Abstract: Client devices in the same device group may use the same group-specific key to perform a key exchange operation with access point(s) to obtain network access. A network access management server may provide centralized management of different device groups each being associated with a different group-specific key during the life cycles of the device groups. An access point may communicate with the network access management server to obtain the group-specific key to assist in authenticating network access of a connecting client device.

Abstract: Client devices in the same device group may use the same group-specific key to perform a key exchange operation with access point(s) to obtain network access. A network access management server may provide centralized management of different device groups each being associated with a different group-specific key during the life cycles of the device groups. An access point may communicate with the network access management server to obtain the group-specific key to assist in authenticating network access of a connecting client device.

Abstract: A method of operating a network is provided that includes identifying a plurality of client devices connected to the network, categorizing the client devices into respective client groups based on device characteristics of each of the client devices, analyzing traffic patterns among the client groups and assigning the client groups to respective network segments based on the observed traffic patterns, and generating one or more network access policy for at least one of the network segments based on the traffic patterns or baseline behavior associated with a portion of the client devices belonging to the at least one of the network segments.

Abstract: A method of operating a network is provided that includes receiving a query, using a first language model to determine an intent or purpose of the query, using a second language model to extract a named entity from the query, and obtaining search results by searching for the extracted named entity on a named entity list corresponding to a particular tenant. The method can further include generating a response based on the search results. The query can be a natural language query, and the first language model can be a natural language model. The second language model for extracting the named entity can be a network-related language model that is trained on network records associated with a plurality of tenants. The network records associated with the plurality of tenants can be stored on a multi-tenant database.

Abstract: A network management server may provide options via a user interface for configuring a network and a network policy for the network. The network management server may identify values for network attributes based on the user-selected option(s). The network management server may maintain network entity attribute information and use the network entity attribute information to populate the selectable options based on which conditions and/or actions for the network policy are defined.

Abstract: A method of operating a server is provided that includes providing, with the server, one or more services relating to network access control and management of a network, predicting a network configuration failure associated with the network with a failure prediction model, and generating a network configuration recommendation based on the predicted network configuration failure to avoid the predicted network configuration failure. The failure prediction model can be a machine-learning based network configuration failure prediction model that is trained on past network configuration failure events. Operated in this way, erroneous network configuration issues can be automatically identified and addressed in a timely fashion.

Abstract: Methods and systems for providing vendor agnostic captive portal authentication in a network that includes a plurality of network access devices are provided. For instance, one method includes receiving a redirect request for a communication between a first user-terminal and a first network access device, the redirect request including at least one of a vendor-specific item of information of the first network access device and an Internet Protocol (IP) address of the first network access device. The method further includes comparing the at least one of the vendor-specific item of information of the first network access device and the IP address of the first network access device against each of a plurality of entries of a network access device database, and providing the first user-terminal access to a captive portal page in response to an appropriate match.

Abstract: Methods and systems for specifying and enforcing network policies are provided. One method for configuring a network that includes a plurality of heterogeneous network access devices includes creating a network enforcement profile based on at least one enforcement policy, and determining a network access device group of the plurality of heterogeneous network access devices that are capable of managing the enforcement profile. The method further includes providing vendor-specific configuration parameters for at least one network access device of the network access device group so as to cause the network to manage the network enforcement profile, and applying the vendor-specific configuration parameters to the at least one network access device.

Abstract: Methods and systems for providing vendor agnostic captive portal authentication in a network that includes a plurality of network access devices are provided. For instance, one method includes receiving a redirect request for a communication between a first user-terminal and a first network access device, the redirect request including at least one of a vendor-specific item of information of the first network access device and an Internet Protocol (IP) address of the first network access device. The method further includes comparing the at least one of the vendor-specific item of information of the first network access device and the IP address of the first network access device against each of a plurality of entries of a network access device database, and providing the first user-terminal access to a captive portal page in response to an appropriate match.

Abstract: A process, system, and non-transient computer readable medium that provides device automation support for the dynamic activation, authentication, and accounting of network access and network access devices while enabling seamless multi-vendor support for change of authorization through multiple network protocols. The process, system, and non-transient computer readable media also provides security threat remediation that can be automated at the device, network access, traffic inspection, and/or threat protection level by taking action on a device by triggering actions in a bidirectional manner.

Abstract: Methods and systems for providing vendor agnostic captive portal authentication in a network that includes a plurality of network access devices are provided. For instance, one method includes receiving a redirect request for a communication between a first user-terminal and a first network access device, the redirect request including at least one of a vendor-specific item of information of the first network access device and an Internet Protocol (IP) address of the first network access device. The method further includes comparing the at least one of the vendor-specific item of information of the first network access device and the IP address of the first network access device against each of a plurality of entries of a network access device database, and providing the first user-terminal access to a captive portal page in response to an appropriate match.

Abstract: A process, system, and non-transient computer readable medium that provides device automation support for the dynamic activation, authentication, and accounting of network access and network access devices while enabling seamless multi-vendor support for change of authorization through multiple network protocols. The process, system, and non-transient computer readable media also provides security threat remediation that can be automated at the device, network access, traffic inspection, and/or threat protection level by taking action on a device by triggering actions in a bidirectional manner.

Abstract: Methods and systems for providing vendor agnostic captive portal authentication in a network that includes a plurality of network access devices are provided. For instance, one method includes receiving a redirect request for a communication between a first user-terminal and a first network access device, the redirect request including at least one of a vendor-specific item of information of the first network access device and an Internet Protocol (IP) address of the first network access device. The method further includes comparing the at least one of the vendor-specific item of information of the first network access device and the IP address of the first network access device against each of a plurality of entries of a network access device database, and providing the first user-terminal access to a captive portal page in response to an appropriate match.

Abstract: Methods and systems for specifying and enforcing network policies are provided. One method for configuring a network that includes a plurality of heterogeneous network access devices includes creating a network enforcement profile based on at least one enforcement policy, and determining a network access device group of the plurality of heterogeneous network access devices that are capable of managing the enforcement profile. The method further includes providing vendor-specific configuration parameters for at least one network access device of the network access device group so as to cause the network to manage the network enforcement profile, and applying the vendor-specific configuration parameters to the at least one network access device.

Abstract: Systems and methods are described that configure network devices to dynamically (1) download privilege setting definitions from an authentication server to address a currently connected set of client devices associated with these privilege setting definitions and (2) clear privilege setting definitions that are no longer in use by client devices connected to the network device. In particular, a network device may determine if a privilege setting definition associated with a successfully authenticated client device is locally available on the network device and request the privilege setting definition from the authentication server when not locally available. In some situations, the authentication server may selectively transmit update messages to network devices that may be affected by an update to a privilege setting definition such that the network devices may request this updated privilege setting definition for download.

Abstract: Systems and methods are described that configure network devices to dynamically (1) download privilege setting definitions from an authentication server to address a currently connected set of client devices associated with these privilege setting definitions and (2) clear privilege setting definitions that are no longer in use by client devices connected to the network device. In particular, a network device may determine if a privilege setting definition associated with a successfully authenticated client device is locally available on the network device and request the privilege setting definition from the authentication server when not locally available. In some situations, the authentication server may selectively transmit update messages to network devices that may be affected by an update to a privilege setting definition such that the network devices may request this updated privilege setting definition for download.

Abstract: The present disclosure discloses a method and a network device for controlling DHCP pool exhaustion in dynamic network environments. Specifically, a network device determines that a client device is assigned an Internet Protocol (IP) address by a DHCP server. The network device detects that the client device is disconnected from a network associated with the IP address, for example, by receiving a de-association message from the client device; determining that a session or an entry corresponding to the client device has timed out; determining that the client device has failed to respond to one or more messages transmitted to the client device; determining that the client device has connected to another network different than said network; etc. In response, the network device then generates a DHCP release message on behalf of the client device, and transmits the DHCP release message to the DHCP server.

Abstract: The present disclosure discloses a method and network device for using mobile devices with validated user network identity as physical identity proof. Responsive to successfully authenticating a client device for network access, a system generates a network credential for the client device and transmits the network credential to the client device. Further, the system detects that the client device is within a range of a short range wireless device that is associated with a particular physical action. Consequently, the system validates the network credential that the client device possesses. Based on the network credential, the system determines that the client device has permissions for performing the particular physical action, and causes performance of the particular physical action.

Abstract: Systems and methods are described that configure network devices to dynamically (1) download privilege setting definitions from an authentication server to address a currently connected set of client devices associated with these privilege setting definitions and (2) clear privilege setting definitions that are no longer in use by client devices connected to the network device. In particular, a network device may determine if a privilege setting definition associated with a successfully authenticated client device is locally available on the network device and request the privilege setting definition from the authentication server when not locally available. In some situations, the authentication server may selectively transmit update messages to network devices that may be affected by an update to a privilege setting definition such that the network devices may request this updated privilege setting definition for download.

Abstract: A method for processing daily consumption, demand and time of use meter reads for electric, gas, water and other metered entities. The meter reads are collected by any of the well known Automated Meter Reading (AMR) technologies and loaded into a meter data warehouse. At a minimum daily meter reading, reads that are tagged as Good, Stale, Partial, Incomplete and Missing are required for properly identifying usage patterns, applying rules for error patterns and estimating the reads which will provide quality meter reads to the utilities thereby identifying meter problems before they become billing problems. The overall process involves loading the daily meter reads into a database, comparing each meter read against its previous day's read and applying a set of rules that help in validating, editing and estimating (VEE) of this data. The VEE rules that are applied can be broadly classified into five (5) categories.