilitates deployment and configuration of conventional, substantially autonomous access points operating in connection with a central management node, such as a server or appliance. In another embodiment, the present invention facilitates deployment and configuration of light-weight access points in a hierarchical wireless network system. In one embodiment, the present invention also provides a streamlined encryption key exchange protocol adapted to hierarchical wireless network system architectures.

Abstract: Methods, apparatuses and systems enabling a directed association mechanism in wireless computer network environments. In certain embodiments, the directed association functionality described herein can be used in a variety of contexts, such as directing wireless clients to associate with a desired access element or subset of access elements in a wireless network environment. In certain embodiments, the present invention can also be used to increase the efficiency of handing off wireless clients between access elements. The directed association mechanism, in one embodiment, increases the efficiency of establishing wireless connections between wireless clients and access points in a wireless network system.

Abstract: Methods, apparatuses and systems facilitating deployment and configuration of managed access points in wireless network systems. An embodiment of the present invention is a light-weight management protocol that reduces the management footprint of a plurality of managed access points in a wireless network system. An embodiment of the invention facilitates deployment and configuration of conventional, substantially autonomous access points operating in connection with a central management node, such as a server or appliance. In another embodiment, the present invention facilitates deployment and configuration of access points in a wireless network system including hierarchical processing of protocol information.

Abstract: Methods, apparatuses and systems facilitating containment of the effects of rogue or unauthorized access points on wireless computer network environments. Embodiments of the present invention support one to a plurality of rogue containment methodologies. A first rogue containment type involves identification of the physical connection of the rogue access point to the wired network infrastructure and, thus, allows for disabling of that physical connection to contain the rogue access point. Other rogue containment methods involve wireless techniques for containing the effect of rogue access points. As discussed below, the rogue containment functionality described herein can be applied to a wide variety of wireless network system architectures.

Abstract: Methods, apparatuses and systems facilitating automated detection of rogue wireless access points in a wireless network environment. The present invention, in one embodiment, integrates automated detection of rogue access points into wireless network systems. As discussed more fully below, the present invention can be applied to a variety of wireless network system architectures.

Abstract: Methods, apparatuses and systems enabling a distributed wireless network security system. In one embodiment, the present invention provides a wireless network system where security policies are automatically distributed and uniformly implemented across wireless network access points. Embodiments of the present invention address the situation where a malicious user moves to a different access point within a wireless network environment after failing to properly authenticate and/or associate at a first access point. Embodiments of the present invention enable an integrated, multi-layer network security system, wherein a security mechanism at one layer (e.g., link layer security mechanisms) can set policies based on information gleaned from operation of a security mechanism at another layer (e.g., application layer authentication servers).

Abstract: A wireless discovery and communication mechanism to facilitate configuration, management and performance tasks associated with wireless network environments. In certain embodiments, access elements transmit and receive neighbor messages on a periodic basis to neighboring access elements. The neighbor messages can include configuration and/or protocol information to allow the access elements or associated devices to discover each other over the air. The present invention can be applied to a variety of wireless network architectures, such as a plurality of distributed, substantially autonomous access points, or to a hierarchical wireless network system comprising central control elements, each supervising and controlling one or more access elements as described more fully below.

Abstract: Methods, apparatuses and systems facilitating location or containment of rogue or unauthorized access points on wireless computer network environments. Embodiments of the present invention support one to a plurality of rogue containment methodologies. A first rogue containment type involves identification of the physical connection of the rogue access point to the wired network infrastructure and, thus, allows for disabling of that physical connection to contain the rogue access point. Other rogue containment methods involve wireless techniques for containing the effect of rogue access points. In some embodiments, the present invention provides methods, apparatuses and systems facilitating network location of rogue access points to determine whether one or more rogue containment methodologies should be applied. As discussed below, the rogue location and containment functionality described herein can be applied to a wide variety of wireless network system architectures.

Abstract: In one embodiment, a method for facilitating authentication and ease the configuration of authentication includes receiving a credential type selection and selecting one or more authentication types based on the credential type selection and one or more policies set by the administrators. The policies can be preconfigured or dynamically pushed or fetched and updated to the client.

Abstract: In a fixed channel wireless network system with a limited number of channels, assignment of the fixed channels between remote client elements and access elements is made systematically according to a set of criteria accounting for network loading and interference, then channel assignments are dynamically updated according to a priority to maintain optimal network performance with changing conditions of load and interference. The channel utilization problem is address at a system level rather than at a local level by treating the system as a three dimensional color mapping problem. All noise is treated as having a source in virtual access elements with an appropriate performance metric. The performance metric is used to select a channel set that minimize chances of interference and maximize user performance. Specifically, there are several parameter matrices which are managed and updated by a central resource management element, namely signal strength between elements, interference, and load.

Abstract: Methods, apparatuses and systems directed to wireless discovery mechanism that facilitates the deployment and configuration of managed access elements in a wireless network system. In one embodiment, the present invention can be utilized to achieve a viral wireless discovery and configuration mechanism wherein un-configured access elements discovery network devices with which to exchange configuration information through wireless messages transmitted by configured access elements. Once configured, the newly installed access elements may then provide wireless messages to other un-configured access elements which receive configuration information in the same manner. In other embodiments, the wireless discovery mechanism can be used alternatively, as a supplement to, or as part of an enhancement to Layer 2 and 3 discovery mechanisms.

Abstract: In a wireless Local Area Network (WLAN) system, a hierarchical architecture is provided which employs a protocol which divides protocol processing functions between a plurality of substantially identical access elements in which reside time-critical protocol functions, such as acknowledgment and retransmission of packets, and a centralized control element which provides control and management functions related to dynamic configuration of wireless networks, such as processing of network management messages (e.g., authentication and association), load control, channel control, and handoff, processing of physical layer information, and processing of channel characteristics, propagation, interference or noise, for the plurality of access elements in the WLAN without loss of information about the wireless characteristics of the access elements.

Abstract: A method and device for providing switched tunnel connections from a user to a destination or a multiple number of destinations. Tunnels are switched from a user to a destination by receiving an incoming tunnel connection from the user and initiating a switched tunnel connection to the destination. Traffic from the incoming tunnel is switched to the destination over the switched tunnel. A disclosed embodiment uses user information to determine the switching of the tunnel to implement security access to a tunnel destination, load balancing among destination resources, and bundling of tunnel sessions to implement high bandwidth transmission.

Abstract: A method and device for providing switched tunnel connections from a user to a destination or a multiple number of destinations. Tunnels are switched from a user to a destination by receiving an incoming tunnel connection from the user and initiating a switched tunnel connection to the destination. Traffic from the incoming tunnel is switched to the destination over the switched tunnel. A disclosed embodiment uses user information to determine the switching of the tunnel to implement security access to a tunnel destination, load balancing among destination resources, and bundling of tunnel sessions to implement high bandwidth transmission.