Method, apparatus, and system for maintaining persistent wireless network connection

Computing devices connected over a wired network typically maintain a persistent connection to the network via a physical connector (eg, an Ethernet cable). This physical connection ensures that the device can maintain a network connection even when the user is not logged on to the device. This persistent connection can provide various advantages. For example, in a corporate environment, a wired network computing device can maintain a persistent network connection so that an information technology (IT) administrator can access the device regardless of whether the user is logged on or not. Can be done. This ability can prove useful and / or useful when an IT administrator needs to "push" a patch onto a device when the user is not logged on or physically does not exist. it can.

However, in the case of wireless networks, computing devices are currently unable to maintain a secure persistent wireless network connection if the user is not logged on to the device. Under certain circumstances, the device can be connected to the wireless network through a "persistent profile" when the user is logged out of the device, but this connection usually involves insecure connections. Profiles are known to those of skill in the art and typically include various computing environments and / or user's stored settings and other such customized information. A persistent profile is a profile created for situations where a user cannot log on to a device.

In summary, if the wireless device is not currently near a wireless access point (WAP) and the user is not logged on to the device, the device will not be able to maintain a secure connection to the wireless network. Without a secure connection, IT administrators cannot securely access the device and push patches, or perform any other administrative work that typically requires a secure connection.

By way of example, but not limiting, the invention is shown in the accompanying drawings where similar references show similar elements.

Embodiments of the present invention provide methods, devices, and systems for maintaining a secure, permanent wireless connection. In particular, embodiments of the present invention utilize machine-based certificates to maintain a secure persistent wireless network connection when the user is not logged on to the device. As used herein, the term "when the user is not logged on" includes situations where the computing device has just started and the user has not yet logged on, as well as situations where the user has just logged off the device. .. Whenever the term "one embodiment" or "embodiment" of the present invention is used herein, a particular feature, structure, or property described in connection with that embodiment is at least one embodiment of the invention. Means to be included in. Therefore, the appearance of terms such as "in one embodiment" and "according to one embodiment" found in various places throughout the present specification does not necessarily refer to the same embodiment.

As mentioned above, wireless computing devices are typically unable to maintain a secure persistent wireless network connection when the user is not logged on. At best, the device can only establish an insecure connection to the wireless network by using the persistent profile. The "secure" connections used herein include certificate-based connections, and "insecure" connections have a lower level of security than any unsecured and / or certificate-based connections (eg, users). Can point to a connection that has a name / password). Certificate-based security is known to those of skill in the art and will be discussed further below. As shown in FIG. 1, when the device "(radio device 150") is near the wireless network ("network 100"), the device user ("user 125") can log in to the network. The user 125 can have a user certificate associated with each, and the wireless device 150 can have a machine certificate associated with itself. Normally, when the user 125 logs on to the wireless device 150 and the wireless device 150 is recognized by the network 100, the network 100 can authenticate the user by using the user certificate. If desired, the network 100 can also use the machine certificate to authenticate the wireless device 150. It is known to those skilled in the art to authenticate users and devices on a network using user and machine certificates, and further herein so as not to unnecessarily obscure embodiments of the present invention. I will omit the explanation of. The user and / or device remain securely connected to network 100 while the user is logged on to wireless device 150. If the user then logs out of network 100, wireless device 150 loses a secure connection to network 100. The radio 150 can then apply a persistent profile to establish an insecure connection to network 100 (configured to do so). If so). Alternatively, if not configured to do so, the radio 150 would not be able to establish any connection to network 100 at all.

According to one embodiment of the present invention, the wireless device is a case where the user is not logged on to the device and / or is not recognized by the network (hereinafter collectively referred to as "logged on to the system"). Can also be securely connected to a wireless network. Embodiments of the present invention utilize the machine certificate associated with the device described above to provide the required level of security for the device so that the device can securely connect to the wireless network when the user is not logged on to the system. To be able to establish and maintain. As conceptually shown in FIG. 2, the radio device 250 can include a monitoring component 200 that includes hardware, software, firmware, and / or any combination thereof. In one embodiment, the monitoring component 200 can receive notification that user 125 has logged off the system (eg, from the operating system via an operating system event). If the monitoring component 200 determines that the wireless device 250 is not connected to the network 100 (for example, the user 125 is not logged on to the system), the monitoring component 200 selects various profiles of the wireless device 250 (collectively, "profile 205"). You can look it up. Profile 205 can include all profiles on radio device 250, including one or more persistent profiles for use when the user is not logged on to the device. In particular, the monitoring component 200 examines the various profiles on the radio device 250, identifies the persistent profiles available on the radio device 250, and then selects the persistent profile based on criteria suitable for the current network 100. Can be applied.

According to one embodiment of the invention, a machine certificate can be associated with at least one of the persistent profiles on the radio device 250 (in FIG. 2, "machine certificate 215" is associated with the "machine certificate 215". Persistent profile 210 "). By associating a machine certificate with a profile, one embodiment of the invention allows the wireless device 250 to securely connect to network 100 when the user is not logged on to the system. Therefore, in the above scenario where the monitoring component 200 determines that the user 125 is not logged on to the system, one of the persistent profiles in the profile 205 can be selected and applied to the radio device 250. In one embodiment, the monitoring component 200 can then examine the applied persistent profile to determine if a machine certificate is associated. As mentioned above, the persistent profile 210 is an example of a persistent profile with which the machine certificate 215 is associated. Therefore, if the persistent profile 210 is selected and applied, the monitoring component 200 can then examine the persistent profile to determine if a machine certificate is associated with it. If the persistent profile 210 is found to have a machine certificate 215 associated with it, the monitoring component 200 finds and uses the machine certificate 215 to authenticate the radio device 250 on network 100. This authentication allows the wireless device 250 to establish a secure connection to the network. When the user 125 logs in to the system, the monitoring component 250 is aware of this event and can disable the persistent profile 210 so that the radio 250 does the traditional method (eg, authenticating the user 125). Allows you to establish a secure connection to the wireless network 100 through.

FIG. 3 is a flow chart showing how a typical radio can now function as well as according to one embodiment of the invention. The following operations can be described as a series of processes, but many of the operations can actually be performed in parallel and / or simultaneously. Moreover, the order of actions can be rearranged without departing from the spirit of the embodiments of the present invention. Operations 301 to 307 describe a scenario in which a wireless device can now be connected to a wireless network and can be authenticated by the wireless network. At 301, the monitoring component can determine if the user is logged on to the system. When the user is logged on, in 302, the user's profile list can be searched, and in 303, one of the profiles can be selected and applied. At 304, the monitoring component can examine the applied profile to determine if the profile has an associated user certificate. If so, at 305, the user certificate can be used to authenticate the user on the network, and then at 307, the user can be authenticated against the wireless network with a secure connection. However, if the profile does not have a user certificate, in 306 the monitoring component can determine that certificate-based security is not possible on the network, and in 308 without a certificate, i.e. secure. Users can be authenticated without a connection.

Embodiments of the present invention will be described in Operations 309 to 313. According to one embodiment, if the monitoring component determines at 301 that the user is not logged on to the system, the monitoring module searches the persistent profile list from the device at 309 and the appropriate persistent at 310. Profiles can be selected and applied. At 311 the monitoring module can then determine if there is a machine certificate associated with the persistent profile. In some cases, the machine certificate can be used in 312 and the device can be authenticated against the network in 313, thus establishing a secure connection to the network. However, if the persistent profile does not have a machine certificate, at 306 the monitoring component can determine that certificate-based security is not possible on the network, and at 308 the device is not certificated. Can be authenticated with (ie, without a secure connection).

Embodiments of the present invention can be implemented in various computing devices. According to one embodiment of the present invention, a computing device can include various components capable of executing instructions to realize one embodiment of the present invention. For example, a computing device comprises at least one machine-accessible medium and / or can be coupled to at least one machine-accessible medium. As used herein, "machine" includes, but is not limited to, any computing device having one or more processors. Machine-accessible media as used herein include any mechanism for storing and / or transmitting information in any form accessible by a computing device, and is recordable / non-recordable medium (read-only memory). (ROM), Random Access Memory (RAM), Magnetic Disk Storage Medium, Optical Storage Medium, and Flash Memory Devices) and Electrical, Optical, Acoustic, or Other Forms of Propagation Signals (Carriers, Infrared Signals, and Digital) (Signals, etc.), but not limited to these.

According to one embodiment, the computing device may include a variety of other known components, such as one or more processors. The processor (s) and machine-accessible media can be communicably coupled using a bridge / memory controller, and the processor may be able to execute instructions stored on the machine-accessible media. .. The bridge / memory controller can be coupled to the graphics controller, which can control the display data output on the display device. The bridge / memory controller can be coupled to one or more buses. One or more of these elements may be integrated with the processor in a single package, or multiple packages or dies may be used. A host bus controller such as a universal serial bus (USB) host controller can be coupled to the bus (s), and multiple devices can be coupled to the USB. For example, a user input device such as a keyboard and a mouse can be included in the computing device to provide input data. In an alternative embodiment, the host bus controller may comply with PCI, PCI Express, Firewire, and various other interconnect standards, including other such current and future standards.

In the above specification, the present invention has been described with reference to specific exemplary embodiments of the present invention. However, it will be appreciated that various modifications and variations can be made without departing from the broad spirit and scope of the invention set forth in the appended claims. Therefore, the specification and drawings should be regarded as an example, not as a limitation.

<figref num="1">A device of a typical wireless network is shown.</figref><figref num="2">An embodiment of the present invention is shown.</figref><figref num="3">It is a flowchart which shows how a typical wireless device can function now and by one embodiment of the present invention.</figref>