Methods and apparatus for providing security to a computerized device

• US 20040120260A1
• Filed: 12/18/2002
• Published: 06/24/2004
• Est. Priority Date: 12/18/2002
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Bolinger, Christopher R., Bernier, Mark, Nassar, Nizar, Tardif, Marc, Volpe, Victor, Rochefort, Dany J.
• Granted Patent: US 8,122,136 B2
• Time in Patent Office: Days
• US Class Current: 370/252
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/30 Profiles
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 76/10 Connection setup
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

When establishing a communications channel to a wireless network, through a wireless connection, a computerized device receives an Internet protocol (IP) address from a Dynamic Host Configuration Protocol (DHCP) server associated with the wireless network. The computerized device is configured with a table or list of IP addresses associated with wireless networks requiring a VPN or secure connection. The computerized device compares the IP address received from the DHCP server with the IP address entries of the table stored by the computerized device. If the computerized device detects a correspondence between the IP address received from the DHCP server and an IP address entry within the table, the computerized device automatically initiates a secure or VPN connection with the wireless network associated with the DHCP server. The computerized device therefore actively establishes a secure connection with the wireless network, prior to user login and without user intervention, based upon the computerized device being a client of the wireless network.

Claims

1. In a computerized device, a method for establishing a data connection to a first network comprising the steps of:

detecting network identification information for the computerized device, the network identification information transmitted from a network identification information source associated with the first network;

comparing the network identification information with at least one address entry, the at least one address entry indicating the corresponding first network requiring a secure data connection and corresponding to the network identification information; and

in response to detecting a correspondence between the network identification information and the at least one address entry, establishing a secure data connection with the first network.

2. The method of claim 1 further comprising the steps of:

monitoring for network identification information; and

in response to detecting network identification information while monitoring, performing the steps of comparing and establishing.

3. The method of claim 1 further comprising the steps of:

receiving updated network identification information for the computerized device from a network identification information source associated with a second network;

comparing the updated network identification information with at least one address entry, the at least one address entry indicating a corresponding second network requiring a secure data connection and corresponding to the updated network identification information; and

in response to detecting a correspondence between the updated network identification information and the at least one address entry, establishing a secure data connection with the second network.

4. The method of claim 1 further comprising, in response to establishing a secure data connection with the first network, the step of providing the user login access to the computerized device.

5. The method of claim 1 wherein the step of comparing further comprises the step of detecting a secure connection stop function and wherein the step of establishing a secure data connection with the first network comprises the step of establishing a non-secure data connection with the first network in response to detecting the secure connection stop function.

6. The method of claim 1 wherein the step of comparing further comprises the step of detecting a secure connection stop function and wherein the step of establishing a secure data connection with the first network comprises the step of preventing establishment of a data connection with the first network in response to detecting the secure connection stop function.

7. The method of claim 1 wherein the step of comparing further comprises the steps of:

in response to detecting a correspondence between the network identification information and the at least one address entry, detecting a profile entry, the profile entry mapped to secure connection instructions relating to establishment of a secure data connection between the computerized device and the first network; and

retrieving the secure connection instructions indicated by the profile entry.

8. The method of claim 1 wherein the step of establishing a secure data connection with the first network comprises the step of establishing a secure wireless data connection to the first network.

9. The method of claim 1 wherein, in response to detecting no correspondence between the network identification information and the at least one address entry, further comprising the step of establishing a non-secure data connection with the first network.

10. The method of claim 1 wherein, in response to detecting no correspondence between the network identification information and the at least one address entry, further comprising the step of preventing establishment of a data connection with the first network.

11. A computerized device comprising:

at least one communications interface;

a controller; and

an interconnection mechanism coupling the at least one communications interface and the controller;

wherein the controller is configured to;

detect network identification information for the computerized device, the network identification information transmitted from a network identification information source associated with the first network through the at least one communications interface;

compare the network identification information with at least one address entry, the at least one address entry indicating the corresponding first network requiring a secure data connection and corresponding to the network identification information; and

in response to detecting a correspondence between the network identification information and the at least one address entry, establish a secure data connection with the first network through the at least one communications interface.

12. The computerized device of claim 11 wherein the computerized device is further configured to:

monitor for network identification information; and

in response to detecting network identification information while monitoring, perform the steps of comparing and establishing.

13. The computerized device of claim 11 wherein the computerized device is further configured to:

receive updated network identification information for the computerized device from a network identification information source associated with a second network through the at least one communications interface;

compare the updated network identification information with at least one address entry, the at least one address entry indicating a corresponding second network requiring a secure data connection; and

in response to detecting a correspondence between the updated network identification information and the at least one address entry, establish a secure data connection with the second network through the at least one communications interface.

14. The computerized device of claim 11 wherein the computerized device is further configured to, in response to establishing a secure data connection with the first network, provide the user login access to the computerized device.

15. The computerized device of claim 11 wherein the computerized device, when comparing, is further configured to detect a secure connection stop function and wherein the computerized device, when establishing a secure data connection with the first network is further configured to establish a non-secure data connection with the first network through the at least one communications interface in response to detecting the secure connection stop function.

16. The computerized device of claim 11 wherein the computerized device, when comparing, is further configured to detect a secure connection stop function and wherein the computerized device, when establishing a secure data connection with the first network is further configured to prevent establishment of a data connection with the first network in response to detecting the secure connection stop function.

17. The computerized device of claim 11 wherein the computerized device is further configured to:

in response to detecting a correspondence between the network identification information and the at least one address entry, detect a profile entry, the profile entry mapped to secure connection instructions relating to establishment of a secure data connection between the computerized device and the first network; and

retrieve the secure connection instructions indicated by the profile entry through the at least one communications interface.

18. The computerized device of claim 11 wherein the computerized device is configured to, when establishing a secure data connection with the first network, establish a secure wireless data connection to the first network through the at least one communications interface.

19. The computerized device of claim 11 wherein, in response to detecting no correspondence between the network identification information and the at least one address entry, the computerized device is further configured to establish a non-secure data connection with the first network.

20. The computerized device of claim 11 wherein, in response to detecting no correspondence between the network identification information and the at least one address entry, the computerized device is further configured to prevent establishment of a data connection with the first network.

21. A computer program product having a computer-readable medium including computer program logic encoded thereon that, when performed on a controller in a computerized device having a coupling to at least one communications interface provides a method for performing the operations of:

detecting network identification information for the computerized device, the network identification information transmitted from a network identification information source associated with the first network through the at least one communications interface;

comparing the network identification information with at least one address entry, the at least one address entry indicating the corresponding first network requiring a secure data connection and corresponding to the network identification information; and

in response to detecting a correspondence between the network identification information and the at least one address entry, establishing a secure data connection with the first network through the at least one communications interface.

22. A computerized device comprising:

at least one communications interface;

a controller; and

an interconnection mechanism coupling the at least one communications interface and the controller;

wherein the controller is configured to produce a means for distributing content, such means including;

means for detecting network identification information for the computerized device, the network identification information transmitted from a network identification information source associated with the first network through the at least one communications interface;

means for comparing the network identification information with at least one address entry, the at least one address entry indicating the corresponding first network requiring a secure data connection and corresponding to the network identification information; and

means for establishing a secure data connection with the first network through the at least one communications interface in response to detecting a correspondence between the network identification information and the at least one address entry.

23. In a client computer, a method for establishing a data connection to an onsite, wireless local area network comprising the steps of:

detecting address information for the computerized device, the address information transmitted from a Dynamic Host Configuration Protocol sever associated with the wireless network;

comparing the address information with at least one address entry in an initiation information table, the at least one address entry indicating the corresponding wireless network requiring a secure data connection and corresponding to the address information; and

in response to detecting a correspondence between the network identification information and the at least one address entry in the initiation information table, performing an autoinitiation procedure to establish a secure data connection with the wireless network.

24. A computerized device comprising:

at least one communications interface;

a controller; and

an interconnection mechanism coupling the at least one communications interface and the controller;

wherein the controller is configured to;

detect address information for the computerized device, the address information transmitted from a Dynamic Host Configuration Protocol sever associated with the wireless network;

compare the address information with at least one address entry in an initiation information table, the at least one address entry indicating the corresponding wireless network requiring a secure data connection and corresponding to the address information; and

in response to detecting a correspondence between the network identification information and the at least one address entry in the initiation information table, perform an autoinitiation procedure to establish a secure data connection with the wireless network.