System and method for providing secure network access

• US 20050149757A1
• Filed: 11/30/2004
• Published: 07/07/2005
• Est. Priority Date: 01/07/2004
• Status: Active Grant

• Current Assignee: Rovi Technologies Corporation (Adeia Inc.)
• Original Assignee: Microsoft Corporation
• Inventors: Nick, Benjamin E., Manchester, Scott A., Corbett, Christopher J., AbiEzzi, Salim S.
• Granted Patent: US 7,769,995 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/082 using revocation of authorisation

Abstract

Secure network access is provided by connecting a secure network provisioning device to a security authority, acquiring one or more network profiles, configuring one or more network interfaces of the secure network provisioning device with data corresponding to attributes of the acquired network profiles, switching the secure network provisioning device from an acquisition mode to a gateway mode, and connecting the secure network provisioning device to a client device. The secure network provisioning device includes a first set of network communication interfaces requiring configuration blocks to enable access to associated networks, a second set of network communication interfaces free from a requirement for configuration prior to network access, a communication interface gateway module configured to gate network traffic between network communication interfaces and a network profile acquisition module configured to acquire network profiles containing data required to configure the communication interfaces of the first set.

Claims

1. A computer-implemented method of providing secure network access, comprising:

connecting a secure network provisioning device to a security authority;

acquiring at least one network profile from the security authority;

configuring at least one network interface of the secure network provisioning device with data corresponding to attributes of said at least one network profile;

switching the secure network provisioning device from an acquisition mode to a gateway mode;

connecting the secure network provisioning device to a client device; and

for each of said at least one network profile, providing the client device with access to a secure network associated with the network profile.

2. The method of claim 1, further comprising, in response to a reset command:

erasing said at least one network profile from the secure network provisioning device; and

switching the secure network provisioning device from the gateway mode to the acquisition mode.

3. The method of claim 1, wherein at least one of said at least one network interface is a wireless network interface.

4. The method of claim 1, wherein connecting the secure network provisioning device to the security authority requires physical proximity of the secure network provisioning device and the security authority.

5. The method of claim 1, wherein connecting the secure network provisioning device to the client device requires physical proximity of the secure network provisioning device and the client device.

6. The method of claim 1, wherein the secure network provisioning device is connected to the security authority through a network interface independent of said at least one network interface.

7. The method of claim 6, wherein the secure network provisioning device is connected to the client device through the network interface independent of said at least one network interface.

8. The method of claim 7, wherein the network interface independent of said at least one network interface is a wire-line network interface.

9. The method of claim 7, wherein the secure network provisioning device presents as a plurality of computing devices, the plurality of devices comprising:

a secure network provisioning device ready to acquire network profiles when in the acquisition mode; and

a standard network interface when in the gateway mode.

10. The method of claim 9, wherein the network interface independent of said at least one network interface is a universal serial bus (USB) interface and presenting as a plurality of devices comprises enumerating different universal serial bus (USB) enumeration class identifiers in different modes.

11. A computerized system comprising:

a security authority; and

a secure network provisioning device, the secure network provisioning device comprising;

a first set of network communication interfaces, at least one of the first set of network communication interfaces requiring a configuration block to enable access to an associated network;

a second set of network communication interfaces, at least one of the second set of network communication interfaces free from a requirement for configuration prior to network access;

a communication interface gateway module configured to gate network traffic between network communication interfaces in the first and second sets of network communication interfaces; and

a network profile acquisition module configured to, at least;

acquire at least one network profile from the security authority; and

provide each configuration block required by each of said at least one of the first set of network communication interfaces, each configuration block corresponding to at least one of said at least one network profile acquired from the security authority.

12. The system of claim 11, wherein:

the secure network provisioning device has a plurality of operating modes, the plurality of operating modes comprising an acquisition mode and a gateway mode;

at least one of the first set of network communication interfaces is enabled when the secure network provisioning device is in the gateway mode;

at least one of the second set of network communication interfaces is enabled when the secure network provisioning device is in the acquisition mode and when the secure network provisioning device is in the gateway mode;

the communication interface gateway module is enabled when the secure network provisioning device is in the gateway mode; and

the network profile acquisition module is enabled when the secure network provisioning device is in the acquisition mode.

13. The system of claim 12, wherein the secure network provisioning device switches from the acquisition mode to the gateway mode after the network profile acquisition module provides each configuration block required by each of said at least one of the first set of network communication interfaces.

14. The system of claim 13, wherein, in response to a reset command, the secure network provisioning device:

erases said at least one network profile; and

switches from the gateway mode to the acquisition mode.

15. The system of claim 11, wherein the acquisition of said at least one network profile from the security authority occurs as a result of connecting the secure network provisioning device to the security authority through one of the second set of network communication interfaces.

16. The system of claim 11, wherein:

the system further comprises a client device; and

for each of said at least one network profile, the secure network provisioning device provides the client device with access to a secure network associated with the network profile.

17. The system of claim 16, wherein while providing said access, the secure network provisioning device is connected to the client device through one of the second set of network communication interfaces.

18. The system of claim 11, wherein:

each of the first set of network communication interfaces is a wireless communication interface; and

each of the second set of network communication interfaces is a wire-line communication interface.

19. The system of claim 11, wherein acquiring said at least one network profile from the security authority requires physical proximity of the secure network provisioning device and the security authority.

20. The system of claim 11, wherein:

the secure network provisioning device has a plurality of operating modes, the plurality of operating modes comprising an acquisition mode and a gateway mode;

said at least one of the second set of network communication interfaces is a universal serial bus (USB) communication interface; and

a universal serial bus (USB) enumeration class identifier enumerated for the secure network provisioning device while establishing a new communication connection depends upon the operating mode of the secure network provisioning device at that time.

21. A computer-readable medium having thereon computer-executable instructions for providing secure network access comprising:

managing at least one network profile associated with a secure network;

accepting a connection from a secure network provisioning device in an acquisition mode, the secure network provisioning device having a plurality of operating modes including the acquisition mode and a gateway mode; and

providing said at least one network profile to the secure network provisioning device, each network profile enabling the secure network provisioning device to provide a client device with access to the secure network associated with the network profile when the secure network provisioning device switches to the gateway mode.

22. The computer-readable medium of claim 21, wherein providing said at least one network profile to the secure network provisioning device comprises engaging in a network profile acquisition protocol with the secure network provisioning device.

23. The computer-readable medium of claim 22, wherein the secure network provisioning device switches from acquisition mode to gateway mode upon completion of the network profile acquisition protocol.

24. The computer-readable medium of claim 21, wherein access to each secure network requires valid authentication credentials.

25. The computer-readable medium of claim 21, wherein managing said at least one network profile comprises, for each network profile, at least one of creating, reading and updating the network profile.

26. The computer-readable medium of claim 21, further comprising recognizing the secure network provisioning device with plug-and-play (PnP).

27. The computer-readable medium of claim 21, wherein accepting the connection from the secure network provisioning device requires physical proximity of the secure network provisioning device and the computer-readable medium.

28. The computer-readable medium of claim 21, wherein providing the client device with access to the secure network requires physical proximity of the secure network provisioning device and the client device.

29. The computer-readable medium of claim 21, wherein:

the secure network provisioning device comprises a plurality of network interfaces;

providing access to the secure network comprises providing access through a first network interface of the plurality; and

accepting the connection from the secure network provisioning device comprises accepting the connection through a second network interface of the plurality.

30. The computer-readable medium of claim 29, wherein the second network interface is a wire-line network interface.

31. The computer-readable medium of claim 29, wherein the secure network provisioning device is capable of presenting as a plurality of computing devices, the plurality of devices comprising:

a secure network provisioning device ready to acquire network profiles when in the acquisition mode; and

a standard network interface when in the gateway mode.

32. The computer-readable medium of claim 31, wherein at least one of the plurality of network interfaces is a universal serial bus (USB) interface and presenting as the plurality of devices comprises enumerating different universal serial bus (USB) enumeration class identifiers in different modes.

33. A computer-readable medium having thereon computer-executable instructions for providing secure network access comprising:

accepting a connection from a secure network provisioning device in a gateway mode, the secure network provisioning device having a plurality of operating modes including an acquisition mode and the gateway mode; and

accessing at least one secure network through the secure network provisioning device, each secure network requiring authentication credentials for access, the secure network provisioning device having been configured with the required authentication credentials while in the acquisition mode.

34. The computer-readable medium of claim 33, wherein for each secure network, the secure network provisioning device acquires a network profile for the secure network from a security authority, the network profile comprising the authentication credentials required to access the secure network.

35. The computer-readable medium of claim 34, wherein the secure network provisioning devices switches from the acquisition mode to the gateway mode after acquiring the network profile for each secure network.

36. The computer-readable medium of claim 33, wherein accepting the connection from the secure network provisioning device requires physical proximity of the secure network provisioning device and the computer-readable medium.

37. The computer-readable medium of claim 33, wherein:

the secure network provisioning device comprises a plurality of network interfaces;

accessing said at least one secure network comprises accessing said at least one secure network through at least one network interface of the plurality; and

accepting the connection from the secure network provisioning device comprises accepting the connection through at least one further network interface of the plurality.

38. The computer-readable medium of claim 37, wherein at least one of said at least one network interface comprises a wireless network interface.

39. The computer-readable medium of claim 37, wherein at least one of said at least one further network interface comprises a wire-line network interface.

40. The computer-readable medium of claim 37, wherein the secure network provisioning device is capable of presenting as a plurality of computing devices, the plurality of devices comprising:

a secure network provisioning device ready to acquire network profiles when in the acquisition mode; and

a standard network interface when in the gateway mode.

41. The computer-readable medium of claim 40, wherein at least one of the plurality of network interfaces is a universal serial bus (USB) interface and presenting as the plurality of devices comprises enumerating different universal serial bus (USB) enumeration class identifiers in different modes.