Network demonstration techniques

• US 7,565,688 B2
• Filed: 12/23/2002
• Issued: 07/21/2009
• Est. Priority Date: 12/23/2002
• Status: Active Grant

• Current Assignee: Marqeta, Inc.
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Horstman, Robert E., Hall, Eric P.
• Primary Examiner(s): Smithers; Matthew B
• Assistant Examiner(s): GERGISO, TECHANE
• Application Number:
  US10/326,287
• Publication Number:
  US 20040122960A1
• Time in Patent Office: 2,402 Days
• Field of Search: 713/168, 726/5
• US Class Current: 726/5
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/06 Authentication

Abstract

Network demonstration techniques are disclosed which allow a fully-operational, secure wireless network to be implemented at a customer location. Using only a portable authentication server, a laptop computer, and at least two access points, a wireless network can be set up at the customer location within a matter of minutes, so that a user of a portable computing device having an appropriate network interface card is able to roam throughout the customer location with the benefit of a wireless connection to one of the access points. The laptop computer contains software integrating the functionality of a security server, a user authentication database, and other components necessary to implement the wireless network. The user may also be able to communicate with the laptop computer and authentication server from locations external to the customer location, perhaps using a wireless wide area network or secondary wireless local area network. Using the network demonstration and related information about the customer, accurate cost estimates for installing a company-wide wireless network can be generated.

Claims

1. A method of demonstrating a wireless network comprising:

transporting an authentication server to a customer location, the transported authentication server being operable to implement a user-specific and session-specific security policy for authenticating a user, the customer location comprising a proposed installation location for a wireless network;

transporting a security server to the customer location, the transported security server being operable to interact with the authentication server and a user database storing user-specific authentication information to implement the security policy;

prior to transporting the authentication server and the security server to the customer location, obtaining customer information including an available network address and the user-specific authentication information associated with the user;

creating a secure wireless network at the customer location using at least the transported authentication server and the transported security server;

activating a port on the authentication server; and

authenticating the user at the port on the authentication server, using the security server and a first portable computing device operated by the user, via a wireless connection to the secure wireless network.

2. The method of claim 1 wherein transporting the security server comprises integrating the security server and the user database onto a second portable computing device.

3. The method of claim 2 wherein integrating the security server and the user database comprises integrating a certificate authority onto the second portable computing device, the certificate authority operable to provide and validate a digital certificate for use in implementing the security policy.

4. The method of claim 2 wherein integrating the security server and the user database comprises integrating a network address assignment server onto the second portable computing device, the network address assignment server operable to assign a network address to the first portable computing device.

5. The method of claim 1 further comprising:

obtaining, for the customer location, a first connection location and a second connection location; and

transporting a first wireless access point and a second wireless access point for installation at the first connection location and the second connection location, respectively, such that the transported first access point and the transported second access point are in communication with the security server.

6. The method of claim 5 wherein the first portable computing device is operable to communicate with the first wireless access point, via a wireless network interface card, when the first portable computing device is within a pre-determined distance of the first wireless access point.

7. The method of claim 6 further comprising transporting the first portable computing device to the customer location with the network interface card pre-installed and pre-configured.

8. The method of claim 6 further comprising installing the network interface card on the first portable computing device, wherein the first portable computing device is supplied by the user.

9. The method of claim 1 further comprising storing the user-specific authentication information in the user database prior to transporting the authentication server and the security server to the customer location.

10. The method of claim 9 wherein authenticating the user comprises authenticating the user based on the network address and the user authentication information.

11. The method of claim 1 further comprising encrypting data traffic between the user and the security server that is subsequent to authenticating the user, using an encryption/decryption key.

12. The method of claim 11 wherein the encryption/decryption key is changed after a predetermined period of time.

13. The method of claim 11 wherein the encryption/decryption key is changed after a predetermined amount, of the data traffic has been transmitted.

14. The method of claim 11 wherein the encryption/decryption key is changed upon a beginning of a new session by the user.

15. The method of claim 14 wherein the beginning of the new session is defined by an ending of a first communication between the user and a first access point communicating with the security server and a beginning of a second communication between the user and a second access point communicating with the security server.

16. The method of claim 1 wherein the first portable computing device maintains the wireless connection to an access point located at a site external to the customer location.

17. The method of claim 16 wherein the access point located at the external site is a broadcasting tower implementing a wireless wide area network.

18. The method of claim 16 wherein the access point located at the external site is connected to the security server via a wide area network and through a gateway device at the customer location.

19. The method of claim 1 further comprising authenticating the user at the security server and via a gateway device located at the customer location, while the user is at a location external to the customer location.

20. The method of claim 1 further comprising implementing an automated method of pricing a potential wireless network based on the demonstrated wireless network and using a computer programmed with spreadsheet software, the automated method comprising:

inputting a first data set describing physical characteristics of the customer location into the spreadsheet software;

inputting a second data set describing existing network conditions at the customer location into the spreadsheet software;

inputting a third data set describing customer-desired characteristics of the potential wireless network into the spreadsheet software; and

estimating a cost for installing the potential wireless network, based on the first data set, second data set, and third data set.

21. The method of claim 1 further comprising connecting the created wireless network with a wired network existing at the customer location.

22. A system for demonstrating a wireless network at a remote location comprising:

a first portable access point;

a second portable access point;

a database containing user authentication information, the user authentication information pre-loaded into the database;

a portable authentication server operable to implement a user-specific and session-specific security policy;

a portable security server operable to interact with the database and the portable authentication server to activate a port on the portable authentication server; and

a first portable computing device including a wireless network interface card operable to communicate with the portable security server through the first portable access point and the second portable access point,

wherein a user of the portable computing device is authenticated at the port on the portable authentication server to a secure wireless network created at the remote location using the portable authentication server, the portable security server, and at least the access points, based on the pre-loaded user authentication information and the security policy, the remote location comprising a proposed installation location for a wireless network.

23. The system of claim 22 wherein the portable security server and the database are integrated onto a second portable computing device.

24. The system of claim 23 wherein a certificate authority is integrated onto the second portable computing device, and further wherein the certificate authority is operable to provide and validate a digital certificate for use in implementing the security policy.

25. The system of claim 23 wherein a network address assignment server is integrated onto the second portable computing device, and further wherein the network address assignment server is operable to assign a network address to the first portable computing device.

26. The system of claim 22 wherein data traffic between the user and the security server that is subsequent to authenticating the user is encrypted using an encryption key.

27. The system of claim 26 wherein the encryption key is changed after a predetermined period of time.

28. The system of claim 26 wherein the encryption key is changed after a predetermined amount of the data traffic has been transmitted.

29. The system of claim 26 wherein the encryption key is changed upon a beginning of a new session by the user.

30. The system of claim 22 wherein the first portable computing device maintains a wireless connection to an access point located at a site external to the portable security server and portable authentication server.

31. The system of claim 22 wherein the access point located at the external site is a broadcasting tower implementing a wireless wide area network.

32. The system of claim 22 wherein the access point located at the external site is connected to the portable security server via a wide area network and through a gateway device co-located with the portable security server and the portable authentication server.

33. The system of claim 22 wherein the user is authenticated at the security server and via a gateway device co-located with the portable security server and the portable authentication server, via a wide area network that is external to the gateway device.