Connecting remote and local networks using an identification device associated with the remote network

• US 8,898,750 B2
• Filed: 08/23/2011
• Issued: 11/25/2014
• Est. Priority Date: 08/23/2011
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Dattagupta, Siddhartha, Simon, James J.
• Primary Examiner(s): Poltorak, Peter
• Application Number:
  US13/216,015
• Publication Number:
  US 20130055363A1
• Time in Patent Office: 1,190 Days
• Field of Search: None
• US Class Current: 726/5
• CPC Class Codes: H04L 12/2818 from a device located outside both the home and the home network access arrangements H04L12/2856; for remote control or remote monitoring of applications H04L67/025; arrangements for transmitting signals characterised by the use of a wireless eletrical link G08C17/00; telephonic communication systems adapted for combination with remote control systems H04M11/007
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

One or more portable identification devices associated with a first smart network can be carried with a user of the first smart network to a second smart network and used to automatically identify the first smart network and allow authorized access to the smart network via the second smart network. The one or more portable identification devices are configured to automatically provision the second smart network with the information necessary for the second smart network to identify the first smart network and the authorization credentials to connect to the first smart network. In some example embodiments, the portable identification devices may be RFID tags.

Claims

1. A method, comprising:

upon detecting a portable device within a local network, obtaining information from the portable device, wherein the information identifies a remote network and allows authorized access to the remote network;

transmitting, from the local network, to a network host device located within the remote network, a first authentication credential based on the obtained information from the portable device, wherein the network host device is configured to authenticate the portable device based on the first authentication credential;

authenticating the network host device, based on a second authentication credential communicatively corresponding to the network host device;

upon successfully authenticating the network host device, and further upon the successful authentication of the portable device by the network host device, establishing, from the local network, a secure network connection with the network host device located within the remote network, based on the obtained information from the portable device, whereby the established secure network connection enables a computing device within the local network and that is distinct from the portable device, to access at least one of one or more devices and one or more services connected to the remote network via the established secure network connection so long as the portable device remains within the local network; and

responsive to detecting that the portable device is no longer present within the local network, terminating the secure network connection established with the network host device, such that the computing device can no longer access the remote network devices and services.

2. The method of claim 1, wherein the portable device includes one or more protected data storage areas, and data within the one or more data storage areas cannot be copied or overwritten with other data.

3. The method of claim 2, wherein the portable device comprises a near-field radio frequency identification (RFID) tag, a universal serial bus (USB) drive manufactured with write-protected encrypted bits, an optical disk with manufactured keys, a secure digital (SD) memory card with digital rights management (DRM) features, or a Bluetooth-enabled device.

4. The method of claim 1, wherein enabling access comprises causing the one or more devices or one or more services associated with the remote network to be discoverable on the local network.

5. The method of claim 1, wherein the obtained information includes identification information for at least one client device or service associated with the remote network and an authorization credential for the at least one of one more or more client devices and one or more services associated with the remote network.

6. The method of claim 1, wherein the portable device comprises a near-field RFID tag, and detecting that the portable device is no longer present comprises detecting that the portable device is no longer proximate to the network host device located within the local network.

7. A non-transitory computer-readable medium including instructions that, when executed by a processing unit, cause the processing unit to perform the steps of:

upon detecting a portable device within a local network, obtaining information from the portable device, wherein the information identifies a remote network and allows authorized access to the remote network;

transmitting, from the local network, to a network host device located within the remote network, a first authentication credential based on the obtained information from the portable device, wherein the network host device is configured to authenticate the portable device based on the first authentication credential;

authenticating the network host device, based on a second authentication credential corresponding to the network host device;

upon successfully authenticating the network host device, and further upon the successful authentication of the portable device by the network host device, establishing, from the local network, a secure network connection with the network host device located within the remote network, based on the obtained information from the portable device, whereby the established secure network connection enables a computing device within the local network and that is distinct from the portable device, to access at least one of one or more devices and one or more services communicatively connected to the remote network via the established secure network connection so long as the portable device remains within the local network; and

responsive to detecting that the portable device is no longer present within the local network, terminating the secure network connection established with the network host device, such that the computing device can no longer access the remote network devices and services.

8. The non-transitory computer-readable medium of claim 7, wherein the portable device includes one or more protected data storage areas, and data within the one or more data storage areas cannot be copied or overwritten with other data.

9. The non-transitory computer-readable medium of claim 8, wherein the portable device comprises a near-field radio frequency identification (RFID) tag, a universal serial bus (USB) drive manufactured with write-protected encrypted bits, an optical disk with manufactured keys, a secure digital (SD) memory card with digital rights management (DRM) features, or a Bluetooth-enabled device.

10. The non-transitory computer-readable medium of claim 7, wherein enabling access comprises causing the one or more devices or one or more services associated with the remote network to be discoverable on the local network.

11. The non-transitory computer-readable medium of claim 7, wherein the obtained information includes identification information for at least one client device or service associated with the remote network and an authorization credential for the at least one of one or more client devices and one or more services associated with the remote network.

12. The non-transitory computer-readable medium of claim 7, wherein the portable device comprises a near-field RFID tag, and detecting that the portable device is no longer present comprises detecting that the portable device is no longer proximate to the network host device located within the local network.

13. A system, comprising:

a network host device located within a local network that is configured to;

upon detecting a portable device within a local network, obtain information from the portable device, wherein the information identifies a remote network and allows authorized access to the remote network;

transmit, from the local network, to a network host device located within the remote network, a first authentication credential based on the obtained information from the portable device, wherein the network host device is configured to authenticate the portable device based on the first authentication credential;

authenticate the network host device, based on a second authentication credential corresponding to the network host device;

upon successfully authenticating the network host device, and further upon the successful authentication of the portable device by the network host device, establish, from the local network, a secure network connection with the network host device located within the remote network, based on the obtained information from the portable device, whereby the established secure network connection enables a computing device within the local network and that is distinct from the portable device, to access at least one of one or more devices and one or more services communicatively connected to the remote network via the established secure network connection so long as the portable device remains within the local network; and

responsive to detecting that the portable device is no longer present within the local network, terminate the secure network connection established with the network host device, such that the computing device can no longer access the remote network devices and services.

14. The system of claim 13, wherein the obtained information includes identification information for at least one client device or service associated with the remote network and an authorization credential for the at least one of one or more client devices and one or more services associated with the remote network.