Dual-connect service box with router bypass

A system and method provide both inline services and in-network services for a dual-connect service box interposed between a modem and a router. The method transceives communications between a service box wide area network (WAN) port and a local area network (LAN) port of a WAN-connected broadband modem, and between a service box WAN-proxy port and a WAN port of a router. The method also selectively transceives communications between the service box WAN port and a LAN port. A service box binding module monitors messages transceived between the router and the modem to determine the service box WAN IP address, and registers at least one service box WAN IP addresses with a WAN network-connected account server. The method selectively transceives communications in response to an authentification means, which may be identifying an authorized port number in the communications, or identifying an authorized command in the communications.

BACKGROUND OF THE INVENTION

1. Field of the Invention

This invention generally relates to computer networking and, more particularly, to a system and method that permits a wide area network (WAN) to be selectively connected to a local area network (LAN) using an inter-network router bypass.

2. Description of the Related Art

As noted in Wikipedia, a wide area network (WAN) is a computer network that covers a broad area (i.e., any network whose communications links cross metropolitan, regional, or national boundaries). This distinction is in contrast to personal area networks (PANs), local area networks (LANs), campus area networks (CANs), or metropolitan area networks (MANs) which are usually limited to a room, building, campus or specific metropolitan area, respectively.

WANs are used to connect LANs and other types of networks together, so that users and computers in one location can communicate with users and computers in other locations. Many WANs are built for one particular organization and are private. Others, built by Internet service providers, provide connections from an organization's LAN to the Internet. WANs are often built using leased lines. At each end of the leased line, a router connects to the LAN on one side and a hub within the WAN on the other. Leased lines can be very expensive. Instead of using leased lines, WANs can also be built using less costly circuit switching or packet switching methods. Network protocols including TCP/IP deliver transport and addressing functions. Protocols including Packet over SONET/SDH, MPLS, ATM and Frame relay are often used by service providers to deliver the links that are used in WANs. X.25 was an important early WAN protocol, and is often considered to be the “grandfather” of Frame Relay as many of the underlying protocols and functions of X.25 are still in use today (with upgrades) by Frame Relay.

A router is an electronic device used to connect two or more computers or other electronic devices to each other, and usually to the Internet (i.e. WAN), by wire or radio signals. A router permits several computers to communicate with each other and to the Internet at the same time. If wired, each computer is connected by its own wire to the router. Modern wired-only routers designed for the home or small business typically have one “input” (WAN) port (to the Internet) and four “output” (LAN) ports, one or more of which can be connected to other computers. A typical modern home wireless router, in addition to having four wired ports, also allows several devices to connect with it wirelessly. Most modern personal computers are built with a wired port (almost always an Ethernet type), which allows them to connect to a router with the addition of just a cable (typically a Category 5e type).

More technically, a router is a networking device whose software and hardware are usually tailored to the tasks of routing and forwarding information. Routers connect two or more logical subnets, which do not necessarily map one-to-one to the physical interfaces of the router.

Residential gateways (often called routers) are frequently used in homes to connect to a broadband service, such as IP over cable or DSL. Such a router may also include an internal DSL or cable modem. Residential gateways and SOHO routers typically provide network address translation and port address translation in addition to routing. Instead of directly presenting the IP addresses of local computers to the remote network, such a residential gateway makes multiple local computers appear to be a single computer. Thus, it is difficult for a remote (WAN-connected) client to connect to a particular computer or LAN agent in a LAN network.

In providing connectivity to external networks, the router's functionality must be carefully considered as part of the overall security architecture. A router may include Firewall functions and a virtual private network (VPN) concentrator.

Generally, a modem (modulator-demodulator) is a device that modulates an analog carrier signal to encode digital information, and also demodulates such a carrier signal to decode the transmitted information. The types of fast modems used by Internet users are cable, ADSL, and broadband modems. In telecommunications, wide-band radio modems transmit repeating frames of data at very high data rates over microwave radio links. Some microwave modems transmit more than a hundred million bits per second. Optical modems transmit data over optical fibers. Optical modems routinely have data rates in excess of a billion (1×109) bits per second. A 56 k modem can transfer data at up to 56,000 bit/s (7 kB/s) over the phone line.

FIG. 1is a schematic block diagram depicting a home network (LAN) with one or more client PCs100and a gateway/router device102that connects to a DSL or cable modem104(prior art).

FIG. 2is a schematic block diagram depicting a first option for adding services to the basic home network ofFIG. 1(prior art). In this aspect, the router ofFIG. 1is replaced with a services router200. The services router200can be augmented to supply additional inline security, such as IPS, virus scanning, content inspection, and URL filtering, in addition the security features supplied by conventional routers. In addition, the router supplies a service that is conventionally supplied by an agent of the LAN network. One example of such a service is network-attached storage (NAS). Advantageously, the service is always available to a WAN connected device. However, the introduction of such a unique device would require significant start-up costs. The servicing and support services may also be expensive. Further, there may have problems installing and using such a complex networking device. The typical user wants their networking device to be simple, cheap, and failure proof.

FIG. 3is a schematic block diagram depicting a third option for adding services to the basic home network ofFIG. 1(prior art). In this aspect, an inline service box400(e.g., a NAS) is added to the LAN. Because the service box in part of the LAN, it can provide an in-network service (e.g., NAS), but it cannot provide additional inline security.

FIG. 4is a schematic block diagram depicting a fourth option for adding services to the basic home network ofFIG. 1(prior art). In this aspect, an inline appliance500is added between the router102and the modem104. The inline appliance500can supply additional inline security. However, because the appliance500is on the other side of the router firewall from the LAN, it cannot provide service (e.g., NAS) for LAN network PCs100using built-in windows clients.

FIG. 5is a schematic block diagram depicting a fifth option for adding services to the basic home network ofFIG. 1(prior art). In this aspect, an inline box500provides additional inline security (500) and an in-network box400provides LAN services. However, 3 boxes are too expensive and too complicated for home/SOHO users. Further, most home users would be unwilling to deal with multiple service providers.

It would be advantageous if an inline device existed that would provide the security of the conventional inline arrangement of router and modem, while selectively permitting remote clients connected via a WAN to bypass the router in accessing the LAN.

SUMMARY OF THE INVENTION

Accordingly, a method disclosed herein provides both inline services and in-network services, for a dual-connect service box interposed between a modem and a router. The method transceives communications between a service box wide area network (WAN) port and a local area network (LAN) port of a WAN-connected broadband modem. The method transceives communications between a service box WAN-proxy port and a WAN port of a router. The method also selectively transceives communications between the service box WAN port and a LAN port.

In one aspect, a service box binding module monitors messages transceived between the router and the modem to determine the service box WAN IP address, and registers at least one service box WAN IP addresses with a WAN network-connected account server. In another aspect, the binding module uses a dynamic host configuration protocol (DHCP) request to the router to obtain a service box LAN IP address

The method selectively transceives communications between the service box WAN port and the LAN port in response to an authentification means, which may involve a binding module identifying an authorized port number in the communications, identifying an authorized command in the communications, or a combination of the above-noted means. The binding module transceives authorized communications from a remote client, between the WAN port and the LAN port, with the communications being addressed to the service box WAN IP address and including a command specifying a service type to be performed by a service box-external LAN agent embedded in a connected LAN network. The binding module also determines the IP addresses of LAN agents associated with supported services.

Additional details of the above-described method and a dual-connect service box for providing both inline services and in-network services, are provided below.

DETAILED DESCRIPTION

Various embodiments will be presented in terms of systems that may include a number of components, modules, and the like. It is to be understood and appreciated that the various systems may include additional components, modules, etc. and/or may not include all of the components, modules etc. discussed in connection with the figures. A combination of these approaches may also be used.

FIG. 6is a schematic block diagram of a dual-connect service box for providing both inline services and in-network services. The service box700comprises a wide area network (WAN) port on line702for transceiving communications with a local area network (LAN) port of a WAN-connected broadband modem704. A WAN-proxy port on line706transceives communications with a WAN port of a router708. The service box700also comprises a LAN port on line710for selectively transceiving communications with the WAN port on line702, as explained in more detail below.

In one aspect, a security module712is interposed between the service box WAN-proxy port and the WAN port, for analyzing communications transceived between the router708and the broadband modem704. The security module712may optionally performs a function such as firewall protection, virus scanning, content inspection uniform resource locator (URL) filtering, virtual private network (VPN) tunneling, or intrusion prevention system (IPS) protection, to name a few examples. Advantageously, some, none, or all of the security features may be selectively engaged. These features, if selected, are intended to augment the security functions provided by a conventional router. The optional use of the security module is enabled through the security bypass circuit714.

FIG. 7is a schematic block diagram depicting additional details of the service box ofFIG. 6. In this aspect, the service box700comprises a binding module800monitoring messages transceived between the router and the modem on line802to determine the service box WAN IP address. For simplicity, the security module is not shown. However, it should be understood that the service box may include both a binding module800and a service module. An internal LAN agent716is interposed between the binding module800and the LAN port on line710. The LAN port can be a wired or wireless connection interface. Typically, both wired and wireless interfaces are provided. Although LANs are explicitly described, it should be understood that the service box may alternately be connected to personal area networks (PANs) as well.

Knowing the service box WAN IP address permits the binding module to register at least one service box WAN IP address with a WAN network-connected account server810. In one aspect, the binding module800initiates account maintenance messages with the account manager server810, for dynamically updating service box WAN IP addresses. The binding module800uses a dynamic host configuration protocol (DHCP) request to the router708to obtain the service box LAN IP address.

The internal LAN agent716is interposed between the binding module800and the LAN port on line710. The internal LAN agent716is typically enabled as a sequence of software instructions stored in a computer-readable memory (not shown) and executed by a processor (not shown). The internal LAN agent has the responsibility for communicating with the service box-external LAN agents814. As shown, the LAN port on line710is connected to the multiport switch portion of the router708(the LAN ports of the router). As is well known in the art, devices connected in parallel on such a switch are able to communicate while bypassing the conventional router functions that act to separate the LAN ports from the WAN port.

FIG. 8is a schematic block diagram depicting a variation of the service box ofFIG. 7. In this case the service box LAN port is wireless connected to the router switch816via wireless connection818. Note, although hardwired connected are shown between the switch816and the LAN812, it should be understood that these connections may be wireless or a combination of wired and wireless connections.

It is possible for the binding module800to inadvertently connect to an out-of-network router via a wireless LAN interface710. As shown, the binding module800is able to communicate with router804in LAN806. The binding module800is able to determine if a router is connected to the service box WAN-proxy port on line706by sending a first message to the router with the service box LAN IP address as an IP source and the service box WAN IP address as an IP destination. If the first message is received at the service box WAN IP address within a predetermined period of time, the router is connected on line706. If a time-out occurs before the first message is received, it can be assumed that a router is not connected on line706.

More explicitly, a LAN port IP address is obtained from the router. A message is sent to the router with the obtained service box LAN IP address as an IP source and the service box WAN IP address as an IP destination. A time-out period is started. If the message is received back by the service box within a predetermined period of time, the services box concludes that the router is connected on line706. If a time-out occurs and the message has not been received, it can be assumed that a router is not connected on line706.

In case the service box800utilizes the wireless LAN port connectivity to connect to a wireless router, and the router connected to its WAN-proxy port has a wireless security feature enabled, then above steps fail in establishing the wireless connection with the local router until the service box submits a connectivity request with a security key, for example, a Wired Equivalent Privacy (WEP) security key.

The service box may post a request at the associated account administrator to request the WEP key for router708. Once the WEP key is entered by the administrator of the local network governed by the router708, the server sends the WEP key to the service box through a server-to-service box message. The service box is then able to connect to all secure reachable routers using the WEP key provided by the server using the steps described above.

FIG. 9is a diagram depicting an exemplary message sent to the service box by a remote client, requesting service. ContrastingFIGS. 7,8, and9, the binding module800identifies authorized communications in response to identifying an authorized port number in the communications, identifying an authorized command in the communications, or a combination of the above-noted means. The binding module800transceives authorized communications from a remote client808, between the WAN port on line702and the LAN port on line710. These communications are addressed to the service box WAN IP address and include a command specifying a service type to be performed by a LAN agent.

The LAN port on line710is connected to one or more service box-external LAN agents. As shown, the LAN port on line710is shown connected to LAN812with service box-external LAN agents814. Shown are external LAN agents814athrough814n, where n is a variable not limited to any particular value. Some examples of service box-external LAN agents include a network attached storage (NAS) module, personal computer, server, printing device, to name a few. As is understood in the art, a NAS is file-level computer data storage device connected to a computer network, providing data access to heterogeneous network clients. The binding module800determines the IP addresses of service box-external LAN agents814associated with supported services. For example, uPnP (Universal Plug-n-Play) protocols can be used. Once communications from a remote client are authenticated and the service type identified, the binding module to able to direct the service request to the appropriate LAN agent IP address.

FIG. 10is a schematic block diagram showing details of the account manager server ofFIGS. 7 and 8. The account manager1000is embedded in a WAN network-connected server810. The account'manager1000maintains a watch list1002in memory1004of service box IP addresses cross-referenced to enabled services, service commands, authentication means, and service box-external LAN IP addresses. The first two IP addresses shown are associated with the service box ofFIG. 7or8(service box700). In this aspect, each address is associated with a different service, but they both use the same authentication means. Alternately but not shown, the service box may have only one IP address, but the different service types may be distinguished by different authentication means.

The account manager can also be used to track billing information for provided serves, and to access history information. The billing may also be a function of some bandwidth usage. The remote client can access the account manager via a URL link from a conventional browser. Once inside the account manager website, the remote client can select a service or domain name from a menu. If the remote client is allowed, the menu selection may lead to the automatic submission of a request to the service box WAN IP address, along with the authentication means and the service command. With this information, the remote client can establish communications with a LAN agent, via the service box. Alternately, the services box is accessed from a remote client using a service box-specific client, which is a custom protocol for communication between the client and services box.

It should be understood that some components of the above-described service box may be enabled as a list of software instructions stored in a computer-readable memory and executed by a processor. The operation of computer systems able to read and process software applications is well understood in the art, and details a computer system sufficient to enable a software application are omitted in the interest of brevity.

Functional Description

The above-described service box provides both inline security and always-on LAN services (e.g., VPN or NAS). This design permits a conventional router to be used, with no router dependency on external services, and without the need to make any configuration changes to the router.

The mechanism for auto-binding a service box WAN IP address to the associated web account is as follows. First, the inline (WAN-proxy) port of the service box is connected to the “modem” port of the router/gateway and the WAN port of the service box to the modem LAN port. A services management website associated with one of the service providers (e.g., www.apmservices.com) is accessed to start the process of creating a services subscription account. A list of all approved services providers is registered with the service box provider. The service box tracks messages (content inspection) to any of the programmed candidate web sites. During bring-up, the service box resolves the programmed URL addresses to associated IP addresses (from a known IP address for the DNS server) or IP addresses of approved services web sites may themselves be programmed in the service box. The service box also connects to its own website for auto management functions. Based on the tracking of messages to the programmed services website, the service box determines with which account on the site it should associate itself. The service box binds its WAN IP address to the services account. Binding is accomplished by sending a “binding” message to the services web site with the account number to bind. The service box periodically reconfirms the WAN IP address and keeps the association of account and LAN IP address current.

If the service box is connecting to a wireless router, the following additional steps are performed during the initial account creation phase. First, the service box monitors all reachable local area Wireless (WiFi) networks. For each reachable unsecure router, the service box sends a series of packets with randomly generated data to a well known address, say the service box's service provider's web address. The service box monitors whether the series of packets with the same data pass through the inline connection within a timeout period. If the data sequence is not detected within a short timeout period, the targeted router is determined to be not connected locally to the service box.

If the local router has wireless security enabled (e.g., WEP security or another security type well known in the art), then the above-mentioned steps will fail for all of the candidate unsecure routers. At this stage, on the account creation page, a query is made as to whether the local router is a wireless router. In case the local router is a wireless router, a follow-on question is asked to enter the WEP key. If the local router is not a wireless router, then on the account page a suggestion is made to connect the 3rd port, the WAN-proxy port of the service box, to one of the network ports of the router. If the local router is a wireless router with WEP security, then using the provided WEP key, the service box repeats the data monitoring steps described above, for all WEP enabled routers that can be reached. The service box binds itself to the candidate router for which the inline path presents same data as the data sent over the in-network wireless path. If the step does not succeed, an error is reported and a physical wire connection between the in-network service box and router network is suggested.

Alternately, the service box may display the list of all of reachable routers on the services website as part of the account creation page. The user selects which of the routers is the local router, including providing the WEP key if needed. Then, the service box performs the data monitoring steps to validate that the selected router is indeed a local router and that it can establish the connection successfully. If the step does not succeed, an error is reported and a physical wire connection between the in-network service box and router network is suggested

FIG. 11is a flowchart illustrating a method for providing both inline services and in-network services in a dual-connect service box interposed between a modem and a router. Although the method is depicted as a sequence of numbered steps for clarity, the numbering does not necessarily dictate the order of the steps. It should be understood that some of these steps may be skipped, performed in parallel, or performed without the requirement of maintaining a strict order of sequence. Generally however, the steps are performed in numerical order. The method starts at Step1100.

Step1102transceives communications between a service box wide area network (WAN) port and a local area network (LAN) port of a WAN-connected broadband modem. Step1104transceives communications between a service box WAN-proxy port and a WAN port of a router. Step1106selectively transceives communications between the service box WAN port and a LAN port. Steps1104and1106are shown as parallel operations, not necessarily because the operations are performed simultaneously, but more usually, because the method selects one of the alternate paths. In Step1108a service box security module, interposed between the service box WAN-proxy port and the WAN port, analyzes communications transceived between the router and the broadband modem, and optionally performs firewall protection, virus scanning, content inspection uniform resource locator (URL) filtering, virtual private network (VPN) tunneling, or intrusion prevention system (IPS) protection. It should be noted that these security functions may be performed in addition to, and without interfering with any router security functions.

In one aspect, transceiving communications between the service box WAN port and the LAN port of the WAN-connected broadband modem includes a service box binding module monitoring messages transceived between the router and the modem to determine the service box WAN IP address. Once the service box WAN IP address is determined by the binding module, Step1101aregisters at least one service box WAN IP addresses with a WAN network-connected account manager server. Step1101amay further include the binding module initiating account maintenance messages with the account manager, for dynamically updating the service box WAN IP address.

In another aspect, transceiving communications between the service box WAN-proxy port and the WAN port of the router (Step1104) includes the binding module using a dynamic host configuration protocol (DHCP) request to the router to obtain a service box LAN IP address. Further in Step1104, the binding module may determine IP addresses of service box-external LAN agents associated with supported services.

In Step1101ban account manager embedded in a WAN network-connected server maintains a watch list of service box WAN IP addresses cross-referenced to enabled services, service commands, service box-external LAN IP addresses, and authentication means. In Step1101ca remote client accesses the account manager to acquire an authentication means and service command. Then, selectively transceiving communications between the service box WAN port and the LAN port in Step1106includes substeps. In Step1106athe remote client sends communications to the service box WAN IP address with the embedded authentication means. In Step1106ba service box-external LAN agent embedded in a connected LAN network provides a requested service to the remote client.

In another aspect, selectively transceiving communications between the service box WAN port and the LAN port in Step1106includes the binding module identifying authorized communications in response to an authentification means, which can involve identifying an authorized port number in the communications, identifying an authorized command in the communications, and a combination of the above-noted means. Further in Step1106, the binding module transceives authorized communications from a remote client, between the WAN port and the LAN port, in which the communications being are addressed to the service box WAN IP address and include a command specifying a service type to be performed by a service box-external LAN agent.

In a different aspect, transceiving communications between the service box WAN-proxy port and the WAN port of a router in Step1104includes the binding module determining if a router is connected to the service box WAN-proxy port by: sending a first message to the router with the service box LAN IP address as an IP source and the service box WAN IP address as an IP destination; and, receiving the first message at the service box WAN IP address within a predetermined period of time.

A system and method have been provided for providing both inline and in-network services. Specific device components and processes have been used as examples to illustrate the invention. However, the invention is not limited to merely these examples. Other variations and embodiments of the invention will occur to those skilled in the art.