System and method for automatically configuring remote computer

• US 7,844,718 B2
• Filed: 02/22/2007
• Issued: 11/30/2010
• Est. Priority Date: 05/14/2002
• Status: Active Grant

• Current Assignee: VPN Technology Holdings LLC
• Original Assignee: Andrew J. Polcha, Michael P. Polcha
• Inventors: Polcha, Michael P., Polcha, Andrew J.
• Primary Examiner(s): Mesfin; Yemane
• Application Number:
  US11/709,355
• Publication Number:
  US 20080034200A1
• Time in Patent Office: 1,377 Days
• Field of Search: 709/220, 709/221, 709/222, 709/227, 709/229, 726/2, 726/3, 726/5, 726/15, 717176-178
• US Class Current: 709/229
• CPC Class Codes: G06F 21/305 by remotely controlling device operation
• CPC Class Codes: G06F 9/44505 Configuring for program initiating, e.g. using registry, configuration files
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 41/0853 by actively collecting configuration information or by backing up configuration information
• CPC Class Codes: H04L 41/0883 Semiautomatic configuration, e.g. proposals from system
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A system and method for automatically configuring a remote computer to establish a VPN connection with a network is disclosed. According to the system and method, a configuration generator determines information necessary for the remote computer to establish the VPN connection, and generate an executable file to be run the remote computer. When run on the remote computer, the executable file automatically updates the remote computer'"'"'s configuration settings so as to enable it to establish the connection with the network. The information required by the configuration generator can either be extracted from a database automatically, or can be keyed in by a network administrator.

Claims

1. A method of configuring a remote computer to access a network of computers, comprising:

initiating, at a network administrator computer of the network of computers, an installer program having an empty binary file, the installer program being configured to generate an executable file using the binary file when the empty binary file is populated;

accessing, at the network administrator computer, a network database using a user data application to extract configuration data that represents binary settings of a network topology and binary settings of the remote computer;

applying, at the network administrator computer, the binary settings of the network topology and the binary setting of the remote computer to code a Remote Access Service (RAS) Application Programming Interface (API) to generate a configuration data binary file and prescribed RAS settings;

embedding, at the network administrator computer, the configuration data binary file as instructions in the RAS API;

replacing the empty binary file of the installer program with the configuration data binary file and generating the executable file using the configuration data binary file;

deploying the executable file comprising the configuration data binary file from the network to the remote computer;

executing the executable file on the remote computer to modify configuration settings of the remote computer by installing the prescribed RAS settings to edit RAS files of an operating system of the remote computer such that the remote computer is configured to establish a VPN connection to access the network;

configuring at the remote computer the RAS API as a connection application software;

configuring at the remote computer the executable file as a self-deleting file;

the step of executing the executable file further comprises;

executing on the remote computer the executable file such that the RAS API functions as the connection application software that issues instructions to the remote computer to establish the VPN connection with the network;

before establishing the VPN connection with a VPN server of the network, creating a connection profile that the RAS API is configured to provide to the operating system of the remote computer when the executable file is executed, wherein the connection profile contains information regarding at least one of an IP address, an address for a gateway, a DNS address, a WINS address, a DHCP address, and a NAT address;

coding WAN login credentials and automatically transmitting the WAN login credentials from the remote computer to the VPN server of the network when executing the executable file;

coding LAN login credentials and automatically transmitting the LAN login credentials from the remote computer to a domain controller of the network when executing the executable file;

wherein the WAN and the LAN login credentials are coded in a manner that the WAN and LAN login credentials are unknown to the user in order to prevent the user from becoming aware of the code of the WAN and LAN login credentials; and

automatically deleting the executable file from the remote computer after terminating the VPN connection.

2. The method of claim 1, wherein the executable file is e-mailed to the remote computer to be executed on the remote computer.

3. The method of claim 1, further comprising storing the executable file on a computer readable medium prior to execution of the executable file to provide the executable file to the remote computer for execution.

4. The method of claim 3, wherein the computer readable medium comprises a universal serial bus (USB) data storage peripheral having first and second storage areas, the first area being an electronically erasable read-only memory (EEPROM) storage area and the second storage area being a flash RAM storage area.

5. The method of claim 4, wherein the first storage area is a secure storage area which is accessible to a user of the USB data storage peripheral, and wherein the second storage area comprises a general storage area, which emulates a disk/hard drive, wherein the executable file is stored in the second storage area.

6. The method of claim 5, wherein an encryption key is stored in the first storage area, and wherein the executable file searches the first storage area for a prescribed authentication key before it can be executed by a user of the remote computer.

7. The method of claim 6, wherein the modified configuration settings of the remote computer comprise a setting that requires the remote computer to access the first storage area of the USB data storage peripheral prior to accessing the network.

8. The method of claim 6, wherein the remote computer cannot access the network if the encryption key within the first storage area cannot be accessed by the remote computer.

9. The method of claim 1, wherein the configuration data binary file comprises at least one of an IP address of a router coupled to the network of computers, a gateway address of the router, at least one DNS address, and at least one WINS address.

10. The method of claim 9, wherein the configuration data binary file further comprises at least one login and password necessary for the remote computer to access the network of computers.

11. The method of claim 1, wherein the user data application is configured to run with at least one of a commercial database application, a commercial spreadsheet application, and a commercial word processor application.

12. The method of claim 1, wherein executing the executable file on the remote computer further comprises manipulating a RAS phonebook to modify registry entries of the remote computer.

15. The method of claim 1, further comprising:

creating a custom VPN connection software application based on the configuration data;

encrypting and embedding VPN login credentials into the custom VPN connection software application, wherein the VPN login credentials are encrypted and embedded in a manner that the VPN credentials are hidden and protected from the user in order to prevent the user from establishing the VPN connection using a different connection mechanism; and

providing application-based VPN connections using the custom VPN connection software application, instead of user-based connections, to establish the VPN connection in order to protect and secure proprietary data of the network by preventing the remote computer from directly gaining access to resources and data of the network.

16. The method of claim 15, further comprising:

embedding the LAN login credentials into a connection software application;

configuring the connection software application to provide additional levels of access control to the VPN connection software application when the VPN connection is established, wherein the additional levels of access control restrict login attempts to connections that have been validated by the VPN server; and

configuring the WAN credentials of the VPN login credentials to provide additional security measures during the VPN connection and to provide different access experiences on the network to different users accessing the network, wherein network access control tools manage the access experiences provided to the different users by the network.

17. The method of claim 16, wherein the custom VPN connection software application comprises at least one of a dialer, the executable file, and a combination of the dialer and the executable file, and the connection software application comprises the executable file built on the network administrator computer and configured to leverage the RAS API on the remote computer.

18. The method of claim 17, further comprising:

generating a binary data resource by attaching custom and encrypted data to generic executable code;

automating customization of the custom VPN connection software application by attaching the binary data resource to the executable file, wherein the binary data resource can be either;

attached within the executable file using Windows API;

or

provided in a separate file that is attached to the executable file such that the custom and encrypted data is completely separate from the generic executable code, and the custom and encrypted data is configured to be available to the generic executable code when required through calls to the Windows API;

including, in the custom VPN connection software application, a decrypting mechanism to decrypt the custom and encrypted data from the binary data resource; and

embedding, using the network database, local and internal run-time user authentication mechanisms within the custom VPN connection software application to control access to the executable file and to prevent unauthorized access to the network.

19. The method of claim 1, wherein the network database comprises an administrative database;

configuring the administrative database to create and manage the RAS API configuration and a connection software by;

storing the connection profile for each remote computer accessing the network;

creating a custom VPN connection software application and a connection software application for each remote computer; and

deploying the RAS API configuration and the connection software including the VPN connection software application and the connection software application from the network to each remote computer via at least one of e-mailing the VPN connection software application and the connection software application to the remote computer, transferring the VPN connection software application and the connection software application to a magnetic storage device, transferring the VPN connection software application and the connection software application to an optical disc, and loading the VPN connection software application and the connection software application onto a web site for download by the remote computer;

automatically configuring, using the administrative database, a VPN server of the network to accept connections initiated by the RAS API configuration and the connection software; and

automatically configuring, using the administrative database, a LAN domain controller to accept connections initiated by the RAS API configuration and the connection software.

20. The method of claim 19, further comprising:

configuring the administrative database comprising at least one of the following properties;

having a web page based interface;

to provide an interface to an e-commerce website;

to be included as a component within a customer relationship management (CRM) system or a enterprise resource planning (ERP) system;

to support call-center oriented customer support data;

to disable any prior connections initiated by the RAS API configuration and the connection software to the VPN server or to the LAN domain controller; and

to monitor and manage the connections of at least one of the VPN server and the LAN domain controller through a complete connection cycle while the remote computer accesses services and resources of the network.

13. A method of configuring a remote computer to access a network of computers, comprising:

accessing a database associated with a configuration program generator that runs on a network administrator computer of the network of computers, the database having networking information necessary for at least one remote computer to access the network of computers, wherein the network information includes a WAN profile for the network of computers, at least one DNS address for the network of computers, and at least one WINS address for the network of computers;

executing a software module from within the database, the software module configured to;

extract the networking information for a selected one of the at least one remote computer;

convert the extracted networking information to a binary code representing configuration settings for the selected one of the at least one remote computer;

apply the binary code of the at least one remote computer to code a Remote Access Service (RAS) Application Programming Interface (API) to generate a configuration data binary file and prescribed RAS settings;

embed the configuration data binary file as instructions in the RAS API;

generate an executable program file having the binary code embedded therein, the executable program file being configured to modify current configurations of the selected one of the at least one remote computer when executed by the remote computer; and

provide the executable program file comprising the configuration data binary file from the network of the computers to the selected one of the at least one remote computer for execution;

executing the executable program file on the remote computer to modify the current configurations of the selected one of the at least one remote computer by installing prescribed Remote Access Service (RAS) settings to edit RAS files of an operating system of the selected one of the at least one remote computer such that the selected one of the at least one remote computer is configured to establish a VPN connection to access the network of the computers;

configuring, at the at least one remote computer, the RAS API as a connection application software;

configuring, at the at least one remote computer, the executable program file as a self-deleting file;

the step of executing the executable program file further comprises;

executing on the at least one remote computer the executable program file such that the RAS API functions as the connection application software that issues instructions to the at least one remote computer to establish the VPN connection with the network of the computers;

before establishing the VPN connection with a VPN server of the network of the computers, creating a connection profile that the RAS API is configured to provide to the operating system of the at least one remote computer when the executable program file is executed, wherein the connection profile contains information regarding at least one of an IP address, an address for a gateway, a DNS address, a WINS address, a DHCIP address, and a NAT address;

coding WAN login credentials and automatically transmitting the WAN login credentials from the at least one remote computer to the VPN server of the network of the computers when executing the executable program file;

coding LAN login credentials and automatically transmitting the LAN login credentials from the at least one remote computer to a domain controller of the network of the computers when executing the executable program file;

wherein the WAN and the LAN login credentials are coded in a manner that the WAN and LAN login credentials are unknown to the user in order to prevent the user from becoming aware of the code of the WAN and LAN login credentials; and

automatically deleting the executable program file from the at least one remote computer after terminating the VPN connection.

14. The method of claim 13, wherein providing the executable program file comprises at least one of e-mailing the executable program file to the at least one remote computer, transferring the executable program file to a magnetic storage device, transferring the executable program file to an optical disc, and loading the executable program file onto a web site for download by the at least one remote computer.