Patent Grant
9270654
Coffee shops and other small enterprises frequently offer internet service to their customers. To make such internet services available, small enterprises typically purchase telecom services from large-scale telecom providers. These telecom services enable connectivity to telecom networks, and use of telecom components that process network traffic originating at small enterprises. Some small enterprises (a.k.a. small venues) authenticate prospective network users by forwarding access requests to remote private authentication servers. Such authentication may require that the small venue embed expensive components in the telecom network (e.g., regional authentication gateways running on telecom hardware.) Furthermore, large telecom companies do not typically offer small venues a wide range of service options. For example, large telecom companies may not let small venues select various network and billing policies that control network traffic and customer billing at the small venue. As a result, small venue operators could benefit from new systems that facilitate highly customizable network connectivity services.
Even though large telecom companies may provide services to small venues, small venues still may have to purchase and configure equipment for providing network services to their customers. For example, small venues may need to set-up local area WiFi access points that provide wireless connectivity to telecom networks. Small venue operators may not have technical expertise necessary for properly configuring and maintaining such networking equipment. As a result, small venue operators could benefit from new systems that make configuring network equipment easier.
Some embodiments include a method for initially configuring a network appliance. The method can detect, by the network appliance, a subscriber network. The method can transmit, to a remote configuration service via the subscriber network, a request for configuration information for the network appliance, and receive, via the subscriber network, the configuration information, wherein the configuration information includes first parameters for the subscriber network, and second parameters for an access network for connecting computing devices to the network appliance. The method can also perform an automated initial configuration of the network appliance using the configuration information, wherein the automated configuration does not require user input, and wherein the automated configuration includes using the first parameters and the second parameters to configure the network appliance for use with the access network and the subscriber network.
The present embodiments may be better understood, and numerous objects, features, and advantages made apparent to those skilled in the art by referencing the accompanying drawings.
The description that follows includes exemplary systems, methods, techniques, instruction sequences and computer program products that embody techniques of the present inventive subject matter. However, some embodiments may be practiced without these specific details. In some instances, well-known instruction instances, protocols, structures and techniques have not been omitted for clarity.
As noted above, small venue operators may encounter challenges when offering network connectivity to their customers. Some embodiments of the inventive subject matter include a network appliance that enables small venue operators to provide internet connectivity without extensive telecommunications services from large telecom companies. Using the appliance, small venue operators need only obtain basic internet services to provide internet connectivity to their customers. Some embodiments of the appliance can perform can limit network access and authenticate users without aid of an authentication gateway embedded in the telecom system. That is, some embodiments can require network users to authenticate with a remote authentication service without an authentication gateway running in the telecom network. After users have been authenticated, the appliance may route network traffic to the internet without going through telecom gateways or the remote authentication service.
As noted above, small venue operators may lack technical expertise to properly configure and maintain equipment for providing network connectivity to small venue customers. Some embodiments provide a graphical user interface (GUI) and configuration components (e.g., a website, etc.) that enable small venue operators to easily configure the network appliance and/or other networking equipment. Using the GUI, small venue operators can select configuration options by answering basic questions about billing and network traffic, by choosing sets of pre-configured configuration parameters, or by enabling automated configuration. Some embodiments store configuration options in the cloud (i.e., in remote components accessible via a network) and download them onto the networking equipment. After a small venue has configured its networking equipment, embodiments store the configuration information in the cloud, in case the configuration information is needed later. Some embodiments periodically verify and/or update configuration parameters of the network appliance.
Some embodiments of the inventive subject matter include network appliances configured to provide network connectivity at venues, such as coffee shops, restaurants, bookstores, etc. In some instances, upon initial set-up, the network appliances can download configuration information over a network from a remote configuration service, thereby streamlining initial setup and maintenance of the network appliance. In addition to the remote configuration service, the network appliance may also obtain services from other remote components. For example, the appliance may connect with remote services to provide walled gardens to venue customers. The discussion of
The configuration information can include technical information for configuring access network parameters, subscriber network parameters, and billing/business parameters. An access network is a local area network that facilitates wireless access for the mobile device 126 to the appliance 102. The access network parameters can include Internet protocol (IP) addresses, Wi-Fi channel information, frequencies, Service Set Identifier information (SSID), WiFi Protected Access (WPA) protocol information, etc. The subscriber network comprises telecom company components that facilitate access between the appliance 102 and the remote services 110. The subscriber network may also facilitate access to the Internet. Subscriber network configuration information can include domain name server (DNS) information, dynamic host configuration protocol (DHCP) information, gateway information, etc. Billing/business parameters can include connectivity costs (e.g., how much a venue user pays to connect to the Internet), credit card service information, etc.
In some embodiments, as shown in
As part of the configuration process, the appliance 102 provides certain identifying information to the remote configuration service 110. The identifying information can include a serial number for the appliance 102, and location information indicating a location at which the appliance resides (e.g., zip code, street address, longitude and latitude, etc.). Based on the identifying information, the remote configuration service can provide appropriate configuration information to the appliance 102. For example, based on the identifying information, the remote configuration service can provide configuration information appropriate for the appliance's access network and subscriber network. In some instances, the configuration service offers a website at which a venue operator can set billing/business parameters, which the configuration service pushes to the appliance 102. After the appliance 102 has been configured, the configuration service retains a record of all configuration settings for the appliance 102. The configuration service stores the configuration information in the database 124.
In
In
In
In
This discussion continues with more details about embodiments of the network appliance.
In
The network appliance 200 also includes a configuration management module 210 configured to perform automated configuration of the network appliance 200. The configuration manager module 210 can communicate with a remote configuration service, and procure configuration information for use in configuring the network appliance 200. In some embodiments, the configuration information includes parameters for configuring components (e.g., access point 216) to support an access network, subscriber network, and billing/business policies. Operations of the configuration management module 210 are described in detail below (see discussion of
The authorization and payment module 212 communicates with remote services (e.g., the remote services 110) to facilitate payment transactions associated with providing venue customers access to the Internet. In some embodiments, the authorization and payment module 212 utilizes a secure tunnel (e.g., provided by the split tunnel client VPN 222) to communicate with a remote authorization and payment server (e.g., see 114). The remote authorization and payment server can determine a payment gateway to use for each transaction. In turn, the authorization and payment module 212 contacts the payment gateway for posting payment transactions on behalf of the venue. Determination of the payment gateway may be a function of multiple factors including schedule, country, payment type, and venue account. In some embodiments, a venue account is owned and controlled by the remote services network, so financial transactions are handled seamlessly by the remote services network. In other embodiments, the venue owns and controls the venue account. In such embodiments, payments flow directly to the venue account, whereas authorization records go to the remote services for storage and processing.
The network appliance 200 also includes a venue self-registration module 206 and user self-registration module 208.
The network appliance 200 also includes an authentication module 214. The authentication module 214 can receive credentials from users and transmit them to a remote authentication service via a secure tunnel provided by the split tunnel client VPN 222. In turn, the authentication module 214 receives responses from the remote authentication service, and communicates the responses to venue users. In some embodiments, the authentication module 214 enforces monetization policies, such as whether payment is required before it will authenticate a user.
In some embodiments, there are multiple remote services to choose from (e.g., there are multiple remote services to service different geographic regions. The appliance's SHR framework 218 can select an instance of remote services with which to communicate (e.g., the instance geographically closest).
The network appliance 200 also includes a split tunnel virtual private network client 222, which facilitates secure tunnels between the network appliance 200 and remote services, such as a remote authentication service. The split tunnel VPN client 222 can simultaneously maintain secure channels and unsecured channels. For example, the VPN client can establish a secure channel tunnel to a VPN server located at a remote service network, where the secure channel is used for authenticating venue customers. The VPN client 222 can also establish an unsecured channel to the Internet, where the unsecured channel is available for users who have already been authenticated by the remote authentication service. Such a split tunnel capability enables the network appliance 200 to reduce resource consumption (e.g., computation overhead) for network traffic originating from users that have been authenticated by the remote authentication service.
The components shown in
As shown, the software-based network appliance 300 is connected to a computing device 308. In contrast to the hardware-based network appliance 200, the software-based network appliance may not natively include components for configuring itself upon deployment. However, the software-based appliance 300 can utilize the computing device 308 for automated configuration. For example, upon initial deployment, the computing device's configuration manager 310 can perform operations for configuring the software-based network appliance 300, similarly described above. The network appliance 300 can utilize the authentication manager 312 and payment manager 314 to facilitate user authentication and payment management. The configuration manager 310, authentication manager 312, and payment manager 314 can utilize remote services, as similarly described vis-à-vis the network appliance 200.
As discussed above, some embodiments offer a configuration website that assists venue operators in selecting configuration options for network appliances.
After a venue operator has selected configuration via the webpage 400, the remote configuration service transmits configuration information to the network appliance. In some embodiments, the webpage 400 enables venue operators to configure their walled gardens, venue-specific websites, and other preferences. The webpage may be hosted by the remote services network or a webserver residing on the network appliance.
In some embodiments, the webpage enables venue operators to select security options for network appliances. As noted above, the security options may be selected after a venue owner answers a series of non-technical questions. In some embodiments, the webpage 400 can facilitate configuration of any parameters supported by a network appliance.
There are several scenarios in which venue operators configure their network appliances. In some instances, using a website hosted by the configuration service, a venue operator can select configuration options for a network appliance, where the configuration options are selected from a small number of pre-set configuration profiles. The operator can select a configuration profile, and associate the profile to a particular appliance (e.g., the configuration profile is associated with an appliance serial number). When selecting from the pre-set configuration profiles, the venue operator need not have technical expertise about access networks, subscriber networks, and billing/business options. Instead, the operator may simply select (via the website) a configuration profile based on a simple, lay person's description about the configuration. After selecting the configuration, the venue operator can set-up the appliance at a venue. After each appliance is plugged-into the subscriber network, the appliance provides its serial number to the configuration service. In response, the configuration service can transmit back to the appliance the configuration information that has been selected for that appliance. In turn, the appliance receives the configuration information and automatically configures itself.
In some scenarios, venue operators may want to configure appliances in an on-demand manner. For on-demand configuration, a venue operator can plug-in an appliance to a subscriber network. After plugging-in the appliance, a venue operator can browse to a website hosted by the configuration service. The website enables the venue operator to choose configuration options to load onto the appliance. In some instances, the venue operator may choose a configuration from a detailed list of parameters (e.g., access network parameters, provider network parameters, etc.). In other instances, the venue operator may answer questions about the venue and appliance, where the answers are used to select configuration information for the appliance. After the configuration options are selected via the website, the configuration service transmits configuration information to the appliance. In turn, the appliance can configure itself based on the configuration information.
Technicians can set-up the configuration service's pre-set configuration profiles. Therefore, some embodiments enable the venue owner to access configuration profiles designed by technicians with expertise about access networks, subscriber networks, etc. The configuration information can include the following: venue identifier and location, monetization model, authorization and payment information, venue federation assignment, appliance routing configuration, quality of service parameters, etc.
In other scenarios, the appliance cannot communicate with a subscriber network to reach the configuration service. In such a scenario, a venue operator can plug (e.g., via a Universal Serial Bus connection) the appliance into a laptop computer or other device that has internet connectivity. The configuration service can transmit configuration to the laptop computer, which in turn forwards it to the appliance.
In some scenarios, there are very specific configurations for different locations. For example, there may be different appliance configurations for different zip codes, street addresses, latitude and longitude locations, etc. An appliance deployed in one zip code may have different business/billing parameters then appliances deployed in other zip codes. One reason for this may be that rents are higher in certain zip codes, and therefore Internet access charges are higher in those zip codes. As another example, certain zip codes may have access to certain provider networks, while others have access to other provider networks. The appliances may need different configurations to work with the different subscriber networks.
This section describes operations performed by some embodiments of the network appliance and the remote configuration service.
At block 504, the network appliance's access point detects a subscriber network. As discussed above, embodiments of the network appliance use a subscriber network to download configuration parameters from the cloud (e.g., a remote configuration service). The flow continues at block 506.
At block 506, the network appliance's configuration management module transmits, to a remote configuration service, identifying information to a remote configuration service via a secure tunnel. In some embodiments, the appliance's split tunnel VPN client establishes a secure tunnel over the subscriber network with the remote configuration service. In some embodiments, the identifying information includes the network appliance's serial number or other unique identifier, and location information (e.g., street address, longitude and latitude coordinates, zip code, etc.). The flow continues at block 508.
At block 508, the network appliance's configuration management module receives configuration information from the remote configuration service. Configuration information can include parameters for configuring all aspects of the network appliance, including access network parameters, subscriber network parameters, billing business parameters, etc. The flow continues at block 510.
At block 510, the network appliance's configuration management module configures the appliance according to the configuration information. For example, based on the configuration information, the configuration manager module sets the access network's WiFi channels, frequencies, SSID, security protocol (e.g., WPA), etc. The configuration manager module can also use the configuration information to set parameters for the subscriber network, and billing and business parameters. The flow continues at block 512.
At block 512, the configuration management module determines whether an operator has enabled configuration on-demand. Configuration on-demand enables an operator to tweak configuration settings. In some embodiments, the network appliance downloads basic configuration settings from the remote configuration service, while enabling operators to tweak the configuration after the network appliance is up and running. In some embodiments, the network appliance presents configuration on-demand configuration options via a web server residing locally on the appliance. The configuration options may be in the form of questions that do not require technical expertise to answer. Alternatively, the configuration options can be suited for a technical expert. The web server can communicate with the remote configuration service, receiving new configuration parameters and updating the service about the appliance's final configuration after the on-demand configuration is complete. If on-demand configuration has not been selected, the flow continues at block 516. Otherwise, the flow continues at block 514.
At block 514, the configuration management module configures the network appliance according to parameters selected via the on-demand interface. The flow continues at block 516.
At block 516, after the configuration is complete, the network appliance processes network traffic. From block 516, the flow ends. The discussion of
At block 604, as part of servicing the access request, the network appliance's split tunnel VPN client establishes a secure tunnel through which the network appliance communicates authentication credentials to a remote authentication service. The network appliance can communicate with the remote configuration service without an authentication gateway residing on telecom system components. For example, the network appliance need not send network traffic to a gateway residing on the telecom system, where the gateway filters traffic looking for the network access requests, and forwards the requests to the remote configuration service. Instead, the network appliance itself directs network access requests to the remote authentication service via a secure tunnel. The flow continues at block 606.
At block 606, the network appliance determines whether the authentication was successful. That is, the network appliance determines whether the remote authentication service successfully authenticated the user credentials. If the remote authentication service did not authenticate the user credentials, the flow ends. Otherwise, the flow continues at block 608.
At block 608, the network appliance enables network traffic from the user to reach the Internet without passing through the remote authentication system. For example, the network appliance's split tunnel VPN client routes traffic for authenticated users to the Internet, bypassing the remote authentication service. As a result, the network appliance reduces the amount of traffic sent to the remote authentication service. Because less traffic goes to the remote authentication service, users receive web content faster. From block 608, the flow ends.
While
At block 704, the configuration service determines whether this is the network appliance's initial configuration. In some embodiments, the configuration service maintains records identifying network appliances that have not yet been initially configured. The records may also indicate network appliances that have already been configured. If this is the network appliance's initial configuration, the flow continues at block 706. Otherwise, the flow continues at block 710.
At block 706, the configuration service determines configuration parameters for the network appliance. As discussed above, a network appliance's initial configuration can be designed by technicians associated with the configuration service, or selected by operators using a configuration website. The configuration parameters can include parameters for an access network, subscriber network, billing/business policies, and any other suitable configuration parameters. The flow continues at block 708.
At block 708, the configuration service records the configuration parameters selected at block 706, and transmits the configuration parameters to the network appliance. As a result, the network appliance can perform an automatic configuration process, and the configuration parameters are stored for safekeeping and future operations. From block 708, the flow ends.
Returning to block 710, after determining that the network appliance has already undergone initial configuration (see 704), the configuration service validates the network appliance's configuration parameters. That is, to ensure proper operation of the network appliance, the configuration service validates the network appliance's configuration parameters and by comparing them to the recorded settings. The flow continues at block 712.
At block 712, if the network appliance's configuration parameters and are valid, the flow ends. Otherwise, the flow continues at block 714, where the configuration service takes measures to address issues with the configuration parameters. For example, if the identifying information indicates that the network appliance has moved, the network appliance determine new configuration information based on the new location. From block 714, the flow ends.
As will be appreciated by one skilled in the art, aspects of the present inventive subject matter may be embodied as a system, method or computer program product. Accordingly, aspects of the present inventive subject matter may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a “circuit,” “module” or “system.” Furthermore, aspects of the present inventive subject matter may take the form of a computer program product embodied in one or more computer readable medium(s) having computer readable program code embodied thereon.
Any combination of one or more computer readable medium(s) may be utilized. The computer readable medium may be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium would include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.
A computer readable signal medium may include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.
Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.
Computer program code for carrying out operations for aspects of the present inventive subject matter may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the “C” programming language or similar programming languages. The program code may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider).
Aspects of the present inventive subject matter are described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems) and computer program products according to embodiments of the inventive subject matter. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer readable medium that can direct a computer, other programmable data processing apparatus, or other devices to function in a particular manner, such that the instructions stored in the computer readable medium produce an article of manufacture including instructions which implement the function/act specified in the flowchart and/or block diagram block or blocks.
The computer program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
While the embodiments are described with reference to various implementations and exploitations, it will be understood that these embodiments are illustrative and that the scope of the inventive subject matter is not limited to them. In general, techniques for configuring and operating network appliances as described herein may be implemented with facilities consistent with any hardware system or hardware systems. Many variations, modifications, additions, and improvements are possible.
Plural instances may be provided for components, operations or structures described herein as a single instance. Finally, boundaries between various components, operations and data stores are somewhat arbitrary, and particular operations are illustrated in the context of specific illustrative configurations. Other allocations of functionality are envisioned and may fall within the scope of the inventive subject matter. In general, structures and functionality presented as separate components in the exemplary configurations may be implemented as a combined structure or component. Similarly, structures and functionality presented as a single component may be implemented as separate components. These and other variations, modifications, additions, and improvements may fall within the scope of the inventive subject matter.
| Number | Name | Date | Kind |
|---|---|---|---|
| 20020161885 | Childers | Oct 2002 | A1 |
| 20060191005 | Muhamed | Aug 2006 | A1 |
| 20100080202 | Hanson | Apr 2010 | A1 |
| 20130029687 | Cooper | Jan 2013 | A1 |
| Number | Date | Country | |
|---|---|---|---|
| 20140188676 A1 | Jul 2014 | US |
