Patent US3259072A successfully refreshed from Google Patents.
Patent US6954790B2 successfully refreshed from Google Patents.
US6954790B2
Expired / Lapsed
US
⏱️ 0.0 years remaining
Network-based mobile workgroup system
Assignee: Longhorn Hd LLC
•
Filing: 2000-12-05
•
Granted: 2005-10-11
•
Expires: 2020-12-05
Abstract
Abstract A network-based mobile workgroup system has considerably wider appeal and application than normal virtual private networks in that it provides seamless mobility across a number of access technologies at the same time as it offers a granular security separation down to workgroup level. The mobile workgroup system is an access management system for mobile users with VPN and firewall functionality inbuilt. The mobile user can access the mobile workgroup system over a set of access technologies and select server resources and correspondent nodes to access pending their workgroup membership approvals. All workgroup policy rules are defined in a mobile service manager and pushed down to one or more mobile service routers for policy enforcement. The mobile service router closest to the mobile client, and being part of the mobile virtual private network, performs regular authentication checks of the mobile client during service execution. At the same time it performs traffic filtering based on the mobile user's workgroup memberships. Together, these two components constitute an unprecedented security lock, effectively isolating a distributed workgroup into a mobile virtual private network.
Inventors
- 👤 Jan Forslöw
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-30 10:27
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; H04L63/0227; H04L63/0263; H04L63/0272; H04W; H04W80/00; H04W80/04
Claims Analysis
Total Claims: 102
Claim 1
Independent Claim
147 words
A network-based mobile workgroup system comprising: a plurality of mobile client nodes, each mobile client node providing an interface for user interaction by a mobile user; a plurality of mobile service router nodes, each mobile service router node providing a mobile Virtual Private Network (VPN) to the mobile client nodes spanning multiple router hops and sites; a network address identifier (NAI) with which a user of a mobile client is uniquely identified to the mobile VPN system; and a set of firewall filters and route policies with which the workgroup is protected, wherein the mobile VPN provides each mobile client secure data access to the VPN and provides secure data access to each mobile client from within the mobile VPN, wherein a point of attachment of any mobile client node to the mobile VPN may change without affecting that mobile client node's participation in the mobile VPN.
Claim 2
Dependent Claim
147 words
A network-based mobile workgroup system comprising: a plurality of mobile client nodes, each mobile client node providing an interface for user interaction by a mobile user; a plurality of mobile service router nodes, each mobile service router node providing a mobile Virtual Private Network (VPN) to the mobile client nodes spanning multiple router hops and sites; a network address identifier (NAI) with which a user of a mobile client is uniquely identified to the mobile VPN system; and a set of firewall filters and route policies with which the workgroup is protected, wherein the mobile VPN provides each mobile client secure data access to the VPN and provides secure data access to each mobile client from within the mobile VPN, wherein a point of attachment of any mobile client node to the mobile VPN may change without affecting that mobile client node's participation in the mobile VPN.
Claim 3
Dependent Claim
53 words
The mobile workgroup system of claim 1 , wherein the network address identifier is used to authenticate the mobile user at start and during the continuation of a network login session and wherein the firewall filters and route policies are applied to the forwarding of packets based on the mobile user's workgroup memberships.
Claim 4
Dependent Claim
28 words
The mobile workgroup system of claim 2 , wherein an IP address allocated to the mobile client is tied to the network address identifier of the mobile user.
Claim 5
Dependent Claim
46 words
The mobile workgroup system of claim 3 , wherein the allocated IP address for each mobile client is kept stable during the duration of a network login session and used in the mobile service router as a identifier of workgroup filters to apply to a packet.
Claim 6
Dependent Claim
32 words
The mobile workgroup system of claim 4 , wherein a specific IP address is an IPv6 address where one portion of the address indicates mobile VPN system and another mobile client identity.
Claim 7
Dependent Claim
31 words
The mobile workgroup of claim 4 , wherein a specific IP address is an IPv4 address where the IP address range from which the address is selected indicates mobile VPN system.
Claim 8
Dependent Claim
21 words
The mobile workgroup system of claim 4 , wherein the participating nodes can communicate using intra-domain, inter-domain or remote access routing.
Claim 9
Dependent Claim
43 words
The mobile workgroup system of claim 7 , wherein a node first attempts to establish intra-domain routing with the mobile workgroup data network; wherein inter-domain routing is attempted in case intra-domain routing is not available; wherein remote access is seen as last resort.
Claim 10
Dependent Claim
31 words
The mobile workgroup system of claim 8 , wherein intra-domain routing between participating nodes in a mobile VPN home network is based on flat (non-hierarchical), mobile adhoc network (MANET) routing techniques.
Claim 11
Dependent Claim
19 words
The mobile workgroup system of claim 9 , wherein one specific metric for route calculation is quality of service.
Claim 12
Dependent Claim
25 words
The mobile workgroup system of claim 9 , wherein one specific mobile adhoc routing technique includes the Topology Broadcast based on Reverse-Path Forwarding (TBRPF) protocol.
Claim 13
Dependent Claim
24 words
The mobile workgroup system of claim 9 , wherein one specific mobile adhoc routing technique includes the Core-Extraction Distributed Ad Hoc Routing (CEDAR) protocol.
Claim 14
Dependent Claim
24 words
The mobile workgroup system of claim 9 , wherein one specific mobile adhoc routing protocol technique includes the Adhoc On-demand Distance Vector (AODV) protocol.
Claim 15
Dependent Claim
35 words
The mobile workgroup system of claim 9 , wherein one specific mobile adhoc routing technique includes multicasting and groupcast (xcast) protocols for the purpose of sending messages to all or selected members of a workgroup.
Claim 16
Dependent Claim
28 words
The mobile workgroup system of claim 14 , wherein the multicast address resolution protocol is used to discover a node for subsequent unicasting of packets to same node.
Claim 17
Dependent Claim
36 words
The mobile workgroup system of claim 14 , wherein one specific routing algorithm to obtain lowest cost to reach a set of destinations is based on a branch and cut algorithm for solving Steiner tree problems.
Claim 18
Dependent Claim
24 words
The mobile workgroup system of claim 9 , further comprising routing between: mobile client—mobile client; mobile client—mobile service router; mobile service router—mobile service router.
Claim 19
Dependent Claim
21 words
The mobile workgroup system of claim 17 , wherein multiple paths are available for routing to and from a multi-homed node.
Claim 20
Dependent Claim
36 words
The mobile workgroup system of claim 18 , wherein the selection of next-hop node for a route in the workgroup network is decided on; a per destination basis; Quality of service preferences; Security preferences; Protocol/application type.
Claim 21
Dependent Claim
32 words
The mobile workgroup system of claim 19 , wherein any node (mobile client and mobile service router) may change primary point of attachment to the workgroup home network without changing IP address.
Claim 22
Dependent Claim
107 words
The mobile workgroup system of claim 20 , wherein changing point of attachment is treated as a routing update; wherein a link-state routing update may be due to forced handoff initiated by the underlying link or IP tunneling layer technology; and wherein a change of point of attachment may be due to a volunteer handoff initiated by the intra-domain routing process when discovering a stable, new optimal route to all workgroup nodes across alternative links or IP tunnels; wherein either handoff style causes temporary replication of sent data packets from and towards the moving node over both old and new route in the mobile virtual private network.
Claim 23
Dependent Claim
66 words
The mobile workgroup system of claim 21 , wherein forced handoff at the link layer initiates partitioning at the routing layer in case no route is discovered during a configured interval to a subset of the workgroup nodes; and wherein the discovery of a new link initiates merging of partitions at the routing layer in case nodes from both partitioning are part of the same workgroup.
Claim 24
Dependent Claim
38 words
The mobile workgroup system of claim 8 , wherein inter-domain routing is performed through encapsulation of intra-domain packets in a tunneling protocol between foreign and home mobile service router following a handshake via any number of AAA proxies.
Claim 25
Dependent Claim
94 words
The mobile workgroup system of claim 23 , further comprising: authentication, authorization and accounting between foreign mobile service router and home mobile service router based on the DIAMETER protocol; authentication, authorization and accounting between foreign mobile service router and home mobile service router based on the RADIUS protocol; authentication and mobility management between the mobile client, the foreign mobile service router and the home mobile service router based on the Mobile IP protocol. payload encryption, authentication and compression between mobile client and the foreign and home mobile service router respectively using the IPSec protocol.
Claim 26
Dependent Claim
23 words
The mobile workgroup system of claim 24 , wherein the mobile user information data storage is separated from the home mobile service router.
Claim 27
Dependent Claim
31 words
The mobile workgroup system of claim 25 , wherein multiple home mobile service routers may act as AAA servers for the same user through the use of a common data storage.
Claim 28
Dependent Claim
48 words
The mobile workgroup system of claim 26 , wherein the selection of home mobile service router acting as DIAMETER server is based on routing information, further comprising: Route preference of each mobile service router for IPv4 networks; Shared anycast address for all mobile service routers in IPv6 networks.
Claim 29
Dependent Claim
34 words
The mobile workgroup system of claim 26 , wherein the geographic vicinity of the mobile client with regards to available home mobile service routers is determined by the use of a spatial location protocol.
Claim 30
Dependent Claim
27 words
The mobile workgroup system of claim 26 , wherein the home mobile service router is kept the same at change of point of attachment in foreign domain.
Claim 31
Dependent Claim
24 words
The mobile workgroup system of claim 29 , wherein the selection of mobile service router is re-computed when roaming into a new foreign domain.
Claim 32
Dependent Claim
26 words
The mobile workgroup system of claim 8 , wherein remote access from non-workgroup aware Internet environment is allowed for both mobile client and mobile service router.
Claim 33
Dependent Claim
50 words
The mobile workgroup system of claim 31 , further comprising: mobility service router discovery and security negotiation using the Security Policy Protocol (SPP); authentication and mobility management using the Mobile IP (MIP) protocol applied with the co-located care of address option; payload authentication, encryption and compression using the IPSec protocol.
Claim 34
Dependent Claim
24 words
The mobile workgroup system of claim 32 , wherein the policy server function is placed in the mobile client and the mobile service router.
Claim 35
Dependent Claim
19 words
The mobile workgroup system of claim 33 , wherein the security gateway is placed in the mobile service router.
Claim 36
Dependent Claim
44 words
The mobile workgroup system of claim 34 , wherein the node attempting mobile service router discovery sets the destination to a well-known name for the workgroup and can retrieve a set of IP addresses of available mobile service routers from the domain name system.
Claim 37
Dependent Claim
31 words
The mobile workgroup system of claim 35 , wherein discovery of and negotiation with intermediate security gateways is performed during the security policy protocol exchange towards the discovered mobile service router.
Claim 38
Dependent Claim
22 words
The mobile workgroup system of claim 36 , wherein the intra-domain routing protocol is applied on top of the remote access technique.
Claim 39
Dependent Claim
27 words
The mobile workgroup system of claim 1 , wherein the mobility workgroup service is provided independently of mobility services offered by a radio access technology specific network.
Claim 40
Dependent Claim
20 words
The mobile workgroup system of claim 38 , wherein the radio access technology specific network includes Wireless LAN and HiperLAN2.
Claim 41
Dependent Claim
23 words
The mobile workgroup system of claim 38 , wherein the cellular access technology specific network includes IMT-2000 based systems like UMTS and cdma2000.
Claim 42
Dependent Claim
26 words
The mobile workgroup system of claim 38 , wherein the data network is operated by an Internet Service Provider (ISP) utilizing a centralized mobile service manager.
Claim 43
Dependent Claim
27 words
The mobile workgroup system of claim 41 , wherein extranet workgroups are created through the aggregation of workgroups from different organizations in the same mobile service manager.
Claim 44
Dependent Claim
46 words
The mobile workgroup system of claim 38 , further comprising: service access control to intranet and internet services; secure access connectivity option to neighbor node; service provisioning based on physical location; quality of service differentiation based on workgroup membership; interactive real-time communication services between workgroup members.
Claim 45
Dependent Claim
27 words
The service access control service of claim 43 , wherein a firewall profile is downloaded from the mobile service manager to all nodes allocated to the workgroup.
Claim 46
Dependent Claim
26 words
The mobile workgroup system of claim 44 , wherein Internet access is provided via any of the nodes allocated to the workgroup using Internet routing protocols.
Claim 47
Dependent Claim
19 words
The mobile workgroup system of claim 45 , wherein the Internet routing protocols include Open Shortest Path First (OSPF).
Claim 48
Dependent Claim
18 words
The mobile workgroup system of claim 45 , wherein the Internet routing protocols include Border Gateway Protocol (BGP).
Claim 49
Dependent Claim
25 words
The mobile workgroup system of claim 45 , wherein the route metrics from the Internet routing protocol is propagated into the workgroup intra-domain routing protocol.
Claim 50
Dependent Claim
33 words
The mobile workgroup system of claim 44 , wherein threshold-based scanner protection is applied in all nodes allocated to the workgroup to protect against attacks towards the workgroup data network from the Internet.
Claim 51
Dependent Claim
19 words
The mobile workgroup system of claim 43 , wherein every packet is authenticated and/or encrypted using the IPSec protocol.
Claim 52
Dependent Claim
27 words
The mobile workgroup system of claim 43 , wherein wildcards are added in the service profile when downloaded from the mobile service manager to the workgroup nodes.
Claim 53
Dependent Claim
30 words
The mobile workgroup system of claim 51 , wherein the mobile service router acts as a directory agent using the Service Location Protocol to discover services from local service agents.
Claim 54
Dependent Claim
26 words
The mobile workgroup system of claim 51 , wherein the mobile service routers allocated to a workgroup provides consistent domain names for services in the profile.
Claim 55
Dependent Claim
40 words
The mobile workgroup system of claim 51 , wherein the mobile service routers update their domain name service resource records with the results of the local service discovery process and the mobile clients caches correspondent resource records for later use.
Claim 56
Dependent Claim
19 words
The mobile workgroup system of claim 43 , wherein all workgroup members share the same quality of service profile.
Claim 57
Dependent Claim
22 words
The mobile workgroup system of claim 55 , wherein all nodes allocated to a workgroup applies the same quality of service profile.
Claim 58
Dependent Claim
18 words
The mobile workgroup system of claim 56 , wherein the quality of service differs based on application type.
Claim 59
Dependent Claim
20 words
The mobile workgroup system of claim 55 , wherein a distributed weighted fair queuing schema is applied among neighbor nodes.
Claim 60
Dependent Claim
35 words
The mobile workgroup system of claim 58 , wherein cause of packet loss due to random error on radio link is made known to the Transport Control Protocol (TCP) implementation running on the mobile client.
Claim 61
Dependent Claim
25 words
The mobile workgroup system of claim 59 , wherein the mobile client TCP implementation ignores packet loss due to random error when determining window size.
Claim 62
Dependent Claim
31 words
The mobile workgroup system of claim 55 , wherein quality of service statistics are collected from the workgroup nodes to the mobile service manager in order to follow-up service level agreements.
Claim 63
Dependent Claim
34 words
The mobile workgroup system of claim 43 , wherein mobile service routers maintain stable domain name resource records for all members of a workgroup and mobile clients caches such resource records for later use.
Claim 64
Dependent Claim
19 words
The mobile workgroup system of claim 62 , such as multimedia services wherein voice over IP is one service.
Claim 65
Dependent Claim
19 words
The mobile workgroup system of claim 63 , wherein the technology specific protocols include the Session Initiation Protocol (SIP).
Claim 66
Dependent Claim
31 words
The mobile workgroup system of claim 64 , wherein the nodes belonging to a workgroup applies a SIP filter downloaded from the mobile service manager applying encryption only to control communication.
Claim 67
Dependent Claim
22 words
The mobile workgroup system of claim 63 , wherein the technology specific protocols include the xcast protocol suite for small group multicasting.
Claim 68
Dependent Claim
63 words
The mobile workgroup system of claim 38 , wherein the security solution is based on a separation of each site of the mobile virtual private network into two parts, further comprising: an access network acting as a shared media for workgroup members and non-members to access the site; a service network acting as a safe repository for workgroup server resources at the site.
Claim 69
Dependent Claim
41 words
The mobile workgroup system of claim 67 , wherein one or several mobile service routers perform user authentication, policy routing and packet filtering of traffic between the access and service network in a site based on a mobile user's workgroup memberships.
Claim 70
Dependent Claim
35 words
The mobile workgroup system of claim 68 , wherein mobile service routers placed at the border of the mobile virtual private network also provide firewall protected interfaces to the Internet and a de-militarized zone (DMZ).
Claim 71
Dependent Claim
32 words
The mobile workgroup system of claim 68 , wherein the mobile IP home network for the mobile client is defined as a service network protected by one or more mobile service routers.
Claim 72
Dependent Claim
32 words
The mobile workgroup system of claim 68 , wherein the mobile home network for the mobile client is defined as a virtual home network hosted by one or several mobile service routers.
Claim 73
Dependent Claim
89 words
The mobile workgroup system of claim 69 , wherein a three tier security architecture is defined, further comprising: a mobile virtual private network tier encompassing service and access networks at each mobile VPN site as well as the tunnels connecting the sites; a workgroup network tier protecting the workgroup peer-to-peer and client-server traffic in the mobile VPN from attacks; a service network tier protecting workgroup servers at a single mobile VPN site against attacks as well as separating specific workgroup applications from each other using virtual local area networks.
Claim 74
Dependent Claim
42 words
The mobile workgroup system of claim 72 , wherein the entry barrier to the mobile VPN Tier is a one-way network address translation (NAT) gateway for Internet traffic and an IPSec-based tunnel limited by at least protocol type and source IP addresses.
Claim 75
Dependent Claim
33 words
The mobile workgroup system of claim 72 , wherein a mobile client is required to go through a user authentication and a per packet workgroup filtering in order to enter the workgroup network.
Claim 76
Dependent Claim
18 words
The mobile workgroup system of claim 74 , wherein the workgroup filtering includes functions like static packet filtering.
Claim 77
Dependent Claim
18 words
The mobile workgroup system of claim 74 , wherein the workgroup filtering includes functions like dynamic packet filtering.
Claim 78
Dependent Claim
19 words
The mobile workgroup system of claim 74 , wherein the workgroup filtering includes functions like application level proxy filtering.
Claim 79
Dependent Claim
34 words
The mobile workgroup system of claim 72 , wherein a packet filter controls the entrance to the service network using site-local application restrictions and optional end-to-end secure socket layer (SSL) or similar cryptographic associations.
Claim 80
Dependent Claim
28 words
The mobile workgroup system of claim 67 , wherein the closest mobile service router can push security policy information, extracted from an external source, to a mobile client.
Claim 81
Dependent Claim
36 words
The mobile workgroup system of claim 67 , wherein the closest mobile service router extracts security policy information that is dynamically obtained during the registration of a mobile client, and thereafter enforce the security policy received.
Claim 82
Dependent Claim
28 words
The mobile workgroup system of claim 38 , wherein the closest mobile service router acts as DHCP server for the subsequent workgroup home network configuration of the node.
Claim 83
Dependent Claim
22 words
The mobile workgroup system of claim 81 , wherein the node is configured based on client id=network address identifier and user class=workgroup.
Claim 84
Dependent Claim
76 words
The mobile workgroup system of claim 82 , wherein the node can be configured with: IP address(es) Subnet mask(s) Broadcast address(es) Host name Domain name Domain Name Server Time offset Servers (e.g. SMTP, POP, WWW, DNSINIS, LPR, syslog, WINS, NTP) Mobile Service Router(s) Router discovery options Service Location Protocol Directory Agent Static routes MTU Default TTL Source routing options IP Forwarding enable/disable PMTU options ARP cache timeout X Windows options NIS options NetBIOS options Vendor-specific options.
Claim 85
Dependent Claim
28 words
The mobile workgroup system of claim 83 , wherein a set of mobile service routers allocated to a workgroup share DHCP schema tree, address pool and fail-over support.
Claim 86
Dependent Claim
22 words
The mobile workgroup system of claim 38 , wherein the reachability of the mobile client is ensured via the Dynamic DNS protocol.
Claim 87
Dependent Claim
27 words
The mobile workgroup system of claim 38 , further comprising a self-service management window for mobile users and workgroup administrators to control workgroup profiles and exchange information.
Claim 88
Dependent Claim
27 words
The mobile workgroup system of claim 86 , wherein the mobile service router redirects a request for the browser default web page to said self-service management portal.
Claim 89
Dependent Claim
24 words
The mobile workgroup system of claim 87 , wherein the workgroup administrator can define workgroup based on available service policies and mobile service routers.
Claim 90
Dependent Claim
22 words
The mobile workgroup system of claim 88 , wherein the mobile user can request and the workgroup administrator can accept workgroup membership.
Claim 91
Dependent Claim
23 words
The mobile workgroup system of claim 89 , wherein the workgroup administrator can import mobile user data of members from external user directory.
Claim 92
Dependent Claim
31 words
The mobile workgroup system of claim 90 , wherein the workgroup administrator can provide further information in the form of links to downloadable scripts and software packages applicable to the workgroup.
Claim 93
Dependent Claim
17 words
The mobile workgroup system of claim 91 , wherein the mobile user can personalize his own profile.
Claim 94
Dependent Claim
42 words
The mobile workgroup system of claim 38 , wherein the mobile service manager imprints a physically secured security key for each mobile user and network administrator to use within the workgroup through the physical insertion into the mobile service manager management port.
Claim 95
Dependent Claim
20 words
The mobile workgroup system of claim 93 , wherein the mobile service manager can reprint the physically secured security key.
Claim 96
Dependent Claim
32 words
The mobile workgroup system of claim 94 , wherein the mobile service manager may imprint policies into the physically secured security key for delegating partial control for self-service management to mobile clients.
Claim 97
Dependent Claim
34 words
The mobile workgroup system of claim 95 , wherein the physically secured security key includes shared secrets for authentication and encryption of control and payload traffic towards other nodes in the mobile workgroup system.
Claim 98
Dependent Claim
39 words
The mobile workgroup system of claim 95 , wherein the physically secured security key includes certificates, private and public keys for authentication and encryption of control and payload traffic towards other nodes in or outside the mobile workgroup system.
Claim 99
Dependent Claim
26 words
The mobile workgroup system of claim 95 , wherein the mobile user and network administrator also is given a PIN code for accessing the security key.
Claim 100
Dependent Claim
39 words
The mobile workgroup system of claim 98 , wherein the mobile user plugs the security key into the management port of the node's hardware and opens it up for use by entering the PIN code on the control panel.
Claim 101
Dependent Claim
24 words
The mobile workgroup system of claim 99 , wherein manual typing of security keys into mobile client control panel is available as fallback alternative.
Claim 102
Dependent Claim
45 words
The mobile workgroup system of claim 100 , wherein a secure intra-domain link, inter-domain mobile IP tunnel or remote access tunnel can be established between the node and another node belonging to the same workgroup based solely on the information stored in the security keys.
References Cited (Backward Citations)
US20020013150A1
Cited
US5825759A
Cited
US5572528A
Cited
US6445920B1
Cited
US6571289B1
Cited
US6487600B1
Cited
US6560217B1
Cited
US6539483B1
Cited
US20010033556A1
Cited
US20030179742A1
Cited
US20020004817A1
Cited
US6717921B1
Cited
US20020006133A1
Cited
US6424657B1
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2008-10-10 | 2009-04-11 | 2009-10-11 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2012-10-10 | 2013-04-11 | 2013-10-11 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2016-10-10 | 2017-04-11 | 2017-10-11 | $7700.00 | Window Closed / Lapsed |