Stable mac address change procedure

Abstract

A method includes linking, at an access node, a first media control access (MAC) address of a device to an identifier of the device to establish a communication session between the access node and the device, and receiving, at the access node during the communication session, an indication that the first MAC address has changed to a second MAC address. The method also includes linking, at the access node, the second MAC address to the first MAC address and the identifier, and receiving, at the access node from the device, communications using the second MAC address while maintaining the communication session.

Description

Technical Field

[0001] The embodiments presented in this disclosure generally relate to network communications. More specifically, the embodiments disclosed herein relate to maintaining a communication session during a Media Access Control (MAC) address rotation. Background Technology

[0002] Devices can connect to access nodes in a network to transmit information to other devices over the network. Traditionally, access nodes use a device's Media Access Control (MAC) address (assuming it to be static) to identify and track devices. However, devices can use non-static MAC addresses. For example, during a communication session, a device can rotate or change its MAC address for various reasons (e.g., privacy). If the access node assumes the MAC address is static, the device may lose connection to the access node due to MAC address rotation or change. Attached Figure Description

[0003] To gain a more detailed understanding of the features described above, the present disclosure, which has been briefly summarized above, can be described in more detail with reference to embodiments, some of which are illustrated in the accompanying drawings. However, it should be noted that the accompanying drawings illustrate exemplary embodiments and should not be considered limiting; other equivalent embodiments may be contemplated.

[0004] Figure 1 An example system is shown;

[0005] Figure 2 yes Figure 1 A flowchart of an example method in the system;

[0006] Figure 3 yes Figure 1 Flowcharts of example methods in the system; and

[0007] Figure 4 yes Figure 1 The flowchart shows an example method in the system.

[0008] For ease of understanding, the same reference numerals are used where possible to designate common elements in the figures. Elements disclosed in one embodiment may be advantageously used in other embodiments without specific description. Detailed Implementation

[0009] Overview

[0010] According to an embodiment, a method includes: linking a first Media Control Access (MAC) address of a device to an identifier of the device at an access node to establish a communication session between the access node and the device; and receiving, at the access node, an indication that the first MAC address has been changed to a second MAC address during the communication session. The method further includes linking the second MAC address to the first MAC address and the identifier at the access node, and receiving communication from the device at the access node using the second MAC address while maintaining the communication session.

[0011] Example Implementation

[0012] This disclosure describes a system that allows a device to maintain a communication session with a network access node when its MAC address is changed or rotated. The access node links the device's MAC address with an identifier to establish a session. During the session, the device can transmit an indication to the access node to notify it that it wants to rotate or change its MAC address to a new one. The access node then links the new MAC address to the old MAC address and the identifier. In this way, when the device sends communications using the new MAC address, the access node can determine that the communication originated from the device based on the link between the new MAC address and the identifier, or the link between the new MAC address and the old MAC address. Therefore, in a particular embodiment, the communication session is maintained, and the device does not experience service interruption due to MAC address rotation or change.

[0013] Figure 1 Example system 100 is shown. From Figure 1 As can be seen, system 100 includes one or more devices 104, network 106, access node 108, and identity provider 110. Typically, access node 108 tracks changes or rotations of the MAC address of device 104 to maintain the session between device 104 and access node 108. In a particular embodiment, because access node 108 tracks MAC address rotations or changes, device 104 does not experience service stoppage or interruption after a MAC address rotation or change.

[0014] User 102 can use device 104 to interact with other components of system 100. For example, device 104 can communicate with access node 108 or identity provider 110. Additionally, device 104 can send a signal to access node 108 when it rotates or changes its MAC address. Device 104 can change or rotate its MAC address to maintain or enhance the privacy of user 102 or device 104. For example, by rotating or changing the MAC address, it may become more difficult to track or record the communications of user 102 or device 104 based on MAC addresses.

[0015] Before allowing a device to send communications on network 106 via access node 108, device 104 may establish a connection with access node 108. Access node 108 may broadcast its own identifier or that of network 106. When user 102 or device 104 moves within the service area of ​​access node 108, device 104 may detect the identity broadcast by access node 108 or network 106. User 102 or device 104 may then attempt to connect to network 106 via access node 108. Access node 108 may then determine whether access should be allowed. For example, access node 108 may authenticate user 102 or device 104 before allowing a connection from device 104.

[0016] In some embodiments, device 104 and access node 108 belong to an identity federation (e.g., Open Roaming), which may be a trusted third-party service responsible for authenticating user 102 or device 104. In these embodiments, the third-party service provides identity provider 110, and device 104 and access node 108 rely on identity provider 110 to authenticate user 102 and device 104. For example, when authentication is required, access node 108 can open a communication channel between device 104 and identity provider 110 via network 106. Identity provider 110 can then authenticate device 104. For example, device 104 can provide credentials (e.g., credentials for user 102 or device 104) to identity provider 110. Identity provider 110 can use these credentials to authenticate user 102 or device 104. Identity provider 110 can then provide an identifier (e.g., a token) indicating that user 102 or device 104 has been authenticated. Identity provider 110 can provide this identifier to access node 108 or device 104. If an identifier is provided to access node 108, access node 108 can use that identifier to determine the identity of user 102 or device 104. Access node 108 can then establish a communication session with device 104. Alternatively, if an identifier is provided to device 104, device 104 can transmit that identifier to access node 108. Access node 108 can then use that identifier to identify user 102 or device 104 and establish a communication session with device 104. In this way, user 102 or device 104 can connect to any access node 108 or network 106 belonging to the identity federation. Furthermore, access nodes 108 and network 106 belonging to the identity federation do not need to store and maintain the credentials of user 102 and device 104.

[0017] Identity provider 110 can be an optional component of system 100. In other words, device 104 or access node 108 does not need to belong to the identity federation. When identity provider 110 is absent or unused, user 102 or device 104 can directly authenticate themselves to access node 108. For example, user 102 or device 104 can directly provide access node 108 with an identifier including authentication credentials, and access node 108 can use these credentials to authenticate user 102 or device 104. After authentication is complete, access node 108 can establish a communication session with device 104.

[0018] Device 104 includes any suitable device for communicating with components of system 100. By way of example and not limitation, device 104 may be a computer, laptop computer, wireless or cellular phone, e-notebook, personal digital assistant, tablet computer, or any other device capable of receiving, processing, storing information, or exchanging information with other components of system 100. Device 104 may be a wearable device such as a virtual reality or augmented reality headset, smartwatch, or smart glasses. Device 104 may also include a user interface such as a display, microphone, or keyboard, or other suitable terminal device usable by user 102. Device 104 may include a hardware processor, memory, or circuitry configured to perform any of the functions or actions of device 104 described herein. For example, a software application designed using software code may be stored in memory and executed by a processor to perform the functions of device 104.

[0019] Access node 108 serves as the entry point for network 106. Network 106 is any suitable network operable to facilitate communication between components of system 100. Network 106 may include any interconnected system capable of transmitting audio, video, signals, data, messages, or any combination thereof. Network 106 may include all or a portion of the following networks operable to facilitate communication between components: Public Switched Telephone Network (PSTN), public or private data network, Local Area Network (LAN), Metropolitan Area Network (MAN), Wide Area Network (WAN), local, regional, or global communications or computer network (e.g., the Internet), wired or wireless network, corporate intranet, or any other suitable communication link including combinations thereof.

[0020] Identity provider 110 may be a separate entity or service from access node 108 that authenticates user 102 or device 104. For example, identity provider 110 may store the credentials of user 102 or device 104. When user 102 or device 104 transmits credentials to identity provider 110, the transmitted credentials can be compared with the stored credentials to identify a match. If identity provider 110 identifies a match, it can assume that user 102 or device 104 associated with the matching credentials is authenticated. Identity provider 110 can then transmit an identifier indicating the identity of user 102 or device 104 to access node 108 or device 104. The identifier may also indicate that user 102 or device 104 has been authenticated.

[0021] Access node 108 forms part of network 106. Access node 108 can send and receive communication through network 106. Figure 1 As can be seen, access node 108 includes processor 112 and memory 114, which are configured to perform any action or function of access node 108. In a particular embodiment, access node 108 tracks the rotation or change of MAC address of device 104 so that device 104 does not experience service stoppage or interruption when the MAC address is rotated or changed.

[0022] Processor 112 is any electronic circuit communicatively coupled to memory 114 and controlling the operation of access node 108, including but not limited to microprocessors, application-specific integrated circuits (ASICs), application-specific instruction set processors (ASIPs), and / or state machines. Processor 112 may be 8-bit, 16-bit, 32-bit, 64-bit, or any other suitable architecture. Processor 112 may include an arithmetic logic unit (ALU), processor registers, and a control unit. The ALU performs arithmetic and logical operations, the processor registers provide operands to the ALU and store the results of ALU operations, and the control unit fetches instructions from memory and executes these instructions by coordinating the operation of the ALU, registers, and other components. Processor 112 may include other hardware with operating software to control and process information. Processor 112 executes software stored in memory to perform any of the functions described herein. Processor 112 controls the operation and management of access node 108 by processing information (e.g., information received from device 104, network 106, and memory 114). Processor 112 may be a programmable logic device, a microcontroller, a microprocessor, any suitable processing device, or any suitable combination thereof. Processor 112 is not limited to a single processing device, but may include multiple processing devices.

[0023] Memory 114 may permanently or temporarily store data, operating software, or other information of processor 112. Memory 114 may include any one or a combination of volatile or non-volatile local or remote devices suitable for storing information. For example, memory 114 may include random access memory (RAM), read-only memory (ROM), magnetic storage devices, optical storage devices, or any other suitable information storage devices or combinations thereof. Software refers to any suitable set of instructions, logic, or code embodied in a computer-readable storage medium. For example, software may be embodied in memory 114, a disk, CD, or flash drive. In a particular embodiment, software may include an application executable by processor 112 to perform one or more of the functions described herein.

[0024] Access node 108 receives the MAC address 116 of device 104. Access node 108 may receive the MAC address 116 before, during, or after device 104 is authenticated. Access node 108 may also receive an identifier 118 of device 104. As previously described, device 104 or identity provider 110 may provide the identifier 118 to access node 108. When device 104 is authenticated, the identifier 118 may be a token identifying device 104 or user 102. Access node 108 may link the MAC address 116 to the identifier 118 to establish a session 120. Session 120 allows device 104 to communicate through access node 108. For example, session 120 allows device 104 to send and receive communications on network 106 through access node 108. After session 120 is established, device 104 can use the MAC address 116 to send and receive communications on network 106 through access node 108.

[0025] During session 120, device 104 may determine that it should rotate or change its MAC address 116. In response to this determination, device 104 transmits a rotation instruction 122 to access node 108. The rotation instruction 122 instructs access node 108 that device 104 will rotate or change its MAC address 116. The rotation instruction 122 may include a new MAC address 124 to which device 104 intends to rotate or change its MAC address 116. Access node 108 may link MAC address 124 to one or more of session 120, MAC address 116, or identifier 118. In this way, access node 108 will be able to link communication 126 sent using MAC address 124 to session 120, MAC address 116, or identifier 118. In some embodiments, rotation instruction 112 indicates that device 104 has changed its MAC address 116 to MAC address 124. Device 104 may transmit rotation instruction 122 to access node 108 after or while rotating or changing its MAC address.

[0026] For example, after device 104 rotates or changes its MAC address 116 to MAC address 124, access node 108 can correctly route communication 126, which includes MAC address 124, to and from device 104. If access node 108 does not link MAC address 124 to session 120, MAC address 116, or identifier 118, access node 108 may consider these communications 126 as originating from a new, unidentified device. Access node 108 can then either reject communication 126 or request authentication from the new device. In both cases, device 104 experiences service stoppage or interruption because access node 108 no longer recognizes the communication from device 104. Because access node 108 links MAC address 124 to session 120, MAC address 116, or identifier 118, communication 126 from device 104 using MAC address 124 is recognized by access node 108. For example, access node 108 can receive communication 126 and determine, based on the previously established link, that MAC address 124 is linked to session 120, MAC address 116, or identifier 118. Access node 108 can then consider communication 126 to belong to device 104. In this way, in some embodiments, device 104 does not experience service stoppage or interruption after rotating its MAC address 116 to MAC address 124. Furthermore, in response to device 104 changing its MAC address 116 to MAC address 124, access node 108 maintains session 120 and does not create a new session.

[0027] In some embodiments, access node 108 notifies identity provider 110 of a MAC address rotation or change. Access node 108 transmits a MAC update 128 to identity provider 110. MAC update 128 may include MAC address 124 and identifier 118. Access node 108 may transmit MAC update 128 after access node 108 has linked MAC address 124 to session 120, MAC address 116, or identifier 118. By transmitting MAC update 128 to identity provider 110, access node 108 can notify identity provider 110 that device 104, identified by identifier 118, has changed its MAC address to MAC address 124.

[0028] In some embodiments, identity provider 110 rotates or changes identifier 118 of device 104. For example, identity provider 110 may rotate or change identifier 118 to improve the security or privacy of user 102 or device 104. Identity provider 110 may transmit an updated identifier 130 to access node 108 to indicate to access node 108 that identifier 118 is being changed or rotated to identifier 130. Identity provider 110 may transmit identifier 130 in response to access node 108 transmitting MAC update 128 to identity provider 110. In other words, identity provider 110 may rotate or change identifier 118 of device 104 in response to device 104 rotating or changing its MAC address 116 to MAC address 124. After access node 108 receives identifier 130, access node 108 may link identifier 130 to MAC address 116, identifier 118, session 120, or MAC address 124. In some embodiments, access node 108 may replace identifier 118 with identifier 130. In this way, the MAC address 116 and identifier 118 can be rotated or changed without interrupting or stopping the session 120 between device 104 and access node 108. Therefore, the security and privacy of user 102 or device 104 are improved in some embodiments.

[0029] In some embodiments, device 104 may trigger a rotation or change of identifier 118. Device 104 may transmit an updated identifier 130 to access node 108. After access node 108 has linked identifier 130 from device 104 to MAC address 116, identifier 118, MAC address 124, or session 120, access node 108 may transmit identifier 130 to identity provider 110. For example, if device 104 rotates or changes identifier 118 after rotating or changing MAC address 116 to MAC address 124, access node 108 transmits identifier 130 and MAC address 124 to identity provider 110. Identity provider 110 can then link identifier 130 to MAC address 124. Identity provider 110 then knows that device 104 is identified using MAC address 124 or identifier 130.

[0030] In embodiments where identity provider 110 is absent or unused, device 104 may decide to rotate or change identifier 118. When device 104 determines that identifier 118 should be rotated or changed, access node 108 may receive identifier 130 from device 104. Access node 108 may link identifier 130 with MAC address 116, identifier 118, session 120, or MAC address 124. Additionally or alternatively, access node 108 may replace identifier 118 with identifier 130. In this way, device 104 may rotate or change its MAC address 116 and identifier 118.

[0031] In some embodiments, access node 108 supports a limited number of MAC address rotation schemes 132. These rotation schemes 132 may define certain aspects of MAC address rotation. For example, rotation scheme 132 may limit the frequency of MAC address rotation or change. As another example, rotation scheme 132 may limit the range of allowed MAC addresses. Access node 108 may transmit the rotation schemes 132 supported by access node 108 to device 104 before or after device 104 establishes a session 120 with access node 108. Device 104 may follow the supported rotation schemes 132 when rotating or changing the MAC address 116.

[0032] In a particular embodiment, access node 108 allocates a MAC address rotation or change budget 136 to device 104. Budget 136 may indicate the number of times device 104 can rotate or change its MAC address 116. For example, when device 104 transmits a rotation instruction 122 to access node 108, access node 108 may check budget 136 to see if device 104 has remaining budget to rotate or change its MAC address 116. If the device has sufficient budget 136 remaining, access node 108 may allow device 104 to rotate or change its MAC address 116 to MAC address 124. If device 104 does not have sufficient budget 136 remaining, access node 108 may prevent rotation or change of MAC address 116. Additionally, access node 108 may transmit an alarm 138 to device 104. Alarm 138 may notify device 104 that device 104 has exceeded its MAC address rotation or change budget 136. In some embodiments, budget 136 may be specified by one or more rotation schemes 132.

[0033] In some embodiments, access node 108 can locate the decryption key 134 to be used after device 104 rotates or changes its MAC address 116 to MAC address 124. For example, device 104 can encrypt rotation indication 122 such that when access node 108 receives rotation indication 122, access node 108 locates the decryption key 134 to decrypt rotation indication 122. In this way, device 104 can ensure that access node 108 has located the appropriate decryption key 134 before device 104 begins communicating using the new MAC address 124.

[0034] Figure 2 yes Figure 1 The flowchart shows an example method 200 in system 100. Access node 108 can execute method 200. In a particular embodiment, by executing method 200, access node 108 allows device 104 to rotate or change its MAC address 116 without experiencing service interruption or termination.

[0035] In box 202, access node 108 links the MAC address 116 of device 104 to the identifier 118 of device 104 to establish a communication session 120. The identifier 118 may be provided by device 104 or identity provider 110 after device 104 has authenticated itself. Device 104 may also transmit its MAC address 116 to access node 108. Access node 108 can link the MAC address 116 and the identifier 118 to establish the communication session 120. After the communication session 120 is established, device 104 can send and receive communications on network 106 through access node 108.

[0036] In block 204, access node 108 receives instruction 122 from device 104 to change its MAC address 116 to a new MAC address 124. Instruction 122 may include the new MAC address 124. In block 206, access node 108 links the new MAC address 124 to MAC address 116 and identifier 118. In this way, access node 108 indicates that MAC address 124 belongs to device 104 assigned to MAC address 116 and identifier 118. Therefore, the new MAC address 124 is linked to the existing communication session 120.

[0037] In box 208, access node 108 receives communication 126 from device 104 using a new MAC address 124 while maintaining communication session 120. Because the new MAC address 124 is linked to MAC address 116, identifier 118, or session 120, access node 108 can identify communication 126 as originating from device 104 even though communication 126 uses the new MAC address 124. Therefore, device 104 does not experience service stoppage or interruption after rotating or changing its MAC address 116 to MAC address 124.

[0038] Figure 3 yes Figure 1 The flowchart below shows an example method 300 in system 100. Access node 108 can execute method 300. In a particular embodiment, by executing method 300, access node 108 allows the identifier 118 of device 104 to be rotated or changed without stopping or interrupting the communication session 120. Method 300 can be executed after method 200.

[0039] In block 302, access node 108 transmits a new MAC address 124 of device 104 to identity provider 110. Access node 108 may transmit the new MAC address 124 after receiving it and linking it to MAC address 116, identifier 118, or session 120. Access node 108 may transmit the new MAC address 124 to identity provider 110 to notify identity provider 110 that device 104 is using the new MAC address 124. In some embodiments, access node 108 may also transmit the identifier 118 of device 104 to identity provider 110 to identify device 104 as having the new MAC address 124.

[0040] In block 304, access node 108 receives a new identifier 130 for device 104 from identity provider 110. Identity provider 110 may change identifier 118 to identifier 130 to improve the security or privacy of user 102 or device 104. Identity provider 110 may change identifier 118 in response to an indication that device 104 has changed its MAC address 116 to a new MAC address 124. In some embodiments, identity provider 110 may change identifier 118 of device 104 even if device 104 has not changed or rotated its MAC address 116. In this way, both MAC address 116 and identifier 118 can be changed or rotated to improve the security or privacy of user 102 or device 104. Importantly, MAC address 116 and identifier 118 can be rotated or changed independently of each other.

[0041] Figure 4 yes Figure 1 The flowchart below illustrates example method 400 in system 100. Access node 108 can execute method 400. In a particular embodiment, by executing method 400, access node 108 controls the rotation or change of MAC addresses in system 100. In some embodiments, method 400 is executed as an alternative to method 200.

[0042] In block 402, access node 108 allocates a budget 136 for MAC address changes to device 104. Budget 136 may indicate the number of times device 104 can rotate or change its MAC address 116. Additionally or alternatively, budget 136 may indicate the frequency at which device 104 can rotate or change its MAC address 116. In some embodiments, budget 136 is specified by a rotation scheme 132 supported by access node 108.

[0043] In box 404, access node 108 receives instruction 122 that device 104 wants to change its MAC address 116 to a new MAC address 124. Box 404 may be similar to box 204 in method 200. In box 406, after receiving instruction 122, access node 108 determines whether there is sufficient budget 136. For example, access node 108 may determine whether budget 136 indicates that device 104 has a sufficient number of MAC addresses to rotate or change remaining. As another example, access node 108 may determine whether device 104 is rotating or changing its MAC address 116 at a frequency exceeding the frequency indicated by budget 136.

[0044] If access node 108 determines that there is insufficient budget 136 remaining, it sends an alarm 138 to device 104 in box 412. Alarm 138 may indicate to device 104 that MAC address rotation is not allowed. In response, device 104 cannot perform MAC address rotation or change.

[0045] If access node 108 determines that there is sufficient budget 136 remaining, access node 108 can reduce budget 136 in box 408. For example, access node 108 can decrease the number of MAC address rotations or changes indicated by budget 136. As another example, access node 108 can update the frequency at which device 104 rotates or changes its MAC address 116. In box 410, access node 108 links a new MAC address 124 to device 104's MAC address 116 and identifier 118. Box 410 can be similar to box 206 in method 200.

[0046] In summary, access node 108 in network 106 tracks the rotation or change of MAC address of device 104. Access node 108 links MAC address 116 of device 104 with identifier 118 to establish session 120. During the session, the device may transmit indication 122 to access node 108 to notify access node 108 that device 104 intends to rotate or change its MAC address 116 to a new MAC address 124. Access node 108 then links the new MAC address 124 to the old MAC address 116 and identifier 118. In this way, when device 104 sends communication 126 using the new MAC address 124, access node 108 can determine that communication 126 originates from device 104 based on the link between the new MAC address 124 and identifier 118 or the link between the new MAC address 124 and the old MAC address 116. Therefore, in a particular embodiment, communication session 120 is maintained, and device 104 does not experience service interruption due to MAC address rotation or change.

[0047] Various embodiments have been referenced in this disclosure. However, the scope of this disclosure is not limited to the specific embodiments described. Rather, any combination of the described features and elements is considered for implementing and practicing the considered embodiments, regardless of whether different embodiments are involved. Furthermore, when elements of an embodiment are described in the form of "at least one of A and B," it should be understood that embodiments including only element A, only element B, and including both elements A and B are all considered. Moreover, while the embodiments disclosed herein may achieve advantages over other possible solutions or over the prior art, whether a particular advantage is achieved by a given embodiment does not limit the scope of this disclosure. Therefore, the aspects, features, embodiments, and advantages disclosed herein are merely illustrative and should not be considered elements or limitations of the appended claims unless expressly recited in the claims. Similarly, references to "the invention" should not be construed as a generalization of any inventive subject matter disclosed herein and should not be considered elements or limitations of the appended claims unless expressly recited in the claims.

[0048] As will be apparent to those skilled in the art, the embodiments disclosed herein can be embodied as systems, methods, or computer program products. Therefore, the embodiments may take the form of entirely hardware embodiments, entirely software embodiments (including firmware, resident software, microcode, etc.), or embodiments combining software and hardware aspects, all of which are generally referred to herein as “circuit,” “module,” or “system.” Furthermore, the embodiments may take the form of computer program products embodied in one or more computer-readable media having computer-readable program code embodied thereon.

[0049] Program code embodied on a computer-readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, fiber optic cable, RF, or any suitable combination of the foregoing.

[0050] Computer program code used to perform the operations of the various embodiments of this disclosure can be written in any combination of one or more programming languages, including object-oriented programming languages ​​(e.g., Java, Smalltalk, C++, etc.) and conventional procedural programming languages ​​(e.g., the "C" programming language or similar programming languages). This program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer via any type of network (including a local area network (LAN) or a wide area network (WAN)), or can be connected to an external computer (e.g., via the Internet through an Internet service provider).

[0051] Aspects of this disclosure have been described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments presented in this disclosure. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus to produce a machine such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / actions specified in the blocks of the flowchart illustrations and / or block diagrams.

[0052] These computer program instructions may also be stored in a computer-readable medium that can direct a computer, other programmable data processing apparatus or other device to operate in a particular manner such that the instructions stored in the computer-readable medium produce an article of manufacture, including instructions that implement the functions / actions specified in the boxes of flowcharts and / or block diagrams.

[0053] Computer program instructions may also be loaded onto a computer, other programmable data processing apparatus or other equipment to cause a series of operational steps to be performed on the computer, other programmable apparatus or other equipment to produce a computer-implemented process. Thus, the instructions that execute on the computer, other programmable data processing apparatus or other equipment provide a process for implementing the function / action specified in the boxes of the flowchart and / or block diagram.

[0054] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments. In this regard, each box in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing one or more specific logical functions. It should also be noted that in some alternative implementations, the functions mentioned in the boxes may appear in a different order than that shown in the drawings. For example, depending on the functions involved, two boxes shown consecutively may actually be executed substantially simultaneously, or the boxes may sometimes be executed in reverse order. It should also be noted that each box in the block diagrams and / or flowcharts, and combinations of boxes in the block diagrams and / or flowcharts, may be implemented by a dedicated hardware-based system that performs a specific function or action, or by a combination of dedicated hardware and computer instructions.

[0055] In view of the foregoing, the scope of this disclosure is defined by the appended claims.

Claims

1. A method for communication, comprising: At the access node, the device's first Media Control Access (MAC) address is linked to the device's identifier to establish a communication session between the access node and the device; During the communication session, the access node receives an indication that the first MAC address has been changed to a second MAC address; At the access node, the second MAC address is linked to the first MAC address and the identifier; as well as While maintaining the communication session, the second MAC address is used at the access node to receive communication from the device. The method further includes allocating a budget for MAC address changes to the device, the budget indicating the number or frequency at which the device can rotate or change its MAC address.

2. The method according to claim 1, further comprising: After linking the second MAC address to the identifier, the access node transmits the second MAC address and the identifier to the device's identity provider.

3. The method according to claim 2, further comprising: In response to transmitting the second MAC address and the identifier to the identity provider, the second identifier of the device is received from the identity provider at the access node.

4. The method according to any one of claims 1-3, further comprising: The access node transmits an indication of the MAC address rotation scheme supported by the access node to the device.

5. The method according to any one of claims 1-3, further comprising: At the access node, a second instruction is received from the device to change the identifier to a second identifier. as well as In response to the second instruction, the second MAC address and the second identifier are transmitted to the device's identity provider.

6. The method according to any one of claims 1-3, further comprising: An alert is sent to the device when it attempts to change its MAC address beyond the budget.

7. The method according to any one of claims 1-3, further comprising: The decryption key of the device is located based on the instruction.

8. An access node, comprising: Memory; as well as A hardware processor, communicatively coupled to the memory, is configured to: Link the device’s first Media Control Access (MAC) address to the device’s identifier to establish a communication session between the access node and the device; During the communication session, an indication is received that the first MAC address has been changed to the second MAC address; Link the second MAC address to the first MAC address and the identifier; and While maintaining the communication session, the second MAC address is used to receive communications from the device. The hardware processor is further configured to allocate a budget for MAC address changes to the device, the budget indicating the number or frequency at which the device can rotate or change its MAC address.

9. The access node according to claim 8, wherein, The hardware processor is further configured to transmit the second MAC address and the identifier to the device's identity provider after linking the second MAC address to the identifier.

10. The access node according to claim 9, wherein, The hardware processor is also configured to receive a second identifier of the device from the identity provider in response to transmitting the second MAC address and the identifier to the identity provider.

11. The access node according to any one of claims 8 to 10, wherein, The hardware processor is also configured to transmit to the device an indication of the MAC address rotation scheme supported by the access node.

12. The access node according to any one of claims 8 to 10, wherein, The hardware processor is also configured to: Receive a second instruction from the device to change the identifier to a second identifier; and In response to the second instruction, the second MAC address and the second identifier are transmitted to the device's identity provider.

13. The access node according to any one of claims 8 to 10, wherein, The hardware processor is also configured to: An alert is sent to the device when it attempts to change its MAC address beyond the budget.

14. The access node according to any one of claims 8 to 10, wherein, The hardware processor is also configured to locate the decryption key of the device based on the indication.

15. An access node, comprising: Memory; as well as A hardware processor, communicatively coupled to the memory, is configured to: During a communication session with the device, receive an indication that the first MAC address has been changed to the second MAC address; Link the second MAC address to the first MAC address and identifier of the device; and While maintaining the communication session, the second MAC address is used to receive communications from the device. The hardware processor is further configured to allocate a budget for MAC address changes to the device, the budget indicating the number or frequency at which the device can rotate or change its MAC address.

16. The access node according to claim 15, wherein, The hardware processor is further configured to transmit the second MAC address and the identifier to the device's identity provider after linking the second MAC address to the identifier.

17. The access node according to claim 16, wherein, The hardware processor is also configured to receive a second identifier of the device from the identity provider in response to transmitting the second MAC address and the identifier to the identity provider.

18. The access node according to any one of claims 15 to 17, wherein, The hardware processor is also configured to transmit to the device an indication of the MAC address rotation scheme supported by the access node.

19. The access node according to any one of claims 15 to 17, wherein, The hardware processor is also configured to: Receive a second instruction from the device to change the identifier to a second identifier; and In response to the second instruction, the second MAC address and the second identifier are transmitted to the device's identity provider.

20. The access node according to any one of claims 15 to 17, wherein, The hardware processor is also configured to: An alert is sent to the device when it attempts to change its MAC address beyond the budget.

Images