Methods, systems, and computer program products for providing trusted access to a communicaiton network based on location

RELATED APPLICATIONS

0001This application is related to a commonly assigned U.S. patent application Ser. Nos. 11/093,355 and 11/093,564, entitled, respectively, “Methods, Systems, and Computer Program Products for Determining a Trust Indication Associated with Access to a Communication Network” and “Methods, Systems, and Computer Program Products for Establishing Trusted Access to a Communication Network”, both filed on Mar. 30, 2005, the content of both being incorporated by reference herein in their entirety.

TECHNICAL FIELD

0002The subject matter described herein relates to communications with a network. More particularly, the subject matter described herein relates to providing trusted access to a communication network based on a location of the client.

BACKGROUND

0003Advancements in communication technologies have led to expansive growth in the availability and use of communication networks. For example, the Internet's ubiquitous nature and limitless supply of practical applications has fueled a rapid growth in providing access to the Internet to users wherever they may be across the world. Such access may be provided with or without the use of security, authentication, and encryption technologies, depending on the user's requirements. Common methods of access include dial-up, landline broadband (over coaxial cable, fiber optic cables or copper wires), wireless broadband, and satellite.

0004Many public places, such as airports, libraries, Internet cafes, and businesses provide access to the Internet to cater to users away from their home or business. Internet access points in some public places, like airport halls, are sometimes designed just for brief use while standing. Various terms such as “public Internet kiosk”, “public access terminal”, and “Web payphone” have been used to describe these access points.

0005Wi-Fi provides wireless access to communication networks, and therefore may provide Internet access. Wi-Fi “hotspots” providing such access include Wi-Fi cafes, where a potential user typically brings his or her own wireless-enabled device, such as a notebook computer or personal digital assistant (PDA). These services may be free to all, free to customers only, or fee-based. A hotspot need not be limited to a confined location. Whole campuses, parks, and even metropolitan areas have been Wi-Fi enabled.

0006With many people using Wi-Fi hotspots and other access points to access the Internet and other communication networks, new security threats arise from the access provider and other users of the access point. Access is typically provided via networks that are privately owned by individuals or small companies where the user doesn't know the owner. It's a simple matter for the owner to “sniff” traffic on his network on the way to the Internet to steal personal information from the users of the network.

0007In addition, many business and residential users do not botherto protect their network. As a result, others in close proximity to the business or network can gain unauthorized access to the user's network. For example, users have been known to identify locations that provide unsecured access, such as active Wi-Fi access points, either by physically marking a building or sidewalk with chalk or by placing its street address on a Website of hotspots. This technique is commonly referred to as “warchalking”. Another technique, commonly referred to as “wardriving”, involves users driving around an area with a notebook computer with wireless capabilities in order to find unsecured Wi-Fi hotspots. The goal here is to find vulnerable sites either to obtain free Internet service or to potentially gain illegal access to an organization's or other user's data.

0008Early attempts to provide security included changing or suppressing a service set identifier (SSID) associated with a Wi-Fi access point and/or only allowing access by devices with specific addresses. These methods are easily defeated by hackers armed with packet sniffers and address spoofing equipment. In addition, precautions that hide an access point or limit computers that can access the access point are not practical in commercial applications when the access provider provides the access point to users as a service.

0009Other possible security precautions that may be taken by a user include the use of a firewall at the user's device. Firewalls, however, only help protect the user's device and data thereon, but provide no protection for the data that is sent and received from the device to/from a communication network.

0010Virtual private networks (VPNs) have also been used to provide access to a trusted, usually private network. The use of VPNs, however, also has several disadvantages, such as creating excessive traffic on the private trusted networks. In addition, VPN use often results in significant performance degradation for the user. For example, the VPN server may not be near the user's local network or the VPN server may not be designed for high-speed access, just occasional access from remote clients to the trusted network.

0011Other available precautions include the use of certificate authorities such as VERISIGN™ and THAWTE™ to provide an identity service where they guarantee the identity of a device by providing the device with a digital certificate with identification information. The digital certificate is signed by one or more certificate authorities that a receiving device or user trusts. Trust exists because the digital signatures of the certificate authorities are difficult to forge, and the certificate authorities themselves have established trust throughout the user community, usually through marketing and branding. Certificate authorities, however, simply verify identity. For example, they can verify that a website “my.website.com” or server that is accessed is indeed my.website.com. Certificate authorities do not guarantee anything further about the remote service or device. The certificate authority's signature is the symbol of the guarantee. VERISIGN™, for example, will allow a website to place the VERISIGN™ logo on the site to verify that the site is secure. The logo provides assurance to users of the identity of the site and assures that all information sent to the site is sent using the secure sockets layer (SSL) security protocol.

0012None of the above-mentioned security precautions provides assurances that access provided to a communication network, such as via a Wi-Fi hotspot or other access point, can be trusted.

0013Commonly assigned U.S. patent application Ser. Nos. 11/093,355 and 11/093,564, referenced above, relate to methods and systems that can be used to determine if a network can be trusted. U.S. patent application Ser. No. 11/093,355 relates to determining a trust indication associated with an access network providing access to a communication network. A trust-related characteristic of an access network providing access to a target communication network is determined. A trust indication for the access network is determined based on the determined trust-related characteristic. The determined trust indication is associated with the access network and is made available to clients detecting the access network. The trust indication is originated by a trust authority that is separate from the client and from the access network.

0014U.S. patent application Ser. No. 11/093,564 relates to establishing trusted access to a communication network by a client. The client detects an available access network providing access to a target communication network and determines a trust indication associated with the available access network. The trust indication is originated by a trust authority that is separate from the client and from the available access network. A determination of whether to access the communication network via the available access network is made at the client based on the trust indication. The trust-related characteristics and the trust indication are determined by the trust authority, which makes the determined trust indication available to clients detecting the access network. For example, a trust indication message may be sent to a client prior to providing access by the client to the target communication network. The access is provided based on a response by the client to the received trust indication message.

0015When a user is attempting to access a communication network via an untrusted access network, however, it would be helpful for the user to have the ability to identify one or more trusted access networks based on a location of the user/client.

0016U.S. Publication No. 2002/0138635 to Redlich et al. describes a system comprising a client device, an access station, and a trusted network element. In Redlich's system, an ISP can select a trusted network node based on a user's security requirements and an access station's location. Redlich, however, does not provide trusted access to a communication network based on a client's location.

0017Accordingly, there exists a need for methods, systems, and computer program products for providing trusted access to a communication network based on location information.

SUMMARY

0018In one aspect of the subject matter disclosed herein, a method is disclosed for providing trusted access to a communication network by a client based on location. The method includes detecting an available access network providing access to a target communication network, determining whether the available access network is a trusted access network, determining location information for the client responsive to determining that the available access network is not a trusted access network, and determining an identity of at least one trusted access network based on the determined location information.

0019In another aspect of the subject matter disclosed herein, a method is disclosed for providing trusted access to a communication network by a client based on location. The method includes determining location information for the client and determining an identity of at least one trusted access network based on the determined location information.

0020In another aspect of the subject matter disclosed herein, a method is disclosed for providing trusted access to a communication network to a client based on location. The method includes receiving a request for an identity of at least one trusted access network for accessing a target communication network at a server from the client. The request includes at least one of an access network identifier associated with an access network currently available to the client and location information for the client. Corresponding information for at least one trusted access network is determined based on the at least one of a network identifier for an access network currently accessible to the client and location information for the client. The corresponding information for the at least one trusted access network is forwarded to the client.

0021In another aspect of the subject matter disclosed herein, a computer program product is disclosed. The computer program product includes computer executable instructions embodied in a computer-readable medium for performing steps at a client including detecting an available access network providing access to a target communication network, determining whether the available access network is a trusted access network, determining location information for the client responsive to determining that the available access network is not a trusted access network, and determining an identity of at least one trusted access network based on the determined location information.

0022In another aspect of the subject matter disclosed herein, a computer program product is disclosed. The computer program product includes computer executable instructions embodied in a computer-readable medium for performing steps including determining location information for the client and determining an identity of at least one trusted access network based on the determined location information.

0023In another aspect of the subject matter disclosed herein, a computer program product is disclosed. The computer program product includes computer executable instructions embodied in a computer-readable medium for performing steps including receiving a request for an identity of at least one trusted access network for accessing a target communication network at a server from a client. The request includes at least one of an access network identifier associated with an access network currently available to the client and location information for the client. The performed steps also include determining corresponding information for at least one trusted access network based on the at least one of a network identifier for an access network currently accessible to the client and location information for the client and forwarding the corresponding information for the at least one trusted access network to the client.

0024In another aspect of the subject matter disclosed herein, a communication device for providing trusted access to a communication network based on location includes means for detecting an available access network providing access to a target communication network, means for determining whether the available access network is a trusted access network, means for determining location information for the client, and means for determining an identity of at least one trusted access network based on the determined location information.

0025In another aspect of the subject matter disclosed herein, a communication device for providing trusted access to a communication network based on location includes a network interface that detects an available access network providing access to a target communication network, a location manager that determines location information for the communication device, and a network information manager that determines whether the available access network is a trusted access network and, responsive to determining that the available access network is not a trusted access network, determines an identity of at least one trusted access network based on the determined location information.

0026In another aspect of the subject matter disclosed herein, a server for providing trusted access to a communication network by a client includes means for receiving a request for an identity of at least one trusted access network for accessing a target communication network from a client. The request includes at least one of an access network identifier associated with an access network currently available to the client and location information for the client. The server also includes means for determining corresponding information for at least one trusted access network based on the at least one of a network identifier for an access network currently accessible to the client and location information for the client and means for forwarding the corresponding information for the at least one trusted access network to the client.

0027In another aspect of the subject matter disclosed herein, a server for providing trusted access to a communication network by a client includes a client interface that receives a request for an identity of at least one trusted access network for accessing a target communication network from a client. The request includes at least one of an access network identifier associated with an access network currently available to the client and location information for the client. The server also includes a network information manager that determines corresponding information for at least one trusted access network based on the at least one of a network identifier for an access network currently accessible to the client and location information for the client. The client interface forwards the corresponding information for the at least one trusted access network to the client.

BRIEF DESCRIPTION OF THE DRAWINGS

0028Objects and advantages of the present invention will become apparent to those skilled in the art upon reading this description in conjunction with the accompanying drawings, in which like reference numerals have been used to designate like elements, and in which:

0029<figref idref="DRAWINGS">FIG. 1</figref> is a schematic diagram illustrating a system for providing trusted access to a communication network based on location according to an aspect of the subject matter disclosed herein;

0030<figref idref="DRAWINGS">FIG. 2</figref> is a representation of a user interface for selecting among access networks;

0031<figref idref="DRAWINGS">FIG. 3</figref> is a flow diagram illustrating a method for providing trusted access to a communication network by a client based on location according to an aspect of the subject matter described herein;

0032<figref idref="DRAWINGS">FIG. 4</figref> is a flow diagram illustrating a method for providing trusted access to a communication network by a client based on location according to another aspect of the subject matter described herein; and

0033<figref idref="DRAWINGS">FIG. 5</figref> is a flow diagram illustrating a method for providing trusted access to a communication network to a client based on location according to another aspect of the subject matter described herein.

DETAILED DESCRIPTION

0034To facilitate an understanding of exemplary embodiments, many aspects are described in terms of sequences of actions that can be performed by elements of a computer system. For example, it will be recognized that in each of the embodiments, the various actions can be performed by specialized circuits or circuitry (e.g., discrete logic gates interconnected to perform a specialized function), by program instructions being executed by one or more processors, or by a combination of both.

0035Moreover, the sequences of actions can be embodied in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer-based system, processor containing system, or other system that can fetch the instructions from a computer-readable medium and execute the instructions.

0036As used herein, a “computer-readable medium” can be any means that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The computer-readable medium can be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, device, or propagation medium. More specific examples (a non-exhaustive list) of the computer-readable medium can include the following: an electrical connection having one or more wires, a portable computer diskette, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, and a portable compact disc read-only memory (CDROM).

0037Thus, the subject matter described herein can be embodied in many different forms, and all such forms are contemplated to be within the scope of what is claimed.

0038<figref idref="DRAWINGS">FIG. 1</figref> is a schematic diagram illustrating a system for providing trusted access to a communication network based on location according to an aspect of the subject matter disclosed herein. In <figref idref="DRAWINGS">FIG. 1</figref>, a user of a client <b>100</b> is considering accessing a communication network <b>102</b> to communicate with one or more remote endpoints <b>104</b> accessible via network <b>102</b>. For example, network <b>102</b> may be the Internet and remote endpoints <b>104</b> may be Internet sites accessible by client <b>100</b> once access is established to network <b>102</b>. Alternatively, network <b>102</b> may be a metropolitan area network (MAN), wide area network (WAN), local area network (LAN), and the like, or any combination thereof. Since the user is considering accessing network <b>102</b>, network <b>102</b> will be referred to herein as a “target network”. Client <b>100</b> may be any communication device, such as a computer, mobile phone, PDA, and the like.

0039Client <b>100</b> can access target network <b>102</b> via one of multiple available networks <b>106</b>, <b>108</b>, and <b>110</b> providing access to target network <b>102</b>. Since these networks provide access to target network <b>102</b>, each will be referred to herein as an “access network”. Access networks <b>106</b>, <b>108</b>, and <b>110</b> may include access gateways <b>114</b>,<b>116</b>, and <b>118</b> to provide access to target network <b>102</b> either alone or in conjunction with the access networks <b>106</b>,<b>108</b>, and <b>110</b>, respectively. By way of example, access network <b>106</b> may include a Wi-Fi hotspot provided by a commercial establishment. That is, access network <b>106</b> may include a wireless access point (WAP) <b>112</b> for communicating wirelessly with client <b>100</b> when client <b>100</b> is within range of the Wi-Fi hotspot. Client <b>100</b> can communicate with target network <b>102</b> via access network <b>106</b>. Note that additional networks, such as a LAN, an Internet service provider (ISP), and other entities not shown may also be employed along with access networks <b>106</b>, <b>108</b>, and <b>110</b> to provide access to target network <b>102</b>.

0040As used herein, the term “access network” refers to one or more communication nodes providing communication between a client, such as client <b>100</b>, and target network <b>102</b>. The access network may include, for example, an access gateway, a wireless access point, routers, switches, and other such devices. For example, the access network may include an access gateway, such as access gateways <b>114</b>, <b>116</b>, and <b>118</b>. In addition, or alternatively, the access network may include a set of communication nodes arranged to provide access to target network <b>102</b>. In each case, the access network may include hard-wired, optical, or wireless components, or any combination thereof. In addition, an access network may include any of the number of protocols and software supporting communication via the access network, including security protocols. In each case, access network will be used herein to represent the above-described infrastructure and functionality.

0041It should also be understood that the term access network as used herein refers to a network that is, in whole or in part, under the control of an access network provider that may exercise control over the use of the access network to limit access thereto. Put another way, the access network provider may exercise some degree of control over communications via the access network to and from the target network. One example of an access network is a Wi-Fi hotspot providing controlled wireless access to the Internet (target network). The owner of the hotspot exercises control over access to the Internet by, e.g., imposing fees for the service, limiting availability of the access network, and a number of other control practices not normally associated with the Internet. Accordingly, an access network should not be considered as merely an extension of target network <b>102</b>.

0042In <figref idref="DRAWINGS">FIG. 1</figref>, a network information server <b>120</b> may be accessed to determine information about access networks, including trust indication information, location information, access network identities, and other such information associated with access networks providing access to target network <b>102</b>. Network information server <b>120</b> is separate from client <b>100</b>, an access network provider, and an associated access network. That is, network information server <b>120</b> operates independently of client <b>100</b> and an access network, but may interface with both.

0043Client <b>100</b> includes means for detecting an available access network providing access to a target communication network. For example, client <b>100</b> may include a network interface <b>122</b> for detecting an available access network. Network interface <b>122</b> may detect an access gateway or WAP in the access network. For example, network interface <b>122</b> may receive a service set identifier (SSID) broadcast from a WAP. Network interface <b>122</b> may also detect an available access network using other known communication techniques.

0044Client <b>100</b> may also include means for determining whether the available access network is a trusted access network. For example, client <b>100</b> may include a network information manager <b>124</b> that determines whether the available access network is a trusted access network. Network information manager <b>124</b> may be configured to determine whether the available access network is a trusted access network by determining an access network identifier associated with the available access network and by determining, based on the access network identifier, whether the available access network is in an access network database. The access network identifier associated with the available access network may be based on an Internet protocol (IP) address for the access gateway associated with the available access network and/or an access point associated with the available access network. Using the IP address provides a unique address for devices in the access network. The IP address may be a permanent address or one that is dynamically assigned.

0045The access network identifier may also be based on a media access control (MAC) address for an access gateway associated with the available access network and/or an access point associated with the available access network. Using the MAC address provides a unique serial number associated with a network device that identifies the network device hardware to other network devices.

0046The access network identifier may also be based on an IP subnet identifier associated with the available access network. An IP subnet identifier is a portion (typically 8 bits) of an IP address that is common to devices within a network that is a subnetwork to another network. For example, a LAN or other network may be a subnetwork to the Internet. When a subnet identifier is employed with a class B IP address, sixteen bits represent the net ID, eight bits represent the subnet ID, and eight bits represent the host ID. All devices within the subnetwork will have the same subnetID.

0047The access network identifier may also be based on a signed digital certificate associated with the available access network. The signed digital certificate may be obtained from the access network. For example, an access gateway providing access to the target network may provide a signed digital certificate indicating an identity associated with the access network.

0048The access network identifier may also be based, in-part, on an SSID received from a wireless access point. The SSID is typically represented by a case-sensitive name assigned to a wireless Wi-Fi network used by devices in the Wi-Fi network to communicate. Although an SSID is not guaranteed to be unique, the SSID of a network can be combined with other information, such as the items described above, to form the access network identifier.

0049It should be understood that the access network identifier may also be based on any combination of the above discussed items. According to one aspect of the subject matter disclosed herein, network information manager <b>124</b> determines whether the available access network is in an access network database based on the access network identifier. For example, network information manager <b>124</b> may determine whether the available access network is in an access network database based on prior use of the access network or based on information provided by the access network. In one implementation, client <b>100</b> can receive a trust indication from an access gateway, WAP, or any communication node associated with the access network. In one implementation, when a broadcast SSID message is received at network interface <b>122</b>, network information manager <b>124</b> extracts a trust indication from the SSID message. The trust indication may be absent in the case of untrusted access networks, or may include an associated trust level.

0050According to another aspect, client <b>100</b> may also include a local access network database <b>126</b>. Network information manager <b>124</b> accesses local access network database <b>126</b> to determine based on the access network identifier whether the available access network is a trusted access network. For example, local access network database <b>126</b> may include network identifiers, such as those described above, and corresponding records indicating whether the available access network is a trusted access network. Network information manager <b>124</b> searches local access network database <b>126</b> to determine whether or not an available access network is a trusted access network. Trust indications may be determined and compiled in local access network database <b>126</b> as discussed above with reference to U.S. patent application Ser. Nos. 11/093,355 and 11/093,564.

0051According to another aspect, network information manager <b>124</b> in client <b>100</b> is configured to access a remote access network database <b>128</b> on network information server <b>120</b>. Network information manager <b>124</b> sends a request to network information server <b>120</b> with the access network identifier to determine whether the available access network is trusted. Network information server <b>120</b> determines whether the available access network is trusted by, for example, accessing remote access network database <b>128</b> based on the access network identifier. Network information server <b>120</b> responds with an indication as to whether the identified access network is trusted.

0052According to another aspect, network information manager <b>124</b> accesses local access network database <b>126</b> to determine whether the available access network is in an access network database based on the access network identifier as described above. Responsive to not finding the access network identifier in local access network database <b>126</b> on client <b>100</b>, network information manager <b>124</b> accesses remote access network database <b>128</b> on network information server <b>120</b>. In one implementation, local access network database <b>126</b> on client <b>100</b> may include information about access networks within a given region or regions. For example, local access network database <b>126</b> may include information about access networks within regions covering a home area of a user of client <b>100</b> and commonly traveled regions of the user. Accordingly, local access network database <b>126</b> on client <b>100</b> may be checked first to determine if an access network identifier for the available access network is listed. In this example, remote access network database <b>128</b> is checked when client <b>100</b> is outside those regions and thus no matching local access network database <b>126</b> is available on client <b>100</b>.

0053According to another aspect, when a local access network database <b>126</b> is included on client <b>100</b>, network information server <b>120</b> may provide updates to client <b>100</b> for maintaining local access network database <b>126</b>.

0054Client <b>100</b> may also include means for determining location information corresponding to the location of client <b>100</b>. For example, client <b>100</b> may include a location manager <b>130</b> that determines location information for client <b>100</b>. According to one aspect, location manager <b>130</b> is configured to determine location information for the communication device by determining an access network identifier associated with the available access network and accessing one or both of access network databases <b>126</b> and <b>128</b> to determine location information based on the access network identifier associated with the available access network. The access network identifier associated with the available access network may be based on at least one of an IP address, MAC address, IP subnet identifier, a signed digital certificate, and an SSID associated with the available access network, as described above. The location information may include an address, intersection, landmark, public area, and/or other location information.

0055According to another aspect, client <b>100</b> includes a global positioning system (GPS) receiver (not shown) that receives GPS location information from a global positioning system. Location manager <b>130</b> is configured to determine location information for the communication device based on the received GPS location information. GPS location information is determined by the GPS receiver in conjunction with a system of satellites. Generally speaking, the GPS receiver determines its latitude and longitude by calculating the time difference for signals from different satellites to reach the GPS receiver. Once the latitude and longitude are determined, location information may be determined by accessing a location database that cross-references the latitude and longitude information with more user-friendly location information, such as street addresses. The location information may be included in network database <b>126</b> and/or network database <b>128</b>. Here, for example, GPS exchange format (GPX) may be used for transferring GPS data between client <b>100</b> and network information server <b>120</b>. GPX is an extensible markup language (XML) schema designed for transferring GPS data between software applications.

0056According to another suspect, location manager <b>130</b> is configured to determine location information for client <b>100</b> by prompting a user of client <b>100</b> to input the location information. For example, a user may be prompted by a dialog box in a user interface on client <b>100</b>. The user enters (or selects) the location information via the dialog box.

0057Client <b>100</b> also includes means for determining an identity of one or more trusted access networks based on the determined location information. For example, network information manager <b>124</b> may determine an identity of at least one trusted access network based on the determined location information. For example, network information manager <b>124</b> may be configured to access one or both of access network databases <b>126</b> and <b>128</b> to determine an identity of a trusted access network based on the determined location information. As described above with reference to access network trust indications, client <b>100</b> may access local access network database <b>126</b> on client <b>100</b> and, responsive to not finding the trusted access network identifier in local access network database <b>126</b>, may access remote access network database <b>128</b> on network information server <b>120</b>.

0058Network information server <b>120</b> includes means for receiving, from one or more clients <b>100</b>, a request for an identity of at least one trusted access network for accessing a target communication network. For example, network information server <b>120</b> includes a client interface <b>132</b> that receives a request for an identity of at least one trusted access network for accessing target communication network <b>102</b> from one or more clients <b>100</b>. The request includes at least one of an access network identifier associated with an access network currently available to the client and location information for the client. The access network identifier may include at least one of an IP address, a MAC address, an IP subnet identifier, a signed digital certificate, and a SSID associated with the available access network, as described above. The location information may include location information based on a global positioning system, such as GPX data received from client <b>100</b> based on a GPS receiver in client <b>100</b>. For example, client <b>100</b> may contact network information server <b>120</b> to determine if an available access network is a trusted access network, to determine a location for an available access network, and/or to determine the location of trusted access networks based on location information.

0059Network information server <b>120</b> also includes means for determining corresponding information for at least one trusted access network based on at least one of a network identifier for an access network currently accessible to the client and location information for the client. For example, network information server <b>120</b> may include a network information manager <b>134</b> that determines corresponding information for at least one trusted access network based on at least one of a network identifier for an access network currently accessible to the client and location information for the client. Network information manager <b>134</b> determines corresponding information for the at least one trusted access network by accessing remote access network database <b>128</b>.

0060Network information manager <b>134</b> may be configured to determine network characteristics of the trusted access networks. For example, trust indications of each of the trusted access networks, bandwidth availability of each of the trusted access networks, and/or quality of service of each of the trusted access networks may be determined. The trust indication may be determined as described in above-referenced U.S. patent application Ser. Nos. 11/093,355 and 11/093,564. Network information manager <b>134</b> may be configured to determine corresponding information only for trusted access networks that meet minimum network characteristics, such as minimum trust level, bandwidth availability, and/or quality of service.

0061Network information manager <b>134</b> may be configured to determine an identity of a secure server <b>136</b> providing secure communications with the target communication network. For example, when a trusted access network is not available for use or is not conveniently located, network information manager <b>134</b> may provide identities of one or more secure servers <b>136</b> that may be used for secure communications with target network <b>102</b>, even via an untrusted access network.

0062Network information server <b>120</b> also includes means for forwarding the corresponding information for the at least one trusted access network to a client. For example, client interface <b>132</b> may forward the corresponding information for the at least one trusted access network to client <b>100</b>. Alternatively, or in addition, network information manager <b>128</b> at client <b>100</b> may be configured to determine a secure server providing secure communications with target communication network <b>102</b>.

0063Secure server <b>136</b> may be a VPN server, for example. Access to target network <b>102</b> may be established by tunneling to secure server <b>136</b>. Tunneling involves encapsulating an entire packet of data within another packet and sending it via a network. The protocol of the encapsulating packet is understood by both the sending and receiving endpoints. Examples of protocols used for tunneling include IPSec, layer 2 tunneling protocol (L2TP), and point-to-point tunneling protocol (PPTP).

0064Network information server may also include a location manager <b>136</b> that determines location information for trusted access networks. The location information is obtained from remote access network database <b>128</b> based on an access network identifier provided by client <b>100</b>. The location information for the trusted access networks is provided to client <b>100</b> via client interface <b>132</b>.

0065With reference again to client <b>100</b>, network information manager <b>124</b> may be configured to select one or more trusted access networks by automatically selecting a trusted access network meeting minimum network characteristics. Alternatively, network information manager <b>124</b> may be adapted to select between access networks based on a comparison of respective network characteristics of the available access networks. For example, network information manager <b>124</b> may automatically select an available access network offering the best quality of service. Client <b>100</b> may also be redirected to another access network based on network characteristics.

0066According to another aspect, client <b>100</b> may include a display and input device (not shown), or any form of user interface. Network information manager <b>124</b> controls the display of the trusted access network and corresponding network characteristics to a user on the display and controls the requesting of user input via the input device for selecting a trusted access network. <figref idref="DRAWINGS">FIG. 2</figref> is a representation of a user interface <b>200</b> for selecting among access networks. For example, user interface <b>200</b> may be a window on a computer display.

0067In <figref idref="DRAWINGS">FIG. 2</figref>, user interface <b>200</b> includes access network identifiers <b>202</b> with corresponding location information <b>203</b>, access network trust levels <b>204</b>, access network fees <b>206</b>, access network bandwidths <b>208</b>, quality of service <b>210</b>, and access network selection radio buttons <b>212</b>. In addition, user interface <b>200</b> includes buttons for search/refresh <b>214</b>, access/done <b>216</b>, search for secure server <b>218</b>, and done/no access <b>220</b>. User interface <b>200</b> may be presented to a user to select an available access network. A user compares the available information and activates a corresponding radio button <b>212</b> to make a selection. Once a selection is made, access/done button <b>216</b> is activated to initiate access to target network <b>102</b> via the selected access network. Alternatively, done/no access button <b>220</b> may be activated to signify the user is not satisfied with any of the available access networks and chooses not to access target network <b>102</b>. Search/Refresh button <b>214</b> may be activated to initiate or reinitiate a search for available access networks.

0068Button <b>218</b> may be used to initiate a search for a secure server. When button <b>218</b> is activated, a list of available secure servers is presented in user interface <b>200</b> for selection. Referring again to <figref idref="DRAWINGS">FIG. 1</figref>, a secure server <b>136</b> is shown. When client <b>100</b> establishes communication with untrusted access gateway <b>118</b>, network information manager <b>124</b> may determine a list of secure servers accessible to access gateway <b>118</b> to provide a secure connection to target network <b>102</b>.

0069The access networks listed in <figref idref="DRAWINGS">FIG. 2</figref> may be gathered by network information manager based on networks that are detected via network interface <b>122</b> and/or are retrieved from access network databases <b>126</b> and/or <b>128</b> based on location information. For example, networks may be listed that have a location <b>123</b> within a given radius of the current location of client <b>100</b>. The radius may be fixed or configurable by a user of client <b>100</b>.

0070It will be understood that <figref idref="DRAWINGS">FIG. 2</figref> illustrates one possible implementation of a user interface. As will be appreciated, not all of the information need be provided and additional information and functionality may be provided in a user interface.

0071<figref idref="DRAWINGS">FIG. 3</figref> is a flow diagram illustrating a method for providing trusted access to a communication network by a client based on location according to an aspect of the subject matter described herein. In <figref idref="DRAWINGS">FIG. 3</figref>, location information for the client is determined in block <b>300</b> using any of the methods described above. In block <b>302</b>, an identity of at least one trusted access network is determined based on the determined location information. As described above, one or both of access network databases <b>126</b> and <b>128</b> may be accessed to determine the identity of the at least one trusted access network based on the location information.

0072<figref idref="DRAWINGS">FIG. 4</figref> is a flow diagram illustrating a method for providing trusted access to a communication network by a client based on location according to another aspect of the subject matter described herein. In <figref idref="DRAWINGS">FIG. 4</figref>, an available access network providing access to a target communication network is detected by network interface <b>122</b> in block <b>400</b>. In block <b>402</b>, network information manager <b>124</b> determines whether the available access network is a trusted access network. Responsive to network information manager <b>124</b> determining that the available access network is not a trusted access network in block <b>402</b>, location manager <b>130</b> determines location information for the client in block <b>404</b>. In block <b>406</b>, an identity of at least one trusted access network is determined based on the determined location information. Accordingly, the identity of the trusted access network is known, as indicated by block <b>408</b>. Returning to block <b>402</b>, the identity of the trusted access network may also be known responsive to network information manager <b>124</b> determining that the available access network is a trusted access network.

0073<figref idref="DRAWINGS">FIG. 5</figref> is a flow diagram illustrating a method for providing trusted access to a communication network to a client based on location according to another aspect of the subject matter described herein. In <figref idref="DRAWINGS">FIG. 5</figref>, a request for an identity of at least one trusted access network for accessing a target communication network is received by client interface <b>132</b> of network information server <b>120</b> from a client in block <b>500</b>. The request includes at least one of an access network identifier associated with an access network currently available to the client and location information for the client. In block <b>502</b>, corresponding information for at least one trusted access network is determined based on the network identifier and/or location information for the client. The corresponding information for the at least one trusted access network is forwarded to the client in block <b>504</b>.

0074It will be understood that various details of the invention may be changed without departing from the scope of the claimed subject matter. Furthermore, the foregoing description is for the purpose of illustration only, and not for the purpose of limitation, as the scope of protection sought is defined by the claims as set forth hereinafter together with any equivalents thereof entitled to.