US 20070127500 A1
A system, device, method and software for providing a visitor access to a public network are disclosed. In one form, a virtual visitor enabled local area network includes a visitor access point operable to provide a visitor access to a public network while connected to a local area network (LAN). The visitor access point is operable to protect the LAN using a virtual visitor network established between the visitor access point and a virtual visitor network gateway.
34. A system for escorting packets from a source device to a destination device in a private network comprising:
memory in electronic communication with the processor; and
instructions stored in the memory, the instructions being executable to:
receive a packet from the source device;
encapsulate the packet from the source device with a first header and a second header, wherein the first header indicates an encryption method, and wherein the second header includes routing information.
35. The system of
36. The system of
37. The system of
38. The system of
39. The system of
40. A method for escorting packets from a source device to a destination device in a private network comprising:
receiving a packet from the source device;
encapsulating the packet from the source device with a first header and a second header, wherein the first header indicates an encryption method, and wherein the second header includes routing information.
41. The method of
42. The method of
43. The method of
44. The method of
45. The method of
46. A network for escorting packets from a source device to a destination device comprising:
an access point to provide access to the network;
memory in electronic communication with the processor; and
instructions stored in the memory, the instructions being executable to:
receive a packet from the source device;
encapsulate the packet from the source device with a first header and a second header, wherein the first header indicates an encryption method, and wherein the second header includes routing information
47. The network of
48. The network of
49. The network of
50. The network of
51. The network of
The disclosure relates generally to local area networking, and more particularly to a system, device, method and software for providing a visitor access to a public network.
Most enterprises do not allow visitors to access their private local area networks (LANs) due to security concerns creating difficult work environments when visitors need to access the Internet or remote access accounts via public networks. The primary reason enterprise network managers limit access is to protect their network, servers, systems, etc. from direct or indirect malignant attacks. As such, a visitor's productivity can be significantly affected if a visitor cannot access the Internet while visiting an enterprise. For example, consultants may not be able to efficiently advise their clients without having access to a public network while they are working with clients.
Currently, some conventional solutions are available including creating visitor accounts to provide a visitor access public access with significantly limiting access to the private LAN. Though effective, this usually requires client and server synchronized software to provide access and management of user names, passwords, access levels, etc. Such arrangements may be functional but leave a network vulnerable to outside attacks when a user accesses a public network and provides for continuous management and monitoring of network accounts. As such, there is a need for enterprises to provide visitors access to a public network from within their local area network without compromising the security of their own network or having to maintain user accounts, passwords, custom software, etc.
According to one aspect of the invention, a virtual visitor enabled local area net work includes a visitor access point operable to provide a visitor access to a public network while connected to a local area network (LAN). The visitor access point is operable to protect the LAN using a virtual visitor network established between the visitor access point and a virtual visitor network gateway.
According to another aspect of the invention, a device for providing visitor access to a public network via a private local area network is provided. The device includes a visitor access port operable to enable a visitor to access a public network from within a private local area network (LAN) while protecting the private LAN from the visitor. The device further includes a communication interface operably coupled to the visitor access port and the private LAN and the communication interface is operable to communicate information between the visitor access port and a selective location within the private LAN.
According to a further aspect of the invention, a network enabled gateway operable to provide a visitor access to a public network from within a private local area network (LAN) is disclosed. The gateway includes a public network access interface operable to communicate processed virtual visitor network data packets to a public network that originate from within a private local area network (LAN). The gateway further includes a virtual network processor operable to process public network access data packets to provide virtual visitor network data packets for communication within the private LAN to provide a visitor access to the public network.
Other advantages, features and characteristics of the invention, as well as methods, operation and functions of related elements of structure, and the combinations of parts and economies of manufacture, will become apparent upon consideration of the following description and claims with reference to the accompanying drawings, all of which form a part of the specification, wherein like reference numerals designate corresponding parts in the various figures, and wherein:
Visitor access point 101 allows for a visitor that would normally not have access to LAN 102 to access public network 103 when connected to LAN 102. For example, a visitor may couple a computer system (not expressly shown) to visitor access point 101 and may require accessing public network 103. Visitor access point 101 advantageously allows for protection of LAN 102 while a user accesses public network 103 through encapsulating data packets communicated via visitor access point 101 and LAN 102. In this manner, other network locations or nodes within LAN 102 (not expressly shown) may be isolated from inquiries, data requests, snooping, malignant attacks, etc. initiated by a visitor or other agent when a visitor connects to LAN via visitor access point 101.
During operation, visitor 201 may access public network 206 through connecting to a VVN module 202. VVN module 202 detects that visitor 201 is attempting to access network and initiates a process to isolate visitor 201 from private LAN 200 while all owing visitor 201 to access only public network 206. For example, VVN module 202 processes data packets initiated by a visitor's computer system 201 coupled to VVN module 202 such that other locations within private LAN 200 ignore any unauthorized data or access requests to one or more locations within private LAN 200. VVN gateway 208 identifies data packets communicated by VVN module 202 and as data packets are communicated by VVN module 202, VVN gateway 208 receives the data packets and processes the data packets prior to communicating the data packets to public network 206. For example, VVN gateway 208 modifies header information within the data packets to include a source address of VVN gateway 208. As data packets are received from public network 206 in response to data packets communicated by VVN gateway 208, VVN gateway 208 processes the data packet to provide a destination or IP address of VVN module 202 and communicates the data packet to VVN module 202 using private LAN 200. As such, each packet is processed to encapsulate or isolate all other network locations within private LAN 200 from the visitor 201 requested data and communicated only to visitor 201 allowing a visitor 201 to access a public network 206, such as the Internet, from within a private local area network without compromising security of a private local area network or having to manage or create visitor/user access accounts with limited access to network locations within a local area network. In one embodiment, VVN gateway 208 and the public network gateway 205 may be integrated into a single server or system operable to provide accessing to public network 206.
In another embodiment, VVN module 202 may be used to allow an employee to access public network 206 via VVN gateway 208. In this manner, an employee that may not be able to access a private LAN node(s) 204 or an employee LAN access point(s) 203 may access only public network 206 via virtual visitor network 207 when connected to VVN module 202.
During operation, VVN module 300 dynamically assigns a network IP address when a visitor connects to visitor access points 308 and performs a network address translation using NAT 305 when data is communicated using the assigned IP addresses. VVN processor 304 processes data communicated between private LAN 307 and visitor access point(s) 308 to add and remove data packet header information for data packets and provide a unique network IP address that identifies a visitor when connected to one of visitor access point(s) 308. VVN processor 304 encapsulates data communicated via visitor access points 308 through isolating data packets to select or specific network ad dresses within private LAN 307. For example, VVN processor 304 may provide a network destination address for only a network gateway (not expressly shown) provided within or in association with private LAN 307 that allows for access to a public network. In this manner, no other locations or network addresses within private LAN 307 may be accessed by a computer system connected to one of visitor access point(s) 308. As incoming data packets are communicated from private LAN 307 and received by network interface 306, network address translator 305 translates the address information for the data packets and VVN processor 304 verifies heading information and detects if data packets having IP addresses for a visitor coupled to one of visitor access point(s) 308 have been received. If a visitor's data packet has been received, VVN processor 304 restore the information and router 302 and network switch 301 processes and communicates the data packet to the appropriate visitor connected to a visitor access point 308.
In one embodiment, VVN module 300 may allow a visitor to use a network printer (not expressly shown) accessible by VVN module 300. For example, a network printer may be coupled directly to VVN module 300 and VVN module 300 may include a print server (not expressly show) and a network printer connected to VVN module 300 via, for example, one of visitor access point(s) 308. In another embodiment, a network printer may be accessed by a visitor coupled to one of visitor access point(s) via private LAN 307. For example, VVN module 300 may include a print server having network IP addresses for one or more network printers and may allow for access to a printer internal to private LAN 307 without using a print server (not expressly shown) located within private LAN 307. In this manner, visitor originated data may be selectively communicated to a specific destination or IP address within private LAN 307 without jeopardizing network security and allowing a visitor to print a document.
Wireless VVN module 310 includes a network address translator (NAT) 315 operable to translate addresses contained within data packets and a DHCP server 313 operable to assign dynamic IP addresses to visitor computers wirelessly coupled to wireless VVN module 310 via wireless visitor access point(s) 318. A router 312 and wireless hub transceiver 311 provide for routing of information to and from wireless visitor computers connected via wireless visitor access point(s) 318 and further connected to private LAN 317. Though illustrated as a single access point to private LAN 317, it should be understood that wireless VVN module 310 may configured to accommodate more than one network address within private LAN 317. Wireless VVN module 310 further includes a virtual visitor network (VVN) processor 314 operable to process data packets communicated from one or more systems coupled to wireless visitor access point(s) 318 and a VVN server (not expressly shown) and desiring access to a public network, such as the Internet, via private LAN 317.
During operation, a user may access private LAN 317 using a wireless-enabled computer system operable to connect to wireless visitor access point(s) 318. For example, wireless VVN module 310 may be placed proximal to a conference room, visitor center, etc. which may be frequently used by visitors. VVN module 310 being wirelessly coupled to private LAN 317 allows for flexible placement of VVN module 310 in various locations such that VVN module 310 may be operational without a user having to physically access wireless VVN module 310. However, in other embodiments, wireless VVN module 310 may include one or more wire line connection ports or visitor access point allowing a user to connect directly to wireless VVN module 310.
Wireless VVN module 310 further allows for visitor's to have flexibility in being untethered to wireless VVN module 310. A visitor may access wireless VVN module 310 through performing a search on available wireless networks and, upon identifying a wireless signal or wireless visitor access point 318 communicated by wireless hub transceiver 311, a user may elect to connect to wireless VVN module 310 to access private LAN 317.
During operation, VVN gateway 400 provides a visitor access to a public network 403 via a private LAN 407 and manages communication of data between private LAN 407 and public network 403. As data packets are communicated from a VVN module located within private LAN 407, VVN gateway 400 receives data packets via LAN network interface 401 and translates data packets to determine if the data packets were communicated from a VVN module. If a data packet was communicated from a VVN module, VVN processor 404 converts the data packets into a standard IP data packet having standard IP protocols. VVN processor 404 maintains a network address for the VVN module and when requested data packets are received from public network 403 via public network interface 406, VVN processor 404 identifies the VVN module and converts the public data packets into to encapsulate the data packets and communicate the data packets to only the VVN module. In this manner, a visitor accessing private LAN 407 may access public network 403 through VVN gateway 400.
The method begins generally when a virtual visitor module, such as module VVN module 202 illustrated in
Upon processing the IP header at 501, the visitor's data packet including the IP header and the data may be processed according to a VVN protocol 502. For example, a VVN protocol may include scrambling the information or data, or applying a security protocol, to make the data contained within the data packet meaningless to other network nodes, hosts, locations, etc. within a private network. At step 503, VVN module then encapsulates the visitor's packet by adding a VVN header to indicate the method used in processing the visitor's packet and then adds a VVN IP header to indicate the VVN gateway address to direct the packets to VVN gateway. Packets are then communicated to the VVN gateway 504.
At step 514, when a data packet is received from VVN gateway 514 and operable to be processed by a VVN module, VVN module removes the VVP IP header and VVN header from the packet 513 from the data packet and processes the data packet 512 ac cording to information specified in the VVN header 512. For example, a data packet may be processed using a VVN protocol and may include de-scrambling the information or data, or applying a security protocol to restore data packets processed by VVN gateway. The IP header is then processed 511 by replacing the destination address to include the visitor's IP address 511 and then communicates the data packet to the visitor computer 510.
During operation, a visitor may access a public network 605 via a private LAN 604 through coupling a computer system at 601 having an IP address of “192.168.1.10” to VVN module 602. An visitor data packet 611 communicated at “A” from visitor 601 contains a source (Src) address=192.168.1.10 identifying the assigned IP address of the visitor's computer system and a destination (Dst) address=188.8.131.52 identifying web site 606 requested by the visitor. VVN module 602 detects a connection (either wireless or wire line) and translates the source IP address of visitor data packet 611 to include a new IP address, such as VVN gateway 603's IP address of “10.2.1.20”. For example, VVN module 602 includes a network address translator and VVN processor (not expressly shown) that changes, converts, or appends visitor data packet 611's IP header 612 to include a VVN IP header 615 having a source (Src) IP address of “10.2.1.20” and a destination (Dst) address of “10.2.1.15”. IP header 617 is modified to include a source (Src) IP address of “10.2.1.20” and a destination (Dst) address of “184.108.40.206”. Said another way, source data for visitor data packets are replaced with an IP address of a valid VVN module such as VVN module 602 (e.g. “10.2.1.20”) and destination data for visitor data packets are replaced with an IP address of VVN gateway 603 (e.g. “10.2. 1.15”). In this manner, visitor data packets are confined between VVN gateway 603 and VVN module 602 employing a VVN protocol that isolates visitor data packets 611 when communicated within private LAN 604 using a VVN protocol while retaining original source and destination information for visitor 601.
An exemplary VVN data packet 614 may include processing the visitor data packet 611 to include a VVN protocol having a VVN header 616 and a VVN IP header 615. One or more values may be provided within VVN header 616 to indicate a method or type of modification used to process visitor data packets 611. For example, a simple rearrangement of bits or data encryption methods may be used for processing visitor data packets 611 originating from visitor 601. When VVN gateway 603 receives VVN packet 614, it removes VVN IP header 615 and processes VVN packets 614 based on information stored within VVN header 616. For example, a decryption or other bit deciphering process may be used to restore the data packets to determine destination data to create IP data packet 619.
In one embodiment, VVN gateway 603 may include more than one IP address for use in communicating data packets. For example, VVN gateway 603 may include an IP address for internal routing within private LAN 604 (e.g. “10.2.1.15”) and an IP address communicating data via public network 605 (e.g. “220.127.116.11”). As illustrated above, VVN gateway 603 replaces VVN data packet 614 to include an IP header with having VVN gateway 603's own IP address resulting in IP data packet 619. When IP data packets are returned from website 606, VVN gateway 603 and VVN module 602 used stored information maintained by VVN gateway 603 and VVN module 602 in association with a NAT to send a reply or return data packets to visitor 601. Processing of IP data packets 619 returned from website 606 are modified in a reverse sequence to return data to visitor 601.
In one embodiment, a visitor data packet 611 may be processed by VVN module 602 to include only a VVN IP header 615 without including any additional information within VVN header 616. In this manner, no additional processing, other then removing VVN IP header, will be required. In another embodiment, VVN header 616 may not be provided as a part of visitor data packet 611 and as such no additional processing would be required when visitor data packet 611 is communicated to VVN gateway 603 or returned to VVN module 602.
In one embodiment, processing visitor data packets 611 using a VVN protocol provided by VVN module 602 and VVN gateway 603 renders the visitor data packets 611 useless when communicated to an un-intended device within private LAN 604. For example, VVN gateway 603 and VVN module 602 may be the only devices within private LAN 604 having knowledge of a VVN protocol used and other devices or systems connected to private LAN 604 may not be able to restore VVN packets 614. As such, devices or systems within private LAN 604 may discard or ignore VVN packets 614 when received. In this manner, visitor data packets 611 that originate from a visitor's system are communicated by visitor 601 and processed by VVN module 602 to generate VVN packets 614 which cannot cause security concerns within private LAN 604. Similarly, IP data packets 619 that are returned from public network 605 are processed by VVN gateway 603 to produced VVN packets 614 that can only be consumed by VVN module 602 provided within private LAN 604.
In one embodiment, a security protocol such as IPsec, secure socket layer (SSL), may be used in combination with a VVN protocol. For example, a secure socket layer (SSL) protocol may be used prior to or after processing data packets based on a VVN protocol provided by VVN module 602 and/or VVN gateway 603. Through providing a security protocol or SSL between VVN module 602 and VVN gateway 603, VVN packets 614 are confined to within a SSL-enabled channel established between VVN gateway 603 and VVN module 602.
In another embodiment, VVN gateway 603 and VVN module 602 may use either a dynamic IP addresses or a static IP addresses. For example, a DHCP server (not expressly shown) provided as a part of private LAN 604 may assign a dynamic address to VVN gateway 603 and/or VVN module 602. A DHCP server works in association with a client computer and enables individual computers on a network to obtain their configurations from a DHCP server. DHCP allows a network administrator to supervise and distribute IP addresses from a central server (not expressly shown) that automatically sends a new IP address when a computer is connected to private LAN 604. For example, when VVN module 602 is initialized, VVN module 602 registers with VVN gateway 603 and VVN module 602 and VVN gateway 603 both agree on one or more processing methods or protocols for processing VVN packets 614 to be communicated within private LAN 604.
During use, network traffic 711 includes both VVN packets 709 and employee packets 710 communicated through using embedded VVN module 702. For example, a user may select from one or more Service Set Identification (SSID's) transmitted by wireless transceiver 708 for wireless access point 701. In one form, an employee network SSID may be broadcast by wireless transceiver 708 and an employee may enter a valid password to access an employee network within private LAN (not expressly shown). Similarly, wireless transceiver 708 may broadcast a visitor SSID allowing a visitor to connect to wireless access point 701 using a visitor SSID. VVN module 702 having NAT 704 and router 706 may then determine the source of a data packet (either employee or visitor) received by wireless transceiver 708 and process based on the SSID a user connects (either employee or visitor) to wireless access point 701 accordingly. For example, all data packets communicated the visitor SSID would be processed by VVN processor 705 to create VVN packets 709 that may be communicated within network traffic 711 of a private LAN. For example, dotted lines illustrated in
During use, visitors may connect computers via wireless access point 803 which may be a 802.11-enabled wireless access point employing Service Set Identification (SSID). SSID is a 32-character alphanumeric key uniquely identifying a wireless access point such as wireless access point 803. In one embodiment, wireless access point 803 may use two or more SSIDs to distinguish visitors from employees, valid users, etc. For example, one of the SSIDs may be labeled “VisitorNet” to allow visitors to connect to wireless access point. Similarly, another SSID may be labeled “EmployeeNet” to enable employees to connect to wireless access point 803.
When connecting to wireless access point 803 for the first time, a visitor will need to establish an SSID with a label of “VisitorNet” to access wireless access point 803. An employee may be required to enter use a secret key or Wired Equivalent Privacy WEP to access the “EmployeeNet” provided by wireless access point 803. Other security features for either visitors or employees may also be employed and the “EmployeeNet” usually requires additional validation of a system prior to allowing connection to wireless access point 803 as an employee. In this manner, if a visitor tries to access the “EmployeeNet”, wireless access point 803 will deny access if a visitor does not have valid access. In one embodiment, a machine access code (MAC) address for employee's system may be used to allow a user to access wireless access point 803. For example, wireless access point 803 may resolve a MAC address of a computer system attempting to connect to “EmployeeNet” and determine if the MAC address is a valid MAC address for an employee. If an invalid MAC address attempting to access “EmployeeNet” is identified (e.g., a visitor), wireless access point 803 will deny access.
Private LAN 904 further includes a virtual visitor network switch 913 configured as a switch and connectable to virtual visitor network (VVN) gateway 902 operable to establish a first virtual visitor network (VVN) 905 within private LAN 904 and a virtual visitor network hub 914 configured as a hub and connectable to (VVN) gateway 902 and operable to establish a second virtual visitor network (VVN) 912. A network hub or switch may be employed wherein a network hub is a device with shared bandwidth for all users and a network switch provides full bandwidth to individual user coupled to private LAN 904. For example, virtual visitor network switch 913 and/or virtual visitor network hub 914 may be configured to support various communication data rates such as 10 Mbytes/Second, 100 Mbytes/Second, 1 GBytes/Second, etc.
Virtual visitor network switch 913 allows for wire line access of a first visitor computer system 906 and second visitor computer system 907. A visitor printer 908 is also coupled to virtual visitor network switch 913 and allows first visitor computer system 906 and second visitor computer system 907 to print documents without having to access private LAN 904. Virtual visitor network switch 913 may include logic to provide a print server however other embodiments may include utilizing a network nodes such as a print server located within private LAN 904. For example, virtual visitor network switch 913 may establish a VVN between VVN module 913 and a network printer 906.
Network 900 further allows visitors to access private LAN 904 using virtual visitor network hub 914 operable to provide a wireless-enabled network such as an 802.11-based network to connect a first wireless-enabled visitor computer system 916 and second wireless-enabled visitor computer system 915. Virtual visitor network hub 914 is provided in association with virtual visitor network server 902 and provides a visitor wire less access to private LAN 904 through second virtual visitor network 912.
During operation, first VVN 905 and second VVN 912 protect enterprise network or private LAN 904 from visitors by confining and directing packets between a visitor's computer system to a public network 901 through use of first VVN 905 and second VVN 912. A visitor may connect their computer to a virtual visitor network switch 913 or virtual visitor network hub 914 to access the Internet or public network 901. First VVN 905 and second VVN 912 establish a virtual tunnel between VVN gateway 902 and VVN switch 913 and VVN Hub 914. VVN gateway 902 may have a direct connection to public network 901 (e.g., Internet) or an indirect connection through a security device such as VPN/Firewall 903 as shown in
First VVN 905 and second VVN 912 provide several advantages over conventional networks and allow for a simplified visitor access networking solution without having to add an additional private networks to an enterprise network for visitors which may require Information Technology (IT) managers to manage providing visitors access within an exiting enterprise network. For example, network managers will not be required to assign special network outlets or dedicate network ports in a switch, router, wall outlets, etc. for visitors. Such configurations may not guarantee protection of an enterprise network from hacking visitors. Additionally, network outlets are not easily movable and would need to be verified to insure that no visitor is accessing the enterprise network directly.
Additionally, VVN switch 913 and/or VVN hub 914 may be provided in various colors, such as bright yellow, red, etc., to be visually identifiable by a visitor. In one embodiment, VVN switch 913 and/or VVN hub 914 may be provided as modular device that may be connected to any network outlet within private LAN 904. For example, IT managers can provide a visitor a modular device incorporating VVN switch 913 and a visitor can simply plug or connect VVN switch 913 to any available network outlet within private LAN 904 allowing VVN switch 913 to be easily transferred as needed to various rooms, offices, conference rooms, etc. having network connections or ports for private LAN 904. In this manner, when a visitor connects a computer, such as first visitor computer system 906, to modular VVN switch 913, VVN gateway 902 identifies VVN switch 913, and monitors and controls VVN switch 913 connected to a network outlet of private LAN 904. In this manner, VVN switch 913 and VVN gateway 902 confine a visitor's packets (not expressly shown) and prevent visitors from accessing other locations, devices, nodes, etc. within private LAN 904.
Data packets may be received from a within a private LAN (step 1100) or from a public network (step 1114). At step 1100, data packets are received from a VVN module located within a private LAN and the VVN IP header and VVN header of the data packet are removed 1101. The VVN packet is processed 1102 using a specification provided within the VVN header. Such processing results in providing the same data packet communicated by a visitor system and processed by a VVN module (not expressly shown). The IP header is processed 1103 by replacing the source IP address (i.e. VVN module's IP address) with the VVN gateway's IP address 1103. Data packets are then communicated to a public network destination address 1104.
At step 1114, a data packet is received by a VVN gateway from a public network source and the data packet is processed 1113 by modifying the IP header by replacing the destination address (e.g. VVN gateway) with the VVN module's address. The IP header and data received from a source in the public network are processed 1112 which may include processing to add a security feature or scrambling the data contents of the data packet. At step 1111, a VVN header is provided to indicate the method of processing used at step 1112 and a VVN IP header including a destination of address of the VVN module is also provided. Upon adding the VVN header and VVN IP header, data packets are then communicated to the VVN module 1110.
During operation, wireless access point 1104 communicates with each 802.11b enabled device operable to provide access to private LAN 1101 via a wireless communications. For example, first computer system 1107 and second computer system 1107 may be employee systems and may include embedded 802.11b communication devices operable to communicate with access point wireless 1104 provided as a part of private LAN 1101. Wireless VVN hub 1110 does not include physical ports for visitors and may easily support many visitors relative to wireless VVN switch 1105 having only wire-line connectivity. Wireless VVN switch 1105 and wireless VVN Hub 1110 may be wirelessly connected to private LAN 1101 via wireless access point 1104. Private LAN 1101 may be an Ethernet-based network however other communication mediums and protocols, such as fiber, ATM, and the like may also be employed. Private LAN 1101 further connects an enterprise server 1114, network printer 1113 and other network nodes pro viding users access to data storage, applications, etc.
Wireless devices illustrated in
Enterprise network 1100 may also employ various types, configurations, and/or combinations of VVN hubs. For example, enterprise network 1100 may employ a wire-line only connection to private LAN 1101 for visitors as illustrated, for example, in
In one embodiment, VVN modules may be communicatively coupled allowing visitors systems to communicate with each other. For example, VVN gateway 1103 may manage users connected wireless VVN hub 1110 and/or wireless VVN switch 1105 and may allow multiple users to have access each others system. In this manner, multiple visitors from the same company may be able to communicate within enterprise network 1100 thereby providing a private visitor LAN between visitors.
During operation, enterprise network 1200 may protect employees accessing private LAN 1202 from VPN client 1213 when accessed via public network 1203. VPN server 1204 serves as a gateway that is located between private LAN 1202 and public network 1203. A virtual communication tunnel or VPN tunnel 1215 is created using encryption to exchange data packets between VPN client 1213 and VPN server 1204. Through establishing a VPN tunnel 1215, network attacks that originate from public network 1203 are obviated and VPN data packets may be communicated securely within private LAN 1202. Enterprise network 1203 further includes a VVN tunnel 1216 created to protect private LAN 1202 from network attacks that may originate from inside VVN tunnel 1216 established between VVN gateway 1205 and VVN module 1206. VVN data packets are confined to VVN tunnel 1216 and as such attacks that may originate from within a VVN tunnel 1216 are confined to VVN gateway 1205 and VVN module 1206 and cannot escape VVN tunnel 1216. VPN tunnel 1215 and VVN tunnel 1216 are virtual networks which do not exist as physical entity in the physical network
VNS 1300 is a comprehensive security device that provides support services for a business protects private LAN 1308 from intruders from public network 1307, manages privacy within private LAN 1308, and protects private LAN 1308 while providing visitors and authorized users to access to public network 1307 from within the same network environment. During operation, a visitor may access private LAN 1308 via a visitor access point within private LAN 1308. Network address translator 1305 and router 1302 resolve network traffic communicated from private LAN 1308 and determine header information and route traffic based on header and other information provided. For example, a data packet may include a destination or source address information communicated from a virtual visitor network module or hub (not expressly shown) and may be resolved by NAT 1305 and provided to VVN gateway 1304 for processing. VVN gateway 1304 may extract a destination or website being requested within public network 1307 and any other processing information, and process data packets using processing information to restore data packets prior to forwarding to public network 1307 thereby allowing a visitor to access a public network from within private LAN 1308. When data packets are returned from public network 1307, VNS 1300 determines the computer system requesting the data (i.e. employee, visitor, etc.) and processes the data packets if required.
In some embodiments, VVn gateway or VNS 1300 may include a VVN management application (not expressly shown) for managing or monitoring a visitor network(s) provided within private LAN 1308. For example, a VVN management application may be used to change, alter, or configure a virtual visitor network, add and delete VVN features, modify access rights for a VVN, create a VVN status report, create a VVN public access report, manage VVN modules, manage software versions, etc. For example, a VVN management application may keep track of usage within a VVN, monitor for intrusions, and provide alarm notifications when suspicious activities are detected, communicate software upgrades to VVN modules, etc. The VVN management function may be an integral part of VNS 1300 or may be provided as a part of a network server within private LAN 1308.
During operation, as data packets transition through MPLS enabled network 1400, label tables, or a Label Information Base (LIB) is consulted by each component, LER 2 1408, LER 1 1410, LSR1 1409, LSR 2 1411, and LSR 3 1403. For example, an inbound reference maintained by LIB is determined and an outbound interface, communication path or label-switching path (LSP), and outbound label are determined. A LSP includes a sequence of labels that identifies each node or LSR along a communication or transmission path from a source to a destination. An LSP is established either prior to data packets being transmitted or upon detection of a certain flow of data.
VVN module 1404 may be connected to LER 2 1408 and VVN gateway 1402 may be connected to VVN gateway 1402 using LER 1 1410. LER 2 1408 may establish an LSP for VVN module 1404 to send data packets to VVN gateway 1402. Similarly, LER1 1410 may set up an LSP for VVN gateway 1402 to send data packets to VVN module 1404. As such, an LSP for sending data packets to VVN gateway 1402 from VVN module 1404 may be different from an LSP for sending data packets from VVN gateway 1402 to VVN module 1404. In this manner, all data packets coming from VVN module 1404 are routed to VVN gateway 1402 within MPLS network and all data packets from VVN gateway 1402 are directed to VVN module 1404 via MPLS enabled private LAN 1400. As such, MPLS enabled private LAN 1400 escorts data packets or ensures a specific destination for visitor data packets may be achieved.
In some embodiments, LER 1 1410 may be incorporated within or provided as a part of VVN gateway 1402. Similarly, LER 2 1408 may be incorporated within or provided as a part of VVN module 1404. In this manner, VVN module 1404 and VVN gateway 1402 may establish an LSP for data packets. For example, when data packets are delivered from VVN module 1404 to VVN gateway 1402, VVN module 1404 may generate labels for data packets to be maintained with an LIB and VVN gateway 1402 may delete labels from the LIB when data packets are received. Likewise, when data packets are communicated from VVN gateway 1402 to VVN module 1404, VVN gateway 1402 may create labels within an LIB and VVN module 1404 may remove labels from the LIB. In this manner, one or more portions of an MSLP network may be provided as a part of a virtual visitor network to allow a visitor to access a public network from within a private network without compromising security of an enterprise network.
During use, information or data packets communicated from visitor computer 1 503 may be processed to ensure that a virtual visitor network is maintained within LAN Ethernet 1501. Single Port VVN module 1502 may well suited for use within a hotel room or a multiple residential community where single port VVN module 1502 may be located as a permanent device within a specific room.
In another embodiment, single port VVN module 1502 may be a Universal Serial Bus (USB) enabled device that is powered by visitor computer 1503 when plugged into a USB port of visitor computer 1503. For example, a visitor may plug-in USB enabled single port VVN module 1502 into a USB port of visitor computer 1503. A network cable such as an RJ-45 cable provided in association with, or integrated as a part of, USB enabled single port VVN module 1502 may be coupled to a wall outlet of LAN Ethernet 1501. In this manner, single port VVN module 1502 may communicate with a VVN server (not expressly shown) without tethering users together to a multi-port VVN module thereby allowing visitors mobility within an enterprise premise and enabling visitors to use any LAN outlet within private LAN 1500.
Note that although an embodiment of the invention has been shown and described in detail herein, along with certain variants thereof, many other varied embodiments that incorporate the teachings of the invention may be easily constructed by those skilled in the art. Benefits, other advantages, and solutions to problems have been described above with regard to specific embodiments. However, the benefits, advantages, solutions to problems, and any element(s) that may cause any benefit, advantage, or solution to occur or become more pronounced are not to be construed as a critical, required, or essential feature or element of any or all the claims. Accordingly, the invention is not intended to be limited to the specific form set forth herein, but on the contrary, it is intended to cover such alternatives, modifications, and equivalents, as can be reasonably included within the spirit and scope of the invention.