Patent Application
20140189847
The present invention relates to packet switched networks, and more particularly to provisioning an endpoint for communication in a virtual private network (VPN).
VPN services have gained in popularity as an increasingly mobile and disparate work force needs reliable, low-cost remote connectivity to business applications and resources. A VPN is generally a private network that uses a public network (usually the Internet) to connect remote sites or users together. Instead of using a dedicated, real-world connection such as a leased line, a VPN uses “virtual” connections routed through the Internet from the company's private network to the remote site or employee. However, setting up a remote VPN client is a problem because remote connectivity cannot be established, and the purpose of the VPN connection is to establish that connectivity. Generally, a typical remote site client operates within a private network, such as a home network, and is protected by both a firewall and Network Address Translator (NAT). To the outside world, this client is not reachable as the public IP address can change dynamically and the firewall will block any external requests. This makes it very difficult for a centralized system administrator to setup, customize and activate a newly deployed remote terminal device. In addition, deployment over public networks, such as the Internet, is often impeded by lack of interoperability and complexity of configurations.
It is an object of the present invention to mitigate or obviate at least one of the above-mentioned disadvantages.
In one of its aspects, there is provided a method for remote deployment of at least one terminal device in a virtual private network (VPN), the method comprising the steps of:
providing at least one terminal device with client software from a call manager;
updating said at least one terminal device with said terminal settings as defined by said call manager server;
instructing said at least one terminal device to use a VPN connection for connectivity and media communication;
at said call manager server, generating a certificate for said VPN connection;
providing said at least one terminal device with said certificate;
instructing said at least one terminal device to restart;
causing said client software to enable VPN connections and negotiate said VPN connection with said at least one call manager server;
establishing said VPN connection; and
presenting a login page on a graphical user interface associated with said terminal device.
In another of its aspects, there is provided a call manager server, the call manager server comprising:
a machine-readable medium having embodied thereon a computer program coded to provide instructions for provisioning at least one terminal device for communication in a VPN, said computer program coded to:
periodically provide said at least one terminal device with client software updates and terminal settings configuration data;
cause said at least one terminal device to use a VPN connection for connectivity and media communication;
generate a certificate for said VPN connection;
forward said certificate to said at least one terminal device;
instruct said terminal device to restart following receipt of said certificate;
negotiate said VPN connection with said at least one terminal device;
establish said VPN connection upon successful negotiation; and
present a login page on a graphical user interface associated with said at least one terminal device.
In yet another aspect, there is provided a terminal device comprising:
a machine-readable medium having embodied thereon a computer program coded to provide instructions for provisioning said terminal device for communication in a VPN, said computer program coded to:
cause said terminal device to establish a VPN connection for connectivity and media communication;
request a certificate for said VPN connection; and receive;
cause said terminal device to restart following receipt of said certificate;
negotiate said VPN connection with a host device; and
establish said VPN connection upon successful negotiation.
Advantageously, by facilitating substantially hassle-free installations or configuration of IP endpoints for end-users, the operational burden of service activation, requests for support for installation or technical assistance are substantially diminished or eliminated. Consequently, service providers are presented with a competitive time-to market and a service cost advantage. Additionally, service providers have the freedom to choose any number of IP endpoints from numerous manufacturers without being concerned about the resources normally required to provision the IP endpoints using prior art methods.
Several preferred embodiments of the present invention will now be described, by way of example only, with reference to the appended drawings in which:
The detailed description of exemplary embodiments of the invention herein makes reference to the accompanying block diagrams and schematic diagrams, which show the exemplary embodiment by way of illustration and its best mode. While these exemplary embodiments are described in sufficient detail to enable those skilled in the art to practice the invention, it should be understood that other embodiments may be realized and that logical and mechanical changes may be made without departing from the spirit and scope of the invention. Thus, the detailed description herein is presented for purposes of illustration only and not of limitation. For example, the steps recited in any of the method or process descriptions may be executed in any order and are not limited to the order presented.
Moreover, it should be appreciated that the particular implementations shown and described herein are illustrative of the invention and its best mode and are not intended to otherwise limit the scope of the present invention in any way. Indeed, for the sake of brevity, certain sub-components of the individual operating components, conventional data networking, application development and other functional aspects of the systems may not be described in detail herein. Furthermore, the connecting lines shown in the various figures contained herein are intended to represent exemplary functional relationships and/or physical couplings between the various elements. It should be noted that many alternative or additional functional relationships or physical connections may be present in a practical system.
The present invention may also be described herein in terms of screen shots and flowcharts, optional selections and various processing steps. The present invention may employ various integrated circuit components (e.g., memory elements, processing elements, logic elements, look-up tables, and the like), which may carry out a variety of functions under the control of one or more microprocessors or other control devices. Similarly, the software elements of the present invention may be implemented with any programming or scripting language such as C, C++, Java, COBOL, assembler, PERL, extensible markup language (XML), smart card technologies with the various algorithms being implemented with any combination of data structures, objects, processes, routines or other programming elements. Further, it should be noted that the present invention may employ any number of conventional techniques for data transmission, signaling, data processing, network control, and the like.
As is known in the art, Internet Protocol (IP) is a routing protocol designed to route traffic within a network or between networks. IP is described in IETF RFC-791, incorporated herein by reference. However, the present invention is not limited to IP data interfaces and other data interfaces can also be used.
First, the terminal device 12 is communicatively coupled to a network 14, such as a public network or the Internet, following manual configuration or an automated configuration process using auto-discovery mechanisms. As an example, the terminal device 12 obtains an IP address provided through a Dynamic Host Configuration Protocol (“DHCP”) server. Alternatively, the terminal device 12 may be preconfigured with an assigned static IP address. The computer-readable medium of the terminal device 12 is included with factory-set default data, such as, a URI to a call manager server 16 to route calls and process signaling, or an address of an intranet server to establish a VPN connection with, and a port number of a port on the local loopback interface to which traffic is forwarded. The call manager server 16 may also include a repository of the configuration data, digital certificates for the terminal device 12, or is coupled to configuration servers having that configuration data. The URI of the call manager server 16 may be a public name or IP address, for example, “blustarserver.aastra.com”; however, the URI may be customized as part of the branding for a partner/customer in an OEM agreement. The call manager server 16 is preferably remotely based and includes data processing means comprising a processor (which may be referred to as a central processor unit or CPU, logic means, or controller) that is in communication with a computer-readable medium having data and/or program code, input/output (I/O) devices, a network interface, and other interfaces. Preferably, the call manager server 16 is scalable, robust and includes failover capabilities and built-in redundancies.
Next, the remote device 12 initiates a connection destined to the call manager server 16, the connection request is received by a firewall but is not considered a threat, as such a connection request is similar or equivalent to a user starting a browser session. The connection request includes a unique identifier associated with the terminal device, such as a media access control (MAC) address. Preferably, the terminal device 12 connects over port 443 (HTTPS) to the call manager server 16 IP address, such that the connection is encrypted and secure. The call manager server 16 then acknowledges the connection request from the remote device 12, determines the remote device 12's public IP address thus gaining the necessary route back information for communications. Since communication is initiated by the remote terminal device 12, the firewall permits the call manager server 16 to send unsolicited traffic provided that the remote terminal device 12 keeps the communication channel active. Maintaining the communication channel active is achieved by causing the remote terminal device 12 to periodically “poll” the call manager server 16 for software updates, such as the client application and other information.
Upon initiating the above contact, and establishing a bi-directional communication link, the call manager server 16 detects the terminal device 12 type, the terminal device 12 state and performs a series of maintenance and update activities as provisioned by the system administrator. These activities may be customized for each terminal device 12 as each terminal device 12 is uniquely identified by its MAC address.
As shown in
Advantageously, these provisioning steps obviate the need for an end user to have to read and follow instructions on how to setup VPN. Further, these steps greatly minimizes the preparation time, by the system operator, prior to deployment of the terminal device 12. Typically, the system administrator would have to invest a substantial amount of time to un-package and set up a terminal device 12, verify proper function of the terminal device 12, and finally re-package and ship the terminal device 12. Since the terminal device 12 is to be used in a private network, this setup would need to be done on a private IP cloud further complicating the staging setup. Alternatively, the user would have to contact a technical support person who would then have to instruct the user on how to navigate several menus and setup the terminal device 12.
Benefits, other advantages, and solutions to problems have been described above with regard to specific embodiments. However, the benefits, advantages, solutions to problems, and any element(s) that may cause any benefit, advantage, or solution to occur or become more pronounced are not to be construed as critical, required, or essential features or elements of any or all the claims. As used herein, the terms “comprises,” “comprising,” or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Further, no element described herein is required for the practice of the invention unless expressly described as “essential” or “critical.”
The preceding detailed description is presented for purposes of illustration only and not of limitation, and the scope of the invention is defined by the preceding description, and with respect to the attached claims.
This application claims the benefit of priority to U.S. Provisional Application Ser. No. 61/747,702 filed on Dec. 31, 2012.
| Number | Date | Country | |
|---|---|---|---|
| 61747702 | Dec 2012 | US |
