Network device configuration

• US 8,171,143 B2
• Filed: 12/01/2003
• Issued: 05/01/2012
• Est. Priority Date: 12/24/2002
• Status: Active Grant

• Current Assignee: MAKO Networks
• Original Assignee: Yellowtuna Holdings Limited
• Inventors: Monks, Dennis Warren, Massam, Christopher James
• Primary Examiner(s): Bates, Kevin
• Assistant Examiner(s): MCADAMS, BRAD
• Application Number:
  US10/540,328
• Publication Number:
  US 20060168238A1
• Time in Patent Office: 3,074 Days
• Field of Search: 709/219, 709/220, 709/227, 709/229
• US Class Current: 709/227
• CPC Class Codes: H04L 12/2898 Subscriber equipments DSL modems H04M11/062; cable modems H04L12/2801
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0856 by backing up or archiving configuration information
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A network device initially has no configuration data and is permitted only to query a known network address. From this address a server verifies the connection and authorizes another server to download to the network device the necessary configuration to carry out its purpose. This configuration may not be amended and is not retained on power loss. Any updates are carried out by a complete reload of configuration data.

Claims

1. A method of providing a VPN communication between two or more network devices of unknown network address at least a first one of which network devices does not initially know the other network devices internet network addresses, the method comprising:

providing a verification authority connected to the internet remote from the two or more network devices and remote from an internet service provider providing an internet connection to each of the two or more network devices, the verification authority verifying the identity of the two or more internet network devices;

providing a configuration server connected to the internet remote from the two or more network devices and remote from the internet service provider providing an internet connection to each of the two or more network devices, the configuration server supplying to each verified internet device the entire configuration data for that verified internet device;

providing each of the two or more network devices free of provision to permanently store the user configuration data, each of the devices containing configuration information only sufficient to connect the devices to the internet service provider to request a first IP address, and using that first IP address to connect to the remote verification authority at a designated internet address, providing within each of the two or more network devices, a routine which securely contacts the remote verification authority, providing the identity of the network device, and using the designated internet address of that remote verification authority, and subsequently downloading from a remote configuration authority authorized by the remote verification authority the entire configuration data each time the device is initialized, for one of the two or more internet network devices, each time that device is initialized, reloading that device with the downloaded configuration data, each of the two or more network devices creating a private network in a downlink separate from end user devices in the created private network; and

storing the allocated internet network address of the network device at the verification authority,

repeating the process for each of the other network devices so that each of the other network devices downloads from the remote configuration server authorized by the remote verification authority the entire configuration data for that particular internet network device each time that particular device is initialized and reloading that particular device with the downloaded configuration data, and storing the allocated internet network address for that particular device at the verification authority, and initiating a VPN communication between two or more of the network devices, by sending an instruction from the verification authority to one of the network devices by supplying to that network device the allocated internet address of at least one of the other network devices so that the recipient internet device can communicate with the other network device.

2. The method as claimed in claim 1, wherein the two or more network devices are routers.

3. The method as claimed in claim 1, wherein the routers form part of ADSL modems.

4. The method as claimed in claim 1, wherein the configuration data is downloaded as a single transaction.

5. The method as claimed in claim 1, wherein the configuration data is lost when the network device loses power.

6. The method as claimed in claim 4, wherein the configuration data remains unchanged for the duration of the network devices powered on cycle.

7. The method as claimed in claim 4, wherein the configuration data is only downloaded upon a power up sequence.

8. A method of providing a VPN communication over the internet between two or more internet network devices having an allocated or other internet address at least a first one of which network devices does not initially know the other network devices internet network addresses, the method comprising:

providing a remote authority connected to the internet remote from the one or more network devices and remote from an internet service provider providing an internet connection to each of the two or more network devices, the verification authority verifying the identity of the one or more internet network devices; and

requiring each of the network devices to communicate with the remote authority to inform the remote authority of the current public IP address of the network device, and storing the current public IP address of each network device at the remote authority,

wherein a VPN can be initiated from the remote authority by sending a request to at least one of the network devices to connect to another of the network devices by sending to the at least one network device the current public IP addresses of the other network devices to which the at least one network device is to be connected,

wherein each of the two or more network devices free of any means to permanently store its private configuration data instead is provided with configuration information only sufficient to contact only the internet service provider to request a first IP address, and using that first IP address to connect to the remote authority at a designated internet network address of the remote authority, and subsequently downloading from a remote configuration service authorized by the remote authority the entire configuration details and software for the specific internet network device each time the device is initialized, each of the two or more network devices creating a private network in a downlink separate from end user devices in the created private network.

9. A method as claimed in claim 8, wherein a user sends a request via secure internet access to the remote authority to create a VPN between some or all of the network devices whose addresses have been stored at the remote authority.

10. A method as claimed in claim 9, wherein each of the two or more network devices communicate with the remote authority on schedule to send statistics for storage and analysis.

11. A method as claimed in claim 10, wherein each of the two or more network devices are routers.

12. A method as claimed in claim 11, wherein the routers form part of ADSL modems.

13. A method as claimed in claim 12, wherein the configuration details and software are downloaded as a single transaction.

14. A method as claimed in claim 13, wherein the configuration details and software are lost when the network device loses power.

15. A method as claimed in claim 14, wherein the configuration details and software remain unchanged for the duration of the network devices “

powered on”

cycle.

16. A method as claimed in claim 15, wherein the configuration details and software are only downloaded upon a power up sequence.

17. A method as claimed in claim 13, wherein the remote authority sends a code to at least one of the network devices which forces it to download the configuration details and software.

18. A method as claimed in claim 13, wherein the user configuration details and software can be changed by a user via a secure internet connection to the remote authority.