Systems and methods for automatically configuring and managing network devices and virtual private networks

• US 20060236095A1
• Filed: 02/14/2005
• Published: 10/19/2006
• Est. Priority Date: 02/14/2005
• Status: Active Grant

• Current Assignee: Anxebusiness Corporation (Open Text Corporation)
• Original Assignee: ETSEC, Inc. (Open Text Corporation)
• Inventors: Wobst, Olaf Alexander, Smith, Robert Douglas
• Granted Patent: US 7,373,661 B2
• Time in Patent Office: Days
• US Class Current: 713/153
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

Systems and methods are disclosed for automatically configuring, managing, and maintaining a network device or VPN using a public network such as the Internet. Initial configuration of a network device or VPN occurs upon a user entering minimal information via a simple HTML page. After receipt of this minimal information, the present invention automatically configures the network device or VPN without user intervention. Thereafter, a user may modify the network device or VPN configuration via an easy-to-use and easy-to-understand graphical user interface. Parameters are presented such that a user simply checks and unchecks boxes, or clicks on radio buttons, to configure network device parameters. Upon completion of the selection, the user clicks on save, and the configuration is automatically modified. In addition, upon a significant change to any network device, the changed network device automatically initiates reconfiguration of the network device or VPN with zero input from a user.

Claims

1-4. -4. (canceled)

5. A method for automatically creating a VPN, said method comprising the steps of:

receiving VPN data input by a user at a portal;

transmitting said VPN data from said portal to at least one management device;

creating at least two device configuration files at said at least one management device;

automatically establishing at least two first communications between said at least one management device and at least two network devices via at least one network connection of at least one network; and

transmitting said at least two device configuration files from said at least one management device to said at least two network devices via said at least one network connection;

analyzing each of said device configuration files locally at said at least two network devices to determine that reconfiguration of said network devices is required;

automatically establishing at least two second communications between said at least two network devices and said at least one management device via said at least one network connection;

receiving a request at said at least one management device from said at least two network devices for at least two VPN configuration files via said at least one network connection; and

transmitting said at least two VPN configuration files from said at least one management device to said at least two network devices via said at least one network connection;

wherein at least one VPN is automatically created upon local processing of said at least two device configuration files and said at least two VPN configuration files.

6. A method according to claim 5, wherein said VPN data includes at least two customer identifiers, at least two passwords, and a VPN name.

7. A method according to claim 5, wherein said method further comprises:

assigning at least one of the group consisting of a numerical identifier, a network address, a VPN position, and combinations thereof to said at least two network devices.

8. A method according to claim 7, wherein said numerical identifier is assigned to said at least two network devices based upon its respective order of entry to said VPN.

9. A method according to claim 7, wherein said network address is an Internet protocol address.

10. A method according to claim 5, wherein said network device is at least one of the group consisting of a broadband device, a router, a modem, a switch, a wireless gateway, and combinations thereof.

11. A method according to claim 5, said method further comprising the steps of:

encoding at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof; and

encrypting at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof;

wherein said encoding and said encrypting occur prior to transmission of at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof via said network.

12. A method according to claim 5, wherein said receiving of said VPN data input by said user at said portal includes the sub-steps of:

displaying at least one data input screen to said user via at least one of the group consisting of a network browser and an Internet browser; and

receiving said VPN data input by said user into said at least one data input screen at said portal via at least one of the group consisting of said network connection and an Internet connection;

wherein at least one of said data input screens prompts said user to perform at least one of the group consisting of selecting said VPN data from a predefined list of said VPN data, entering said VPN data in predefined user data fields, and combinations thereof.

13. A method according to claim 12, wherein at least one of said data input screens is provided by said portal.

14. A method according to claim 5, wherein said user data is input by said user via a user interface coupled to said network device.

15. A method according to claim 14, wherein said user interface is at least one of the group consisting of a personal computer, a personal data assistant, and a network-equipped appliance.

16. A method according to claim 14, wherein said coupling of said user interface to said network device is at least one of the group consisting of a cable, an Ethernet cable, a wireless connection, a local area network, a wide area network, an Internet connection, and combinations thereof.

17. A method according to claim 5, wherein said network connection is at least one of the group consisting of a wireless connection, a cable connection, a digital subscriber line, a telephone line, and combinations thereof.

18. A method according to claim 5, wherein said network is at least one of the group consisting of an Internet, a wide area network, and combinations thereof.

19. A method according to claim 5, wherein a configuration transfer tool integral to said at least one management device creates and transmits at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof to said at least two network devices.

20. A method according to claim 5, wherein local processing of said at least two device configuration files and VPN configuration files includes the sub-steps of:

extracting configuration data from said at least two device configuration files and said at least two VPN configuration files; and

writing said configuration data to at least one storage location of said at least two network devices;

wherein at least one daemon executed by each of said at least two network devices retrieves and processes at least a portion of said configuration data contained in each of said storage locations.

21. A method according to claim 5, wherein said local processing of said at least two device configuration files and said at least two VPN configuration files includes the sub-steps of:

decrypting at least one of the group consisting of said at least two device configuration files, said at least two VPN configuration files, and combinations thereof;

decoding at least one of the group consisting of said at least two device configuration files, said at least two VPN configuration files, and combinations thereof;

extracting configuration data from said at least two device configuration files and said at least two VPN configuration files; and

writing said configuration data to at least one storage location of said at least two network devices;

wherein at least one daemon executed by each of said at least two network devices retrieves and processes at least a portion of said configuration data contained in each of said storage locations.

22. A method according to claim 5,

wherein said portal is a web portal;

and

wherein said at least one management device is a server.

23. A method according to claim 5, wherein said transmission of said VPN data from said portal to said at least one management device occurs via database replication.

24. A method according to claim 5, said method further comprising the step of:

authenticating at least one communication channel prior to said establishing of said first communication and said second communication between said at least one management device and said at least two network devices.

25. A method according to claim 24, wherein said authenticating is performed using at least one of the group consisting of IP security, secure sockets layer, passwords, digital certificates, smart cards, biometrics, dynamic biometrics, and combinations thereof.

26. A method according to claim 5,

wherein said portal includes at least one portal database;

wherein said at least one management device includes at least one management device database; and

wherein a change to one of the group consisting of said portal database and said management device database is copied to at least one of the group consisting of said portal database and said management device database via database replication.

27. A method according to claim 5,

wherein said at least one management device includes at least one management device database;

and

wherein a change to a first of said management device databases is copied to all remaining management device databases via database replication.

28. A method according to claim 5, wherein said VPN configuration parameter is at least one of the group consisting of a DHCP server parameter, a scope parameter, an address pool parameter, an exclusion range parameter, a lease parameter, and combinations thereof.

29. A method according to claim 5, wherein said configuration parameter is at least one of the group consisting of a VPN parameter, a network parameter, a wide area network parameter, a browsing parameter, an electronic mail parameter, an encryption parameter, a spam parameter, a virus protection parameter, a security parameter, a filtering parameter, an authentication parameter, and combinations thereof.

30. A method according to claim 5, said method further comprising the step of:

querying said at least two network devices to determine if said network device is enabled for inclusion in said VPN;

wherein said device configuration file and said VPN configuration file are transmitted to said network devices enabled for inclusion in said VPN; and

wherein said device configuration file and said VPN configuration file are not transmitted to said network devices not enabled for inclusion in said VPN.

31. A method according to claim 5, said method further comprising the step of:

displaying at least one of the group consisting of a numerical identifier of said network device, a description of said network device, a network address of said network device, a VPN position of said network device, a customer identifier of said network device, a VPN name, a subnet mask, and combinations thereof to said user.

32. A method according to claim 5, wherein said portal and said at least one management device are a single device.

33. A method according to claim 5, wherein one of said at least one management devices is a master device.

34. A method according to claim 33, wherein said portal and said master device are a single device.

35. A method according to claim 5, wherein at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof is created using at least one of the group consisting of a scripting language, a shell command, a batch file, and combinations thereof.

36. A method according to claim 35, wherein said scripting language is selected from the group consisting of PHP Hypertext Processor, Practical Extraction Report Language, Active Server Page, Digital Command Language, and combinations thereof.

37. A method according to claim 35, wherein said scripting language executes the following steps:

verifying a current directory;

retrieving a filename for one of said at least two device configuration files;

establishing a connection to a database of one of said at least one management device;

retrieving current data from said database; and

writing said current data to at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof.

38. A method according to claim 35, wherein said scripting language executes the following steps:

establishing a connection to at least one database of said at least one management device by providing at least one name, at least one username, and at least one password to said at least one management device;

retrieving current data for each of said network devices in said VPN from said at least one database;

retrieving said current data of said network devices having equivalent VPN mesh identifiers;

setting a configuration file path;

writing said current data to a file in said configuration file path; and

copying said current data to said VPN configuration file.

39. A method according to claim 5, wherein said VPN configuration file is requested by a network device configuration transfer tool.

40. A method according to claim 5, wherein said network devices of said VPN are automatically updated upon a change to one of said network devices of said VPN.

41. A method according to claim 40, wherein said change includes a change to an external address of said network device.

42. A method for automatically reconfiguring a VPN, said method comprising the steps of:

receiving VPN data input by a user at a portal;

transmitting said VPN data from said portal to at least one management device;

creating at least one device configuration file at said at least one management device;

automatically establishing at least one first communication between said at least one management device and at least one network device via at least one network connection of at least one network; and

transmitting said at least one device configuration file from said at least one management device to said at least one network device via said at least one network connection;

analyzing each of said at least one device configuration files locally at said at least one network devices to determine whether reconfiguration of said network device is required and, if said reconfiguration of said network device is required, performing the sub-steps of;

automatically establishing a second communication between said network device and said management device via said network connection;

receiving a request at said management device from said network device for a VPN configuration file via said network connection; and

transmitting said VPN configuration file from said management device to said network device via said network connection;

wherein at least one VPN is automatically reconfigured upon local processing of at least one of said device configuration file, said VPN configuration file, and combinations thereof.

43. A method according to claim 42, wherein said VPN data includes at least one customer identifier, at least one password, and a VPN name.

44. A method according to claim 42, wherein said method further comprises:

assigning at least one of the group consisting of a numerical identifier, a network address, a VPN position, and combinations thereof to said at least one network device.

45. A method according to claim 44, wherein said numerical identifier is assigned to said at least one network device based upon its respective order of entry to said VPN.

46. A method according to claim 44, wherein said network address is an Internet protocol address.

47. A method according to claim 42, wherein said network device is at least one of the group consisting of a broadband device, a router, a modem, a switch, a wireless gateway, and combinations thereof.

48. A method according to claim 42, said method further comprising the steps of:

encoding at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof; and

encrypting at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof;

wherein said encoding and said encrypting occur prior to transmission of at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof via said network.

49. A method according to claim 42, wherein said receiving of said VPN data input by said user at said portal includes the sub-steps of:

displaying at least one data input screen to said user via at least one of the group consisting of a network browser and an Internet browser; and

receiving said VPN data input by said user into said at least one data input screen at said portal via at least one of the group consisting of said network connection and an Internet connection;

wherein at least one of said data input screens prompts said user to perform at least one of the group consisting of selecting said VPN data from a predefined list of said VPN data, entering said VPN data in predefined user data fields, and combinations thereof.

50. A method according to claim 49, wherein at least one of said data input screens is provided by said portal.

51. A method according to claim 42, wherein said user data is input by said user via a user interface coupled to said network device.

52. A method according to claim 51, wherein said user interface is at least one of the group consisting of a personal computer, a personal data assistant, and a network-equipped appliance.

53. A method according to claim 51, wherein said coupling of said user interface to said network device is at least one of the group consisting of a cable, an Ethernet cable, a wireless connection, a local area network, a wide area network, an Internet connection, and combinations thereof.

54. A method according to claim 42, wherein said network connection is at least one of the group consisting of a wireless connection, a cable connection, a digital subscriber line, a telephone line, and combinations thereof.

55. A method according to claim 42, wherein said network is at least one of the group consisting of an Internet, a wide area network, and combinations thereof.

56. A method according to claim 42, wherein a configuration transfer tool integral to said at least one management device creates and transmits at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof to said at least one network device.

57. A method according to claim 42, wherein local processing of at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof includes the sub-steps of:

extracting configuration data from at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof; and

writing said device configuration data to at least one storage location of said at least one network device;

wherein at least one daemon executed by each of said at least one network device retrieves and processes at least a portion of said configuration data contained in each of said storage locations.

58. A method according to claim 42, wherein said local processing of at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof includes the sub-steps of:

decrypting at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof;

decoding at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof;

extracting configuration data from at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof; and

writing said device configuration data to at least one storage location of said at least one network device;

wherein at least one daemon executed by each of said at least one network device retrieves and processes at least a portion of said configuration data contained in each of said storage locations.

59. A method according to claim 42,

wherein said portal is a web portal;

and

wherein said at least one management device is a server.

60. A method according to claim 42, wherein said transmission of said VPN data from said portal to said at least one management device occurs via database replication.

61. A method according to claim 42, said method further comprising the step of:

authenticating at least one communication channel prior to said establishing of at least one of said first communication, said second communication, and combinations thereof between said at least one management device and said at least one network device.

62. A method according to claim 61, wherein said authenticating is performed using at least one of the group consisting of IP security, secure sockets layer, passwords, digital certificates, smart cards, biometrics, dynamic biometrics, and combinations thereof.

63. A method according to claim 42,

wherein said portal includes at least one portal database;

wherein said management device includes at least one management device database; and

wherein a change to one of the group consisting of said portal database and said management device database is copied to at least one of the group consisting of said portal database and said management device database via database replication.

64. A method according to claim 42,

wherein said at least one management device includes at least one management device database;

and

wherein a change to a first of said management device databases is copied to all remaining management device databases via database replication.

65. A method according to claim 42, wherein said VPN configuration parameter is at least one of the group consisting of a DHCP server parameter, a scope parameter, an address pool parameter, an exclusion range parameter, a lease parameter, and combinations thereof.

66. A method according to claim 42, wherein said configuration parameter is at least one of the group consisting of a VPN parameter, a network parameter, a wide area network parameter, a browsing parameter, an electronic mail parameter, an encryption parameter, a spam parameter, a virus protection parameter, a security parameter, a filtering parameter, an authentication parameter, and combinations thereof.

67. A method according to claim 42, said method further comprising the step of:

querying said at least one network device to determine if said network device is enabled for inclusion in said VPN;

wherein at least one of said device configuration file, said VPN configuration file, and combinations thereof are transmitted to said network devices enabled for inclusion in said VPN; and

wherein said device configuration file and said VPN configuration file are not transmitted to said network devices not enabled for inclusion in said VPN.

68. A method according to claim 42, said method further comprising the step of:

displaying at least one of the group consisting of a numerical identifier of said network device, a description of said network device, a network address of said network device, a VPN position of said network device, a customer identifier of said network device, a VPN name, a subnet mask, and combinations thereof to said user.

69. A method according to claim 42, wherein said reconfiguration of said VPN includes at least one of the group consisting of deleting said VPN, adding one of said network devices to said VPN, deleting one of said network devices from said VPN, and combinations thereof.

70. A method according to claim 42, wherein said portal and said management device are a single device.

71. A method according to claim 42, wherein one of said management devices is a master device.

72. A method according to claim 71, wherein said portal and said master device are a single device.

73. A method according to claim 42, wherein at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof is created using at least one of the group consisting of a scripting language, a shell command, a batch file, and combinations thereof.

74. A method according to claim 73, wherein said scripting language is selected from the group consisting of PHP Hypertext Processor, Practical Extraction Report Language, Active Server Page, Digital Command Language, and combinations thereof.

75. A method according to claim 73, wherein said scripting language executes the following steps:

verifying a current directory;

retrieving a filename for one of said at least one device configuration files;

establishing a connection to a database of one of said at least one management device;

retrieving current data from said database; and

writing said current data to at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof.

76. A method according to claim 73, wherein said scripting language executes the following steps:

establishing a connection to at least one database of said at least one management device by providing at least one name, at least one username, and at least one password to said at least one management device;

retrieving current data for each of said network devices in said VPN from said at least one database;

retrieving said current data of said network devices having equivalent VPN mesh identifiers;

setting a configuration file path;

writing said current data to a file in said configuration file path; and

copying said current data to said VPN configuration file.

77. A method according to claim 42, wherein said VPN configuration file is not required upon deletion of one of said network devices from said VPN.

78. A method according to claim 42, wherein said determining whether said VPN configuration file is required is performed by comparing at least one new VPN parameter to at least one previous VPN parameter.

79. A method according to claim 42, wherein said VPN configuration file is required whenever a VPN mesh identifier of a received one of said device configuration files is not equal to zero.

80. A method according to claim 42, wherein said VPN configuration file is requested by a network device configuration transfer tool.

81. A method according to claim 42, wherein said network devices of said VPN are automatically updated upon a change to one of said network devices of said VPN.

82. A method according to claim 81, wherein said change includes a change to an external address of said network device.

83. A method for remotely maintaining a VPN, said method comprising the steps of:

transmitting maintenance data to at least one management device;

creating at least one of the group consisting of a device configuration file, a VPN configuration file, and combinations thereof at said management device;

automatically establishing a communication between said management device and at least one of said network devices via at least one network connection of at least one network; and

transmitting at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof from said management device to said network device via said network connection;

wherein at least one parameter of at least one of said network device, said VPN, and combinations thereof is automatically configured upon local processing of at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof.

84. A method according to claim 83, wherein said maintenance data is at least one of the group consisting of virus definitions, block lists, policies, and firmware.

85. A method according to claim 83, wherein said network device is at least one of the group consisting of a broadband device, a router, a modem, a switch, a wireless gateway, and combinations thereof.

86. A method according to claim 83, said method further comprising the steps of:

encoding at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof; and

encrypting at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof;

wherein said encoding and said encrypting occur prior to transmission of at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof via said at least one network.

87. A method according to claim 83, wherein said maintenance data is input via a user interface coupled to said network device.

88. A method according to claim 87, wherein said user interface is at least one of the group consisting of a personal computer, a personal data assistant, and a network-equipped appliance.

89. A method according to claim 87, wherein said coupling of said user interface to said network device is at least one of the group consisting of a cable, an Ethernet cable, a wireless connection, a local area network, a wide area network, an Internet connection, and combinations thereof.

90. A method according to claim 83, wherein said network connection is at least one of the group consisting of a wireless connection, a cable connection, a digital subscriber line, a telephone line, and combinations thereof.

91. A method according to claim 83, wherein said network is at least one of the group consisting of an Internet, a wide area network, and combinations thereof.

92. A method according to claim 83, wherein a configuration transfer tool integral to said management device creates and transmits at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof to said network device.

93. A method according to claim 83, wherein said local processing of at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof includes the sub-steps of:

extracting configuration data from at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof; and

writing said configuration data to at least one storage location of said network device;

wherein at least one daemon executed by each of said at least one network device retrieves and processes at least a portion of said configuration data contained in each of said storage locations.

94. A method according to claim 83, wherein said local processing of at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof includes the sub-steps of:

decrypting at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof;

decoding at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof;

extracting configuration data from at least one of the group consisting of said device configuration file, said VPN configuration file, and combinations thereof; and

writing said configuration data to at least one storage location of said network device;

wherein at least one daemon executed by each of said at least one network device retrieves and processes at least a portion of said configuration data contained in each of said storage locations.

95. A method according to claim 83, said method further comprising the step of:

authenticating a communication channel prior to said establishing of said communication between said at least one management device and said at least one network device.

96. A method according to claim 95, wherein said authenticating is performed using at least one of the group consisting of IP security, secure sockets layer, passwords, digital certificates, smart cards, biometrics, dynamic biometrics, and combinations thereof.

97. A method according to claim 83, wherein said transmitting maintenance data to at least one of said management devices includes the sub-steps of:

transmitting said maintenance data to a master device; and

transmitting said maintenance data from said master device to said at least one management devices.