Charter Communications Operating, LLC

Christopher J Teague

Shane B Newberg

Cheryl Warne

Timothy C Bleidorn

Venkata Ramana Divvi

William Kenneth Logan

Loay O Kreishan

Janath Kumar Madhamanchi

Ahmed Bencheikh

Peter Andrew Ericksen

Donald W Sherker

Tim Bleidorn

A wireless access point receives a request from a communication device for wireless access to a remote network. An authentication resource authenticates the communication device to use a wireless network provided by the wireless access point. Prior to providing notification to the communication device that it has been authenticated, a communication management resource produces data flow control settings and applies the data flow control settings to a communication gateway. Thereafter, the communication device is notified that it has been authenticated via the authentication resource. The communication gateway then controls flow of data through a communication gateway to the remote network via implementation of the data flow control settings.

Authentication and data flow control configuration

The presentation invention relates to methods and apparatus for a mobile device to discover the hidden SSID of a network. An exemplary method embodiment includes the steps of: receiving, at the mobile device, a first beacon frame having a Service Set Identifier (SSID) field set to NULL from a first Access Point; determining, at the mobile device, based on information received from the first Access Point that the mobile device is provisioned to connect to a first network advertised by the first beacon frame; discovering, by the mobile device, a first SSID name for the first network advertised by the first beacon frame for which the mobile device is provisioned. In another embodiment the mobile device associates with the first network after discovering the first SSID name.

Methods and apparatus for discovering hidden network service set identifiers

The present invention relates to methods and apparatus for providing services in high density deployments using dynamic assignment Virtual Local Area Network (VLAN) stacking during client device authentication. An exemplary method includes the steps of: receiving wirelessly, by a first Access Point (AP), a first authentication request message including first user equipment device identification information from a first user equipment device; generating, by the first AP, a second message based on the first authentication request message, the second message including the first user equipment device identification information and location information for the first AP; transmitting, by first AP, the second message to a first server; and receiving in response to the second message, by the first AP, a third message, said third message including dynamically assigned stacked VLAN information including a first Service-VLAN Identifier and a first Customer-VLAN Identifier dynamically assigned to the first user equipment device.

Methods and apparatus for implementing VLAN stacking for seamless roaming in high density wireless networks

A network environment includes multiple wireless access points and communication management hardware. The communication management hardware controls connectivity of a mobile communication device to the first wireless access point. For example, the communication management hardware receives communications from a first wireless access point. In response to receiving the communications, the communication management hardware obtains wireless access point identity information associated with a user and/or a mobile communication device attempting to establish a wireless communication link with the wireless access point. Based on the wireless access point identity information, the communication management hardware produces a control decision associated with establishing the wireless communication link. The control decision indicates whether the first wireless access point should allow or deny establishment of the wireless communication link with the first wireless access point.

Network access control and offloading

According to one configuration, a wireless access service provider selects and assigns a particular authentication option amongst multiple different authentication options to an entity such as a wireless access point or a sub-network supported by the wireless access point. When a communication device attempts to use the corresponding wireless access point provided by the wireless access service provider, a wireless access gateway receives information from the wireless access point indicating the particular authentication option assigned to authenticate the communication device. The wireless access gateway communicates the notification of the particular authentication option to an authentication manager, which provides the wireless access gateway with network address information indicating a captive portal in which to authenticate the communication device. The wireless access gateway then uses the network address information to redirect the communication device to the captive portal, which is then used to authenticate the communication device. to access the Internet.

Multi-option authentication portal implementation in a network environment

Various embodiments comprise systems, methods, architectures, mechanisms and apparatus for caching and sharing client/device keys, session keys, and so on between APs of overlapping wireless networks operated by same or different wireless local areal network (WLAN) operators via one or more Neighbor Key Cache Servers (NKCSs) configured to store client device or session key data for client devices overlapping network boundaries so as to facilitate fast reauthentication between presently serving and target access points (APs) of the same or different WLAN operators. Neighbor reports data may comprise data based on WLAN/SSID from APs associated with each of a plurality of AP home regions and/or realm/Network Access Identifiers from APs associated with an overlapping network of a different WLAN operator.

Dynamic key caching for fast roaming in secured wireless networks

Methods and devices are disclosed for supporting emergency service calls using dynamic service set identifier (SSID) deployment in a wireless communication network. An access point may receive an emergency service call request from a user device. The access point may also send a message with information about the received emergency service call request to a wireless network manager, and determine whether determining whether to serve the emergency service call request based on a response message received from the wireless network manager. In response to determining to serve the emergency service call request, the access point may create a new service set identifier (SSID) with emergency service call capability.

Method and system for supporting emergency voice services over wireless local area network (WLAN) using dynamic SSID deployment

A method for providing a differentiated feature to a first user equipment (UE) connected to a local area network (LAN) implemented by a router connected to a customer premises equipment (CPE) provisioned with a default feature associated with a first service tier of a plurality of service tiers provided by an internet service provider includes obtaining data indicating the first UE has connected to the LAN and determining the first UE is eligible for a second service tier of the different tiers. In response to determining the first UE is eligible for the second service tier, the method includes causing the CPE to be dynamically provisioned for a differentiated service associated with the second service tier. The method includes sending a message to the router to configure the router to provide the differentiated feature to the first UE.

Speed boost for eligible user equipment on a local area network

Systems, methods, and devices for performing targeted filtering of network traffic generated by user equipment (UE) devices connected to a customer premise equipment (CPE) device in a communication system that includes a distributed residential gateway. A network server may determine that the communication system includes a UE device that is compromised, misconfigured, or operating outside normal communication parameters, identify the UE device, determine an Internet protocol (IP) address or a media access control (MAC) address of the identified UE device, generate a quarantine request message that includes the IP address or the MAC address of the identified UE device in response to determining that the preconfigured virtual local area network access control list (VACL) on the CPE lists source IP addresses from which the CPE will filter outbound traffic, and send the generated quarantine request message to a bridged residential gateway (BRG) associated with the CPE device.

System and method for remotely filtering network traffic of a customer premise device

Various embodiments comprise systems, methods, mechanisms, and apparatus by which a network operator such as a wireline internet service provider (ISP) may determine that an endpoint device has one or more other wireless devices tethered to it, such as a mobile handset providing dual-Wi-Fi ad-hoc tethering (i.e., connected to a high-speed Wi-Fi network while simultaneously providing Wi-Fi connections to wireless devices tethered to the mobile handset), by monitoring Transmission Control Protocol (TCP)/IP traffic flow associated with endpoint devices (i.e., to or through endpoint devices), characterizing these traffic flows in accordance with one or more error indicative criteria to establish thereby a baseline profile of error indicative criteria that is indicative of a TCP/IP traffic flow associated with an endpoint device that is not associated with tethering (e.g., a rate or number of duplicate ACKs), wherein deviations from the baseline profile of error indicative criteria beyond a threshold are indicative of a TCP/IP traffic flow associated with an endpoint device that is associated with tethering.

Identifying a tethered device using TCP error transmissions

A same wireless access profile is installed on each of multiple mobile communication devices. The wireless access profile includes outer identity information and anonymous inner identity information for each service. The anonymous inner identity information includes a credential used by each of the multiple mobile communication devices to use the service. To use the service such as access a remote network, a respective mobile communication device communicates an anonymous username and password assigned to the service to a policy server during first level authentication. The policy server stores a network address of the authenticated mobile communication device. During second level authentication, the policy server receives an identity of the mobile communication device from a network gateway. The policy server provides access control information (assigned to the service) to the network gateway. The network gateway then provides access to the mobile communication device in accordance with the access control information.

Anonymous network access in a network environment

Systems, methods, and devices for instantiating both a private network service (PrNS) gateway virtual network function (VNF) and a public network service (PuNS) gateway VNF for a user equipment (UE) device that is associated with a PrNS and communicatively attached a public WiFi network allow users to access the same set of feature-rich network services (including layer 2 services) when connected through a public hotspot WiFi network as when connected through a home or local area network WiFi network.

Growing community of inventors

Highlands Ranch, CO, United States of America

Christopher J Teague