Wireless trusted point of access to a computer network

[0001] The present invention relates generally to computer networks, and more particularly to communication between a wireless device and a computer network.

[0002] Computer networks are linked computers and computer devices (such as peripheral devices) that are used to obtain, manipulate, and transfer digital data. As a result, a computer network is a highly important communication medium. A computer network may be used for text, audio, video, and graphics data. They are becoming an increasingly popular tool for institutions such as corporations, governmental entities, etc., in terms of providing word processing, graphics, e-mail, etc. As institutional use increases, there is an increasing need for computer networks that provide not only computer services to multiple users, but also provide computer services over multiple locations.

[0003] Another increasingly popular type of digital device is a wireless device, such as cell phones, personal digital assistants (PDA), laptop or notebook computers, pagers, etc. These wireless devices are generally small, light-weight, and portable. They use battery power and may be carried with the user. They generally communicate with a fixed wireless infrastructure, such as a cellular telephone network infrastructure, for example. Alternatively, the infrastructure may be a satellite or satellite wireless network, a wireless modem, a wireless modem network, etc.

[0004] Such wireless devices may be connected to a computer network in various ways. In the prior art, the simplest approach has been to connect via a wire harness. For example, a laptop computer may be physically connected to a land-based computer network.

[0005] However, a wire harness has several drawbacks. One drawback is that the user has to find an available port. Therefore, the computer network that the user is trying to connect to must include extra ports for such a purpose and a port must be available at the time the user wants to connect to it. Another drawback is that there is no mobility for the user while the device is connected. Furthermore, a wire or harness connection may require a user to stop whatever he or she is doing and look for an access port.

[0006] FIG. 1 shows a prior art network 100 having a wireless access capability. In this figure, the wireless device 103 is connected to a wireless modem 104, with the wireless modem 104 being further connected to a dedicated server 105. The server 105 is connected to a computer network 106 (or computer intranetwork (intranet), i.e., one or more networks interconnected within an entity, such as a corporation, etc.). The computer network 106 may additionally be connected to the Internet 108 via a proxy 107. The proxy 107 may perform protocol conversion, etc.

[0007] Alternatively, instead of the wireless modem 104 being directly connected to the server 105, the wireless modem 104 may be connected through the Public Switched Telephone Network (PSTN) via a telephone line to the server 105. This provides a low speed access through a dial-up service provider, with the dial-up service provider furnishing the server 105.

[0008] There are several drawbacks to this prior art arrangement. The dial up and connect time using the wireless modem 104 is slow and may be frustrating. In addition, the user may be subjected to the limited availability of the wireless modem 104. Moreover, the wireless device 103 may be out of the service provider's area, and therefore the connection to the wireless modem 104 may be costly if the user has to pay for long distance connect charges (such as through a cellular infrastructure, for example).

[0009] FIG. 2 shows another prior art network 200 having a wireless access capability. In this arrangement, the wireless device 103 communicates with a base station 220 that is a component of a wireless network 231. The base station 220 may be, for example, a cellular infrastructure base station and the wireless network 231 may be a cellular telephone network. The wireless network 231 is connected to a generic service node 234 and remote proxy 235. The remote proxy 235 again may communicate with the Internet 108 (or other networks). The wireless device 103 may therefore communicate with the Internet 108 (or other network) through the wireless network 231 and the base station 220.

[0010] This prior art approach also has several drawbacks. First, the wireless device 103 must be within the service area of a base station 220. Furthermore, the wireless network 231 must be able to communicate with a proxy 235 that can communicate with both the Internet 108 and the wireless network 231. In addition, the user of the wireless device 103 must have an account with the service provider of the wireless network 231. Therefore, the user needs a prior arrangement for service (i.e., the user of the wireless device 103 must subscribe to one or more wireless service providers). Furthermore, the user has no control over whether the wireless infrastructure is available and may suffer from slow access if communication traffic is heavy. Moreover, the user must still have an account in order to access the Internet 108, as communication with the wireless network does not guarantee Internet access without a prior arrangement.

[0011] The prior art approaches therefore provide network access by providing a wireless communication device that is linked to a network interface device that communicates with the computer network. This adds an extra layer of complexity to a network access operation and as a result adds extra time to the access operation. In addition, the access operation may still be less than optimal, as the user of the wireless device 103 may first have to perform a login operation with the network interface device and then perform another login operation with the network.

[0012] Therefore, there remains a need in the art for improvements in wireless device access to computer networks.

[0013] A communication system comprises a computer network that includes a plurality of interconnected computer devices. The communication system further comprises at least one network device capable of communicating with one or more mobile wireless devices. The network device is part of the computer network and is capable of communicating with a mobile wireless device without the mobile wireless device being a member of the computer network.

[0020] FIG. 3 shows a communication system 300 that provides a wireless trusted point of access to a computer network according to one embodiment of the invention. The system 300 may include one or more wireless devices 304, a network member fixed computer device 311, and a computer network 318. In addition, the computer network 318 may be connected to and communicate with a second computer network 325 through a proxy (or proxy server) 323 or similar device (such as a gateway, bridge, or router).

[0021] The wireless device 304 may be any type of mobile wireless device capable of communicating in a wireless manner with other wireless devices. This may include radio frequency communication and may additionally include infrared communication. The wireless device 304 may be, for example, a cellular telephone, a pager, a laptop or notebook computer, a pager, a personal digital assistant (PDA), etc.

[0022] The network member device 311 is a part of the computer network 318 and may be any manner of computer device capable of communicating with other network members. The network member device 311 is not itself a wireless infrastructure device. For example, the network member device 311 may be a personal computer, a network workstation, a dumb terminal, a printer, a copier, a scanner, a facsimile, a disk or tape drive, a disk drive server, etc. The network member device 311 may be any of the devices as modified according to the invention and therefore capable of communicating with the wireless device 304. The network member device 311 will be discussed further below in conjunction with FIG. 4.

[0023] The computer network 318 may be any type of computer network or interconnected computer networks. A computer network is a plurality of generally non-mobile computers and computer devices linked by a network of wires, cables, or optical fibers, and by a network communication protocol. For example, the computer network may be a local area network (LAN), a wide area network (WAN), a virtual private network (VPN), etc. Furthermore, the computer network 318 may comprise various interconnected networks. For example, the computer network 318 may be a computer network comprising one or more interlinked computer networks within an entity, such as a corporation, educational institution, governmental institution or department, etc. Such interlinked institutional networks are commonly referred to as an intranet.

[0024] The network member device 311 is physically connected to the computer network 318 in some manner, preferably such as by a typical network connection (i.e., a cable or wire). As a result, when the wireless device 304 is communicating with the network member device 311, the wireless device 304 is directly connected to the computer network 318.

[0025] The network member device 311 may perform, among other things, protocol conversion, access control, and security measures. The access control and security measures may include regulating connectivity of users by providing and checking an account and password for each wireless device 304 and optionally for each user, and may further include encryption/decryption, etc. Since the only point of access for the wireless device 304 to the computer network 318 is provided by the network member device 311, the network member device 311 will preferably not direct any communication to the wireless device 304 unless the communication is actually directed to the wireless device 304.

[0026] The network member device 311 may additionally track usage characteristics, such as access duration, printing, CPU time, memory usage, bytes transferred, services used, addresses of network members accessed by the wireless device 304, access to the second network 325 (including access duration), transactions, etc. The network member device 311 therefore may establish and track all interactions (sessions or transactions) initiated by the wireless device 304. This includes interactions between the wireless device 304 and the computer network 318, and optionally interacts with other networks.

[0027] The network member device 311 may also perform routing of a communication from the wireless device 304 to another network member device within the computer network 318. Further, the network member device 311 may perform encryption and decryption of all communications passing between the network member device 311 and the computer network 318.

[0028] The proxy (or proxy server) 323 may be any type of device that relays communications between the computer network 318 and other networks, such as the second network 325. The proxy may provide protocol conversion, routing, etc. The proxy 323 may provide communication between the computer network 318 and the Internet 325. The proxy 323 may further provide communication with any other manner of computer network or even with a wireless infrastructure (not shown). Therefore, through the network member device 311 and the computer network 318, the wireless device 304 may be quickly and directly connected to the Internet, or any other network or networks.

[0029] In one embodiment, the network member device 311 may show the resources or services available through the network member device 311. The second computer network 325 may require a user to input access information, such as an account and password information, for example. It should be understood that the access may be restricted in any desired manner. For example, even if the computer network 318 is connected to and communicates with the second computer network 325, the network member device 311 may be set up to deny access to the second computer network 325 by the wireless device 304. Alternatively, the network member device 311 may be configured so that such access is limited in a predetermined way. Moreover, access may be limited to certain members of the computer network 318.

[0030] Another advantageous feature of the communication system 300 is that it may implement a virtual private network (VPN) for a visiting wireless device 304. The fixed computer device 311 therefore may be configured to provide a VPN that tunnels the computer network 318 and the second network 325 in order to access an organization computer network of the mobile user. Consequently, the system 300 is able to not only provide a secure access to a remote computer network, but also is able to provide privacy. As a result, the data that the user transmits through the computer network 318 cannot be converted to plain, unencrypted digital data by any computers of the computer network 318, or even by a system administrator. The data packets can securely reach a destination network, where they may be converted back to plain, unencrypted digital data. The conversion at the destination network may be performed by a proxy, similar to the fixed computer device 311, that includes the necessary software.

[0031] The advantage provided to the mobile device 304 by this feature of the invention is an improved ability to access an associated organization from a remote point. The user may be charged for the service, but any trusted point of access (i.e., any relevant fixed computer device 311) can recognize a qualified wireless device 304 and provide a connection. Moreover, when data for the wireless device 304 is received in the bridge 429 and modem card 424 (see FIG. 4 below), it may be secured by any manner of cryptographic process. The data therefore may not be eavesdropped when being wirelessly communicated between the wireless device 304 and the fixed computer device 311.

[0032] The advantage of performing cryptographic processes in the fixed computer device 311 over performing cryptographic processes in the mobile device 304 is the limited amount of electrical power, processing speed, and memory available in the mobile device 304. The fixed computer device 311 is able to provide the data security without increasing the processing and electrical power load of the wireless device 304.

[0033] FIG. 4 shows detail of the network member device 311 according to one embodiment of the invention. The network member device 311 may include a processor 407, a network card 412, an interface 420 and a network link 433. In addition, the network member device 311 may include a wireless communication card 417 that further includes a modem card 424 and an associated antenna 403 and a bridge 429. In addition, the network member device 311 includes a switch 409.

[0034] The processor 407 performs traditional functions of the network member device 311, and employs the network card 412 and the network link 433 to communicate with the computer network 318. The network link 433 may be any manner of network, wiring or cabling, such as an Ethernet cable, for example.

[0035] The interface 420 may be an expansion slot within the network member device 311. The interface 420 may be included in order to accommodate extra memory, plug-in network cards, co-processors, hard disks, etc. The interface 420 may be an expanded input/output (EIO) slot, for example. The interface 420 as an expansion slot is generally a standard existing feature on most mid-range and high-end printers, for example. The interface 420 is exploited by the invention to provide a trusted point of access to the computer network 318.

[0036] The modem card 424 may be any type of standard modem card capable of communicating with a wireless device. The modem card 424 performs data conversion and performs wireless transmission and reception of data, such as through radio frequency (RF) communications. The modem card 424 may operate according to any known wireless protocol, such as cellular formats, BLUETOOTH, etc.

[0037] The bridge 429 may be a typical computer network bridge that performs protocol, conversions, routing, etc. The bridge 429 may typically include a coprocessor board that includes a microprocessor and some memory, including embedded software. Alternatively, some of the functions of the bridge 429 could be performed by a co-processor in the network member device 311.

[0038] In order to perform routing, the bridge 429 may be connected to the switch 409, with the switch 409 being interposed between the network card 412 and the processor 407. The switch 409 allows the network member device 311 to receive packets that are not destined for the processor 407 and allows them to be forwarded to the correct destination. This functionality is commonly known as switching and the switch 409 therefore acts like a router (but generally with less intelligence).

[0039] When a user is a guest of the network member device 311, the wireless device 304 (not shown) may access the network member device 311 using pre-stored information. For example, the network member device 311 may include a user information storage 439 that may contain user information such as one or more accounts that are allowed to access the network member device 311. The user information storage 439 may include information such as listings of devices and resources that may be accessed by a particular user account, permitted access times, etc. This may further include information previously created and stored accounts and guest accounts. Moreover, the user information storage 439 may include guest accounts spontaneously created by a user who has not been previously granted access privileges. A guest account may be created with any desired level of accessibility, including no expiration time or no access restrictions.

[0040] In operation, the modem card 424 conducts wireless communications with one or more wireless devices 304. The modem card 424 also communicates with the bridge 429. The bridge 429 communicates with the computer network 318 (and therefore is further capable of communicating with the second network 325 via the proxy 323). To the computer network 318, the wireless device 304 therefore looks like the network member device 311. This is what allows network packets to be passed back and forth between the computer network 318 and the wireless device 304 without any need for configuration changes or setup to the computer network 318. As a direct result, a wireless communication port may be transparently added to an existing computer network 318, yet with all of the features of a wireless modem/server that provides security features.

[0041] In an optional feature, the network member device 311 may wirelessly broadcast a wireless trusted point of access availability. The broadcast may include a location of the network member device 311, such as a universal resource locator (URL), IP address, Ethernet address, etc. This may serve as a beacon to wireless devices 304. Since a wireless device 304 may receive multiple broadcasts, the user therefore may have the ability to choose a preferred wireless point of access.

[0042] Because the network member device 311 enables a direct hook-up between the wireless device 304 and the computer network 318, there may be a need for the network member device 311 to perform security and access control. This is done when communication is initiated by the wireless device 304. Upon contact by the wireless device 304, the computer network 318 configures the bridge 429 to accept potential connections and initializes any needed parameters. This may include determining who can connect (a login identification may be requested and verified if access is not open to anyone), determining a session or transaction charge for the service (if any), determining what other devices the wireless device 304 can access (i.e., access only network member device 311, access the local computer network 318, access the second network 325, unlimited access, etc.). Alternatively, the network member device 311 may configure the bridge 429 and therefore may determine the access conditions and may initialize the access parameters.

[0043] Through the network member device 311 the wireless device 304 may not only access the computer network 318, but may additionally access any other network accessible by the computer network 318. As a consequence, the network member device 311 may be used to access the Internet, where the second network 325 is the Internet. In this manner, the wireless device 304 may use an access capability of the network member device 311 without the need for an additional account to be set up or independently accessed. Moreover, if the second network 325 is the Internet, it may be used by the network member device 311 to access other remote networks, such as networks of other entities.

[0044] FIG. 5 is a flowchart 500 of a wireless access method for a computer network. In step 501, a communication initiation from the wireless device 304 is received in the network member device 311 linked to the computer network 318.

[0045] In step 510, the identity of the wireless device 304 is verified in the network member device 311. This may include requesting an account and password information, for example. Optionally, the network member device 311 may also verify an identity of the user, such as by requesting a PIN number, etc. In addition, the user may be requested to enter credit card account information for purposes of charging the user for access. It should be noted that the account and payment information may be previously entered and stored.

[0046] In step 515, if the verification is successful, communications are relayed between the wireless device 304 and the network member device 311. Moreover, communications are relayed between the wireless device 304 and the computer network 318. In this manner, the wireless device 304 may be mobile and yet communicate with the computer network 318.

[0047] The wireless device 304 may establish and be charged for a session with the computer network 318 (and optionally the second network 325). Alternatively, the wireless device may establish a session with the first network 318 and may establish one or more sessions between the first computer network 318 and the second computer network 325. For example, the wireless device 304 may participate in multiple Internet sessions. The benefits of a session mode is that a secure channel may be created in order to work with a different organization or network. This is efficient when the user needs to execute multiple commands, and pays on the basis of the entire session.

[0048] Alternatively, the wireless device 304 may communicate on a transactional basis with the computer network 318. As a result, the wireless device 304 may be charged for access on the basis of each transaction with the computer network 318. Furthermore, the wireless device 304 may establish a session with the first computer network 318 and may establish one or more transactions between the first computer network 318 and the second computer network 325. The benefit of a transactional model is that a user is able to execute a small number of commands without payment of excessive cost. A good example of this is execution of a single print command.

[0049] FIG. 6 shows the communication system 300 wherein the wireless device 304 is conducting multiple remote interactions. In this figure, the wireless device 304 is engaging in multiple Internet sessions, such as Session 1 and Session 2, using the independent entities proxy one 608 and proxy two 623 connected to the second network 325. As a result, the wireless device 304 may independently communicate with multiple institutional networks. The second computer network 325 therefore may be used as a communication medium for communicating with other networks.

[0050] This capability enables wireless remote access to the second computer network 325 via the computer network 318, with the access point being local to the computer network 318. Consequently, the wireless device 304 does not have to be able to access all the remote Internet organizations itself, but may gain such access through the network member device 311.

[0051] Connection can be in a session mode where users are able to connect for a session. Alternatively, in a transactional mode, the user can execute single transactions. Each session or transaction may be an interaction with a device on another LAN, WAN, etc., such as a computer network of another organization.

[0052] The transactional mode may minimize cost if the user has to pay a fee for access to the network member device 311. In the transactional mode, a cost reduction over the prior art is realized due to a reduction in complexity of access to the computer network 318 and to the second computer network 325.

[0053] The wireless trusted point of access of the invention may provide a direct connection to the computer network 318. This wireless trusted point of access is a network member. There is no need for any intervening server, modem, or other network interface devices. Moreover, the network member device 311 may be a device that is always on and always ready for connection. Therefore, the user does not have to suffer through a dial-up time, for example.

[0054] In an additional benefit, the network member device 311 according to the invention may offer connections to visitors. For example, the network member device 311 may offer a pay-for-use connection for visitors and can charge per session or per transaction. Alternatively, a large corporation having multiple sites could use the network member device 311 to allow access (including mobile access) to employees at any office or facility, including access to employees visiting other offices or facilities within the organization. The invention is further capable of providing a transparent connection to the Internet, wherein the security is provided at the point of access and the user of the wireless device 304 may perform only one access operation.

[0055] The communication system 300 can be configured to allow the network member device 311 to access a limited number of types or sets of resources. This configuration may dictate access conditions, and may be independent of the user or independent of the type of wireless device 304.