Cisco Technology, Inc.

Mark Enright

Deepali Apurva Brahmbhatt

Bruce D Moon

Bruce Moon

According to one implementation of the present invention, a business logic application may function as a package tracking application to manage access to wireless access points in different WLANs along the route. A sensor node is initialized and configured with one or more connection parameter sets allowing it to associate with a given wireless network implemented by one or more access points. Before the sensor node disassociates with the wireless access point, the wireless access point transmits a new connection parameter set to the sensor node. This new connection parameter set may include a network ID for another wireless network. In one implementation, the sensor node re-initializes itself using the new connection parameter set information. This process may continue until the sensor node arrives at its final destination.

Intelligent association of nodes with PAN coordinator

Disclosed are methods and apparatus for methods and apparatus for facilitating a secure connection between a first and a second node in a computer network where one or both of the nodes may or may not reside behind a network address translation (NAT) enabled gateway. Embodiments of the present invention provide a seamless integration by providing a uniform solution for establishing secure connections, such as IPSEC, between two nodes irrespective of whether they are behind a NAT-enabled gateway or not. In general, a gateway is operable to receive a request from a remote host for a secure connection to a local host that within the home network of the gateway. The gateway then forwards this received request to a NAT traversal service. The NAT traversal service receives the request and then automatically sends an initiation message to set up a secure session, e.g., performing authentication and exchanging keys. In a specific aspect, the setup data utilizes an IKE (Internet Key Exchange) initiation message that is sent to the originator of the request via the gateway. Upon receipt of this initiation message, the gateway is then able to set up a two way connection to allow other setup data to flow between the remote and local hosts to complete the setup session and then secure data to flow between the remote and local hosts in a secure communication session, such as in IPSec or VPN session.

Service for NAT traversal using IPSEC

A credential provisioning technique is provided that is secure yet easy to administer. A credential provisioner such as a network AP is configured to leave a secure mode of operation and allow open authentication with a wireless supplicant. After open authentication is established, the wireless supplicant requests credential provisioning. In response, the credential provisioner supplies the supplicant with an encrypted password. To prevent unauthorized access, the supplicant again requests credential provisioning but also proves knowledge of the encrypted password. At least one credential is supplied to the wireless supplicant in response to the proof only if a waiting period expires with just one request for credential provisioning being received by the credential provisioner.

Wireless network credential provisioning

Methods and devices are provided for establishing a VPN tunnel for a user whose IP address is not known in advance (a 'road warrior'). The road warrior first initiates a secure authentication session with a security gateway. In some such implementations, the road warrior provides a username/password pair that the security gateway compares to a database of usernames that have been authorized to initiate a VPN tunnel. After authenticating the road warrior, the security gateway then determines the IP address of the road warrior, then makes a correlation between the IP address, user, and a shared secret allocated to the road warrior. If the road warrior uses the proper shared secret in connection with a request to establish a VPN tunnel, the security gateway will establish the VPN tunnel.

Establishing a virtual private network for a road warrior

Methods, apparatuses, and systems directed to managing wireless node access to one or more wireless networks. According to one implementation, a business logic application may function as a package tracking application to manage access to wireless access points in different WLANs along the route. A sensor node is initialized and configured with one or more connection parameter sets allowing it to associate with a given wireless network implemented by one or more access points. In one implementation, the sensor node is configured only to accept received wireless frames that it can properly decrypt using the currently stored encryption key. When the sensor node and such a wireless access point associate, they may exchange encrypted information (e.g., data regarding the package) using an encryption key. Before the sensor node disassociates with time wireless access point, the wireless access point transmits a new connection parameter set to the sensor node.

Growing community of inventors

Soquel, CA, United States of America

Mark Enright