# US 11,122,500 B2 · Using a blockchain for optimized fast-secure roaming on WLANs > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,122,500 B2 - Document ID: US11122500B2 - Status: Granted - Kind: B2 - Application number: 15/872,081 - Filed: 2018-01-16 - Published: 2019-07-18 - Granted: 2021-09-14 - Earliest claimed: 2018-01-16 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Gonzalo Salgueiro; Shankar Ramanathan; Jerome Henry - Web page: https://patentgrep.com/patent/US11122500B2 ## CPC - H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD} - H04W 48/14: using user query {or user detection} - G06F 16/951: Indexing; Web crawling techniques - H04L 9/0637: {Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]} - H04L 9/3297: {involving time stamps, e.g. generation of time stamps} - H04W 48/20: Selecting an access point - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - H04L 63/0892: {by using authentication-authorization-accounting [AAA] servers or protocols} - H04L 63/101: {Access control lists [ACL]} - H04L 2209/80: Wireless - H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA] - H04W 12/06: Authentication - H04W 12/08: Access security - H04W 84/12: WLAN [Wireless Local Area Networks] - H04W 88/02: Terminal devices - H04W 88/08: Access point devices - Y04S 40/20: Information technology specific aspects, e.g. CAD, simulation, modelling, system security - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - Y04S: SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS ## Abstract In one embodiment, a device receives data regarding a wireless client attempting to form an association with a particular wireless access point in a network. The device queries a blockchain ledger in a blockchain database for wireless roaming data regarding the wireless client. The device uses, when available from the blockchain ledger, the roaming data regarding the wireless client to complete the association between the wireless client and the particular wireless access point. The device updates the blockchain ledger with data regarding the association between the wireless client and the particular wireless access point. ## Claims ### Claim 1 A method comprising: receiving, at a device, data regarding a wireless client attempting to form an association between the wireless client and a particular wireless access point in a network; forming, by the device, the association between the wireless client and the particular wireless access point by: querying, by the device, a blockchain ledger in a blockchain database for wireless roaming data regarding the wireless client, the roaming data regarding the wireless client comprising a roaming history of the wireless client that is indicative of wireless access points with which the wireless client has been associated, wherein the blockchain ledger uses a hashing mechanism to link blocks within the blockchain ledger, the blocks representing a roam activity of the wireless client in the network, using, by the device and when available from the blockchain ledger, the roaming data regarding the wireless client to complete the association between the wireless client and the particular wireless access point, and when the wireless client is roaming to the particular wireless access point from another wireless access point, authenticating, by the device, the wireless client based on whether an association between the wireless client and the particular wireless access point is listed in the blockchain ledger using the roaming history of the wireless client queried from the blockchain ledger; updating, by the device, the blockchain ledger with data regarding the association between the wireless client and the particular wireless access point; determining, by the device, whether the wireless client is active based on a timer mechanism associated with the blockchain ledger, wherein the timer mechanism is reset when the blockchain ledger is updated with a new block that is indicative of a new roaming event; and when the timer mechanism associated with the blockchain ledger has expired, removing, by the device, the blockchain ledger from the blockchain database. ### Claim 2 (depends on 1) The method as in claim 1, wherein the wireless roaming data regarding the wireless client comprises a master session key (MSK). ### Claim 3 (depends on 1) The method as in claim 1, wherein updating the data regarding the association between the wireless client and the particular wireless access point comprises: adding, by the device, a child block to the blockchain ledger, wherein the child block indicates the media access control (MAC) address of the wireless client, a basic service set identification (BSSID) of the particular wireless access point, and a timestamp regarding the association between the wireless client and the particular wireless access point. ### Claim 4 (depends on 1) The method as in claim 1, wherein the device comprises a controller for the particular wireless access point. ### Claim 5 (depends on 1) The method as in claim 1, wherein the roaming data regarding the wireless client from the blockchain ledger comprises data regarding an association between the wireless client and a wireless access point located in a second network that is administered separately from that of the network in which the particular wireless access point is located. ### Claim 6 (depends on 1) The method as in claim 1, further comprising: using, by the device, the blockchain ledger to determine whether the wireless client is attempting to perform media access control (MAC) address spoofing. ### Claim 7 (depends on 1) The method as in claim 1, further comprising: receiving, at the device, data regarding a second wireless client attempting to form an association between the second wireless client and the particular wireless access point in the network; and adding, by the device, a new blockchain ledger to the blockchain database regarding the association between the second wireless client and the particular wireless access point, when the blockchain database does not already store roaming data regarding the second wireless client. ### Claim 8 (depends on 1) The method as in claim 1, further comprising: using the roaming data regarding the wireless client to make a security assessment of the wireless client. ### Claim 9 An apparatus, comprising: one or more network interfaces to communicate with a network; a processor coupled to the network interfaces and configured to execute one or more processes; and a memory configured to store a process executable by the processor, the process when executed configured to: receive data regarding a wireless client attempting to form an association between the wireless client and a particular wireless access point in a network during an association phase; form the association between the wireless client and the particular wireless access point by: querying a blockchain ledger in a blockchain database for wireless roaming data regarding the wireless client, the roaming data regarding the wireless client comprising a roaming history of the wireless client that is indicative of wireless access points with which the wireless client has been associated, wherein the blockchain ledger uses a hashing mechanism to link blocks within the blockchain ledger, the blocks representing a roam activity of the wireless client in the network, using, when available from the blockchain ledger, the roaming data regarding the wireless client to complete the association between the wireless client and the particular wireless access point, and when the wireless client is roaming to the particular wireless access point from another wireless access point, authenticating the wireless client based on whether an association between the wireless client and the particular wireless access point is listed in the blockchain ledger using the roaming history of the wireless client queried from the blockchain ledger; update the blockchain ledger with data regarding the association between the wireless client and the particular wireless access point, wherein the blockchain ledger is a blockchain database of client roam activity of the wireless client in the network; determine whether the wireless client is active based on a timer mechanism associated with the blockchain ledger, wherein the timer mechanism is reset when the blockchain ledger is updated with a new block that is indicative of a new roaming event; and when the timer mechanism associated with the blockchain ledger has expired, remove the blockchain ledger from the blockchain database. ### Claim 10 (depends on 9) The apparatus as in claim 9, wherein the wireless roaming data regarding the wireless client comprises a master session key (MSK). ### Claim 11 (depends on 9) The apparatus as in claim 9, wherein the apparatus updates the data regarding the association between the wireless client and the particular wireless access point by: adding a child block to the blockchain ledger, wherein the child block indicates the media access control (MAC) address of the wireless client, a basic service set identification (BSSID) of the particular wireless access point, and a timestamp regarding the association between the wireless client and the particular wireless access point. ### Claim 12 (depends on 9) The apparatus as in claim 9, wherein the apparatus comprises a controller for the particular wireless access point. ### Claim 13 (depends on 9) The apparatus as in claim 9, wherein the roaming data regarding the wireless client from the blockchain ledger comprises data regarding an association between the wireless client and a wireless access point located in a second network that is administered separately from that of the network in which the particular wireless access point is located. ### Claim 14 (depends on 9) The apparatus as in claim 9, wherein the process when executed is further configured to: use the blockchain ledger to determine whether the wireless client is attempting to perform media access control (MAC) address spoofing. ### Claim 15 (depends on 9) The apparatus as in claim 9, wherein the process when executed is further configured to: receive data regarding a second wireless client attempting to form an association between the second wireless client and the particular wireless access point in the network; and add a new blockchain ledger to the blockchain database regarding the association between the second wireless client and the particular wireless access point, when the blockchain database does not already store roaming data regarding the second wireless client. ### Claim 16 (depends on 9) The apparatus as in claim 9, wherein the process when executed is further configured to: use the roaming data regarding the wireless client to make a security assessment of the wireless client. ### Claim 17 (depends on 9) The apparatus as in claim 9, wherein the blockchain ledger comprises at least one of: a pairwise master key (PMK), a group master key (GMK), a pairwise transient key (PTK), a group temporal key (GTK), fast transition (FT) data, robust security network information exchange (RSNIE) data, mobility domain information element (MDIE) data, or fast base substation system transitional information element (FTIE) data. ### Claim 18 A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a process comprising: receiving, at the device, data regarding a wireless client attempting to form an association between the wireless client and a particular wireless access point in a network during an 802.11 association phase; forming, by the device, the association between the wireless client and the particular wireless access point by: querying, by the device, a blockchain ledger in a blockchain database for wireless roaming data regarding the wireless client, the roaming data regarding the wireless client comprising a roaming history of the wireless client that is indicative of wireless access points with which the wireless client has been associated, wherein the blockchain ledger uses a hashing mechanism to link blocks within the blockchain ledger, the blocks representing a roam activity of the wireless client in the network, using, by the device and when available from the blockchain ledger, the roaming data regarding the wireless client to complete the association between the wireless client and the particular wireless access point, and when the wireless client is roaming to the particular wireless access point from another wireless access point, authenticating, by the device, the wireless client based on whether an association between the wireless client and the particular wireless access point is listed in the blockchain ledger using the roaming history of the wireless client queried from the blockchain ledger; updating, by the device, the blockchain ledger with data regarding the association between the wireless client and the particular wireless access point; determining, by the device, whether the wireless client is active based on a timer mechanism associated with the blockchain ledger, wherein the timer mechanism is reset when the blockchain ledger is updated with a new block that is indicative of a new roaming event; and when the timer mechanism associated with the blockchain ledger has expired, removing, by the device, the blockchain ledger from the blockchain database.