Increasing the level of automation when provisioning a computer system to access a network

• US 7,284,062 B2
• Filed: 12/06/2002
• Issued: 10/16/2007
• Est. Priority Date: 12/06/2002
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Moore, Timothy M., Guday, Shai, Krantz, Anton W., Bahl, Pradeep, Aboba, Bernard D., Abraham, Dalen M.
• Primary Examiner(s): Walsh; John B.
• Application Number:
  US10/313,084
• Publication Number:
  US 20040111520A1
• Time in Patent Office: 1,775 Days
• Field of Search: None
• US Class Current: 709/229
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A computer system attempts to authenticate with a server to gain authorization to access a first network. It is determined by the server that the computer system is not authorized to access the first network. The computer system is given authorization to access a second network for at least the purpose of downloading files (e.g., signup and configuration files) needed to access the first network. A user-interface for receiving user-entered signup information is automatically presented at the computer system. A first schema-based document including user-entered information is transferred to the server. If the server determines that the user-entered information is appropriate, a second-schema document, which includes an indication of authorization to access the first network (e.g., a user-identifier and password), is received. A third schema-based document is executed at the computer system to compatibly configure the computer system for accessing the first network.

Claims

1. In a computer system that is network connectable through an intermediary computer system to both a second network that includes a plurality of resources and to a first network that includes at least resources for provisioning the computer system to access the second network, the intermediary computer system determining whether data from the computer system is transferred to the first network or to the second network such that access to the first network can be allowed while access to the second network is restricted, the first network further including a server that can authorize computer systems to access the second network, a method of provisioning the computer system to access the second network so as to reduce user input, the method comprising the following:

an act of sending credentials to the server to attempt to authenticate with the server;

an act of automatically presenting a user-interface that can receive user-entered information so that a user of the computer system is not required to have prior knowledge of how to cause the user-interface to be presented;

an act of receiving user-entered information into the user-interface;

an act of submitting a first schema-based document that includes the user-entered information to the server;

an act of, subsequent to submitting the first schema-based document, receiving a second schema-based document that provides an indication that the server authorized the computer system to access resources located on the second network; and

an act of executing a third schema-based document to configure the computer system for accessing the second network so as to relieve a user from having to manually configure the computer system.

2. The method as recited in claim 1, wherein the act of sending credentials to the server comprises an act of sending credentials to an access point that is communicatively coupled to the server.

3. The method as recited in claim 1, wherein the act of sending credentials to the server comprises an act of sending an EAP message to the server.

4. The method as recited in claim 1, wherein the act of sending credentials to the server comprises an act of encapsulating an EAP message within an IEEE 802.1X message.

5. The method as recited in claim 1, wherein the act of sending credentials to the server comprises an act of associating a Tag Header with the credentials so as to indicate that the credentials are to be transferred to a virtual network that includes the server.

6. The method as recited in claim 1, wherein the act of sending credentials to the server comprises an act sending credentials to an Internet Protocol address that was exposed to the computer system by an Internet Protocol address filtering component.

7. The method as recited in claim 1, wherein the act of sending credentials to the server comprises an act of establishing a Virtual Private Network between the computer system and the first network.

8. The method as recited in claim 1, wherein the act of sending credentials to the server comprises an act of sending a User-Identifier.

9. The method as recited in claim 1, wherein the act of sending credentials to the server comprises an act of sending guest credentials.

10. The method as recited in claim 1, wherein the act of automatically presenting a user-interface that can receive user-entered information comprises an act of receiving a notification via EAP that includes a URI to a master provisioning document.

11. The method as recited in claim 1, wherein the act of automatically presenting a user-interface that can receive user-entered information comprises an act of receiving a TLV object via PEAP that includes a URI to a master provisioning document.

12. The method as recited in claim 1, wherein the act of automatically presenting a user-interface that can receive user-entered information comprises an act of receiving an EAP-notification that includes conditions that are to be satisfied to become authorized to access a virtual network that includes the plurality of resources.

13. The method as recited in claim 1, wherein the act of automatically presenting a user-interface that can receive user-entered information comprises an act of accessing a URI to download a master provisioning document.

14. The method as recited in claim 1, wherein the act of automatically presenting a user-interface that can receive user-entered information comprises an act of downloading a file from a virtual network that includes the server.

15. The method as recited in claim 1, wherein the act of automatically presenting a user-interface that can receive user-entered information comprises an act of processing a signup sub-file to cause the user-interface to be presented.

16. The method as recited in claim 1, wherein the act of automatically presenting a user-interface that can receive user-entered information comprises an act of presenting a renewal user-interface that includes user-entered information that was previously entered for a user.

17. The method as recited in claim 1, wherein the act of submitting a first schema-based document that includes user-entered information comprises submitting an XML document that is defined in accordance with an XML signup schema.

18. The method as recited in claim 1, wherein the act of receiving a second schema-based document that provides an indication that the server authorized the computer system to access the second network comprises an act of receiving a second XML document that is defined in accordance with an XML signup schema.

19. The method as recited in claim 1, wherein the act of receiving a second schema-based document that provides an indication that the server authorized the computer system to access resources located on the second network comprises an act of receiving a credentials that can be used to authenticate with the server.

20. The method as recited in claim 1, wherein the act of executing a third schema-based document to configure the computer system for accessing the second network comprises an act of executing an XML document defined in accordance with an XML configuration schema.

21. The method as recited in claim 1, wherein the act of executing a third schema-based document to configure the computer system for accessing the second network comprises an act of executing a schema-based document to configure the computer system to appropriately communicate with a wired network that is accessed through a wireless access point.

22. The method as recited in claim 1, wherein the act of executing a third schema-based document to configure the computer system for accessing the second network comprises an act of executing a schema-based document to configure the computer system to appropriately communicate with a DSL provider.

23. The method as recited in claim 1, wherein the act of executing a third schema-based document to configure the computer system for accessing the second network comprises an act of executing a schema-based document to configure the computer system to appropriately communicate with an ISP.

24. The method as recited in claim 1, wherein the act of executing a third schema-based document to configure the computer system for accessing the second network comprises an act of executing a schema-based document to configure the computer system to appropriately communicate with an Ethernet network.

25. The method as recited in claim 1, further comprising:

an act of, subsequent to sending the credentials, receiving an indication that the server has authorized limited access to the first network for purposes of downloading provisioning files needed to become authorized to access the plurality of resources located on the second network.

26. The method as recited in claim 1, further comprising:

an act of selecting an EAP type that is to be used for authentication.

27. In a computer system that is network connectable through an intermediary computer system to both a second network that includes a plurality of resources and to a first network that at least resources for provisioning the computer system to access the second network, the intermediary computer system determining whether data from the computer system is transferred to the first network or to the second network such that access to the first network can be allowed while access to the second network is restricted, the first network further including a server that can authorize computer systems to access second network, a method of provisioning the computer system to access the second network so as to reduce user input, the method comprising the following:

an act of sending credentials to the server to attempt to authenticate with the server;

an act of automatically presenting a user-interface that can receive user-entered information so that a user of the computer system is not required to have prior knowledge of how to cause the user-interface to be presented;

an step for requesting authorization to access resources located on the second network;

an act of, subsequent to submitting a first schema-based document, receiving a second schema-based document that provides an indication that the server authorized the computer system to access resources located on the second network; and

an act of executing a third schema-based document to configure the computer system for accessing the second network so as relieve a user from having to manually configure the computer system.

28. A computer program product for use in a computer system that is network connectable through an intermediary computer system to both a second network that includes a plurality of resources and to a first network that includes at least resources for provisioning the computer system to access the second network, the intermediary computer system determining whether data from the computer system is transferred to the first network or to the second network such that access the first network can be allowed while access to the second network is restricted, the first network further including a server that can authorize computer systems to access the second network, the computer program product for implementing a method of provisioning the computer system to access the second network so as to reduce user input, the computer program product comprising one or more computer-readable media having stored thereon computer-executable instructions that, when executed by a processor, cause the computer system to perform the following:

send credentials to the server to attempt to authenticate with the server;

present a user-interface that can receive user-entered information so that a user of the computer system is not required to have prior knowledge of how to cause the user-interface to be presented;

receive user-entered information into the user-interface;

submit a first schema-based document that includes the user-entered information to the server;

subsequent to submitting the first schema-based document, receive a second schema-based document that provides an indication that the server authorized the computer system to access resources located on the second network; and

execute a third schema-based document to configure the computer system for accessing the second network so as relieve a user from having to manually configure the computer system.

29. A computer program product as recited in claim 28, wherein computer-executable instructions that, when executed, cause the computer system to send credentials to the server to attempt to authenticate with the server further comprise computer-executable instructions that, when executed, cause the computer system to negotiate the type of authentication that will used by the computer system to authenticate with the server.

30. A computer program product as recited in claim 28, wherein computer-executable instructions that, when executed, cause the computer system to present a user-interface that can receive user-entered information further comprise computer-executable instructions that, when executed, cause computer the system to receive an EAP-notification.

31. A computer program product as recited in claim 28, wherein computer-executable instructions that, when executed, cause the computer system to execute a third schema-based document to configure the computer system for accessing the second network further comprise computer-executable instructions that, when executed, cause the computer system to execute an XML document defined in accordance with an XML configuration schema.

32. In a computer system that is network connectable through an intermediary computer system to both a first virtual network that provides a plurality of services and to a second virtual network that provides at least a subset of the plurality of services such that the intermediary computer system determines whether data from the computer system is transferred to the first virtual network or to the second virtual network, wherein a server connected to the second virtual network can provide update information for updating computer systems to access services on the first virtual network, a method of updating the computer system to access a service on the first virtual network so as to reduce user input, the method comprising the following:

an act of attempting to access a service on the first virtual network;

an act of automatically presenting an indication that the computer system is to be updated for compatible access with the service so that a user of the application is not required to have prior knowledge of how to update the computer system;

an act of receiving user-entered information indicating a desire to update the computer system;

an act of submitting a first schema-based document that includes the user-entered information to the server;

an act of, subsequent to submitting the first schema-based document, receiving a second schema-based document that includes update information for the computer system; and

an act of executing the second schema-based document to update the computer system so as to relieve a user from having to manually update the computer system.

33. The method as recited in claim 32, wherein the act of automatically presenting an indication that the computer system is to be updated for compatible access with the service comprises an act of receiving a notification via EAP that includes a URI to a master provisioning document.

34. The method as recited in claim 32, wherein the act of automatically presenting an indication that the computer system is to be updated for compatible access with the service comprises an act of receiving a TLV object via PEAP that includes a URI to a master provisioning document.

35. The method as recited in claim 32, wherein the act of automatically presenting an indication that the computer system is to be updated for compatible access with the service comprises an act of receiving an EAP-notification that includes conditions that are to be satisfied to become authorized to access the service.

36. The method as recited in claim 32, wherein the act of submitting a first schema-based document that includes the user-entered information to the server comprises an act of submitting an XML document that is defined in accordance with an XML schema.

37. The method as recited in claim 32 wherein act of, subsequent to submitting the first schema-based document, receiving a second schema-based document that includes update information for the computer system comprises an act of receiving a second XML document that is defined in accordance with an XML schema.

38. The method as recited in claim 32, further comprising:

an act of, subsequent to attempting to access the service, receiving an indication that the server has authorized limited access to the second virtual network for purpose of updating the computer system to access the first virtual network.

39. The method as recited in claim 32, further comprising:

an act of selecting an EAP type that is to be used for authentication with the first virtual network when attempting to access the service.

40. A computer program product for use in a computer system that is network connectable through an intermediary computer system to both a first virtual network that provides a plurality of services and to a second virtual network that provides at least a subset of the plurality of services such that the intermediary computer system determines whether data from the computer system is transferred to the first virtual network or to the second virtual network, wherein a server connected to the second virtual network can provide update information for updating computer systems to access services on the first virtual network, the computer program product of implementing a method of updating the computer system to access a service on the first virtual network so as to reduce user input, the computer program product comprising one or more computer-readable media having stored thereon computer-executable instructions that, when executed by a processor, cause the computer system to perform the following:

attempt to access a service on the first virtual network;

present an indication that the computer system is to be updated for compatible access with the service so that a user of the application is not required to have prior knowledge of how to update the computer system;

receive user-entered information indicating a desire to update the computer system;

submit a first schema-based document that includes the user-entered information to the server;

subsequent to submitting the first schema-based document, receive a second schema-based document that includes update information for the computer system; and

execute the second schema-based document to update the computer system so as to relieve a user from having to manually update the computer system.