Abstract:
A system, method, signal, and computer program product for providing secure wireless access to private databases and applications without requiring a separate wireless client-server internetworking security protocol infrastructure. The wireless device ( 201 ) communicates with the wireless access service provider ( 205 ) via hypertext transfer protocol (HTTP) messages, and the wireless access service provider ( 205 ) and the secure network ( 204 ) perform a RADIUS authentification for the wireless device ( 201 ).

Description:
CROSS REFERENCE TO RELATED APPLICATIONS  
       [0001]     This application claims priority to commonly owned, co-pending U.S. provisional patent application Ser. No. 60/307,172, entitled WIRELESS ACCESS SYSTEM, METHOD AND COMPUTER PROGRAM PRODUCT filed in the U.S. patent and Trademark Office on 24 Jul. 2001 and commonly owned, co-pending U.S. provisional patent application Ser. No. 60/314,656, entitled WIRELESS ACCESS SYSTEM, METHOD AND COMPUTER PROGRAM PRODUCT filed in the U.S. patent and Trademark Office on 27 Aug. 2001, the entire contents of both being incorporated herein by reference. 
     
    
     BACKGROUND OF THE INVENTION  
       [0002]     1. Field of the Invention  
         [0003]     The present invention relates to a system, method, signal, and computer program product for providing secure wireless access to private databases and applications. More particularly, the present invention relates to providing secure access to private networks for wireless devices without requiring a separate wireless security/authentication infrastructure for the private network.  
         [0004]     2. Discussion of the Background Art  
         [0005]     Whenever an external computing device is connected to a corporate network, that network is subject to becoming more vulnerable to security breaches. Network Administrators are left with few tools to guard against break-ins. State of the art security systems generally require special hardware or are only compatible with a small number of products. This problem is exacerbated in large networks that have many points of access.  
         [0006]     To address this problem, Lucent Technologies InterNetworking Systems has developed a distributed security solution called Remote Authentication Dial-In User Service, or RADIUS. RADIUS is an example of a client-server internetworking security protocol configured to control authentication, accounting, and access-control in a networked, multi-user environment. RADIUS provides a software protocol based approach to security that does not require special hardware. Distributed security separates user authentication and authorization from the communications process and creates a single, central location for user authentication data. The RADIUS protocols are defined in Internet Engineering Task Force (IETF) Request for Comments (RFC) 2138 dated April 1997 and 2139 dated April 1997, the entire contents of both being incorporated herein by reference. RADIUS is a TCP/IP application layer protocol as defined in TCP/IP Illustrated: The Protocols by W. Richard Stevens (1994) and TCP/IP Clearly Explained, Third Edition, by Pete Loshin (1999), the contents of both being incorporated herein by reference.  
         [0007]     Based on a model of distributed security previously defined by the IETF, RADIUS provides an open and scaleable client/server security system. The RADIUS server can be easily adapted to work with third-party security products or proprietary security systems. To date, many types of communications servers or network hardware support the RADIUS client protocols and can communicate with a RADIUS server. RADIUS has become a widely accepted remote authentication protocol.  
         [0008]     RADIUS supports a system of distributed security that secures systems against unauthorized access. A system based on RADIUS authentication includes a RADIUS authentication server and a RADIUS client. In conventional RADIUS systems, user authentication and network service access information is located on the RADIUS authentication server. RADIUS supports this information being in a variety of formats based on the customer&#39;s requirements. RADIUS, in its generic form, will authenticate users against, for example, a UNIX password file, Network Information Service (NIS), as well as a separately maintained RADIUS database. RADIUS-compliant communications servers operate to connect RADIUS clients with RADIUS servers. The RADIUS client sends RADIUS authentication requests to the RADIUS server and acts on responses sent back by the RADIUS server.  
         [0009]     RADIUS is used to authenticate users through a protocol including a series of specially formatted messages between the client and the server. Once a RADIUS user is authenticated, the RADIUS client provides that RADIUS user with access to the appropriate network services.  
         [0010]      FIG. 1  is an interaction diagram of an exemplary conventional RADIUS system for providing authentication over the Internet. The order of events in the diagram flows from top to bottom as indicated by the time progression identified by figure element  107 . As shown in  FIG. 1 , an end user  101  initiates a session by dialing  108  into an Internet Service Provider&#39;s (ISP)  102  Point of Presence (POP)  103  on the Internet. The ISP POP  103  then requests  109  that the end user  101  identify himself. In response, the end user  101  provides, for example, a user ID, password, and access server identification  110 . The ISP POP  103  then sends a RADIUS Access Request Message  111  containing the user identification information to its own ISP authentication server  104 , which is a RADIUS server and awaits a response  117 . Based on the user identification information provided in the RADIUS Access Request Message  111 , the ISP Authentication Server  104  recognizes that the end user  101  is an access service provider  105  user. The access service provider  105  is, in this example, a third party that manages the access of remote end users  101  to a company&#39;s internal secure network (e.g., Company XYZ  106 ). FIBERLINK COMMUNICATIONS CORPORATION is an example of a company that provides this type of service. The ISP Authentication Server  104  therefore sends a RADIUS Access Request Message  113  containing the user identification information to the Access Service Provider  105  and awaits a response  116 . Based on the user identification information provided in the RADIUS Access Request Message  113 , the Access Service Provider  105  recognizes that the end user  101  is a COMPANY XYZ  106  user. The Access Service Provider  105  therefore sends a RADIUS Access Request Message  114  containing the user identification information to COMPANY XYZ  106  and awaits a response  115 . Company XYZ  106  will then perform a RADIUS authentication for this particular end-user  101  and send either a RADIUS Access Granted or RADIUS Access Denied message  115  back to the Access Service Provider  105 , which will then forward the RADIUS Access Granted or RADIUS Access Denied message  116  to the ISP authentication server  104 , which in turn, forwards the RADIUS Access Granted or RADIUS Access Denied message  117  to the ISP POP  103 , which finally generates and transmits a corresponding access granted/access denied status message  118  to the end user  101 .  
         [0011]     A limitation associated with the above-described capability is that it does not readily accommodate wireless users and their applications. Wireless devices (e.g., Personal Digital Assistants (PDA) and wireless laptops) have become popular productivity tools, and given their portability, have become a desired tool for accessing applications and databases on secure networks from remote locations. Typically, access is via the Internet as accessed through a wireless network provider. Because wireless network providers do not provide the services that an ISP provides, the ability to have RADIUS-authenticated connections from remote wireless devices is limited. Therefore, a tension has been created between providing the convenience of wireless remote access and maintaining a secure network.  
         [0012]     One proposed solution to this problem is to provide a parallel authentication capability tailored to the needs of wireless users, wireless data services and communication technologies used in wireless networks. However, maintaining more than one authentication database in an organization is an administrative burden for information security personnel who must update multiple databases when employees or other authorized users arrive, depart, or otherwise change their access posture. Furthermore, maintaining more than one authentication database is an operational annoyance to users who may be required to maintain different passwords and be trained in different information security techniques for wireless and non-wireless access. Even further, as more access paths are provided for a network, more opportunities for a security breach or failure are created.  
       SUMMARY OF THE INVENTION  
       [0013]     The present inventors have recognized that there exists a need to provide secure access for wireless devices without compromising the level of security required by the accessed network. The present inventors have further recognized that since many wireless devices have limited processing power, providing a RADIUS capability on a wireless device is not an acceptable solution. The inventors of the present invention have recognized that by providing an ability to translate non-RADIUS authentication messages from a wireless device into RADIUS authentication messages that the existing RADIUS authentication infrastructure can be used to authenticate wireless devices.  
         [0014]     Accordingly, one object of the present invention is to provide systems, devices, communications protocols, and methods for providing RADIUS authentication for wireless devices that do not themselves have a RADIUS capability.  
         [0015]     A further object of the present invention is to provide methods and communications protocols for maintaining an integrated wireless/non-wireless security infrastructure.  
         [0016]     The above-described and other objects are addressed by the present invention, which includes a novel system, method, signal, and computer program product for authenticating, accounting, and controlling access to a secure network from a wireless device. The wireless device desiring remote access to a secure network sends a request for authentication to a wireless access service provider. The wireless access service provider receives the request and creates a formal authentication request or relays the request for authentication originating from the wireless device in compliance with the authentication system of the secure network and forwards the authentication request to the secure network. Since the ultimate authentication request is a formal request, the secure network handles the wireless user in the same way using the same security infrastructure as it does for non-wireless remote users. The result of the authentication request is sent from the secure network to the wireless access service provider via the formal authentication protocol. The wireless access service provider then translates this result into a wireless device compatible format and finally generates and transmits a corresponding access granted/access denied status message to the wireless device over a wireless transmission link.  
         [0017]     In one embodiment of the present invention, the wireless device communicates with the wireless access service provider via hypertext transfer protocol (HTTP) messages, and the wireless access service provider and the secure network perform a RADIUS authentication for the wireless user.  
         [0018]     In one embodiment of the present invention, the wireless access service provider is a third party that provides a service of managing remote access to secure networks for wireless devices.  
         [0019]     In another embodiment of the present invention, the wireless access service provider is housed within the security environment of an organization that has remote wireless users. 
     
    
     BRIEF DESCRIPTION OF THE FIGURES  
       [0020]     A more complete appreciation of the invention and many of the attendant advantages thereof will be readily obtained as the same become better understood by reference to the following detailed description when considered in connection with the accompanying drawings, wherein:  
         [0021]      FIG. 1  is an interaction diagram illustrating a conventional authentication process of a remote dial in user;  
         [0022]      FIG. 2  is a high-level system diagram of one embodiment of the present invention;  
         [0023]      FIG. 3  is an interaction diagram illustrating the authentication of a remote wireless device according to one embodiment of the present invention;  
         [0024]      FIG. 4  is a block diagram illustrating message flow according to one embodiment of the present invention;  
         [0025]      FIG. 5  is a flow chart of an integrated wireless/non-wireless authentication process according to one embodiment of the present invention;  
         [0026]      FIG. 6  is a high-level system diagram of one embodiment of the present invention; and  
         [0027]      FIG. 7  is a system diagram of an exemplary computer device programmed to control one or more embodiments of the present invention.  
     
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS  
       [0028]     Referring now to the figures,  FIG. 2  is a high-level system diagram illustrating the various elements that interact with one another according to one embodiment of the present invention. As shown in  FIG. 2 , the system includes a wireless device  201 , such as, for example, a PDA. The wireless device  201  gains access to an IP network  204 , for example, the Internet, through a wireless transceiver  202  and a data center  203 . As discussed in the Background of the Invention section, wireless users  201  do not gain access to the Internet through an Internet Service Provider (ISP) Point Of Presence (POP), but rather, gain access directly through a data center  203 . The data center  203  creates, for example, IP packets, and serves as the intermediary between the IP network  204  and the wireless device  201 .  
         [0029]     Figure element  209  represents a third party that provides a service of managing remote access to a secure network. For example, figure element  209  may represent FIBERLINK COMMUNICATIONS CORPORATION that provides a service of managing remote access to secure networks of Company XYZ  210 . Access to Company XYZ&#39;s  210  secure networks is controlled by a RADIUS authentication server  207  that accesses a RADIUS authentication database  208 . As discussed in the Background of the Invention section, RADIUS is a widely accepted remote authentication protocol. It should be understood, however, that the present invention is in no way limited to an implementation based on RADIUS. On the contrary, the concepts of the present invention are equally applicable to any authentication protocol.  
         [0030]     The RADIUS protocol requires that a RADIUS client communicate with a RADIUS server to perform the authentication process. A RADIUS client, therefore, must be able to not only receive and unpack a RADIUS message, but also create a RADIUS message that can be sent to the RADIUS server. Accordingly, a client application is necessary to perform this requisite processing. As recognized by the present inventors, it is undesirable to place the processing burden of a RADIUS client onto typical wireless devices. As would be understood, a typical wireless device, such as a PDA, has limited processing capability, and it is more desirable to allocate that processing power to user applications, rather than infrastructure applications such as RADIUS.  
         [0031]     It was the present inventors who recognized that the processing requirements of a RADIUS client could be offloaded to, for example, a third party  209  providing a service of managing remote access to the secured networks of Company XYZ  210 . Accordingly, as shown in  FIG. 2 , the wireless access service provider  205  serves as the RADIUS client for authenticating access from the wireless user  201 . As will be discussed in further detail below, the wireless access service provider  205  serves as a translator to perform a RADIUS authentication with the RADIUS authentication server  207  on behalf of the wireless user  201 . In one embodiment of the present invention, the wireless user  201  communicates with the wireless access service provider  205  via the IP network  204  using, for example, hypertext transfer protocol (HTTP) messages, HTTP being commonly supported in wireless devices such as PDAs and laptop computers, which places no additional burden on the wireless user  201 . Accordingly, the wireless access service provider  205  translates a request for authentication contained in a HTTP message from the wireless end user  201  into a RADIUS authentication request that is used to initiate the RADIUS authentication with the RADIUS authentication server  207  of Company XYZ  210 . This RADIUS authentication request is sent to the RADIUS authentication server  207  of Company XYZ  210  via the IP network  204 . In addition, other RADIUS messages, for example, RADIUS account start/stop messages, may be sent from wireless access service provider  205  to the RADIUS authentication server  207  of Company XYZ  210  via the IP network  204 . Also, session initiation, session termination, or session time-out messages may be exchanged between the wireless access service provider  205 , the wireless user  201 , and wireless application gateway  206  via the IP network  204 .  
         [0032]     The present inventors also recognized that the processing requirements of a RADIUS client could be offloaded to, for example, a separate device dedicated to wireless authentication, located within the confines of Company XYZ, and configured to communicate with the RADIUS authentication server  207  of Company XYZ  210  via the IP network  204 . Thus, in an alternative embodiment, the wireless access service provider  205  is located within the boundaries of Company XYZ  210  and is configured to communicate with the RADIUS authentication server  207  the wireless user  201 , and the wireless application gateway  206  via an IP network  204 . In this alternative embodiment, the wireless access service provider  205  communicates with the RADIUS authentication server  207  and the wireless application gateway  206  via Company XYZ&#39;s  210  private IP network, and the wireless access service provider  205  communicates with the wireless user  201  over an external network, for example, the Internet. Those skilled in the art will recognize that in this alternative embodiment, the wireless access service provider  205  and the wireless application gateway  206  could both be implemented as computer programs running on the same computer, in which case an IP network is not needed for the two computer programs to communicate.  
         [0033]      FIG. 3  is an interaction diagram showing the various messages sent in performing a RADIUS authentication of a wireless end user  301 . The order of events in the diagram flows from top to bottom as indicated by the time progression identified by figure element  305 . As shown in  FIG. 3 , a wireless end user  301  initiates a session by contacting  306  the wireless network provider  302 . The wireless network provider  302  determines if the wireless end user  301  is a valid customer, and if so, sends a message  307  to the wireless end user  301  indicating that the caller has been authenticated as a user of the wireless network provider  302 . If the wireless end user  301  desires access to a secure network, the wireless end user  301  sends an authentication request  308  to a wireless access service provider  303 . In one embodiment of the present invention, the authentication request message from the wireless end user  301  may include, for example, a user identification, a password, and an IP address of the wireless end user. As was discussed above, in one embodiment of the present invention the wireless access service provider  303  is a third party, that provides a service to Company XYZ  304  of managing remote access to Company XYZ&#39;s  304  secure network. In another embodiment of the present invention, the wireless access service provider  303  is part of Company XYZ&#39;s  304  internal infrastructure.  
         [0034]     Continuing with  FIG. 3 , upon receipt of the authentication request by the wireless access service provider  303 , the wireless access service provider creates a RADIUS message that will be used to initiate a RADIUS authentication session with a RADIUS server of Company XYZ  304 . The RADIUS message  309  requesting access to Company XYZ&#39;s secure network, includes information that was sent from the end user  301  in the authentication request message  308 .  
         [0035]     Upon receipt of the RADIUS authentication request message  309 , a RADIUS server residing on Company XYZ&#39;s  304  secure network will attempt to authenticate the wireless end user  301  by accessing the RADIUS authentication database. Company XYZ&#39;s  304  RADIUS authentication server will then send a RADIUS message  310  indicating that access was either granted or denied back to the wireless access service provider  303 . The wireless access service provider will interpret the RADIUS message  310  received from Company XYZ  304 , and then create a non-RADIUS message  311  to communicate the result of the authentication request back to the wireless end user  301 . As discussed above, the communications between the wireless end user  301  and the wireless access service provider are, in one embodiment of the present invention, HTTP messages.  
         [0036]     From a perspective of Company XYZ  304 , wireless end user  301  is not unlike a typical dial-in user requesting access to Company XYZ&#39;s  304  secure networks through an Internet Service Provider. Accordingly, as recognized by the present inventors, wireless end users  301  may be authenticated taking advantage of the same authentication infrastructure that is used by other remote users.  
         [0037]      FIG. 4  is a block diagram illustrating an exemplary message flow in performing a RADIUS authentication of a wireless end user according to one embodiment of the present invention. As shown in  FIG. 4 , a wireless user sends an HTTP message  401  including a user ID, password, and IP address of the wireless user to a data center  402 . The data center  402  creates a TCP/IP packet  403  including the authentication request information and places that TCP/IP packet onto, for example, the Internet. The TCP/IP packet is routed to the wireless access service provider  404 . The wireless access service provider  404  recognizes the HTTP message as an authentication request, and reformats the authentication request information into a RADIUS message  405  that includes the user ID, password, and IP address. The RADIUS message  405  is sent as a TCP/IP packet to Company XYZ&#39;s RADIUS authentication server  406 . Company XYZ&#39;s RADIUS authentication server  406  unpacks the RADIUS message  405  and performs a RADIUS authentication against the RADIUS authentication database to determine whether access should be granted or denied for this particular wireless user. Once the determination has been made, Company XYZ&#39;s RADIUS authentication server creates a RADIUS message indicating whether access has been granted or denied  407 . The RADIUS authentication status message  407  is transmitted as a TCP/IP message to the wireless access service provider  408 . The wireless access service provider  408  recognizes that the intended recipient of the RADIUS message is a wireless user, and therefore, reformats the RADIUS message into a HTTP message  409 , which is sent as a TCP/IP message back through the data center  410 . The data center  410  then transmits an appropriate HTTP message  411  to the wireless user. As can be seen in  FIG. 4 , the interaction between the outside world and Company XYZ strictly adheres to the RADIUS protocol, and therefore, no special requirements are placed on the authentication infrastructure on Company XYZ to enable support of remote wireless users.  
         [0038]      FIG. 5  is a flow chart of an integrated RADIUS/non-RADIUS authentication process according to one embodiment of the present invention. In this example, the wireless access service provider is a third party that provides a service of managing remote access to Company XYZ. As shown in  FIG. 5 , the process begins with step S 501  where an authentication request is received by the wireless access service provider. The process then proceeds to step S 502  where it is determined whether the authentication request is a RADIUS packet. If the request is a RADIUS packet (i.e., “yes” at step S 502 ), the process proceeds to step S 504  where the RADIUS packet is forwarded to the corporate authentication server of Company XYZ. If, on the other hand, it is determined that the authentication request is not a RADIUS packet (i.e., “no” at step S 502 ), the process proceeds to step S 503  where the authentication request is repacked as a RADIUS message. Once the authentication request has been repacked as a RADIUS message, the process proceeds to step S 504 , described above, where that RADIUS packet is forwarded to the corporate authentication server of Company XYZ.  
         [0039]     The process then proceeds to step S 505  where the RADIUS authentication server of Company XYZ queries the RADIUS authentication database in an attempt to authenticate the user. The process then proceeds to step S 506  where it is determined whether the user is authenticated. If the user is authenticated (i.e., “yes” at step S 506 ), the process proceeds to step S 507  where a confirmation message is sent from the RADIUS authentication server of Company XYZ to the third party wireless access service provider. If, on the other hand, the user is not authenticated (i.e., “no” at step S 506 ), the process proceeds to step S 508  where the RADIUS authentication server of Company XYZ sends an authentication failure message to the third party wireless access service provider.  
         [0040]     After the authentication status message has been sent to the third party wireless access service provider at either step S 507  or step S 508 , the process proceeds to step S 509  where the third party wireless access service provider determines whether the end user is a wireless client. If it is determined that the end user requesting authentication is not a wireless client (i.e., “no” at step S 509 ), the process proceeds to step S 510  where the RADIUS authentication result message is returned to the RADIUS client that initiated the authentication request. After the authentication result message has been sent to the RADIUS client, the process ends.  
         [0041]     If, on the other hand, it is determined that the end user is a wireless client (i.e., “yes” at step S 509 ), the process proceeds to step S 511  where the third party wireless access service provider repacks the authentication result message from a RADIUS message into a message compatible with the wireless end user. After the third party wireless access service provider has repacked the authentication result message, the process proceeds to step S 512  where the repacked authentication result message is sent to the non-RADIUS end user. After the authentication result has been sent, the process ends.  
         [0042]      FIG. 6  is a high-level system diagram of an integrated RADIUS/non-RADIUS authentication system corresponding to one embodiment of the present invention where the wireless access service provider  607  is located outside of Company XYZ  614 . In the integrated RADIUS/non-RADIUS authentication system any remote device (either a wireless device  601  communicating via a wireless network data center  603  and a wireless transceiver  602 , or a non wireless device  605  communicating via an ISP  606 ) is able to communicate with secure applications located inside of Company XYZ  614 . Both the wireless network data center  603  and the ISP  606  are configured to relay IP traffic to Company XYZ  614  via an IP network  604 .  
         [0043]     Based on user information and passwords provided by the remote device, a RADIUS authentication request message is repacked (if the remote device is a wireless device  601 ) or is relayed (if the remote device is a non-wireless device  605 ) by the wireless access service provider  607  via the IP network  604  to a RADIUS authentication server  608  located at Company XYZ  614 . The RADIUS authentication server  608  checks the information contained in the authentication request message against data contained in the RADIUS authentication database  609  and replies to the wireless access service provider  607  via the IP network  604  with either a RADIUS authentication granted message or a RADIUS authentication denied message. In addition, the wireless access service provider  607  and the RADIUS authentication server  608  exchange RADIUS account management messages via the IP network  604  when a user&#39;s account is activated and deactivated.  
         [0044]     Optionally, the wireless access service provider  607  may be configured to operate a timer for determining when a wireless session has expired and thereby notifying the remote device (e.g., the wireless device  601  or the non-wireless device  605 ) and the corresponding gateway device (e.g., the wireless application gateway  610  or the non-wireless application gateway  617 ). Actual traffic between the remote device (i.e., the wireless device  601  or the non-wireless device  605 ) and the corresponding gateway device (i.e., the wireless application gateway  610  or the non-wireless application gateway  617 ) is exchanged via the IP Network  604  over corresponding paths (i.e., wireless data path  616  and non-wireless data path  615 ). It is also possible to provide different access privileges to different access devices (e.g., when using a wireless device  601  user A may be granted access to secure application one  611 , while when using a non-wireless device  605  user A may be granted access to secure application one  611 , secure application two  612 , and secure application three  613 ). In another embodiment, the integrated wireless/non-wireless authentication environment may include a wireless access service provider  607  within the boundaries of Company XYZ  614  that communicates with the wireless device  601 , the wireless application gateway  610 , and the RADIUS authentication server  608  via an IP network  604 . In this embodiment, the wireless access service provider  607  communicates with the RADIUS authentication server  608  and the wireless application gateway  610  via Company XYZ&#39;s  614  private IP network, and the wireless access service provider  607  communicates with the wireless user  601  over an external network, for example, the Internet. Those skilled in the art will recognize that in this alternative embodiment, the wireless access service provider  607  and the wireless application gateway  610  could both be implemented as computer programs running on the same computer, in which case an  1 P network is not needed for the two computer programs to communicate.  
         [0045]      FIG. 7  is a block diagram of a computer system  1201  upon which either the first or second embodiment of the present invention may be implemented. The computer system  1201  includes a bus  1202  or other communication mechanism for communicating information, and a processor  1203  coupled with the bus  1202  for processing the information. The computer system  1201  also includes a main memory  1204 , such as a random access memory (RAM) or other dynamic storage device (e.g., dynamic RAM (DRAM), static RAM (SRAM), and synchronous DRAM (SDRAM)), coupled to the bus  1202  for storing information and instructions to be executed by processor  1203 . In addition, the main memory  1204  may be used for storing temporary variables or other intermediate information during the execution of instructions by the processor  1203 . The computer system  1201  further includes a read only memory (ROM)  1205  or other static storage device (e.g., programmable ROM (PROM), erasable PROM (EPROM), and electrically erasable PROM (CPROM)) coupled to the bus  1202  for storing static information and instructions for the processor  1203 .  
         [0046]     The computer system  1201  also includes a disk controller  1206  coupled to the bus  1202  to control one or more storage devices for storing information and instructions, such as a magnetic hard disk  1207 , and a removable media drive  1208  (e.g., floppy disk drive, read-only compact disc drive, read/write compact disc drive, compact disc jukebox, tape drive, and removable magneto-optical drive). The storage devices may be added to the computer system  1201  using an appropriate device interface (e.g., small computer system interface (SCSI) integrated device electronics (IDE), enhanced-IDE (E-IDE), direct memory access (DMA), or ultra-DMA).  
         [0047]     The computer system  1201  may also include special purpose logic devices (e.g., application specific integrated circuits (ASICs)) or configurable logic devices (e.g., simple programmable logic devices (SPLDs), complex programmable logic devices (CPLDs), and field programmable gate arrays (FPGAs)).  
         [0048]     The computer system  1201  may also include a display controller  1209  coupled to the bus  1202  to control a display  1210 , such as a cathode ray tube (CRT), for displaying information to a computer user. The computer system includes input devices, such as a keyboard  1211  and a pointing device  1212 , for interacting with a computer user and providing information to the processor  1203 . The pointing device  1212 , for example, may be a mouse, a trackball, or a pointing stick for communicating direction information and command selections to the processor  1203  and for controlling cursor movement on the display  1210 . In addition, a printer may provide printed listings of data stored and/or generated by the computer system  1201 .  
         [0049]     The computer system  1201  performs a portion or all of the processing steps of the invention in response to the processor  1203  executing one or more sequences of one or more instructions contained in a memory, such as the main memory  1204 . Such instructions may be read into the main memory  1204  from another computer readable medium, such as a hard disk  1207  or a removable media drive  1208 . One or more processors in a multi-processing arrangement may also be employed to execute the sequences of instructions contained in main memory  1204 . In alternative embodiments, hard-wired circuitry may be used in place of or in combination with software instructions. Thus, embodiments are not limited to any specific combination of hardware circuitry and software.  
         [0050]     As stated above, the computer system  1201  includes at least one computer readable medium or memory for holding instructions programmed according to the teachings of the invention and for containing data structures, tables, records, or other data described herein. Examples of computer readable media are compact discs, hard disks, floppy disks, tape, magneto-optical disks, PROMs (EPROM, EEPROM, flash EPROM), DRAM, SRAM, SDRAM, or any other magnetic medium, compact discs (e.g., CD-ROM), or any other optical medium, punch cards, paper tape, or other physical medium with patterns of holes, a carrier wave (described below), or any other medium from which a computer can read.  
         [0051]     Stored on any one or on a combination of computer readable media, the present invention includes software for controlling the computer system  1201 , for driving a device or devices for implementing the invention, and for enabling the computer system  1201  to interact with a human user. Such software may include, but is not limited to, device drivers, operating systems, development tools, and applications software. Such computer readable media further include the computer program product of the present invention for performing all or a portion (if processing is distributed) of the processing performed in implementing the invention.  
         [0052]     The computer code devices of the present invention may be any interpretable or executable code mechanism, including but not limited to scripts, interpretable programs, dynamic link libraries (DLLs), Java classes, and complete executable programs. Moreover, parts of the processing of the present invention may be distributed for better performance, reliability, and/or cost.  
         [0053]     The term “computer readable medium” as used herein refers to any medium that participates in providing instructions to the processor  1203  for execution. A computer readable medium may take many forms, including but not limited to, non-volatile media, volatile media, and transmission media. Non-volatile media includes, for example, optical, magnetic disks, and magneto-optical disks, such as the hard disk  1207  or the removable media drive  1208 . Volatile media includes dynamic memory, such as the main memory  1204 . Transmission media includes coaxial cables, copper wire, and fiber optics, including the wires that make up the bus  1202 . Transmission media also may also take the form of acoustic or light waves, such as those generated during radio wave and infrared data communications.  
         [0054]     Various forms of computer readable media may be involved in carrying out one or more sequences of one or more instructions to processor  1203  for execution. For example, the instructions may initially be carried on a magnetic disk of a remote computer. The remote computer can load the instructions for implementing all or a portion of the present invention remotely into a dynamic memory and send the instructions over a telephone line using a modem. A modem local to the computer system  1201  may receive the data on the telephone line and use an infrared transmitter to convert the data to an infrared signal. An infrared detector coupled to the bus  1202  can receive the data carried in the infrared signal and place the data on the bus  1202 . The bus  1202  carries the data to the main memory  1204 , from which the processor  1203  retrieves and executes the instructions. The instructions received by the main memory  1204  may optionally be stored on storage device  1207  or  1208  either before or after execution by processor  1203 .  
         [0055]     The computer system  1201  also includes a communication interface  1213  coupled to the bus  1202 . The communication interface  1213  provides a two-way data communication coupling to the Gateway Device  1299 . For example, the communication interface  1213  may be a network interface card to attach to any packet switched LAN. As another example, the communication interface  1213  may be an asymmetrical digital subscriber line (ADSL) card, an integrated services digital network (ISDN) card or a modem to provide a data communication connection to a corresponding type of communications line. In any such implementation, the communication interface  1213  sends and receives electrical, electromagnetic or optical signals that carry digital data streams representing various types of information.  
         [0056]     The network link  1214  typically provides data communication through one or more networks to other data devices. For example, the network link  1214  may provide a connection to another computer through a local network  1215  (e.g., a LAN) or through equipment operated by a service provider, which provides communication services through a communications network  1216 . The local network  1214  and the communications network  1216  use, for example, electrical, electromagnetic, or optical signals that carry digital data streams, and the associated physical layer (e.g., CAT 5 cable, coaxial cable, optical fiber, etc). The signals through the various networks and the signals on the network link  1214  and through the communication interface  1213 , which carry the digital data to and from the computer system  1201  may be implemented in baseband signals, or carrier wave based signals. The baseband signals convey the digital data as unmodulated electrical pulses that are descriptive of a stream of digital data bits, where the term “bits” is to be construed broadly to mean symbol, where each symbol conveys at least one or more information bits. The digital data may also be used to modulate a carrier wave, such as with amplitude, phase and/or frequency shift keyed signals that are propagated over a conductive media, or transmitted as electromagnetic waves through a propagation medium. Thus, the digital data may be sent as unmodulated baseband data through a “wired” communication channel and/or sent within a predetermined frequency band, different than baseband, by modulating a carrier wave.  
         [0057]     Instructions, parameters, reference data associated with the above-described embodiments may be encoded in software and/or firmware.  
         [0058]     Obviously, numerous modifications and variations of the present invention are possible in light of the above teachings. It is therefore to be understood that within the scope of the appended claims, the invention may be practiced otherwise than as specifically described herein.