Systems and methods for controlling device network access through a wireless router

Systems and methods are provided for enabling communications over a wide area network and a local area network, wherein one or more computing devices may communicate with a wireless router over the local area network, and wherein the one or more computing devices may obtain access to the wide area network if authorized. Authorization of the one or more computing devices can be dependent upon discovery of the one or more computing devices, as well as a device type of the one or more computing devices. Authorization may also involve discovering a service being run or requested by the one or more computing devices, and determining whether the type of service being run or requested by the one or more computing devices is authorized by the wide area network.

TECHNICAL FIELD

The embodiments described herein generally relate to wireless communication and more particularly to the ability to limit what devices can access a wireless Wide Area Network (WAN) through a mobile, wireless router.

BACKGROUND

Wireless modems exist that can be inserted, or otherwise interfaced with a computer and that enable data communication over a wireless Wide Area Network (WAN) such as a cellular type network. Early versions of these cards had connectors that complied with the PCMCIA standard and that were inserted into a slot in the side of the computer. Newer versions have USB connectors for interfacing with the computer. Such modems allow access to the Internet, or World Wide Web (WWW), even where no wired network connection exists and are most often interfaced with a laptop or other portable computing device.

FIG. 1illustrates a conventional system100in which a data connection can be established over a wide area network using a conventional wireless modem104. InFIG. 1, modem104is interfaced, e.g., via a PCMCIA slot or USB connection, with a computing device106via connection110. Modem104can then establish a data connection between base station102, associated with, e.g., a cellular type network, and computer106. Modem104and base station102can communicate via wireless signals108.

FIG. 2is a flow chart illustrating a conventional process by which such a data connection can be established. First, in step202, a user of computing device106inserts, or connects modem104with computer106. In step204, modem104is then tethered to computing device106. Once modem104is tethered to computing device106, a connection manager running on computing device106can be launched in step206. The connection manager will often display whether the network, i.e., the WAN, is available. If it is, then in step208the user can select the network, which will cause a Point-to-Point Protocol (PPP) connection to be established between base station102and computer106via modem104in step210.

In networking, the PPP is a data link protocol commonly used to establish a direct connection between two networking nodes. It can provide connection authentication, transmission encryption privacy, and compression. PPP is used over many types of physical networks including serial cable, phone line, trunk line, cellular telephone, specialized radio links, and fiber optic links such as SONET. For example, most Internet service providers (ISPs) use PPP for customer dial-up access to the Internet. PPP is commonly used as a data link layer protocol for connection over synchronous and asynchronous circuits, where it has largely superseded the older, non-standard Serial Line Internet Protocol (SLIP) and Telephone Company mandated standards, such as Link Access Protocol, Balanced (LAPB) in the X.25 protocol suite. PPP is designed to work with numerous network layer protocols, including Internet Protocol (IP), Novell's Internetwork Packet Exchange (IPX), NBF, and AppleTalk.

One drawback to system100ofFIG. 1is that only a single computing device106can be interfaced with base station102via modem104. This is because modem104is tethered to computing device106. In the related '970 application, incorporated above, a wireless router was disclosed that allowed multiple devices to access a wireless broadband network, e.g., via the wireless WAN, at the same time. Such a wireless router represents the next evolution of broadband connectivity. Such a device enables any consumer electronics device that, e.g., has a USB connector or an 802.11 transceiver to attach to the wireless broadband network. This does, however, potentially create problems for the wireless carriers.

Such a wireless router solution may create unwelcome traffic on the carriers' networks. Carriers prefer to manage the capability of such a wireless router device in terms of: a. what consumer electronics devices are allowed to attach to the broadband network and b. what services are allowed to run on the device. Conventional 3G router devices provide unlimited open access to any Wifi capable device. They do not have built in intelligence to discriminate between one peripheral 802.11 device or service and another to effectively filter those devices/services according to, e.g., programmed rules. Some routers do limit access to the network to a certain number of connections, but this is really not sufficient to address the carriers' concern with respect to the wireless router device disclosed in the '970 Application.

SUMMARY

Various embodiments of the present disclosure are set out in the claims.

According to a first embodiment, a method comprises: establishing a first data connection with a base station associated a wide area network over the wide area network; establishing a second data connection with at least one computing device over a local area network; discovering the at least one computing device and a device type of the at least one computing device; and determining, based on the device type of the at least one computing device, whether the at least one computing device is authorized to access the wide area network.

According to a second embodiment, a method comprises: establishing a first data connection with a base station associated a wide area network over the wide area network; establishing a second data connection with at least one computing device over a local area network; discovering a service being requested by or being run by the at least one computing device and a service type of the service; and determining, based on the service type, whether the service is authorized by a carrier operating the wide area network.

DETAILED DESCRIPTION OF THE DRAWINGS

In the embodiments below, a wireless router is used to interface a plurality of computing device or LAN client devices with a wireless WAN. For example, the WAN can be configured to implement one of the Third Generation (3G) protocols, such as EDGE, CDMA2000, or the Universal Mobile Telecommunications System (UMTS) protocols, High Speed Packet Access (HSPA) or HSPA+protocols, Long Term Evolution (LTE) protocols, Evolution Data Optimization (EV-DO) rev. A (DOrA), WiMAX, or other newer 4G protocols. The computing devices interface with the wireless router over a wireless Local Area Network (LAN) such as a WiFi network, wireless USB network, ultrawideband network, or a Zigbee network; however, it will be understood that the descriptions that follow are not intended to limit the embodiments herein to particular standards or architectures, the embodiments being provide by way of example only.

FIG. 3is a diagram illustrating an example system300for using a wireless router to access a WAN in accordance with one embodiment. Central to system300is wireless router304. While not illustrated in detail inFIG. 3, wireless router304can comprise two radio communication interfaces: one for communicating with a base station302associated with a WAN, and one for communicating with a plurality of computing or wireless LAN client devices306via a wireless LAN. Thus, wireless router304can communicate with base station302via wireless signals208and with devices306via wireless signals310, where signals308and310implement different protocols associated with the related network.

In certain embodiments, wireless router304can, e.g., be configured to interface as many as five (5) computing devices306with base station302.FIG. 4is a flow chart illustrating an example process by which devices306can be interfaced with base station302. As can be seen inFIG. 3, wireless router304can comprise a single power button, or switch312, when a user presses button312to power on wireless router304, in step402, then wireless router304will power up and automatically establish a data connection, e.g., a PPP connection, with base station302in step404. As illustrated, this PPP connection is between base station302and wireless router304and not between base station302and devices306. In step406, wireless router304will then enable the LAN. In step408, devices306can automatically connect to the WAN through wireless router304and the LAN connections310. In other words, wireless router304can act as a wireless LAN access point for devices306. Communication between wireless router304and devices306can be via TCP/IP over WiFi. In certain embodiments, the users of devices306must provide a password when accessing the LAN. The password can be printed on device304or displayed on device304.

Thus, all that is required to enable multiple computing devices306to access the wireless WAN is to power on wireless router304, and possibly provide a password. Wireless router304will automatically establish a connection with the WAN and enable the wireless LAN hotspot in response. There is no tethering of wireless router304with devices306.

The embodiments described herein address the issue of unrestricted open access of wireless router's by allowing only authorized devices and users to connect through the wireless router. As noted above, Carriers have concerns about having an unlimited number of 802.11, or other devices potentially connecting to their broadband network. They also have concerns about service that would run openly on the carrier networks causing capacity degradations without the carriers being able to benefit from the use of these services.

Accordingly, as described in more detail below, an algorithm for discovering the type of device that is requesting a connection to the broadband network can be embedded within the wireless router processor circuitry. The same algorithm, or alternatively a different algorithm, can also be capable of discovering the type of application or service that is supposed to run on the wireless router device. Once device and service is discovered, a decision can be made, e.g., based on preset preferences stored in the device, with respect to what device is allowed to attach to the broadband network and what service or application is allowed to run on the wireless router device. Only authorized devices and services are allowed to use the wireless router. Thus, a carrier can provision at the factory or remotely a wireless router device and configure it to filter certain devices or certain services from operating on the broadband network.

The basic filtering steps are illustrated inFIG. 5. First, in step520, a wireless router304can detect what device is trying to access the broadband wireless network through wireless router304. In addition, or alternatively, wireless router304can detect what type of service the device is requesting or trying to access in step520. In step522, wireless router304can determine whether the device, the service, or both are authorized by the associated carrier. Again, rules for determining whether a device or service is authorized can be loaded at the factory, or provisioned, updated, or both remotely, i.e., via the wireless WAN. If the device, service, or both, are authorized, then in step524, the connection can be allowed by wireless router304. Otherwise, the connection can be denied in step526.

For device filtering, the device discovery of step520can be based on its MAC address. Other means for discovering the device could be through the browser ID or by means of an application that runs on the peripheral device and that presents identification credentials to wireless router304. Based on the type of device discovered in step520, wireless router304decides whether to allow the device to connect on the network or not in step522. For example, the decision could be based on the basis of a decision table stored in wireless router304that lists authorized devices, banned devices, or both. The table could reside on the PHS memory, or alternatively remotely on a server depending on the implementation.

For service filtering, the service discovery step of520can use the same basic algorithm as device filtering. The service could be discovered by various methods. For example, packet sniffing technology allows for identifying the type of service being run for instance Video vs. VOIP etc. Thus, some form of packet sniffing can be used to determine the service in step520. Service detection can also be accomplished by monitoring the IP address to which the device connects. For instance, if wireless router304is looking to ban E-reader type services, then it could track the content server IP address being requested and ban connectivity to that server. In most embodiments, the algorithm for the service filtering resides on wireless router304, but again it can be updated from a server.

In alternative embodiments, all or a portion of the traffic generated by devices306can be routed to a designated proxy server. The proxy server (not shown) can then be configured to perform the filtering. Such an approach can be advantageous in that it can make available additional computing power.

In certain embodiments, the Quality of Service (QoS) made available to a certain device306can be based on the device and service filtering described above. For example, device based QoS can be based on the above device filtering and service filtering algorithms to determine what level of service to provide to the device or service that is detected. The types of service provided can be the following:

a. Time delay of transmissioni. Immediateii. Cached and delayed

c. Priority of packets

Thus, a device306can be provisioned so as to ban a certain service, for instance say e-reader services. Wireless router304can discover the service either though the reading of the device Mac address, sniffing IP packets or reading the content server IP address. Once a banned service request is discovered, connectivity to the content server can be banned and a message sent to the user to inform him/her about the unauthorized use of the service. Another example use can be to pair a device with a WiFi camera and only allow the pictures to be uploaded to certain sites at particular times.

In certain embodiments, the WAN controller/interface portion of wireless router304(seeFIG. 6) can be put to sleep, while the LAN controller/interface is awake and monitoring traffic from devices306. This can, for example, conserve battery power. Thus, if there were long periods of inactivity where devices306are connected but not accessing from or sending information to the WAN, then the WAN portion of wireless router can be deactivated, or put in a sleep mode to conserve power.

FIG. 6is a diagram illustrating certain components that can be included in wireless router304in accordance with one embodiment. It will be understood that additional components can be included in wireless router304. The example ofFIG. 6is not intended to exhaustively show all components, but rather is provided by way of example to illustrate certain components in relation to the systems and methods described herein. As such, the example ofFIG. 5should not be seen as limiting the systems and methods described herein to a certain design or architecture. Moreover, the components illustrated inFIG. 6are obviously depicted at a high level. It will be understood that the components can actually be implemented via multiple components such as multiple integrated circuits, discrete device, or both, and can be packaged in a single package or in multiple packages. It will also be understood that wireless router304is often battery powered and therefore will comprise a battery (not shown).

Referring toFIG. 6, wireless router304can comprise a processor502interfaced with memory504, LAN radio510, WAN radio512, and user interface514. Processor502will often comprise several processing cores such as a digital signal processing core, a microprocessing core, math-coprocessors, etc.

Memory504can comprise several forms of memory, such as non-volatile memory506and volatile memory508. Non-volatile memory is used to store data and instructions that should be maintained even when power is removed from wireless router304. Volatile memory is used to store instructions and data for which it is not important whether it is maintain when power is removed. For example, the code used to run wireless router304can be stored in non-volatile memory506such that it is maintained even when wireless router304is turned off and so that wireless router304can access this code when it is turned on again; however, the code can be copied to volatile memory508when wireless router304is on. This can, for example, allow faster access to instructions and data by processor502.

Examples of non-volatile memory include Read-Only Memory (ROM), flash memory, and most types of magnetic computer storage devices, e.g., hard disks, floppy disks, and magnetic tape and optical discs, although these later devices are not generally used for wireless router304. Rather, the former, which can be referred to as electrically addressed non-volatile memories are typically used for wireless router304. Non-volatile memory is typically used for the task of secondary storage, or long-term persistent storage. Most forms of non-volatile memory have limitations that make them unsuitable for use as primary storage. Typically, non-volatile memory either costs more or performs worse than volatile random access memory. Electrically addressed non-volatile memories can include a Programmable ROM (PROM), Erasable PROMs (EPROM), Electrically erasable PROM (EEPROM), Flash memory, or some combination thereof.

Volatile memory, also known as volatile storage or primary storage device, is computer memory that requires power to maintain the stored information, unlike non-volatile memory which does not require a maintained power supply. The most widely used form of primary storage today is a volatile form of random access memory (RAM), meaning that when the computer is shut down, anything contained in RAM is lost. Most forms of modern RAM are volatile storage, including Dynamic Random Access Memory (DRAM) and static random access memory (SRAM). Thus, wireless router304can include DRAM, SRAM, or some combination thereof, although wireless router304is more likely to include SRAM than DRAM.

In certain embodiments, some portion or even all of non-volatile memory506, volatile memory508, or both can be included with processor502.

LAN radio510can comprises all of the hardware required for the radio front end of the wireless LAN interface. Similarly, WAN radio512can comprises all of the hardware required for the radio front end of the wireless WAN interface. Processor502or components thereof can serve as the processing backend for both radios510and512. Alternatively, separate processing circuitry can be included for each of the LAN function and the WAN function. In such embodiments, the processing functionality described herein can be included in either the LAN processing circuitry or the WAN processing circuitry.

User interface514can comprise just button312. But in other embodiments, it can also comprise a display, e.g., to display a password.

Instructions stored in memory504can be used by processor502to control the operation of wireless router502including control of radios510and512. Thus, the instructions stored in memory504should include instructions for controlling the operation of radios510and512as well as for bridging communications between basestation320and devices306and for configuring wireless router304. In certain embodiments, the instructions for controlling WAN radio512, and the authentication procedures for connecting to the WAN, can be included in standard code associated with WAN radio512. These instructions can be referred to as modem instructions. Separate instructions for controlling the remaining functions of wireless router304can then also be stored in memory504, including the procedures and settings for controlling LAN radio510. These instructions can be referred to as router instructions.

FIG. 7is a diagram illustrating examples blocks of instructions that can be stored in memory504. For example, the instructions can be stored in non-volatile memory506and can, e.g., be copied to volatile memory508during operation. As can be seen, the instructions illustrated inFIG. 7can comprise modem instructions602and router instructions604. Each set of instructions can comprise an initialization routine610and612respectively, and be associated with a function table606and608respectively. Router instructions604can also be associated with an offset or known address, e.g., A000, at which it should be loaded into volatile memory.

A process for allowing these two sets of instructions to interact must then be implemented in such embodiments.FIG. 8is a flow chart illustrating an example process for loading modem instructions and router instructions into volatile memory508for execution by processor502and for configuring the instructions to interact with each other. In step702, on boot up, e.g., activation of button312, modem initialization function610can generate a modem function pointer table606, which can be populated with modem functions. In step704, a block of memory can be reserved in volatile memory508, e.g., at the known offset address, and router instructions604can be loaded into the reserved block in nonvolatile memory508. Router initialize function612can then be called in step706. Initialization function612in the router instructions604can then populate function table608with router functions. Modem instructions602will need to use, or call certain functions included in router instructions604. Similarly, router instructions604will need to call certain functions in modem instructions602. Accordingly, the initialization functions can cause each set of instructions to exchange pointers to the relevant functions, such that modem function table606will include pointers to the relevant functions in router instructions604and router function table608will include pointers to the relevant functions in modem instructions602.

Alternatively, a single function table with the appropriate functions and pointers can be created and used by both modem and router instructions602and604; however, it will be understood that how the function tables are described is a matter of convenience and that what is important is that there is an association between functions and pointers to functions in the various instructions that is maintained within wireless router304.

Initialization function612can also be configured to create a set of related tasks, e.g., an http server task, a WiFi driver task, a bridge task, etc. For example, once the functional tables are initializes, the router instructions can start to run in step708. Different tasks can then be called in steps712,714, and716, which can cause initialization functions related with each tasks to run in steps718,720, and722. These initialization functions can then initialize the related tasks such that they can run in steps724,726and728.

One of these related tasks can, e.g., comprise a filter task as described above with respect toFIG. 5. For example, filter task713can be included in the router tasks, and filter task713can be initialized in step717, and run in step723.

On successful initialization, router instructions604can be configured to notify modem instructions602through either a return value or a signal.

Modem instructions602can start to run in step708. As the modem instruction and router tasks run, they can communicate with each other using the set of function pointers populated in the function pointer tables. For example, a typical function that a router task can use is “efs_open” or “rex_sleep.” Modem instructions602can, for example, call a transmit function in the router WiFi driver or it can call the address translate functions.

A partition table for memory504can for example have one additional, e.g., 3 MB partition for router instructions604. Router instructions604can be built into a binary file from, e.g., an elf file.FIG. 9is a diagram illustrating an example image802of router instructions604in accordance with one embodiment. A header can be added to the binary and can include a signature field804, for the image signature; a checksum field806, which can, e.g., comprise a 4 byte checksum and a 2 byte version, as well as 2 reserved bytes; and entry point field808to hold the address offset; and a 4 byte reserved field810. Image802can then mostly consist of the binary image812for instructions604.

On boot up, the operating system can verify the checksum, version compatibility, and magic string from the image header before proceeding to the next step, e.g., step702.

Accordingly, router instructions604are not statically linked into modem instructions602. Rather, they will be compiled and linked into a separate binary with a fixed entry point (offset address) specified in the router image header. This binary can then be loaded at that exact location specified by the offset address at run time. The memory location specified by the offset address should specify a block of memory that is not used by the memory instructions. Once the memory section is created, the router binary except the header can then be loaded at the address where the image was created. After the modem instruction initialization is completed, it will call an initialization function located in the router binary. This location will be known to the modem instructions because where the router binary was loaded in the memory will be known. The router initialization function can then populate the rest of the function pointers in the structure described above for the modem instructions. Form this point on the modem and router instructions can communicate with each other using the set of functions that have been saved in the function pointer table.

Once wireless router304is powered up, the connection with base station302is establish, the LAN is activated, and wireless router304will be ready to route data packets from devices306to base station302. Devices306can then access, e.g., the Internet through wireless router304. All that may be required for devices306to access the Internet, or more generally the WAN associated with base station302is a password, which can be displayed in wireless router304. Contrast this with system100in which only a single device106can access the WAN.

FIGS. 10A-Dare diagrams illustrating various example implementations of wireless router304. As can be seen, each implementation includes a single button312. Additionally, as illustrated inFIG. 10D, wireless router304can include a USB or other data connection902for interfacing with wireless router304. In certain embodiments, wireless router304can be approximately credit card sized. In other words, wireless router304can comprise a length (l) and width (w) that are very close to those of a credit card. In addition, wireless router304can comprise a thickness that is very thin. While it may be thicker than a credit card, the overall dimensions can be such that wireless router can easily fit in a pocket or even a wallet.