US9270654B2 - Automated configuration for network appliances - Google Patents
Automated configuration for network appliances Download PDFInfo
- Publication number
- US9270654B2 US9270654B2 US13/732,202 US201213732202A US9270654B2 US 9270654 B2 US9270654 B2 US 9270654B2 US 201213732202 A US201213732202 A US 201213732202A US 9270654 B2 US9270654 B2 US 9270654B2
- Authority
- US
- United States
- Prior art keywords
- network
- configuration
- appliance
- network appliance
- access
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active, expires
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q30/00—Commerce
- G06Q30/04—Billing or invoicing
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/08—Configuration management of networks or network elements
- H04L41/0803—Configuration setting
- H04L41/0806—Configuration setting for initial configuration or provisioning, e.g. plug-and-play
- H04L41/0809—Plug-and-play configuration
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/08—Configuration management of networks or network elements
- H04L41/0876—Aspects of the degree of configuration automation
- H04L41/0886—Fully automatic configuration
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0272—Virtual private networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/34—Network arrangements or protocols for supporting network services or applications involving the movement of software or configuration parameters
-
- H04W4/001—
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
- H04W4/50—Service provisioning or reconfiguring
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/08—Configuration management of networks or network elements
- H04L41/0803—Configuration setting
- H04L41/0813—Configuration setting characterised by the conditions triggering a change of settings
- H04L41/082—Configuration setting characterised by the conditions triggering a change of settings the condition being updates or upgrades of network functionality
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/08—Configuration management of networks or network elements
- H04L41/0866—Checking the configuration
Definitions
- Small enterprises typically purchase telecom services from large-scale telecom providers. These telecom services enable connectivity to telecom networks, and use of telecom components that process network traffic originating at small enterprises.
- Some small enterprises (a.k.a. small venues) authenticate prospective network users by forwarding access requests to remote private authentication servers. Such authentication may require that the small venue embed expensive components in the telecom network (e.g., regional authentication gateways running on telecom hardware.)
- large telecom companies do not typically offer small venues a wide range of service options. For example, large telecom companies may not let small venues select various network and billing policies that control network traffic and customer billing at the small venue. As a result, small venue operators could benefit from new systems that facilitate highly customizable network connectivity services.
- small venues Even though large telecom companies may provide services to small venues, small venues still may have to purchase and configure equipment for providing network services to their customers. For example, small venues may need to set-up local area WiFi access points that provide wireless connectivity to telecom networks. Small venue operators may not have technical expertise necessary for properly configuring and maintaining such networking equipment. As a result, small venue operators could benefit from new systems that make configuring network equipment easier.
- Some embodiments include a method for initially configuring a network appliance.
- the method can detect, by the network appliance, a subscriber network.
- the method can transmit, to a remote configuration service via the subscriber network, a request for configuration information for the network appliance, and receive, via the subscriber network, the configuration information, wherein the configuration information includes first parameters for the subscriber network, and second parameters for an access network for connecting computing devices to the network appliance.
- the method can also perform an automated initial configuration of the network appliance using the configuration information, wherein the automated configuration does not require user input, and wherein the automated configuration includes using the first parameters and the second parameters to configure the network appliance for use with the access network and the subscriber network.
- FIG. 1 is a block diagram illustrating network appliances and remote services, according to some embodiments of the inventive subject matter.
- FIG. 2 is a block diagram illustrating a hardware-based network appliance, according to some embodiments of the inventive subject matter.
- FIG. 3 is a block diagram illustrating a software-based network appliance, according to some embodiments of the inventive subject matter.
- FIG. 4 is a block diagram illustrating a webpage for selecting configuration options for network appliances, according to some embodiments of the inventive subject matter.
- FIG. 5 is a flow diagram illustrating operations for configuring a network appliance, according to some embodiments of the inventive subject matter.
- FIG. 6 is a flow diagram illustrating operations for processing network access requests, according to some embodiments of the inventive subject matter.
- FIG. 7 is a flow diagram illustrating operations for providing and verifying configuration information to network appliances, according to some embodiments of the inventive subject matter.
- Some embodiments of the inventive subject matter include a network appliance that enables small venue operators to provide internet connectivity without extensive telecommunications services from large telecom companies. Using the appliance, small venue operators need only obtain basic internet services to provide internet connectivity to their customers.
- Some embodiments of the appliance can perform can limit network access and authenticate users without aid of an authentication gateway embedded in the telecom system. That is, some embodiments can require network users to authenticate with a remote authentication service without an authentication gateway running in the telecom network. After users have been authenticated, the appliance may route network traffic to the internet without going through telecom gateways or the remote authentication service.
- GUI graphical user interface
- configuration components e.g., a website, etc.
- GUI graphical user interface
- small venue operators can select configuration options by answering basic questions about billing and network traffic, by choosing sets of pre-configured configuration parameters, or by enabling automated configuration.
- Some embodiments store configuration options in the cloud (i.e., in remote components accessible via a network) and download them onto the networking equipment. After a small venue has configured its networking equipment, embodiments store the configuration information in the cloud, in case the configuration information is needed later. Some embodiments periodically verify and/or update configuration parameters of the network appliance.
- Some embodiments of the inventive subject matter include network appliances configured to provide network connectivity at venues, such as coffee shops, restaurants, bookstores, etc.
- the network appliances can download configuration information over a network from a remote configuration service, thereby streamlining initial setup and maintenance of the network appliance.
- the network appliance may also obtain services from other remote components.
- the appliance may connect with remote services to provide walled gardens to venue customers.
- FIG. 1 describes these and other embodiments are more detailed.
- FIG. 1 is a block diagram illustrating network appliances and remote services, according to some embodiments of the inventive subject matter.
- FIG. 1 shows three embodiments of a network appliance.
- the appliance can be a hardware-based appliance 102 , custom software-based appliance 104 , and a wireless access point 106 used in conjunction with a regional authentication gateway 108 . The differences between the network appliances will be described later.
- the hardware-based appliance 102 can connect (via a subscriber network provided by a telecom company) with a remote service network 110 to obtain configuration information used for configuring the appliance.
- the configuration information can include technical information for configuring access network parameters, subscriber network parameters, and billing/business parameters.
- An access network is a local area network that facilitates wireless access for the mobile device 126 to the appliance 102 .
- the access network parameters can include Internet protocol (IP) addresses, Wi-Fi channel information, frequencies, Service Set Identifier information (SSID), WiFi Protected Access (WPA) protocol information, etc.
- IP Internet protocol
- the subscriber network comprises telecom company components that facilitate access between the appliance 102 and the remote services 110 .
- the subscriber network may also facilitate access to the Internet.
- Subscriber network configuration information can include domain name server (DNS) information, dynamic host configuration protocol (DHCP) information, gateway information, etc.
- Billing/business parameters can include connectivity costs (e.g., how much a venue user pays to connect to the Internet), credit card service information, etc.
- the thick dotted lines indicate a private network including the appliances and the remote services 110 .
- the a virtual private network is the only way for an appliance to communicate with the remote services (e.g., see FIG. 2 's split tunnel VPN client).
- the appliance 102 provides certain identifying information to the remote configuration service 110 .
- the identifying information can include a serial number for the appliance 102 , and location information indicating a location at which the appliance resides (e.g., zip code, street address, longitude and latitude, etc.).
- the remote configuration service can provide appropriate configuration information to the appliance 102 .
- the remote configuration service can provide configuration information appropriate for the appliance's access network and subscriber network.
- the configuration service offers a website at which a venue operator can set billing/business parameters, which the configuration service pushes to the appliance 102 .
- the configuration service retains a record of all configuration settings for the appliance 102 .
- the configuration service stores the configuration information in the database 124 .
- the remote configuration service 128 includes a database 124 for storing configuration information for devices that have already been configured, configuration options for devices that have not been configured, pre-set configuration profiles, etc.
- the remote configuration service 128 also includes a venue self-registration service (VSRS) 118 , and a user self-registration service (USRS) 116 .
- the VSRS 118 may verify configuration settings of the appliances ( 102 , 104 , and 106 ). For example, upon startup of an appliance that has been configured, VSRS 118 may receive a list of IP addresses from the appliance to verify that the appliance's static IP addresses have not changed.
- the USRS 116 can facilitates self configuration for new users.
- the USRS 116 allows new users to register and creates accounts for those users. Using the user account, users can roam to numerous venue locations (e.g., venues that use the authentication service). The USRS 116 can carryout policies about how users pay, connection costs, etc. The USRS may offer configurable parameters related to how users are added/registered, which parts of the network are accessible to users, etc. Venue operators can set these parameters.
- the remote services 110 also include an authentication service 130 .
- the authentication service 130 authenticates user credentials received from the mobile devices 126 . After a user's credentials have been authenticated, the remote services 110 instruct the appliance 102 to allow the user to access the Internet.
- the authentication service 130 can verify passwords, digital certificates, or other authentication credentials.
- the authentication service 130 can authenticate users at a plurality of venues. In some embodiments, the authentication service 130 can support any number of venues and users. In some embodiments, the authentication service 130 is operated independent of the telecom company.
- the remote services 110 include a multi-client virtual private network (VPN) server 112 .
- the multi-client VPN server 112 enables the remote services 110 to contemporaneously service, over a virtual private network, a plurality authentication requests from a plurality of users.
- some embodiments of the appliance include VPN clients to facilitate secure authentication.
- the remote services 110 also include walled gardens 120 and 122 .
- each of the walled gardens is for a particular venue.
- a user can access content in the walled garden only after being successfully authenticated by the authentication services 130 .
- the walled garden may offer limited web content, such as daily news stories, information about the venue, and other content provided by the venue operator.
- the walled gardens 120 and 122 can include web servers that provide content to the venue customers (i.e., the mobile devices 126 ).
- FIG. 2 is a block diagram illustrating a hardware-based network appliance, according to some embodiments of the inventive subject matter.
- the network appliance 200 includes a wired/wireless access point 216 .
- the access point 216 provides an interface to a local area access network and a subscriber network.
- the access point 216 can support any suitable connection technology, such as WiFi, Ethernet, etc.
- the network appliance 200 also includes a web server 202 for hosting a website for a venue. For example, if the venue is a restaurant, the web server 202 can host a website for the restaurant.
- venue patrons need not access the internet to access the venue website.
- the website may be accessible to users who do not have network access credentials, or users who are otherwise unauthorized access the Internet via the network appliance 200 (e.g., users who have not paid a network access fee, etc.).
- the network appliance 200 includes a walled garden 220 .
- the walled garden 220 offers content made available by the venue operator.
- a user can access content in the walled garden 220 without being successfully authenticated by an authentication service (e.g., remote authentication service 130 ).
- the walled garden 220 may offer limited web content, such as daily news stories, information about the venue, and other content provided by the venue operator.
- the walled gardens 220 can include a web server that provide content to the venue customers (e.g., to the mobile devices 126 ).
- the network appliance 200 also includes a configuration management module 210 configured to perform automated configuration of the network appliance 200 .
- the configuration manager module 210 can communicate with a remote configuration service, and procure configuration information for use in configuring the network appliance 200 .
- the configuration information includes parameters for configuring components (e.g., access point 216 ) to support an access network, subscriber network, and billing/business policies. Operations of the configuration management module 210 are described in detail below (see discussion of FIG. 5 ).
- the authorization and payment module 212 communicates with remote services (e.g., the remote services 110 ) to facilitate payment transactions associated with providing venue customers access to the Internet.
- the authorization and payment module 212 utilizes a secure tunnel (e.g., provided by the split tunnel client VPN 222 ) to communicate with a remote authorization and payment server (e.g., see 114 ).
- the remote authorization and payment server can determine a payment gateway to use for each transaction.
- the authorization and payment module 212 contacts the payment gateway for posting payment transactions on behalf of the venue. Determination of the payment gateway may be a function of multiple factors including schedule, country, payment type, and venue account.
- a venue account is owned and controlled by the remote services network, so financial transactions are handled seamlessly by the remote services network.
- the venue owns and controls the venue account. In such embodiments, payments flow directly to the venue account, whereas authorization records go to the remote services for storage and processing.
- the network appliance 200 also includes a venue self-registration module 206 and user self-registration module 208 .
- the network appliance 200 also includes an authentication module 214 .
- the authentication module 214 can receive credentials from users and transmit them to a remote authentication service via a secure tunnel provided by the split tunnel client VPN 222 .
- the authentication module 214 receives responses from the remote authentication service, and communicates the responses to venue users.
- the authentication module 214 enforces monetization policies, such as whether payment is required before it will authenticate a user.
- there are multiple remote services to choose from e.g., there are multiple remote services to service different geographic regions.
- the appliance's SHR framework 218 can select an instance of remote services with which to communicate (e.g., the instance geographically closest).
- the network appliance 200 also includes a split tunnel virtual private network client 222 , which facilitates secure tunnels between the network appliance 200 and remote services, such as a remote authentication service.
- the split tunnel VPN client 222 can simultaneously maintain secure channels and unsecured channels.
- the VPN client can establish a secure channel tunnel to a VPN server located at a remote service network, where the secure channel is used for authenticating venue customers.
- the VPN client 222 can also establish an unsecured channel to the Internet, where the unsecured channel is available for users who have already been authenticated by the remote authentication service.
- resource consumption e.g., computation overhead
- inventions shown in FIG. 2 constitute an architecture for some embodiments of the network appliance.
- embodiments of the network appliance can include processors, main memory (e.g., semiconductor random access memory), secondary storage (e.g., magnetic disk memory), and other components (e.g., application specific integrated circuits, communication buses, etc.) for supporting the architecture and functionality described herein.
- main memory e.g., semiconductor random access memory
- secondary storage e.g., magnetic disk memory
- other components e.g., application specific integrated circuits, communication buses, etc.
- FIG. 3 is a block diagram illustrating a software-based network appliance, according to some embodiments of the inventive subject matter.
- a software-based network appliance 300 includes a wired access point 302 , wireless access point 304 , and a virtual private network router 306 .
- the wired and wireless access points support an access network that enables mobile devices (i.e. venue customers) to connect with the network appliance 300 .
- the VPN router 306 can routes traffic to a remote services network via a secure tunnel. As similarly described above, the VPN router 306 can route unauthenticated traffic to a remote authentication service via a secure tunnel.
- the VPN router 306 can also allow traffic from authenticated users to reach the Internet via an unsecured channel.
- the software-based network appliance 300 is connected to a computing device 308 .
- the software-based network appliance may not natively include components for configuring itself upon deployment.
- the software-based appliance 300 can utilize the computing device 308 for automated configuration.
- the computing device's configuration manager 310 can perform operations for configuring the software-based network appliance 300 , similarly described above.
- the network appliance 300 can utilize the authentication manager 312 and payment manager 314 to facilitate user authentication and payment management.
- the configuration manager 310 , authentication manager 312 , and payment manager 314 can utilize remote services, as similarly described vis-à-vis the network appliance 200 .
- FIG. 4 is a block diagram illustrating a webpage for selecting configuration options for network appliances, according to some embodiments of the inventive subject matter.
- a webpage 400 presents various options.
- the configuration options are suited for venue operators who are not experts in telecommunications equipment.
- the webpage 400 can pose a series of multiple-choice questions about configuration. Answers to the questions reveal the venue operator's preferences, and a remote configuration service selects configuration parameters accordingly.
- preferences relate to fees, connection times, maximum number of connections, etc.
- the webpage 400 may allow venue operators to customize configuration parameters business preferences unrelated to the network itself. For example, a restaurant may have limited seating capacity.
- the restaurant owner may want to limit network connection times to twenty minutes, so customers do not occupy tables when they are not eating.
- venue owners may provide free Internet connectivity paying customers.
- the webpage 400 can enable venue owners to configure network appliances to interface with point-of-sale systems to allow paying customers to access the Internet for free.
- the remote configuration service transmits configuration information to the network appliance.
- the webpage 400 enables venue operators to configure their walled gardens, venue-specific websites, and other preferences.
- the webpage may be hosted by the remote services network or a webserver residing on the network appliance.
- the webpage enables venue operators to select security options for network appliances.
- the security options may be selected after a venue owner answers a series of non-technical questions.
- the webpage 400 can facilitate configuration of any parameters supported by a network appliance.
- a venue operator can select configuration options for a network appliance, where the configuration options are selected from a small number of pre-set configuration profiles.
- the operator can select a configuration profile, and associate the profile to a particular appliance (e.g., the configuration profile is associated with an appliance serial number).
- the venue operator need not have technical expertise about access networks, subscriber networks, and billing/business options. Instead, the operator may simply select (via the website) a configuration profile based on a simple, lay person's description about the configuration. After selecting the configuration, the venue operator can set-up the appliance at a venue.
- the appliance After each appliance is plugged-into the subscriber network, the appliance provides its serial number to the configuration service. In response, the configuration service can transmit back to the appliance the configuration information that has been selected for that appliance. In turn, the appliance receives the configuration information and automatically configures itself.
- venue operators may want to configure appliances in an on-demand manner.
- a venue operator can plug-in an appliance to a subscriber network.
- a venue operator can browse to a website hosted by the configuration service.
- the website enables the venue operator to choose configuration options to load onto the appliance.
- the venue operator may choose a configuration from a detailed list of parameters (e.g., access network parameters, provider network parameters, etc.).
- the venue operator may answer questions about the venue and appliance, where the answers are used to select configuration information for the appliance.
- the configuration service transmits configuration information to the appliance.
- the appliance can configure itself based on the configuration information.
- the configuration information can include the following: venue identifier and location, monetization model, authorization and payment information, venue federation assignment, appliance routing configuration, quality of service parameters, etc.
- the appliance cannot communicate with a subscriber network to reach the configuration service.
- a venue operator can plug (e.g., via a Universal Serial Bus connection) the appliance into a laptop computer or other device that has internet connectivity.
- the configuration service can transmit configuration to the laptop computer, which in turn forwards it to the appliance.
- This section describes operations performed by some embodiments of the network appliance and the remote configuration service.
- FIG. 5 is a flow diagram illustrating operations for configuring a network appliance, according to some embodiments of the inventive subject matter.
- the flow 500 begins at block 502 , where the network appliance powers-up. For example, after a venue operator deploys the network appliance in the venue and connects it to the power source, the network appliance powers up and begins configuration operations.
- the flow continues at block 504 .
- the network appliance's access point detects a subscriber network.
- a subscriber network uses a subscriber network to download configuration parameters from the cloud (e.g., a remote configuration service).
- the flow continues at block 506 .
- the network appliance's configuration management module transmits, to a remote configuration service, identifying information to a remote configuration service via a secure tunnel.
- the appliance's split tunnel VPN client establishes a secure tunnel over the subscriber network with the remote configuration service.
- the identifying information includes the network appliance's serial number or other unique identifier, and location information (e.g., street address, longitude and latitude coordinates, zip code, etc.). The flow continues at block 508 .
- the network appliance's configuration management module receives configuration information from the remote configuration service.
- Configuration information can include parameters for configuring all aspects of the network appliance, including access network parameters, subscriber network parameters, billing business parameters, etc. The flow continues at block 510 .
- the network appliance's configuration management module configures the appliance according to the configuration information. For example, based on the configuration information, the configuration manager module sets the access network's WiFi channels, frequencies, SSID, security protocol (e.g., WPA), etc. The configuration manager module can also use the configuration information to set parameters for the subscriber network, and billing and business parameters.
- the flow continues at block 512 .
- the configuration management module determines whether an operator has enabled configuration on-demand.
- Configuration on-demand enables an operator to tweak configuration settings.
- the network appliance downloads basic configuration settings from the remote configuration service, while enabling operators to tweak the configuration after the network appliance is up and running.
- the network appliance presents configuration on-demand configuration options via a web server residing locally on the appliance.
- the configuration options may be in the form of questions that do not require technical expertise to answer. Alternatively, the configuration options can be suited for a technical expert.
- the web server can communicate with the remote configuration service, receiving new configuration parameters and updating the service about the appliance's final configuration after the on-demand configuration is complete. If on-demand configuration has not been selected, the flow continues at block 516 . Otherwise, the flow continues at block 514 .
- the configuration management module configures the network appliance according to parameters selected via the on-demand interface. The flow continues at block 516 .
- the network appliance processes network traffic. From block 516 , the flow ends.
- the discussion of FIG. 6 describes more details about how embodiments of the network appliance may process network traffic.
- FIG. 6 is a flow diagram illustrating operations for processing network access requests, according to some embodiments of the inventive subject matter.
- the flow 600 begins at block 602 , where the network appliance receives a connection request from a mobile device via the appliance's hotspot.
- mobile devices connect to the network appliance via an access network.
- the mobile devices provide user credentials as part of requesting access to the network.
- the access network can utilize Wi-Fi technology, Ethernet technology, or any other suitable networking technology.
- the flow continues at block 604 .
- the network appliance's split tunnel VPN client establishes a secure tunnel through which the network appliance communicates authentication credentials to a remote authentication service.
- the network appliance can communicate with the remote configuration service without an authentication gateway residing on telecom system components. For example, the network appliance need not send network traffic to a gateway residing on the telecom system, where the gateway filters traffic looking for the network access requests, and forwards the requests to the remote configuration service. Instead, the network appliance itself directs network access requests to the remote authentication service via a secure tunnel.
- the flow continues at block 606 .
- the network appliance determines whether the authentication was successful. That is, the network appliance determines whether the remote authentication service successfully authenticated the user credentials. If the remote authentication service did not authenticate the user credentials, the flow ends. Otherwise, the flow continues at block 608 .
- the network appliance enables network traffic from the user to reach the Internet without passing through the remote authentication system.
- the network appliance's split tunnel VPN client routes traffic for authenticated users to the Internet, bypassing the remote authentication service.
- the network appliance reduces the amount of traffic sent to the remote authentication service. Because less traffic goes to the remote authentication service, users receive web content faster. From block 608 , the flow ends.
- FIGS. 5 and 6 describe operations performed by embodiments of the network appliance
- this discussion continues by describing how a remote configuration service can interact with network appliances.
- FIG. 7 describes operations performed by the remote configuration service.
- FIG. 7 is a flow diagram illustrating operations for providing and verifying configuration information to network appliances, according to some embodiments of the inventive subject matter.
- the flow 700 begins at block 702 , where the remote configuration service receives identifying information for a network appliance.
- the remote configuration service 128 receives a serial number and location information from a network appliance 102 .
- the flow continues at block 704 .
- the configuration service determines whether this is the network appliance's initial configuration. In some embodiments, the configuration service maintains records identifying network appliances that have not yet been initially configured. The records may also indicate network appliances that have already been configured. If this is the network appliance's initial configuration, the flow continues at block 706 . Otherwise, the flow continues at block 710 .
- the configuration service determines configuration parameters for the network appliance.
- a network appliance's initial configuration can be designed by technicians associated with the configuration service, or selected by operators using a configuration website.
- the configuration parameters can include parameters for an access network, subscriber network, billing/business policies, and any other suitable configuration parameters.
- the configuration service records the configuration parameters selected at block 706 , and transmits the configuration parameters to the network appliance.
- the network appliance can perform an automatic configuration process, and the configuration parameters are stored for safekeeping and future operations. From block 708 , the flow ends.
- the configuration service validates the network appliance's configuration parameters. That is, to ensure proper operation of the network appliance, the configuration service validates the network appliance's configuration parameters and by comparing them to the recorded settings. The flow continues at block 712 .
- the flow ends. Otherwise, the flow continues at block 714 , where the configuration service takes measures to address issues with the configuration parameters. For example, if the identifying information indicates that the network appliance has moved, the network appliance determine new configuration information based on the new location. From block 714 , the flow ends.
- aspects of the present inventive subject matter may be embodied as a system, method or computer program product. Accordingly, aspects of the present inventive subject matter may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a “circuit,” “module” or “system.” Furthermore, aspects of the present inventive subject matter may take the form of a computer program product embodied in one or more computer readable medium(s) having computer readable program code embodied thereon.
- the computer readable medium may be a computer readable signal medium or a computer readable storage medium.
- a computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing.
- a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.
- a computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof.
- a computer readable signal medium may be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.
- Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.
- Computer program code for carrying out operations for aspects of the present inventive subject matter may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the “C” programming language or similar programming languages.
- the program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server.
- the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider).
- LAN local area network
- WAN wide area network
- Internet Service Provider for example, AT&T, MCI, Sprint, EarthLink, MSN, GTE, etc.
- These computer program instructions may also be stored in a computer readable medium that can direct a computer, other programmable data processing apparatus, or other devices to function in a particular manner, such that the instructions stored in the computer readable medium produce an article of manufacture including instructions which implement the function/act specified in the flowchart and/or block diagram block or blocks.
- the computer program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
Abstract
Description
Claims (18)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US13/732,202 US9270654B2 (en) | 2012-12-31 | 2012-12-31 | Automated configuration for network appliances |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US13/732,202 US9270654B2 (en) | 2012-12-31 | 2012-12-31 | Automated configuration for network appliances |
Publications (2)
Publication Number | Publication Date |
---|---|
US20140188676A1 US20140188676A1 (en) | 2014-07-03 |
US9270654B2 true US9270654B2 (en) | 2016-02-23 |
Family
ID=51018293
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US13/732,202 Active 2033-04-06 US9270654B2 (en) | 2012-12-31 | 2012-12-31 | Automated configuration for network appliances |
Country Status (1)
Country | Link |
---|---|
US (1) | US9270654B2 (en) |
Cited By (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20150289132A1 (en) * | 2014-04-04 | 2015-10-08 | Time Warner Cable Enterprises Llc | Provisioning of wireless security configuration information in a wireless network environment |
US20160066183A1 (en) * | 2014-07-17 | 2016-03-03 | Cirrent, Inc. | Securing credential distribution |
US10154409B2 (en) | 2014-07-17 | 2018-12-11 | Cirrent, Inc. | Binding an authenticated user with a wireless device |
US10356651B2 (en) | 2014-07-17 | 2019-07-16 | Cirrent, Inc. | Controlled connection of a wireless device to a network |
US10834592B2 (en) | 2014-07-17 | 2020-11-10 | Cirrent, Inc. | Securing credential distribution |
Families Citing this family (21)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8743885B2 (en) | 2011-05-03 | 2014-06-03 | Cisco Technology, Inc. | Mobile service routing in a network environment |
US9088584B2 (en) | 2011-12-16 | 2015-07-21 | Cisco Technology, Inc. | System and method for non-disruptive management of servers in a network environment |
US9780966B2 (en) * | 2013-04-10 | 2017-10-03 | Bomgar Corporation | Network apparatus for secure remote access and control |
US9559901B2 (en) * | 2013-06-14 | 2017-01-31 | Google Inc. | Systems and methods for remote device configuration |
US9509614B2 (en) | 2013-06-20 | 2016-11-29 | Cisco Technology, Inc. | Hierarchical load balancing in a network environment |
US20150026779A1 (en) * | 2013-07-16 | 2015-01-22 | Qualcomm Connected Experiences, Inc. | Performing remote wi-fi network configuration when a network security protocol is unknown |
US20150071052A1 (en) * | 2013-09-09 | 2015-03-12 | Qualcomm Innovation Center, Inc. | Reconfiguring a headless wireless device |
US9374297B2 (en) * | 2013-12-17 | 2016-06-21 | Cisco Technology, Inc. | Method for implicit session routing |
US10169064B2 (en) | 2014-04-29 | 2019-01-01 | Vmware, Inc. | Automatic network configuration of a pre-configured hyper-converged computing device |
WO2015174968A1 (en) * | 2014-05-13 | 2015-11-19 | Hewlett-Packard Development Company, L.P. | Network access control at controller |
US9379931B2 (en) | 2014-05-16 | 2016-06-28 | Cisco Technology, Inc. | System and method for transporting information to services in a network environment |
US9479443B2 (en) | 2014-05-16 | 2016-10-25 | Cisco Technology, Inc. | System and method for transporting information to services in a network environment |
US10063445B1 (en) * | 2014-06-20 | 2018-08-28 | Amazon Technologies, Inc. | Detecting misconfiguration during software deployment |
US10417025B2 (en) | 2014-11-18 | 2019-09-17 | Cisco Technology, Inc. | System and method to chain distributed applications in a network environment |
US10397233B2 (en) | 2015-04-20 | 2019-08-27 | Bomgar Corporation | Method and apparatus for credential handling |
US10229262B2 (en) | 2015-04-20 | 2019-03-12 | Bomgar Corporation | Systems, methods, and apparatuses for credential handling |
US9762402B2 (en) | 2015-05-20 | 2017-09-12 | Cisco Technology, Inc. | System and method to facilitate the assignment of service functions for service chains in a network environment |
JP6686308B2 (en) * | 2015-07-13 | 2020-04-22 | 横浜ゴム株式会社 | Rubber composition for flame-retardant hose and flame-retardant hose |
US11044203B2 (en) | 2016-01-19 | 2021-06-22 | Cisco Technology, Inc. | System and method for hosting mobile packet core and value-added services using a software defined network and service chains |
WO2018165722A1 (en) * | 2017-03-13 | 2018-09-20 | Askarov Elchin | A method of projection of real venues and real visitors of venues to an internet-based virtual space through a web server by virtue of wireless, wired or data connection, including unique connection and verification process |
US11604632B2 (en) * | 2020-04-17 | 2023-03-14 | Fastly, Inc. | Development environment deployment for multiple developer types |
Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20020161885A1 (en) * | 1999-10-27 | 2002-10-31 | Netbotz Inc. | Methods for displaying physical network topology and environmental status by location, organization, or responsible party |
US20060191005A1 (en) * | 2005-02-23 | 2006-08-24 | Sbc Knowledge Ventures, L.P. | Centralized access control system and methods for distributed broadband access points |
US20100080202A1 (en) * | 2006-09-21 | 2010-04-01 | Mark Hanson | Wireless device registration, such as automatic registration of a wi-fi enabled device |
US20130029687A1 (en) * | 2011-07-27 | 2013-01-31 | Unwired Planet, Inc. | System and method for providing location information for communications through an access network |
-
2012
- 2012-12-31 US US13/732,202 patent/US9270654B2/en active Active
Patent Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20020161885A1 (en) * | 1999-10-27 | 2002-10-31 | Netbotz Inc. | Methods for displaying physical network topology and environmental status by location, organization, or responsible party |
US20060191005A1 (en) * | 2005-02-23 | 2006-08-24 | Sbc Knowledge Ventures, L.P. | Centralized access control system and methods for distributed broadband access points |
US20100080202A1 (en) * | 2006-09-21 | 2010-04-01 | Mark Hanson | Wireless device registration, such as automatic registration of a wi-fi enabled device |
US20130029687A1 (en) * | 2011-07-27 | 2013-01-31 | Unwired Planet, Inc. | System and method for providing location information for communications through an access network |
Cited By (11)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20150289132A1 (en) * | 2014-04-04 | 2015-10-08 | Time Warner Cable Enterprises Llc | Provisioning of wireless security configuration information in a wireless network environment |
US9554272B2 (en) * | 2014-04-04 | 2017-01-24 | Time Warner Cable Enterprises Llc | Provisioning of wireless security configuration information in a wireless network environment |
US10951466B2 (en) * | 2014-04-04 | 2021-03-16 | Time Warner Cable Enterprises Llc | Provisioning of wireless security configuration information in a wireless network environment |
US20160066183A1 (en) * | 2014-07-17 | 2016-03-03 | Cirrent, Inc. | Securing credential distribution |
US9942756B2 (en) * | 2014-07-17 | 2018-04-10 | Cirrent, Inc. | Securing credential distribution |
US10154409B2 (en) | 2014-07-17 | 2018-12-11 | Cirrent, Inc. | Binding an authenticated user with a wireless device |
US10356618B2 (en) | 2014-07-17 | 2019-07-16 | Cirrent, Inc. | Securing credential distribution |
US10356651B2 (en) | 2014-07-17 | 2019-07-16 | Cirrent, Inc. | Controlled connection of a wireless device to a network |
US10645580B2 (en) | 2014-07-17 | 2020-05-05 | Cirrent, Inc. | Binding an authenticated user with a wireless device |
US10834592B2 (en) | 2014-07-17 | 2020-11-10 | Cirrent, Inc. | Securing credential distribution |
US10856171B2 (en) | 2014-07-17 | 2020-12-01 | Cirrent, Inc. | Controlled connection of a wireless device to a network |
Also Published As
Publication number | Publication date |
---|---|
US20140188676A1 (en) | 2014-07-03 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US9270654B2 (en) | Automated configuration for network appliances | |
CN106131079B (en) | Authentication method, system and proxy server | |
KR101710067B1 (en) | Network access based on social-networking information | |
CN107404485B (en) | Self-verification cloud connection method and system thereof | |
JP6069327B2 (en) | Terminal and manager for discovering and accessing local services via WiFi hotspots | |
US9473458B2 (en) | Connection configuration | |
US8898286B2 (en) | Method and system for providing secure transactions via a broadband gateway | |
US9264433B2 (en) | Secure and automatic connection to wireless network | |
US8938785B2 (en) | Wireless session configuration persistence | |
EP2936881B1 (en) | Connecting to a wireless network using social network identifier | |
US10299131B2 (en) | Wireless gateway, network access, and management | |
US20230231838A1 (en) | Multi-option authentication portal implementation in a network environment | |
CN107615799A (en) | The access of individual session in network | |
US20110107414A1 (en) | System and Method for Location Assisted Virtual Private Networks | |
US9591485B2 (en) | Provisioning subscriptions to user devices | |
CN103312744A (en) | Business management method, platform and system based on cloud desktop | |
US20210160128A1 (en) | Provisioning of wireless security configuration information in a wireless network environment | |
US20210211878A1 (en) | Facilitating Residential Wireless Roaming Via VPN Connectivity Over Public Service Provider Networks | |
WO2018032085A1 (en) | System for connecting to a secured wireless local area network (wlan) when roaming by means of purchased secure access credentials | |
US20080244705A1 (en) | Method and apparatus for extending remote network visibility of the push functionality | |
CN105991610B (en) | Log in the method and device of application server | |
US20070016684A1 (en) | System and method for facilitating use of network features | |
US10038729B1 (en) | Cooperative network access | |
CN207706214U (en) | It is a kind of to connect system from verification cloud | |
Network | White paper |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: IPASS INC., CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:MARMOLEJO-MEILLON, LUIS G.;NELSON, BARBARA;AVILLEZ, MARCIO;AND OTHERS;SIGNING DATES FROM 20130402 TO 20130429;REEL/FRAME:030461/0597 |
|
STCF | Information on status: patent grant |
Free format text: PATENTED CASE |
|
AS | Assignment |
Owner name: FORTRESS CREDIT CORP., NEW YORK Free format text: SECURITY INTEREST;ASSIGNOR:IPASS INC.;REEL/FRAME:046094/0323 Effective date: 20180614 |
|
AS | Assignment |
Owner name: IPASS IP LLC, CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:IPASS INC.;REEL/FRAME:046148/0555 Effective date: 20180619 |
|
AS | Assignment |
Owner name: FIP UST LP, NEW YORK Free format text: SECURITY INTEREST;ASSIGNORS:IPASS INC.;IPASS IP LLC;REEL/FRAME:046170/0457 Effective date: 20180621 Owner name: DBD CREDIT FUNDING LLC, NEW YORK Free format text: SECURITY INTEREST;ASSIGNORS:IPASS INC.;IPASS IP LLC;REEL/FRAME:046170/0457 Effective date: 20180621 Owner name: FORTRESS CREDIT CORP., NEW YORK Free format text: SECURITY INTEREST;ASSIGNORS:IPASS INC.;IPASS IP LLC;REEL/FRAME:046170/0457 Effective date: 20180621 |
|
AS | Assignment |
Owner name: POST ROAD ADMINISTRATIVE LLC, CONNECTICUT Free format text: SECURITY INTEREST;ASSIGNOR:IPASS IP LLC;REEL/FRAME:048462/0641 Effective date: 20190226 |
|
AS | Assignment |
Owner name: IPASS INC., CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:FORTRESS CREDIT CORP.;REEL/FRAME:048503/0518 Effective date: 20190222 |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 4TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1551); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment: 4 |
|
AS | Assignment |
Owner name: IPASS IP LLC, CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:POST ROAD ADMINISTRATIVE LLC;REEL/FRAME:052525/0357 Effective date: 20190926 |
|
AS | Assignment |
Owner name: IPASS INC., CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNORS:FIP UST LP;DBD CREDIT FUNDING, LLC;REEL/FRAME:052564/0488 Effective date: 20190222 Owner name: IPASS IP LLC, CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNORS:FIP UST LP;DBD CREDIT FUNDING, LLC;REEL/FRAME:052564/0488 Effective date: 20190222 |
|
AS | Assignment |
Owner name: HIGH TRAIL INVESTMENTS SA LLC, AS COLLATERAL AGENT, NEW JERSEY Free format text: INTELLECTUAL PROPERTY SECURITY AGREEMENT;ASSIGNOR:IPASS IP LLC;REEL/FRAME:052888/0728 Effective date: 20200608 |
|
AS | Assignment |
Owner name: CHANNEL VENTURES GROUP, LLC, WASHINGTON Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:PARETEUM CORPORATION;PARETEUM NORTH AMERICA CORPORATION;DEVICESCAPE HOLDINGS, INC.;AND OTHERS;REEL/FRAME:063988/0501 Effective date: 20220711 |
|
AS | Assignment |
Owner name: CHANNEL IP B.V., NETHERLANDS Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:CHANNEL VENTURES GROUP, LLC;REEL/FRAME:064180/0440 Effective date: 20230526 |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 8TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1552); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment: 8 |