US20060075467A1

Movatterモバイル変換

Info

Publication number: US20060075467A1
Application number: US11/167,747
Authority: US
Inventors: Frank Sanda; Naohisa Fukuda; Edward Laves; Robert Johnston; Justin Tidwell; Raymond Gurgone; David Robins; Laura Worthington; Karlton Zeitz
Original assignee: Individual
Current assignee: Japan Communications Inc
Priority date: 2004-06-28
Filing date: 2005-06-27
Publication date: 2006-04-06
Also published as: WO2006004786A1; US20060075472A1; US20060064588A1; WO2006004785A1; JP2008504631A; JP2008504792A; EP1766927A1; US20060023738A1; WO2006012346A1; EP1766926A1; WO2006004930A1; WO2006012058A1; WO2006004928A2; US7760882B2; WO2006004928A3; US20060075506A1; JP2008504630A; EP1766931A1; US20060072583A1; WO2006004784A1

Abstract

Systems and methods for enhanced network access are described. One aspect of one described embodiment includes receiving a request to connect to a network, the request associated with a user, determining a policy associated with the user, identifying at least one available network connection, determining at least one property of the at least one available network connection, evaluating the property based at least in part on the policy, and selecting the at least one available network connection based on the evaluation. In another embodiment, a computer-readable medium (such as, for example random access memory or a computer disk) includes code for carrying out such a method.

Description

RELATED APPLICATIONS

This application claims priority to Application Ser. No. 60/583,765, filed on Jun. 28, 2004, titled “Controlling Use of a Mobile Work Station Based on Network Environment,” Application Ser. No. 60/598,364, filed on Aug. 3, 2004, titled “Systems and Methods for Enhancing and Optimizing a User's Experience on an Electronic Device,” Application Ser. No. 60/652,121, filed on Feb. 11, 2005, titled “Remote Access Services,” and Application Ser. No. 60/653,411, filed on Feb. 16, 2005, titled “Creating an Environment for Secure Mobile Access Anywhere,” the entirety of all of which are incorporated herein by reference.

FIELD OF THE INVENTION

The present invention relates generally to computer networking and, more particularly to systems and methods for enhanced network access.

BACKGROUND

As the workforce becomes more mobile, enterprises often must provide a means for their users to connect to the enterprise network remotely. Enterprises and their users have much greater flexibility in selecting methods of connecting to the enterprise network as well as other resources, such as the Internet. With this added flexibility comes a concomitant increase in complexity and risk. Thus, although remote access may be necessary, enterprises may resist providing their users with remote access.

Each remote method for connecting to an enterprise network opens a potential security hole that might be exploited. For instance, listeners on a network, such as rogue access points, may be able to determine a user's username/password combination for accessing the network.

Also, each connection type may be purchased from a different network provider. The enterprise must reconcile charges from each of the providers for each of the users accessing the network remotely.

Further, every conventional connection product connecting to the enterprise network provides a unique interface. And although each interface may be relatively straightforward, complexity arises from the enterprise and its users having to deal with multiple interfaces for each of the various network connections the user wishes to make.

SUMMARY

Embodiments of the present invention provide systems and methods for enhanced network access. One aspect of one embodiment of the present invention comprises receiving a request to connect to a network, the request associated with a user, determining a policy associated with the user, identifying at least one available network connection, determining at least one property of the at least one available network connection, evaluating the property based at least in part on the policy, and selecting the at least one available network connection based on the evaluation. In another embodiment, a computer-readable medium (such as, for example random access memory or a computer disk) comprises code for carrying out such a method.

This illustrative embodiment is mentioned not to limit or define the invention, but to provide one example to aid understanding thereof. Illustrative embodiments are discussed in the Detailed Description, and further description of the invention is provided there. Advantages offered by the various embodiments of the present invention may be further understood by examining this specification.

FIGURES

These and other features, aspects, and advantages of the present invention are better understood when the following Detailed Description is read with reference to the accompanying drawings, wherein:

FIG. 1 is a block diagram showing an illustrative environment for implementation of one embodiment of the present invention;

FIG. 2 is a block diagram illustrating the modules present on aclient device102 in one embodiment of the present invention;

FIG. 3 is a block diagram illustrating the modules present on asecurity server104 in one embodiment of the present invention;

FIG. 4 is a block diagram illustrating the modules present on anenterprise server106 in one embodiment of the present invention;

FIG. 5 is a flowchart illustrating a process for creating a policy for a group in one embodiment of the present invention;

FIG. 6 is a flowchart illustrating a process for updating policy information on a client in one embodiment of the present invention; and

FIG. 7 is a flowchart illustrating a method for changing a network connection while downloading data in one embodiment of the present invention.

DETAILED DESCRIPTION

Embodiments of the present invention provide systems and methods for enhanced network access. There are multiple embodiments of the present invention. By way of introduction and example, one illustrative embodiment of the present invention provides a method for a client device to seamlessly switch from a first network connection to a second.

As a mobile client device moves from a first location to a second location, the device is provided with an indication that the second network connection is available. The device determines a set of properties regarding the second connection, such as speed, reliability, and cost for the connection. The client device then evaluates these properties based on a set of policies, which are specified by the enterprise with which the user is associated, so that at any one time, the user is connected to the “best” network from the point of view of the enterprise. A rules engine automatically determines which of the two connections is most suitable based on the policies and the properties of the connection.

For instance, the second connection may be faster and cheaper than the first. However, the first connection is more reliable. The enterprise policies weigh speed and cost more highly than reliability. Thus, the client device automatically switches from the first connection to the second connection without any user intervention.

This introduction is given to introduce the reader to the general subject matter of the application. By no means is the invention limited to such subject matter. Illustrative embodiments are described below.

System Architecture

Various systems in accordance with the present invention may be constructed. Referring now to the drawings in which like numerals indicate like elements throughout the several figures,FIG. 1 is a block diagram showing an illustrative environment for implementation of one embodiment of the present invention. The system shown inFIG. 1 includes aclient102. The client is in communication with asecurity server104.

Communication with thesecurity server104 occurs via anetwork108. Thenetwork108 may comprise a public or private network and may include the Internet. The network may also comprise a plurality of networks, including, for example, dedicated phone lines between the various components. In one embodiment, theclient102 communicates with thesecurity server104 via a virtual private network (“VPN”) established over the Internet.

Thesecurity server104 is also in communication with anenterprise server106 via a network. Thenetwork108 may comprise various elements, both wired and wireless. In one embodiment, the communication between thesecurity server104 andenterprise server106 occurs over a static VPN established over dedicated communication lines.

In one embodiment, a user connects aclient device102 to thenetwork108 using a network access user interface. The network access user interface is always on and only allows the user to connect to thenetwork108 via the interface. The network access user interface automatically causes theclient102 to connect to thesecurity server104 through thenetwork108. Thesecurity server104 provides value added services to theclient102 and to one or more enterprises. Access to other services, such as the Internet, may be provided via thesecurity server104.

AlthoughFIG. 1 includes only asingle client102,security server104, andenterprise server106, an embodiment of the present invention will typically include a plurality ofclients102 and may include a plurality ofsecurity servers104 andenterprise servers106.

FIGS. 2 through 4 are block diagrams illustrating components on theclient102,security server104, andenterprise server106. Each of the components shown may be a third-party application, a custom application, or a combination of both. Each of the components may also be implemented in hardware, software, or a combination of hardware and software.

Client Devices

FIG. 2 is a block diagram illustrating the modules present on aclient device102 in one embodiment of the present invention. Examples ofclient device102 are personal computers, digital assistants, personal digital assistants, cellular phones, mobile phones, smart phones, pagers, digital tablets, laptop computers, Internet appliances, and other processor-based devices. In general, aclient device102 may be any suitable type of processor-based platform that is connected to thenetwork108, and that interacts with one or more application programs. Theclient device102 can contain a processor coupled to a computer-readable medium, such as RAM.Client device102 may operate on any operating system, such as Microsoft® Windows® or Linux. Theclient device102 is, for example, a laptop computer executing a network access user interface.

The modules shown inFIG. 2 represent functionality of theclient102. The modules may be implemented as one or more computer programs that include one or more modules. For instance, in one embodiment, all the modules shown inFIG. 2 are contained within a single network access application. Also, the functionality shown on theclient102 may be implemented on a server in other embodiments of the present invention. Likewise, functionality shown inFIGS. 3 and 4 as being on a server may be implemented on theclient102 in some embodiments of the present invention.

Theclient102 shown inFIG. 2 comprises aVPN client202. TheVPN client202 allows theclient102 to connect to theenterprise server106. In one embodiment of the present invention, theVPN client202 is used to determine whether or not theVPN client202 is active and whether or not theVPN client202 is connected to a VPN server. For instance, an embodiment of the present invention may determine whether or not to connect to a particular service based on whether or not theVPN client202 is enabled.

In another embodiment of the present invention, theVPN client202 is used for four purposes: (1) to manage policy files, which include information, such as a gateway Internet Protocol (IP) address, secrecy and authentication level, and hash; (2) automatically connecting a VPN; (3) automatically disconnecting the VPN; and (4) monitoring the status of the VPN. Each of these four purposes may be affected by other modules, including, for example, theconnection manager210.

Theclient102 also comprises asecure vault204. Thesecure vault204 protects content on theclient102. In one embodiment, thesecure vault204 is responsible for storing encrypted content on theclient102 and allowing access to the encrypted content based on a set of permissions or policies. In such an embodiment, a content creator can provide access via a viewer to secured content and allow a recipient of the content read-only access or allow the recipient to perform other tasks, such as modifying the content and forwarding it to other users. In another embodiment, thesecure vault204 allows the user to create and distribute secure content toother clients102, the content creator can decide to send a document to several users and allow two of the users full access and one of the users read-only access.

Theclient102 shown inFIG. 2 also comprises afirewall206. Thefirewall206 allows port blocking via predefined policies. For instance, in one embodiment, an information technology (“IT”) manager specifies port blocking based on two zones, a safe zone and a dangerous zone. The IT manager specifies one of these two zones for each of the network interface devices installed on theclient102. The IT manager is then able to set port-blocking rules by zone on thefirewall206.

For example, the IT manager may classify a Wireless Fidelity (“Wi-Fi”) network interface as dangerous since it has traditionally been considered fairly unsafe. And the IT manager may apply more restrictive port-blocking rules to the dangerous zone than to the safe zone and network interface devices, such as those used to connect to a wired Local Area Network (“LAN”) or a Personal Handyphone System (“PHS”) cellular connection. The PHS standard is a TDD-TDMA based microcellular wireless communications technology and has been traditionally considered relatively safer than Wi-Fi connections. The PHS cellular connection may also be referred to as a wireless wide area network (“WWAN”) as opposed to a dial-up connection providing access to a wide area network (“WAN”).

In various other embodiments, the port-blocking rules of thefirewall206 may be based on time of day, client IP address, terminating IP address, terminating and originating port, protocol, and other variables. In one embodiment, the port-blocking rules are based on policy data associated with individual users logged into theclient102.

In one embodiment, the port-blocking rules of thefirewall206 include a blacklist. The blacklist allows an IT manager to prevent an application from executing on theclient102. For instance, an IT manager may blacklist a DVD player so that a user is unable to view DVD's on theclient102. Thefirewall206 may provide a message to the user informing the user that an application is unavailable.

In another embodiment, thefirewall206 implements a white list. The white list is somewhat more restrictive than the blacklist described above. The white list allows only specified applications to execute. For example, an IT manager may allow only MS Word, Excel, PowerPoint, and Outlook to execute. No other applications will be permitted to execute. Thefirewall206 may be a custom firewall or a third-party firewall integrated into an embodiment of the present invention.

The embodiment shown inFIG. 2 also includes an antivirus module208. The antivirus module208 shown determines whether policy files, virus dictionary, or other virus-related resources are out of date and provides theclient102 with a mechanism for updating the files or data. The antivirus module208 may restrict access to various connections, applications, and other functionality when the policy files are out of date. For instance, the antivirus module208 may restrict theclient102 to connecting to a single gateway through which the policy files are available. In one embodiment, the antivirus module208 comprises a third-party antivirus product that is integrated with the other modules on theclient102.

Theclient102 also comprises aconnection manager210, which includes a rules processor. In one embodiment, theconnection manager210 assigns a priority number to every connection, e.g., one to one hundred, and selects the connection with the highest number to connect to.

Theconnection manager210 may provide a connection to a variety of networks, including, for example, dial-up, LAN, digital subscriber line (“DSL”), cable modem, Wi-Fi, wireless local area network (“WLAN”), PHS, and satellite.

In one embodiment, theconnection manager210 differentiates between public and private connections. A public connection is a connection provided by a service provider who has a relationship with the administrator of thesecurity server104, which allows thesecurity server104 to authenticate the connection. For instance, thesecurity server104 administrator may have a business arrangement with a hotspot provider. In order to connect, theclient102 connects to a local access point and the authentication of the user occurs automatically at thesecurity server104. In contrast, a private connection requires that all aspects of the authentication mechanism for a connection are managed in the absence of thesecurity server104, although the connection manager may provide certain facilities to allow for automated authentication where possible.

In one embodiment, theconnection manager210 makes connections available or unavailable to theclient102 based on policies present on theclient102. Theconnection manager210 may also download changes to policy data and transmit quality of service (“QoS”) and other data to thesecurity server104 or theenterprise server106.

In one embodiment, theconnection manager210 determines the type of connections that are available based on signals provided by hardware associated with theclient102. For example, when theclient102 passes near a hotspot, a Wi-Fi card in theclient102 senses the hotspot and sends a signal to theconnection manager210. For instance, the Wi-Fi card may sense a broadcast service set identifier (“SSID”). Once the signal exceeds a threshold, theconnection manager210 provides a signal to a user of theclient102 that the network is available or may automatically connect to the hotspot. Alternatively, the Wi-Fi card may poll for a non-broadcast SSID. Theconnection manager210 may provide a single connection to theclient102 at one time or may provide multiple connections to theclient102.

Theclient102 shown inFIG. 2 also comprises aQoS collector212. TheQoS collector212 collects data values, including, for example, the number of bytes sent and received, the average transfer rate, the average signal strength at connection, termination cause, failed connections, and a network identifier. In another embodiment, theQoS collector212 collects data during the session to determine when a connection provides inconsistent performance.

In one embodiment, theQoS collector212 collects data regarding a connection during a session but does not send the data for a session until the next session. Thus, if a session is terminated abnormally, the QoS data will still be collected and transferred successfully. In another embodiment, theQoS collector212 transfers data only when a particular type of connection is detected, such as a high-speed or low cost connection.

Theclient102 also comprises asession statistics module214. The session statistics module stores data representing user characteristics. For instance, the sessionstatistic module214 may store a list of the applications a user generally accesses, how often the user is connected, the typical CPU and memory utilization measure, keyboard sequences, and other characteristics of a user. If a particular user deviates from the expected characteristics by greater than a threshold, such as N standard deviations, and the significance of the statistic is more than a specified amount, thesession statistics module214 can identify the current user as a potential unauthorized user.

Thesession statistics module214 may perform other tasks as well. For instance, in one embodiment, thesession statistics module214 pre-loads applications based on a user's general usage patterns.

Theclient102 shown inFIG. 2 also comprises apolicy reader216. In one embodiment, a company's policies are housed on theenterprise server106. For instance, individual groups and users within an enterprise are identified and associated with policies, such as what types of connections they are able to access and what a user's VPN profile is. The user may also be able to specify a VPN policy on theclient102. In such an embodiment, thepolicy reader216 downloads the policy rules from theenterprise server106 and accesses local user policies and reconciles any conflicts between the two.

For example, an IT manager may establish a VPN profile to be used by a user when connecting to a Wi-Fi network. However, the user may wish to create a secondary VPN profile to be used if the first VPN becomes unavailable. Thepolicy reader216 loads both local and enterprise VPN profiles, resolving any conflict between the two VPN profiles.

In one embodiment, thepolicy reader216 accesses data at an enterprise, department, and user level. In such an embodiment, some of the policy rules may be stored in a lightweight directory access protocol (“LDAP”) server on theclient102, security server104, orenterprise server106. In another embodiment, thepolicy reader216 receives only changes to policy data and does not typically download all of the policy data at once. Policies downloaded by thepolicy reader216 may be provided to the rules processor of theconnection manager210.

Theclient102 may also comprises aclient security module216. In one embodiment, theclient security module216 implements a client asset protection process. When theclient security module216 receives a signal indicating that the client asset protection process is to be executed, theclient security module216 may, for example, disable devices and interfaces on theclient device102 and may, in some embodiments, encrypt the hard drive of theclient device102 so that the files stored on the drive are not easily accessible.

Theclient102 may also comprise a user interface220. The user interface220 may control the underlying operating environment or the user's view of the underlying environment. For example, in one embodiment, the user interface220 supplants the Microsoft® Windows operating system interface from the user's perspective. In other words, the user is unable to access many of the standard Windows features. Such a user interface may be implemented to limit the applications and configuration setting a user is able to access. In some embodiments, such as a personal digital assistant (“PDA”), no user interface is provided by an embodiment of the present invention; the standard PDA user interface is utilized.

The user interface220 provides the user with an easy-to-use mechanism for accessing network connections. In one embodiment, when the user interface220 is visible, it provides a very easy-to-use format that displays network connection types and provides other functionality to the user. For example, during complex operations, such as connecting to a new network type, the user can simply select a single button within the user interface220 and theclient102 will properly disconnect from the previous network, acquire the new network, perform all authentication and policy-based requirements, and then allow the user to continue using an application on the new network. This simple, easy-to-use user interface220, the complexity of which may be hidden and completely automatic, allows a less-technical user to successfully operate theclient102. All network connection, authentication, secure sign on, VPN parameters, and other aspects of the connection are managed by the user interface220.

Theclient102 shown inFIG. 2 also comprises asecurity agent222. In some embodiments, thesecurity agent222 is also referred to as a “bomb.” In one embodiment, an IT manager indicates that thesecurity agent222 should be activated when theclient102 next connects to theenterprise server106. The IT manager may do so because theclient102 has been reported stolen. Subsequently, theclient102 connects to theenterprise server106, either directly or indirectly and receives the message to initiate thesecurity agent222.

In one embodiment, when thesecurity agent222 activates, it stops all applications from being able to run and encrypts the data on the hard drive of theclient102. For instance, thesecurity agent222 may implement a white list as (described above and then implement a secure vault for all data on theclient102. Theconnection manager210 may also be configured so that no connections are possible.

In one such embodiment, since the data is merely encrypted bysecurity agent222, rather than erased, the data may be recovered if theclient102 is subsequently recovered. For instance, the enterprise may retain the key needed for decrypting the local drive. Theclient102 is returned to the enterprise, which then decrypts the drive. In another embodiment, the data on the local drive of the client is rendered inaccessible by, for example, writing over the data multiple times.

Theclient102 shown inFIG. 2 also comprises an out-of-band communication receiver224. The out-of-band communication receiver224 allows the client to receive communications other than through a network-based connection. Theconnection manager210 may manage the out-of-band communication. For instance, the command to activate thesecurity agent222 may be transferred via a short messaging service (“SMS”) communication received by the out-of-band communication receiver224.

Security Server

FIG. 3 is a block diagram illustrating the modules present on asecurity server104 in one embodiment of the present invention. Thesecurity server104 shown inFIG. 3 comprises a remote authentication dial-in user service (“RADIUS”) server302, which may also be referred to as an AAA (authentication, authorization, and accounting) server. RADIUS is the standard by which applications and devices communicate with an AAA server.

The RADIUS server302 provides authentication services on thesecurity server104. In some embodiments of the present invention, the RADIUS server302 proxies to a RADIUS server on theenterprise server106. In one embodiment, the RADIUS server302 provides mutual authentication for theclient102 using Extensible Authentication Protocol Transport Layer Security (“EAP-TLS”). Although EAP-TLS itself is strictly an802.lx authentication protocol, designed primarily for WiFi connections, the underlying TLS authentication protocol may be deployed in both wired and wireless networks. EAP-TLS performs mutual secured sockets layer (“SSL”) authentication. This requires both theclient device102 and the RADIUS server302 to have a certificate. In mutual authentication, each side may prove its identity to the other using its certificate and its private key.

The security server shown inFIG. 3 also comprises anLDAP server304. TheLDAP server304 uses the LDAP protocol, which provides a mechanism for locating users, organizations, and other resources on the network. In one embodiment of the present invention, theLDAP server304 provides access control at the network layer to various components that an enterprise customer may or may not purchase. For example, a customer may choose to implement a secure vault as described in relation toFIG. 1. In such a case, the customer or users or groups associated with the customer are also associated with the firewall module. The LDAP entry is then used to determine that the firewall is to be enabled on a client.

In some embodiments, theLDAP server304 is implemented as a list of user identifiers not using the LDAP protocol. In another embodiment, data in theLDAP server304 is propagated from data present in theenterprise server106.

Thesecurity server104 shown inFIG. 3 also comprises asession manager306. Thesession manager306 controls sessions, including sessions between theclient102 andenterprise server106. In some embodiments, thesession manager306 also determines how to route data requests. For instance, thesession manager306 may determine that a particular data request should be routed to the Internet rather than to theenterprise server106. This may be referred to as “splitting the pipe” and provides a mechanism to replace “split tunneling” (a traditional configuration option with most standard VPN clients) at the client device by the more secure split of traffic not intended for the enterprise at the security server, allowing monitoring of all traffic without the enterprise incurring the expense of the extra bandwidth required.

In some embodiments, theclient102 andenterprise server106 establish a VPN for communication. In such an embodiment, thesession manager306 may be unable to route requests to any location other than the enterprise—the packets are encrypted and thus, cannot be separately evaluated.

In one embodiment, thesession manager306 performs automated authentication of aclient device102 or user. For example, if thesession manager306 determines that aclient102 is approaching a Wi-Fi hotspot, thesession manager306 is able to pre-populate the hotspot with the certificate that the hotspot requires to authenticate the user. In this manner, the authentication appears very fast to the user. Thesession manager306 may also control the manner in which data is queued for download to theclient device102.

In one such embodiment, thesession manager306 provides two modes for data queuing. In a first mode, thesession manager306 determines that the network down time will be brief, e.g., the user is moving through a tunnel, which interferes with network access. In such a case, the session manager queues a minimal amount of data. In a second mode, thesession manager306 determines that the network down time will be of a longer duration, e.g., the user is boarding a plane from New York to Tokyo. In such a case, thesession manager306 may queue a larger amount of data. In one such embodiment, thesession manager306 determines the mode by querying the user for the downtime interval. When the user reconnects to thesecurity server104, thesession manager306 determines the best manner of downloading the queued data and begins the download.

In one embodiment, thesession manager306 comprises a packet shaper (not shown). The packet shaper provides various functional capabilities to thesession manager306. For example, in one embodiment, the packet shaper provides a mechanism for prioritizing packets sent between theenterprise server106 and theclient102. In one embodiment, the packet shaper utilizes Multiprotocol Label Switching (“MPLS”). MPLS allows a specific path to be specified for a given sequence of packets. MPLS allows most packets to be forwarded at the switching (layer 2) level rather than at the (routing) layer 3 level. MPLS provides a means for providing QoS for data transmissions, particularly as networks begin to carry more varied traffic.

Thesession manager306 may also provide session persistence capabilities. For instance, in one embodiment, when a user drops a connection or moves from one provider network coverage area to another, theconnection manager306 persists a virtual connection as the first connection is terminated and the second is initiated.

Thesession manager306 may include a server-side rules engine. The server-side rules engine may use historical information, such as the session statistics described above, for statistical attack determination. For instance,session manager306 may access a stored statistic regarding aclient device102 and based on monitoring of the current statistics for theclient device102 determine that an unauthorized user is using theclient device102.

Thesecurity server104 shown inFIG. 3 also comprises a real-time monitor308. The real-time monitor308 monitors the status of communications, such as which clients and users are logged on, the amount of data being transferred, ongoing QoS measures, ports in use, and other information.

When the real-time monitor308 detects a problem, it may issue an alert to network support. In one embodiment, data from the real-time monitor308 is provided to users via a portal available on thesecurity server308. In another embodiment, the real-time portal308 transfers information to theenterprise server106, from which users access the data.

The embodiment shown inFIG. 3 also comprises ahistorical monitor310. Thehistorical monitor310 provides information similar to the real-time monitor310. However, the underlying data is historical in nature. For instance, in one embodiment, thehistorical monitor310 provides audit information for making intelligent business decisions and for dealing with regulatory compliance issues.

The information available via thehistorical monitor310 may include, for example, historical QoS data, registration compliance data, and metrics consistency data. The historical data monitor310 may be used to determine that certain clients are not performing optimally by comparing metrics of various clients over time. For instance, by evaluating information available via the historical data monitor310, a support person may be able to determine that a radio tuner on aspecific client device102 is failing. If the user of oneclient device102 is complaining about the availability of service, but other users are able to successfully access service, then the client device's radio may be the problem.

The historical data monitor310 may also be used to reconcile information captured on thesecurity server104 regarding connections and data provided by telecommunication carriers. The data may be used to determine when certain resources need to be increased and when a certain carrier is not performing adequately.

The security server also comprises adatabase312. In embodiments of the present invention, thedatabase312 may be any type of database, including, for example, MySQL, Oracle, or Microsoft SQL Server relational databases. Also, although thedatabase312 is shown as a single database inFIG. 2, thedatabase312 may actually comprise multiple databases, multiple schemas within one or more databases, and multiples tables within one or more schemas. Thedatabase312 may also be present on one or more other machines, e.g., database servers.

In one embodiment of the present invention, thedatabase312 stores customer information regarding enterprises served by thesecurity server104, such as a list of valid users, a list of valid cellular cards, the relationships between the individual users and groups within the enterprise, and other customer information.

For example, in one embodiment, thedatabase312 stores an association between users and cellular data cards. The enterprise may allocate a single user to a specific data card. Alternatively, the enterprise may associate a group of users with a group of cellular data cards. Other types of data may also be stored in thedatabase312, such as billing data.

Thesecurity server104 shown inFIG. 3 also comprises aQoS server314. TheQoS server314 uploads information from theQoS collector212 on theclient device102 and stores the QoS data. TheQoS server314 can collect data from multiple clients and store it in thedatabase312.

The security server also comprises aQoS tools engine316. TheQoS tools engine316 displays data made available by theQoS server314 and other processes, such as the real-time monitor308.

In one embodiment, theQoS tools engine316 provides an aggregation of QoS data in a spreadsheet. In another embodiment, theQoS tools engine316 provides data using map views, pie charts, and graphs. TheQoS tools engine316 may also provide the capability for setting QoS-based alarms and may provide data to users via a portal.

In the embodiment shown inFIG. 3, thesecurity server104 also comprises aportal server318. Theportal server318 may be, for example, a web server. Any standard web server application may be utilized, including Microsoft® Internet Information Server (“IIS”) or Apache.

Although thesecurity server104 shown inFIGS. 1 and 3 is illustrated as a single server, it may comprise multiple servers. For example, in one embodiment of the present invention, thesecurity server104 comprises multiple regional servers.

Also, the description above suggests that data is provided to and queried from thesecurity server104 by theclient102, i.e., the client pulls the data. However, in some embodiments, theclient102 also comprises a listener (not shown) so that thesecurity server104 can push data to theclient102.

Enterprise Server

FIG. 4 is a block diagram illustrating the modules present on anenterprise server106 in one embodiment of the present invention. Theenterprise server106 may also be referred to herein as a customer server and may comprise one or more servers for one or more enterprises linked to one ormore security servers104.

Theenterprise server106 shown inFIG. 4 comprises apolicy server402. Thepolicy server402 provides a means for managing the policy rules, including, for example, available VPN profiles, available transports (e.g. WiFi, LAN, PHS, Dialup), firewall rules, such as blacklists and white lists, connection rules, and antivirus rules. Thepolicy server402 may include other rules as well, such as the level of data throttling to perform for each client or group of clients. Data throttling limits the data transfer rate to aparticular client102 so that connection resources can be optimized.

The policies may be managed at one or more levels. For example, an IT manager may wish to create a VPN profile for the enterprise as a whole, but a different VPN profile for an engineering group since the engineering group needs access to various unique applications.

Thepolicy server402 may also provide a mechanism for configuring the location of various servers that theclient102 will utilize. For instance, thepolicy server402 may allow an IT manager to specify the IP address of anacceleration server404 or avault server406

In one embodiment, the policy server also allows the IT manager to specify which users receive updates for various components on theclient102. Thepolicy server402 may also allow the IT manager to perform connection configuration. For instance, the IT manager may use the policy server to specify phone numbers for PHS connections, Wi-Fi SSID's for private connections, and other connection configuration information.

Theenterprise server106 shown inFIG. 4 also comprises anacceleration server404. Theacceleration server404 performs processes to improve the performance of data transfer. For instance, theacceleration server404 may automatically compress images that are to be transferred to aclient102.

In one embodiment, theacceleration server404 communicates with thepolicy server402. An IT manager sets acceleration rules using thepolicy server402, and theacceleration server404 uses these rules to determine what level of acceleration to use for a particular communication. In one embodiment, the IT manager sets a default level of acceleration for all communication and a specific level of acceleration for one group of users. The specific level of acceleration may be referred to as an override.

Theenterprise server106 also comprises avault server406. The vault server comprises two components, an automatic component and an administration component. In one embodiment, the automatic component integrates with an enterprise's mail server (not shown) and performs operations on emails to and from the mail server. For instance, thevault server406 may quarantine an email, automatically encrypt the email before it is sent, add a legal disclaimer to an email, or perform other functions on the email.

In one embodiment, the automatic component of thevault server406 searches an email based on words or based on the domain or specific address to which the email is addressed or from which the email originated. Using this information, the user can perform functions on the email, such as those described above.

The administration component of thevault server406 allows a user to terminate access to secure content, either by a specific user or by all users. It also logs activity. Using one embodiment of thevault server406, a user can indicate that a set of users whose employment has been terminated will no longer have access to any secure content. In an alternative embodiment of thevault server406, a user can indicate that a given element of secure content, say a price list, is now out of date, and so that piece of secure content will no longer be viewable by any user. When each user accesses the secure content, thevault server406 logs the event. So for each secure content element, thevault server406 creates a log of all activity on the secure content.

In one embodiment, thevault server406 also compresses data. For instance, one embodiment utilizes standard PKZIP compression to compress all content. In another embodiment, an IT manager may identify three types of images and specify a different level of compression for each type of image based on the level of resolution necessary for each type of image.

Theenterprise server108 also comprises a RADIUS server408 andLDAP server410, which are similar to those described above in relation to thesecurity server104. The RADIUS server302 on thesecurity server104 may proxy to the RADIUS server408 on theenterprise server106. Similarly, data in theLDAP server410 may be propagated to theLDAP server204 on thesecurity server104.

Theenterprise server106 also comprises a one-time password (“OTP”)server412. TheOTP server412 provides a mechanism for authentication. For instance, in one embodiment of the present invention, theenterprise server106 uses theOTP server412 to perform a mutual authentication process.

Theenterprise server106 also comprises aconcentrator414. Theconcentrator414 provides remote access capability to theclient102. For instance, theconcentrator414 may serve as a means for terminating a VPN between theclient102 andenterprise server106.

Theenterprise server104 shown inFIG. 4 also comprises aportal server416. Theportal server416 may comprise a standard web server, such as IIS or Apache. Theportal server416 may provide one or more portals. For example, in one embodiment, theportal server416 provides two portals, portal one and portal two.

Portal one provides a configuration interface for managing the various elements shown inFIGS. 2 and 3, including, for example, thepolicy server402 andLDAP server410. Portal two provides an interface for accessing data, such as QoS data and session data.

For instance, a user may use historical QoS data on portal two to determine how a particular provider is performing in terms of throughput, user connections, and other QoS metrics. Portal two may also provide real-time information, such as how many users are currently connected.

For instance, in one embodiment, an IT manager determines that twenty users have been rejected by a carrier in the last three minutes due to authentication failure and five users with the same user identifier are currently logged on to five different devices. The IT manager uses this information to detect a potential security problem. Portal two may also be used to set alerts as described above.

It should be noted that the present invention may comprise systems having a different architecture than that which is shown inFIGS. 1 through 4. For example, in some systems according to the present invention, thesecurity server104 andenterprise server106 may comprise a plurality of security and enterprise servers. The system100 shown inFIGS. 1 through 4 is merely illustrative, and is used to help explain the illustrative systems and processes discussed below.

Illustrative Methods of Enhanced Network Access

The following illustrative embodiments utilize acentral policy server402 on anenterprise server106. Theclient device102 downloads policies from thepolicy server402 and theconnection manager210 utilizes the policies to make connections. In other embodiments, policy files are created and distributed to theclient device102 in other ways. For example, an email attachment or disk may be distributed to eachclient device102. Each time an update is necessary, a new disk or email is distributed.

In embodiments of the present invention, policies are created and distributed toclient devices102. Theclient devices102 utilize the policies for making connections.FIG. 5 is a flowchart illustrating a process for creating a policy for a group in one embodiment of the present invention.

In the embodiment shown inFIG. 5, policy administrator first determines apolicy502. The policy may be based on a variety of factors, such as, for example, regulatory issues, the type of data and/or applications to be used, the level of control desired by the enterprise, the physical environment in which a client device or group of client devices will operate, the experience and technical knowledge of the user group associated with the policy, and the job to be performed by the group or groups associated with the policy. The policy may include various elements, including, for example a list of allowed connections or applications and a list of disallowed connections or applications, acceleration preferences, and a VPN profile. The policy may also include connection preferences of the enterprise or of the users. For instance, an enterprise may decide not to use certain WiFi hotspots. The policy may vary by time of day.

The policies may be based on a number of factors, including, for example, an enterprise's need to minimize overall transport cost when billed on a usage basis, an enterprise's wish to minimize perceived security exposure based on assumed insecurity on some transports and specific connections, and an enterprise's wish to ensure the highest speed and most reliable usage experience for their users. The policies may be based on third party parameters as well. For instance, the policy may be based on the enterprise's security provider's desire to minimize its transport costs overall.

The policy administrator next selects a group to be associated with thepolicy504. The administrator may manually enter group names and user identifiers. Alternatively, the administrator may select groups from a central directory, such as theLDAP410 or a Microsoft Active Directory Server. Each policy may be associated with, for example, an enterprise, a group within the enterprise or across enterprises, or with an individual.

Once the administrator has created a policy and associated the policy with a group, the administrator saves the policy-group association506. The policy-group association may be stored in a database (not shown) in communication with thepolicy server402. Alternatively, the policy-group association may be stored in a file, for example, in an XML format in a file.

The administrator then causes the policy and policy-group association to be distributed toclient devices508. For instance, the policy and policy-group association may reside in the database, which is in communication with thepolicy server402, so that when a client device attempts to download a policy, the policy-group association is used to determine which policy or policies to download. The policy and policy-group association may be distributed via a network, such asnetwork108, or by media, such as CD-ROM. In one embodiment, only changes to the policies are downloaded. In other embodiments, all policies are downloaded each time a download occurs.

In some embodiments, once the policies are downloaded to the client device, the user may make changes to them. For instance, the user may set up an alternative VPN profile on the client if the VPN associated with the VPN profile downloaded from thepolicy server402 is temporarily unusable.

FIG. 6 is a flowchart illustrating a process for updating policy information on a client in one embodiment of the present invention. In the embodiment shown, thepolicy reader216 on theclient device102

loads policies

602. For instance, the policies may exist in an XML file, which thepolicy reader216 opens and reads.

Theconnection manager210 then determines what the most recently used connection was and whether the most recently used connection is available604. For example, a user may shut down aclient device102 while theclient device102 is connected to a WiFi hotspot. When the user starts theclient device102, the client device will attempt to connect to the WiFi hotspot.

If theclient device102 is not able to connect to the most recently used connection, theclient device102 attempts to identify anew connection606. For example, theclient device102 may have moved out of range of the WiFi hotspot to which the client was connected. Theclient device102 identifies all currently-available connections. Theclient device102 also identifies one or more policies associated with the user. Theclient device102 then identifies properties of the network connection or connections and compares the network properties to the policy (rule). A network property may be, for example, quality of service measures, such as security, reliability, and speed may be utilized. Theclient device102 may also use cost or a combination of cost and a plurality of other properties in making the determination. In one embodiment, theclient device102 applies a normalization algorithm to the plurality of properties to come up with a single number for each network connection. Theclient device102 then compares the single numbers to determine to which network to connect.

Using either the most recently used connection or the newly-identified connection, the client device connects to the policy server (402)608. For instance, theclient device102 may connect to the most recently used WiFi hotspot and then establish a connection with thepolicy server402 and theQoS server310 over the Internet.

Once theclient device102 has established a connection with the network, the client device uploads QoS data to the QoS server (310)610. In one embodiment, QoS data from the previous session is uploaded at the start of the current session so that interruptions in service, such as a lost connection, can be accurately tracked.

The client device next downloads the latest policy data from the policy server (402)612. The policy data may comprise only changes since the last connection. For example, theclient device102 may store a last download date and only download policies from thepolicy server402 that have been created or changed since the last update date. The client device may download other information as well. For instance, the administrator may determine that aparticular client device102 has been stolen and set an indicator to cause the client device to encrypt data on its hard drive. When theclient device102 connects, it downloads the indicator.

The process may be transparent to the user. In one embodiment, the download process runs as a service. Each time theclient device102 starts up, the process executes. The process may also include having theclient device102 connect to a VPN automatically so that the user can access enterprise applications.

FIG. 7 is a flowchart illustrating a method for changing a network connection while downloading data in one embodiment of the present invention. In the embodiment shown, theconnection manager210 receives an indication to changenetwork connections702. The indication may be due to an identification of a newly available network, a manual selection by a user, or some other indication. For instance, a hardware device, such as a cellular data card, may indicate that a new connection is available. The user receives the indication and decides to change to the new network and clicks a button on a user interface, indicating the desire to change.

In one embodiment, theconnection manager210 identifies a new network. The connection manager then compares a first property of the currently connected (existing) network to a first property of the second new network. The properties may signify the same or similar information about the two networks, e.g., the type of network. Based on policies, theconnection manager210 determines to which network to connect.

In one embodiment, theconnection manger210 rules engine makes connection decisions based on six core pieces of data for connection that is physically available (the correct device is installed and operating, and a signal is available):

- (1) Is the connection allowed for this user;
- (2) How secure is the connection deemed to be;
- (3) How reliable is the connection deemed to be;
- (4) How fast is the connection deemed to be;
- (5) How expensive is the connection relative to others for the enterprise; and
- (6) How expensive is the connection relative to others for a service provider, such as a network security service provider?

Item (1) in this list is specified based on whether or not the connection is available to the enterprise in general and whether the enterprise has made the connection available to the user (or, more precisely in some implementations, not barred the user from the connection). Item (2) is based on enterprise preference indication. It could also be based on attack detection algorithms automatically applied, e.g., if relatively more attacks on a specific type of connection or specific location are detected, then relatively more attacks are occurring.

Item (3) is based on connection statistics. In one such embodiment, the enterprises has the option to indicate perceived relative reliability measures. Item (4) is also based on connection statistics. Item (5) is based on the pricing plan that the enterprise has entered into with the provider. And item (6) is based on carrier pricing arrangements and usage assumptions for various connections.

One embodiment of the present invention takes each of these six items and uses a normalization algorithm to work these elements (with their relative strengths) into a “weighting” within a range. Then, the rules engine on theclient device102 simply selects the connection with the highest weighting.

In some cases, despite the rules based analysis, an enterprise may not wish for a user to use a specific connection for a given, short period of time. In one embodiment, the system allows the enterprise to specifically exclude a connection for a short time.

Before disconnecting, theconnection manager210 sends a signal to thesession persistence server316 to suspend any currentlyactive data transfer704. By suspending data transfer, theconnection manager210 helps to eliminate the potential for losing data.

Theconnection manager210 then disconnects theclient device102 from the network (108)706. The process for disconnecting may differ between various networks. During the period when theclient device102 is disconnected, thesession persistence server316 caches data. After a period of time, which may be very brief, theconnection210 manager attempts to reconnect to anetwork708. Thenetwork108 may be the most recently used network or may be a newly identified network. The connection may be dropped for a period of time. In one embodiment, a user may specify the duration that the user expects to be disconnected when the disconnect occurs. Thepersistence server316 uses this information to determine how much data to cache during the period of disconnection.

Theconnection manager210 orpersistence server316 then determines whether the download that was occurring before the disconnect should continue710. For instance, theconnection manager210 may determine that the new connection is too slow to support the data download. Theconnection manager210 may also look to the policies to determine what rules apply to the connection.

If the download, should continue, theconnection manager210 resumes thedata transfer712. The data transfer may then complete or may be subject to subsequent disconnects. If the new network is not suitable to support the download, or if the download is complete, the process ends714.

For example, in one embodiment, a salesperson needs to download a large document containing a price list. The salesperson's computer is currently connected via a wide area network connection, which is relatively slow. The salesperson enters a coffee shop that the salesperson knows has a high speed WiFi connection.

When theclient device102 indicates that the WiFi connection is available, the user indicates that theclient device102 should change networks. The client device seamlessly connects to the WiFi network and, based on rules established in the policies, begins downloading the document. If the user must leave the coffee shop before the download is complete, theconnection manager210 can signal thesession persistence server316 to pause the download until the user reenters the coffee shop or connects to another high-speed network.

In one embodiment, session persistence operates on the following process: when a disconnection event occurs, theconnection manager216 buffers application data coming to theclient device102, making applications “believe” that they are still connected. At the same time,session persistence server216 buffers information on the server side, making theserver104 “believe” that it is still connected. Once a network connection has been reconnected, theconnection manager210 andsession persistence server316 empty the buffers that have built up on both sides.

One such embodiment implements a kernel mode driver at the NDIS layer in the Microsoft Protocol stack (roughly equivalent to layer 3 in the OSI model). This kernel mode driver is implemented as an “Intermediate Driver” on the Microsoft W2K/WXP operating systems. The driver acts as a single “virtual device” through which all network communications goes. This single device routes this traffic to the appropriate physical device (directed through a virtual device associated with a third-party VPN when appropriate), depending on the current physical connection.

In order to make application layer components believe that a network is still up and running, no “disconnect” signal is transmitted to the application layer components when a network interruption occurs. In this way, application layer components treat the connection as if it is simply slow.

The primary interface component between theclient102 andserver104 in such an embodiment is an indication that a client will be disconnecting for a long period of time, but wishes to persist the session over this extended time. In this case, theclient102 provides the user a means to enter the time that the system will be un-connected (say for the duration of a domestic flight), and the client notifies the server of the expected length of the disconnection event.

On theserver104, thesession persistence server316 functions as a proxy for connections from clients to network resources. Be those resources at the enterprise data center or public resources. The server implementation includes a similar intermediate driver architecture to that on the client, combined with application layer components to manage caching locations and recording for billing purposes. There may be cases where enterprises wish caching to occur at the enterprise. In this case, the system allows for the cache to be on the other side of a static tunnel to the enterprise.

General

The foregoing description of the embodiments of the invention has been presented only for the purpose of illustration and description and is not intended to be exhaustive or to limit the invention to the precise forms disclosed. Numerous modifications and adaptations thereof will be apparent to those skilled in the art without departing from the spirit and scope of the present invention.