Method and apparatus for configuring a router, and a computer program product

[0001] The invention relates, in general, to communications via gateways or routers, and more particularly, to a method and an apparatus for configuring a router of a local-area network (LAN), such as a corporate network or Intranet, in a communication network with a wide-area-network (WAN) connected or linked via the router, such as the worldwide web WWW or Internet.

[0002] In a communication network, the router serves as an interface between a plurality of networks, such as a plurality of local-area networks, or one global network and one local-area network, and via the router all the local communication subscribers or users of a particular network are able to communicate simultaneously with another network, such as the Internet or an Intranet, via a communication connection, such as an ISDN connection (Integrated Services Digital Network). A firewall or a firewall-router combination is also considered to be a router. In other words, the router is a piece of switching equipment in the communication network, for transmitting data from one communication subscriber to another external communication subscriber or user on the basis of a protocol, such as the Internet protocol, associated with the data transmitted or forwarded.

[0003] Typically, one router can connect various communication networks or computer networks to one another, such as the local-area network and the external computer network of a business. Moreover, the router may be configured such that firewall functions are fulfilled. The firewall functions can be fulfilled if a packet filter is realized via the router. This packet filter typically forwards only data or data sets of a predetermined type, predetermined addresses of origin and/or destination, predetermined ports of origin and/or destination, and/or possibly data with predetermined flags, depending on a configuration that has been predetermined or set.

[0004] Before the user can access certain computer programs of a local-area computer network from a computer or device of an external computer network, the router needs to be configured in a suitable way. Typically, this router configuration is done manually by an administrator, who is usually also responsible for problem-free operation of the local-area network. Before the administrator configures the router in this suitable way, the user as a rule can make a request to gain access to the desired computer program. The administrator thereupon checks whether the user even has the right to access the computer program the user has requested, and then performs a technical risk analysis, with the aid of which possible risks to security should at least be limited. Based on the technical risk analysis, the administrator could for instance be assured that the user has access only to the computer program he requested, or is prevented from gaining unauthorized access to that requested computer program and/or other computer programs or to a communication subscriber or computer of the local computer network. On the basis of the technical risk analysis, an administrator for instance determines suitable packet or port filters, or a suitable host routing. Next, the administrator configures the router in the suitable way that enables the user to access the requested computer program.

[0005] However, the above described process may be relatively time-consuming, and as a rule may only be performed by a specialist, such as the administrator.

[0006] From German Patent Disclosure DE 101 46 397 A1, a method for configuring a firewall or a router is known in which a first computer or a first computer network is connected to a second computer network via the firewall or the router, and the router or the firewall is configured such that communication between a computer in the second computer network and the first computer, or a predetermined computer of the first computer network, is made possible once a predetermined request form is filled out, which is automatically translated into a code suitable for the configuration of the firewall or the router. As such, a deadline is agreed upon with a central station or communication center for when the configuration will be performed, online, from the central station. A disadvantage of this method is that coordination is more difficult given the need to agree on a deadline with the central station and the time differences involved in worldwide use, so that potentially several visits on site by technicians or administrators are required.

[0007] The present invention is defined by the appended claims. This description summarizes some aspects of the present embodiments and should not be used to limit the claims.

[0008] One object is to disclose a method and an apparatus for configuring a router.

[0009] One concept is that upon configuration of a router of a local-area network, on-site configuration with the effort and expense which that involves may be prevented or limited. A simpler configuration can be made available. As such, the concept provides that by an arbitrary external communication subscriber, who is bound in a different remote local-area network, and via a dynamic web page (webpage) of a remote server, configuration data for the applicable or involved router of the local-area network are input, and a communication connection to the router is automatically established by the remote server, and the configuration data are transmitted to the router automatically once the communication connection has been successfully made.

[0010] The term “dynamic web page” is understood in particular to mean or refer to an HTML document (HTML=Hyper-Text Markup Language), which for inputting the configuration data includes control elements, such as tags or ActiveX control elements. The control elements are interactive software components of the HTML document, and indicate for instance how a user should act, such as inputting data from a keyboard or by clicking with a mouse. A dynamic web page thus has variable contents. The term “remote server” is understood to be a conventional computer or personal computer that includes server software which supports an Internet protocol, such as the http protocol, which transits or transmits the HTML documents to a user upon request by the user. Once the HTML document has been sent, as a rule the connection between user and server is broken off.

[0011] The method is used for final settings or adjustments of the router that is to be newly set up, or for changing the configuration of an already existing router in a communication network, such as a corporate network, via a dial-up connection, but also via the Internet. The settings may pertain to new or modified remote connections or communication connections between the router and the remote server. The dial-up connection, for instance by ISDN, is an economical way of achieving this set-up, since resources are occupied or busy only as needed. However, a dedicated communication line may also be used.

[0012] In one possible embodiment, the dial-up connection is initiated by the remote server, and the remote server keeps trying the dial-up connection until a communication connection has been established, or until a predetermined time has elapsed. The initiation of the dial-up connection by the remote server makes coordinated triggering of the router possible, while balancing timing with other server services. For the repeated dial-up attempts until a communication connection is made or until a predetermined time has elapsed, a predetermined error tolerance is implemented, which is configured to limit or minimize the effort and expense of transmission.

[0013] In another embodiment, the dial-up connection may be initiated by the router. In this case, the transmission of the configuration data may be started by the remote server. The initiation of the dial-up connection by the router, for routers already configured to be capable of dialing up, may establish a communication connection. If the transmission is initiated by the server, when the communication connection already exists, the configuration data may be transmitted in regular or typical dial-up operations of the router. This router dial-up is used whenever, for security reasons, for instance, a router does not allow dial-up from outside.

[0014] For a secure and substantially precise configuration of the router in terms of the configuration data that also takes various applications into account, the configuration data are checked in the server and/or the router for plausibility and correctness. As such, even in an automatic transmission of the configuration data from an external communication subscriber to the router, the configuration of the router on the basis of the configuration data transmitted is not done until after the configuration data have been substantially checked. This checking of the configuration data reliably avoids or minimizes an erroneous configuration of the router. Checking the identification data and/or configuration data input after they have been input substantially prevents incorrect settings that may impair the function of the router.

[0015] For checking configurations that have already been made, or for checking for updating of transmitting configuration data, the configuration data are stored in memory in the server and/or the router. Newly received configuration data are checked on the basis of the stored and already used configuration data. If the configuration data match, updating of the configuration of the router need not be done; otherwise, the new configuration data, after a check for plausibility and correctness and optionally a check for completeness, are used for configuring the router.

[0016] In another embodiment, the transmitted configuration data are activated with a time delay (i.e. in delayed fashion). As such, for instance upon a remote access over a great distance with major differences in time zones, involving for instance a local-area network with a router in Asia and a remote server in the local-area network used by a user or administrator in Europe, the updating of the configuration data for the router can be activated in delayed fashion. Updating the router on the basis of the configuration data can also be done in delayed fashion, for instance at a predetermined time. Particularly when restarting the router is necessary after a reconfiguration, the reconfiguration can be started at night, for instance.

[0017] For changing the setting of the router and thus changing a configuration of the router by an authorized person or administrator, identification data may be input by the external communication subscriber via the dynamic web page. From the identification data, an authorization for access to the web server or remote server for the applicable router is checked.

[0018] The configuration data required for setting the router are automatically ascertained, after identification data and/or configuration data have been input into the dynamic web page. The web page is available worldwide. The data input can be done on the site of the router to be configured, or at any other site, such as an external communication subscriber. The configuration data that have been input and/or transmitted may be transmitted automatically by the remote server to the router, such as transmitted in a form that is readable by the router, once a communication connection between the remote server and the router has been made. This communication connection may be initiated by either side—the server or the router. The configuration data to be ascertained for the identification data and authorization data that have been input are stored in a database, from which they can be extracted on the basis of the identification data and authorization data that have been input. The configuration data can also be generated dynamically after the input, such as to enable individual generation of rules for a firewall.

[0019] In another embodiment, substantially fast and flexible inputting or modification of router and/or firewall configurations, and especially with a remote connection, is possible. The manual help from a central device can be dispensed with. The configuration can be performed by the automatic transmission of the configuration data and their activation, and in particular without router skills. Security is not impaired or compromised, since the configuration is adequately well protected because of the identification data and/or authorization data, for instance in the form of passwords or electronic keys. A need for technicians to travel to the router may no longer be necessary.

[0020] Illustrative and exemplary embodiments of the invention are described in further detail below with reference to and in conjunction with the figures.

[0024] Elements corresponding to one another are identified by the same reference numerals in all the drawings.

[0025] In FIG. 1, a communication network 1 is shown which includes a first local-area network 2a, such as a computer network of a technical system, such as an office, an industrial plant, a school, a factory or so forth, and a second remote local-area network 2b, such as a computer network of a corporation, for instance an Intranet. The two local-area networks 2a, 2b and their associated communication subscribers K can exchange data with one another, for instance via a communication connection 4.

[0026] A remote server 6 (e.g., a web server) is assigned to the local-area networks 2aand/or 2b. The remote server 6 provides access or communication by one local-area network 2a to a different local, distant network 2b, or vice versa, and/or to a global network, such as Internet, and its services, such as the WWW service. In a manner not shown in further detail, the remote server is in communication with the local-area networks 2a, 2b via the Internet and an associated remote router 8 on the one hand, or via a direct ISDN connection on the other. The remote router 8 may be a short message service (SRS) router.

[0027] Moreover, the remote server 6 can make Internet services, as WWW service, available to the communication subscribers K of the local-area networks 2a, 2b. As such, the respective local-area network 2a, 2b has an associated router 10a and 10b, respectively. The router 10a, 10b of the respective local-area network 2a, 2b, via a switch (not shown), makes a communication connection 4 possible for the associated communication subscribers K, for instance an Internet connection or a direct dial-up connection, to the remote server 6. In the case of a dial-up connection, for instance, the respective router 10a, 10b may be connected to a telephone network via an ISDN system in a manner not further shown.

[0028] If the local-area networks 2a, 2b are networks at a branch location of a business that is active globally, then upon shipping and installation of the particular local-area network 2a and 2b, the respective associated router 10a and 10b is preconfigured for the communication connections 4. Once the particular local-area network 2a, 2b and thus the associated router 10a, 10b have been put into operation, data can be exchanged via the communication connections 4.

[0029] For an automatic configuration or modification of the configuration of the particular router 10a, 10b, the remote server 6 may include, as a service or application, the WWW service, for instance, to which a user has access to the router 10a of the first local-area network 2a from one of the communication subscribers K, such as the second local-area network 2b, via a dynamic web page 12 of the remote server 6 via the communication connection 4.

[0030] For the communication connection 4 between the communication subscribers K of the second local-area network 2b and the remote server 6, a dial-up connection or direct dial-up may be used. Once the connection has been successfully made, the dynamic web page 12 may be called up by the applicable communication subscriber K. The dynamic web page 12 may serve to input configuration data KD for the router 10a of the first local-area network 2a. For instance, as the configuration data KD, telephone numbers, present or future IP addresses, and the gateway of the applicable router 10a are input. Depending on how the dynamic web page 12 is configured, identification data ID, for instance in the form of a password or codeword, can be input in addition. Once the identification data ID has been successfully checked and the communication connection 4 has been enabled, the configuration data KD for the router 10a that have been input via the dynamic web page 12 are then transmitted from the external communication subscriber K of the remote local-area network 2b to the remote server 6.

[0031] Next, the configuration data KD ascertained in a server are transmitted via a communication connection 4 between the remote server 6 and the applicable first local-area network 2a to its router 10a. A dial-up connection may be used as the communication connection 4. Depending on the specification, the dial-up connection may be initiated by the remote server 6 or the applicable router 10a. In the case of dial-up by the remote server 6, the dial-up connection may be attempted until the communication connection 4 has been made, or a predetermined time has elapsed. Once the dial-up has been successful, the configuration data KD may be automatically transmitted to the router 10a by the remote server 6.

[0032] In the event that the dial-up is initiated by the router 10a, the transmission of the configuration data KD may be started by the remote server 6. In addition, the configuration data KD can be checked for plausibility and correctness either in the server before a transmission or in the router after a transmission. As such, an incorrect setting of the router 10a to be reconfigured may be reliably prevented. Moreover, the configuration data KD can be stored in the server and/or in the router in a data store or memory M. The entire method described here may also be performed in reverse order, if desired. That is, a communication subscriber K of the first local-area network 2a may configure the router 10b of the second local-area network 2b on the basis of new configuration data KD.

[0033] The method for configuring one of the routers 10a, 10b will now be described in further detail in terms of the flow charts of FIGS. 2 and 3.

[0034] FIG. 2 shows a flow chart with the following sequence. After the configuration data KD have been input via the dynamic web page 12, at act 22, and the web page 12 has been sent, the configuration data KD are checked for plausibility and correctness, for instance via a Common Gateway Interface (CGI) script. As such, a comparison with known data is made, for instance. Furthermore, the input identification data ID, such as a codeword or password, are optionally checked for correctness and authorization. If the input data are correct, the configuration data KD which are intended for the router 10a or 10b and which may be composed entirely or in part of the input data, are stored in a database, at act 24. Once again, a comparison with already-stored data may be done, so that only new and modified configuration data KD are stored. Moreover, additional configuration specifications may be read out of the database and can continue to be used along with the configuration data KD that may have been input.

[0035] Next at act 26, via the remote server 6, an attempt at dialing the input telephone number is made, in order to construct an associated communications connection 4 with the applicable router 10a or 10b. The applicable router 10a or 10b is configured such that incoming data calls are accepted. The incoming connection is accepted only after successful checking for an access code, for instance on the basis of identification data ID. If a connection cannot be made successfully, then the attempt at establishing the dial-up connection by the remote server 6 may be repeated, for instance once an hour, until such time as either a communication connection 4 has been made or a predetermined time, such as 24 hours, has elapsed, or a maximum number of dial-up attempts, such as ten, has been rejected.

[0036] If the dial-up was successful, then via a suitable protocol that instructs the router 10a or 10b to receive the configuration data KD, these data are automatically transmitted to the router 10a or 10b, at act 26, where they are buffer-stored if needed, or the router configuration is updated directly with the configuration data KD transmitted. The dial-up connection is then terminated. If the transmitted configuration data KD have been buffer-stored, then the updating of the router configuration with the buffer-stored configuration data KD is done either immediately or after a delay, such as at a predetermined time, for instance at night.

[0037] In the flowchart of FIG. 3, the remote server 6 remains passive. That is, the applicable router 10a or 10b may already have a valid dial-up configuration with the remote server 6. If the applicable router 10a or 10b establishes a dial-up connection with the remote server 6, at act 36, the latter informs the router 10a or 10b, via a suitable protocol, that new or modified configuration data KD are present and need to be received. These data are then transmitted to the router 10a or 10b, where they are buffer-stored if needed or are used directly for router configuration on the basis of the configuration data KD transmitted, at act 38. Next, the regular communication sequences, on account of which the dial-up connection was established, may be performed or executed.

[0038] Alternatively, the dial-up connection may be terminated after the configuration data KD have been transmitted. If the configuration data KD transmitted are buffer-stored, so that the subsequent, regular communication sequences are already performed with the new configuration, the updating becomes effective only upon a newly initiated dial-up connection. The updating can also be done only after the regular communication sequences and after the termination of the dial-up connection, for instance, immediately afterward or after a delay, or at a fixed time, such as at night. If, for instance, the regular communication is time-critical, the updating can be done after the regular communication sequences and after the termination of the dial-up connection.

[0039] In both versions, that is, both with the active and with the passive remote server 6, the new or modified dial-up to the remote server 6 is now available to whichever local-area network 2a or 2b is the remote one.

[0040] For instance, if the IP address of the remote server 6, or the dial-up number for the active dial-up of the router 10a, 10b to the remote server 6 changes, then the configuration must be performed again. Changes in the identification data ID, such as changes in passwords, for the dial-up to the remote server 6 could also be forwarded in this way, if a corresponding chronological specification or arrangement is made or set up and the router 10a, 10b is capable or performing configuration changes at predeterminable times. Even without preconfigured Internet access, the method can be used, if the input of the identification data ID and/or configuration data KD is done via a different Internet connection, for instance from a different computer or communication subscriber K via a modem, or from a communication subscriber K outside the local-area networks 2a, 2b, such as from a laptop in a global network, and a corresponding communication connection 4 with the remote server 6 is constructed.