Patent Application
20050177640
The present invention relates to the field of computer networks. In particular, the present invention relates to a device and a method for selectively providing access to voice and data networks by use of intelligent hardware.
Modern businesses commonly integrate computer networks (both data and voice IP) into their business operations. Typically, network access ports are located throughout the place of business operations. An electronic device can often access the network by connecting with one of the network access ports.
Typical office buildings often have public spaces (e.g., areas open to the public on a regular basis) and private spaces (e.g., areas closed to the public, such as private offices and cubicles). Additionally, these public and private spaces often have gray zones, such as lobbies and conference rooms. Furthermore, some spaces are both public and private, depending on the times of day and the location (e.g., a main lobby during business hours and after business hours). As a result, it is often possible for people unaffiliated with the business to access the network. Thus, unaffiliated people may access the Internet, or possibly the company Intranet, simply by connecting to a network access port.
One way to attempt to control the access of persons to a network is to administer a password system, requiring a user to enter in a user name and password to access the network. However, passwords are often hard to administer, as they require a password control infrastructure. Furthermore, password systems are not completely effective against all attempts at circumventing security, and are often subject to dictionary or other automated means of attack.
Another way to attempt to control access to a network is to control access to locations of the office building where network access ports are located. This is not always effective, as individuals who desire to access the network may tap into the network cabling at an uncontrolled location, such as a closet or through a ceiling panel.
Accordingly, a need exists for security measures for controlling access to a network connection. In particular, a need exists for a method for selectively providing access to a network. A need also exists that satisfies the above requirements, and does not permit access to the network at anywhere but a network access port.
The present invention provides for security measures for controlling access to a network connection. A method for selectively providing access to voice and data networks by use of intelligent hardware is presented. The present invention provides security measures for controlling access to a network connection. The present invention provides a method of easier management of information systems.
In one embodiment, an electronic device communicatively coupled to intelligent hardware, also referred to herein as an intelligent data concentrator, initiates a request to access a network. The request is received at the intelligent data concentrator communicatively coupled to the network and configured to allow access to the network according to predetermined criteria. Provided the request satisfies the predetermined criteria, the electronic device is provided access to the network.
In one embodiment, the predetermined criteria may include placing geographic restrictions (e.g., the room the port is located in), temporal restrictions (e.g., weekend or nighttime restrictions), and user class restrictions (e.g., visitor restrictions or low-level employee restrictions), or any combination of multiple criteria, on specific ports. In one embodiment, a central control site manages the predetermined criteria, and transmits the predetermined criteria to each intelligent data concentrator.
In one embodiment, the intelligent hardware comprises a first interface for communicatively coupling the intelligent hardware to a network and a second interface for communicatively coupling the intelligent hardware to a plurality of electronic devices. Coupled to both the first interface and the second interface is a processor. Coupled to the processor is an access provider for receiving a request from an electronic device to access the network at the intelligent hardware and for providing access to the network according to predetermined criteria. In one embodiment, the intelligent hardware has a specific access port serial number associated therewith.
These and other objects and advantages of the present invention will become obvious to those of ordinary skill in the art after having read the following detailed description of the preferred embodiments which are illustrated in the various drawing figures.
The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments of the invention and, together with the description, serve to explain the principles of the invention:
In the following detailed description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the present invention. However, it will be apparent to one skilled in the art that the present invention may be practiced without these specific details. In other instances, well-known structures and devices are not described in detail in order to avoid obscuring aspects of the present invention.
Some portions of the detailed descriptions which follow are presented in terms of procedures, steps, logic blocks, processing, and other symbolic representations of operations on data bits within a computer memory. These descriptions and representations are the means used by those skilled in the data processing arts to most effectively convey the substance of their work to others skilled in the art. A procedure, computer executed step, logic block, process, etc., is here and generally conceived to be a self-consistent sequence of steps of instructions leading to a desired result. The steps are those requiring physical manipulations of data representing physical quantities to achieve tangible and useful results. It has proven convenient at times, principally for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers or the like.
It should be borne in mind, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities. Unless specifically stated otherwise as apparent from the following discussions, it is appreciated that throughout the present invention, discussions utilizing terms such as “receiving”, “allowing”, “processing”, “interpreting”, “providing” or the like, refer to the actions and processes of a computer system, or similar electronic computing device. The computer system or similar electronic device manipulates and transforms data represented as electronic quantities within the computer system's registers and memories into other data similarly represented as physical quantities within the computer system memories into other data similarly represented as physical quantities within the computer system memories or registers or other such information storage, transmission, or display devices.
Portions of the present invention are comprised of computer-readable and computer executable instructions which reside, for example, in computer-usable media of a computer system. It is appreciated that the present invention can operate within a number of different computer systems including general purpose computer systems, embedded computer systems, and stand alone computer systems specially adapted for controlling automatic test equipment.
The present invention provides a device and method for selectively providing access to voice and data networks by use of intelligent hardware, also referred to herein as an intelligent data concentrator. Specifically, the present invention is a device and method for providing security measures based on predetermined criteria for controlling access to a network connection. In one embodiment, the present invention is a device and method for providing security measures to accessing a corporate network. The described method can be controlled from a remote network management console, providing a central control site for enacting security measures. In one embodiment, access to the network is restricted to electronic devices connecting through intelligent hardware.
In one embodiment, network access is provided through intelligent data concentrator 210 that is physically mounted in the wall of a public area such as a conference room or lobby. The integrity of the protection that intelligent data concentrator 210 offers is enhanced by this type of arrangement since the end user can not readily bypass the unit by gaining access to the network connection.
In one embodiment, mounting hardware attaching intelligent data concentrator 210 to the wall also comprises a tamper detection means 260. In one embodiment, tamper detection means 260 is tamper detection hardware or a tamper detection switch. If a user attempts to circumvent the security measures by physically removing intelligent data concentrator 210, the act of removing the mounting screws would be detected by tamper detection means 260 and an alerting message would be transmitted to the central control site. In one embodiment, the attempt would be logged and a control message could be sent to the head end switch or router that would disallow network traffic on the segment that intelligent data concentrator 210 was attached to.
A plurality of standard communications ports 220 are mounted on the external surface 230 of this embodiment. In one embodiment, communication port 220 is an RJ-45 jack. In another embodiment, communication port 220 is an RJ-11 jack. It should be appreciated that communication port 220 is not limited to any particular jack, and that any type of communication port can be used. Additionally, while intelligent data concentrator 210 illustrates four communication ports 220, it should be appreciated that alternative implementations could support a greater or lesser number of communication ports 220.
Connections to the central data (LAN) or voice network 240 are terminated at intelligent data concentrator 210 for coupling to communication ports 220. Termination of the network cabling 250 (voice or data) will provide for both a reliable electrical and mechanical connection for industry standard communications cabling such as CAT-3, CAT-5, CAT-5E or similar cabling.
In addition to wired connections to and from this embodiment and the client devices, wireless connectivity is a viable method. Infrared (IR), BlueTooth, 802.11 or other means could be utilized to communicate with the device.
In one embodiment, intelligent hardware 410, 415 and 420 are connected to central control site 405 by means of network cabling. In the current embodiment, CAT 3 or 5 cabling is used and an Ethernet physical interface is employed. However, it should be appreciated that the present invention will work with other types of LANs, such as LANs with differing physical connections or adopted for use in RF wireless and optical systems.
Intelligent hardware 410 is coupled to electronic devices 425a and 425b. Similarly, intelligent hardware 415 is coupled to electronic devices 430a, 430b and 430c, and intelligent hardware 420 is coupled to electronic devices 435a and 435b. It should be appreciated that electronic devices can comprise any number of data devices or client devices, including but not limited to: computer systems, printers, voice IP telephones, and fax machines configured for use over voice IP networks. It should be further appreciated that electronic devices coupled to intelligent hardware can be coupled by either a wired or a wireless connection. In the event of a wireless connection, intelligent data concentrator 210 can operate as part of the wireless authentication protocol.
At step 510, a request to access a network is received at intelligent hardware (e.g., intelligent data concentrator 210 of
In one embodiment, each intelligent data concentrator has a specific access port serial number associated therewith. The serial number is deployed at installation and the installed units cannot be moved without the central control site being alerted to an attempt to move the intelligent data concentrator. The present embodiment provides a high level of access control for each intelligent data concentrator.
At step 520, the intelligence of the intelligent data concentrator (e.g., means for processing and interpreting data 612 of
In one embodiment, the criteria established are tailored according to several factors. For example, the criteria may pertain to the registration status of a user, the type of location the user is accessing from (e.g. public or private), or the time of day. In one embodiment, commands to update and change the characteristics of the permitted types of traffic are managed by an encrypted exchange between the central control site and the intelligent data concentrators. The filtering of traffic through the device is implemented by traditional firewall techniques.
In one embodiment, criteria is established where network connections initiated from a public space, such as a conference room connected to a public lobby, are limited to the access of the public internet while restricting all traffic to and from the corporate intranet. In another embodiment, criteria is established that operates to block all access from specific geographic locations outside of the normal business hours.
In certain instances it might be desirable to enable a higher degree of access to specific identified and trusted users. In one embodiment, the intelligent data concentrator comprises an identification means configured to read an identification verification means. In one embodiment, the identification means is identification hardware, such as an identification badge reader. In one embodiment, the identification verification means is an access control badge or other identification tokens are used to control the degree of access. The detection of a badge by a reader could initiate a request transmission that would be logged and would then forward a request to the network control application. Once the request was received, criteria that enable a greater degree of access (e.g., access to corporate Intranet) could be sent to the intelligent data concentrator. Alternately, once identified, a specific user may be denied access to the network from a certain locations, thus limiting the number of predefined locations a user may access the network from.
In one embodiment, the criteria allowing greater access could be retained for the duration of the current session and automatically revert to a restrictive set when the user logs out or when a sensor detected that the user had left the room. In the present embodiment, the badge reader is the same system that is commonly used to control physical access to certain locations. In another embodiment, utilizing password control or biometric identification for identifying the end user is employed.
Returning to
Intelligent data concentrator 602 comprises a first interface 604 for communicatively coupling intelligent data concentrator 602 to network 608. Intelligent data concentrator 602 also comprises a plurality of second interfaces 606a-d for communicatively coupling intelligent data concentrator 602 to a plurality of electronic devices 610a-d. In one embodiment, second interfaces 606a-d are communication ports (e.g., communication ports 220 of
Intelligent data concentrator 602 also comprises means for processing and interpreting data 612 coupled to the first interface 604 and access provision means 614 coupled to the means for processing and interpreting data 612. Means for processing and interpreting data 612 is intended to include, but not limited to: a processor, a robust processor, a central processing unit (CPU), and a random access memory (RAM).
Access provision means 614 is intended to include, but not limited to: a hardware access provider, a network connection filter, a software access provider and a firmware access provider. In one embodiment, access provision means 614 is an access provider for selectively providing electronic devices with access to a network. In one embodiment, access provision means 614 is a software implementation for selectively providing electronic devices with access to a network. In one embodiment, access provision means 614 operates in conjunction with a central control site (e.g., central control site 405 of
The preferred embodiment of the present invention, a device and method for selectively providing access to voice and data networks by use of intelligent hardware, is thus described. While the present invention has been described in particular embodiments, it should be appreciated that the present invention should not be construed as limited by such embodiments, but rather construed according to the below claims.
This application claims priority to the copending provisional patent applications: patent application Ser. No. 60/277,593, attorney docket number 3COM-3650.BCG.US.PRO, entitled “‘Intellijack’ physical concepts,” with filing date Mar. 20, 2001, and assigned to the assignee of the present invention; patent application Ser. No. 60/277,767, attorney docket number 3COM-3651.BCG.US.PRO, entitled “A method for managing intelligent hardware for access to voice and data networks,” with filing date Mar. 20, 2001, and assigned to the assignee of the present invention; patent application Ser. No. 60/277,451, attorney docket number 3COM-3652.BCG.US.PRO, entitled “A method for filtering access to voice and data networks by use of intelligent hardware,” with filing date Mar. 20, 2001, and assigned to the assignee of the present invention; patent application Ser. No. 60/277,592, attorney docket number 3COM-3653.BCG.US.PRO, “‘Intellijack’ usage,” with filing date Mar. 20, 2001, and assigned to the assignee of the present invention; and patent application Ser. No. 60/285,419, attorney docket number 3COM-3722.BCG.US.PRO, “Intelligent concentrator,” with filing date Apr. 20, 2001, and assigned to the assignee of the present invention.
| Number | Date | Country | |
|---|---|---|---|
| 60277593 | Mar 2001 | US | |
| 60277767 | Mar 2001 | US | |
| 60277451 | Mar 2001 | US | |
| 60277592 | Mar 2001 | US | |
| 60285419 | Apr 2001 | US |
