# US 10,321,306 B2 · Network device selective synchronization > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,321,306 B2 - Document ID: US10321306B2 - Status: Granted - Kind: B2 - Application number: 15/262,707 - Filed: 2016-09-12 - Published: 2017-12-28 - Granted: 2019-06-11 - Earliest claimed: 2016-06-24 - Assignees: Aerohive Networks, Inc. - Applicants: Aerohive Networks, Inc. - Inventors: Geoffrey Joseph Mason; Shruti Narayan - Web page: https://patentgrep.com/patent/US10321306B2 ## CPC - H04W 8/245: {from a network towards a terminal} - H04L 9/0833: {involving conference or group key (network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065)} - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 9/12: Transmitting and receiving encryption devices synchronised or initially set up in a particular manner - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L 63/105: {Multiple levels of security} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04W 12/041: Key generation or derivation - H04W 12/084: using delegated authorisation, e.g. open authorisation [OAuth] protocol - H04W 84/12: WLAN [Wireless Local Area Networks] - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques for selectively synchronizing network devices to authenticate wireless device to access a network using a key. A system utilizing such techniques can include a unique pre-shared key assignment system and a network device selective synchronization system. A method utilizing such techniques can include unique pre-shared key assignment and selective synchronization management. ## Claims ### Claim 1 A method comprising: assigning a unique private pre-shared key to a wireless device, a media access control (MAC) address of the wireless device being bound to the unique private pre-shared key; determining network personas of a user of the wireless device; mapping the user to a network group according to the network personas of the user; maintaining synchronization policies for selectively synchronizing a plurality of network devices to authenticate wireless devices to access a network; determining a network device of the plurality of network devices to which to send key data associated with the unique private pre-shared key in accordance with the synchronization policies and the network group and as part of selective synchronization of the plurality of network devices, the key data including the MAC address of the wireless device bound to the unique private pre-shared key; sending the key data to the network device for storage in local storage of the network device for purposes of locally authenticating the wireless device to access the network. ### Claim 2 (depends on 1) The method of claim 1, wherein the synchronization policies are maintained, at least in part, according to input received from a network administrator of the network. ### Claim 3 (depends on 1) The method of claim 1, wherein the synchronization policies are modified according to network access patterns of wireless devices including the wireless device in accessing the network. ### Claim 4 (depends on 1) The method of claim 1, wherein the network device is configured to authenticate the wireless device to access the network using the key data according to a 4-way handshake. ### Claim 5 (depends on 1) The method of claim 1, further comprising: determining characteristics of the network devices; selecting the network device according to the characteristics of the network device. ### Claim 6 (depends on 1) The method of claim 1, further comprising: determining characteristics of the network devices including physical locations of the network devices; selecting the network device according to a physical location of the network device. ### Claim 7 (depends on 1) The method of claim 1, wherein the plurality of network devices are selectively synchronized in response to a threshold number of wireless devices being onboarded to access the network using unique pre-shared keys. ### Claim 8 (depends on 1) The method of claim 1, wherein the network personas of the user include the user gaining a right to have key data associated with wireless devices utilized by the user stored locally at the plurality of network devices. ### Claim 9 (depends on 1) The method of claim 1, further comprising sending an expiration stamp with the key data, the expiration stamp specifying a time at which to delete the key data from the local storage of the network device, the expiration stamp set according to an expiration time indicated by the synchronization policies. ### Claim 10 (depends on 1) The method of claim 1, further comprising assigning a connection limit with the unique private pre-shared key, the connection limit specifying a number of wireless devices that can authenticate using the unique private pre-shared key. ### Claim 11 A system comprising: a unique private pre-shared key assignment engine configured to assign a unique private pre-shared key to a wireless device, a media access control (MAC) address of the wireless device being bound to the unique private pre-shared key; a network persona based mapping engine configured to: determine network personas of a user of the wireless device; map the user to a network group according to the network personas of the user; a synchronization policies management engine configured to maintain synchronization policies for selectively synchronizing a plurality of network devices to authenticate wireless devices to access a network; a selective synchronization engine configured to determine a network device of the plurality of network devices to which to send key data associated with the unique private pre-shared key in accordance with the synchronization policies and the network group and as part of selective synchronization of the plurality of network devices, the key data including the MAC address of the wireless device bound to the unique private pre-shared key; a network device communication engine configured to send the key data to the network device for storage in local storage of the network device for purposes of locally authenticating the wireless device to access the network. ### Claim 12 (depends on 11) The system of claim 11, wherein the synchronization policies management engine is further configured to maintain the synchronization policies, at least in part, according to input received from a network administrator of the network. ### Claim 13 (depends on 11) The system of claim 11, wherein the synchronization policies management engine is further configured to modify the synchronization policies according to network access patterns of wireless devices including the wireless device in accessing the network. ### Claim 14 (depends on 11) The system of claim 11, wherein the network device is configured to authenticate the wireless device to access the network using the key data according to a 4-way handshake. ### Claim 15 (depends on 11) The system of claim 11, further comprising: a network device characteristics determination engine configured to determine characteristics of the network devices; wherein the selective synchronization engine is further configured to select the network device according to the characteristics of the network device. ### Claim 16 (depends on 11) The system of claim 11, further comprising: a network device characteristics engine configured to determine characteristics of the network devices including physical locations of the network devices; wherein the selective synchronization engine is further configured to select the network device according to a physical location of the network device. ### Claim 17 (depends on 11) The system of claim 11, wherein the selective synchronization engine is further configured to selectively synchronize the plurality of network devices in response to a threshold number of wireless devices being onboarded to access the network using unique pre-shared keys. ### Claim 18 (depends on 11) The system of claim 11, wherein the network personas of the user include the user gaining a right to have key data associated with wireless devices utilized by the user stored locally at the plurality of network devices. ### Claim 19 (depends on 11) The system of claim 11, wherein the network device communication engine is further configured to send an expiration stamp with the key data, the expiration stamp specifying a time at which to delete the key data from the local storage of the network device, the expiration stamp set according to an expiration time indicated by the synchronization policies. ### Claim 20 A system comprising: means for assigning a unique private pre-shared key to a wireless device, a media access control (MAC) address of the wireless device being bound to the unique private pre-shared key; means for determining network personas of a user of the wireless device; means for mapping the user to a network group according to the network personas of the user; means for maintaining synchronization policies for selectively synchronizing a plurality of network devices to authenticate wireless devices to access a network; means for determining a network device of the plurality of network devices to which to send key data associated with the unique private pre-shared key in accordance with the synchronization policies and the network group and as part of selective synchronization of the plurality of network devices, the key data including the MAC address of the wireless device bound to the unique private pre-shared key; means for sending the key data to the network device for storage in local storage of the network device for purposes of locally authenticating the wireless device to access the network.