EP2845366A1

EP2845366A1 - System and methods for accessing content stored on a local area network of a company

Info

Publication number: EP2845366A1
Application number: EP13723446.4A
Authority: EP
Inventors: Christophe DU LAURENT DE LA BARRE; Guillaume FOLTRAN; Nicolas MOTRON; Sébastien ROGER
Original assignee: Bouygues Telecom SA
Current assignee: Bouygues Telecom SA
Priority date: 2012-05-04
Filing date: 2013-05-02
Publication date: 2015-03-11
Also published as: FR2990318A1; US20150120880A1; FR2990318B1; WO2013164412A1

Abstract

The present invention concerns a system for accessing content stored on at least one server (5) of a secure local area network (20) from a device (1), said device (1) being connected to the local area network (20) via the Internet network (10), the system being characterised in that it comprises at least one publication server (3) connected to the device (1) via the Internet network (10) and an aggregation server (4) connected to said server (5) via the local area network (20); and in that, when the publication server (3) receives a request from the device (1) for access to said content of the server (5), the request comprising at least one valid connection identifier, said publication server (3) is capable of establishing a secure connection with said aggregation server (4); and in that the aggregation server (4) implements a content aggregation engine capable of collecting content from the server (5) via said local area network (20) on request, and of aggregating and then transmitting said collected content to the publication server (3). The present invention further concerns content transfer methods.

Description

System and methods for accessing content stored on a corporate LAN

GENERAL TECHNICAL FIELD

The present invention relates to the field of enterprise local area networks, and more specifically a system for access from a device to content stored on at least one server of such a secure network.

STATE OF THE ART

Companies usually have a private local area network (LAN), commonly known as an intranet.

This network interconnects all the workstations of the company, and is itself connected to the Internet, usually via proxies ("proxy servers" or "gateways" in French), which secure the interface by implementing firewall functions, filtering, etc. Access to the intranet is therefore impossible if you are not physically connected to the local network, which ensures the best possible protection against intrusions.

The advantage of an intranet is indeed to allow the free sharing of professional data and communication within the company, without external third parties, who could be competitors, to access this shared data and exchanged. This data can be working documents produced by the collaborators, but also often internal communication data. For example, many companies have a web portal configured as the start page for enterprise desktop browsers, which provides a gateway to many corporate resources such as a directory, diaries, news lists, etc. Although the content made available by an intranet is not intended to be able to leave the corporate network, it is desirable that employees can sometimes have access even if they are outside the premises of the company (eg from home with their personal computer, from the Wifi of a hotel or a customer with their laptop when they are traveling, etc.).

For this, it has been proposed a solution "extension" of a local network, via VPN ("Virtual Private Network"). It is to use the Internet as transmission medium by using a "tunneling" protocol, for example L2TP ("Layer 2 Tunneling Protocol"), that is to say encapsulating the data to be transmitted. in encrypted form. This is called VPN to designate the network thus artificially created. This network is said to be virtual because it links two "physical" networks (in this case on the one hand the local network consisting of the remote user and his box providing him with access to the Internet, and on the other hand the network local company) by an unreliable link (Internet), and private because this technique still prevents unauthorized third parties to access the intranet since the tunnel is secure. In other words, the remote private network of the user is virtually "added" to the local network of the company.

It should be noted that this is most often this technique that allows the intranet of a company to be made up of several small networks connected by tunnels if the company is located on several separate sites.

Alternatively, secure communication protocols such as SSH allow a user to connect remotely to his or her workstation (which is physically located in the local network of the company) provided that an agent is installed on the workstation. target work. The advantage of SSH is to be a purely software solution, while the use of VPN requires specifically configured routing equipment. All these techniques are satisfactory but have several disadvantages. On the one hand, these technologies are not within the reach of any neophyte, because complex manipulations are to be performed both on the remote workstation and within the local network of the company. On the other hand, the quality of the service is limited. For these reasons, users usually try to avoid using the intranet when they do not have physical connectivity with the local network. Moreover, it should be noted that these techniques work poorly or not at all on new computing devices with particular connections to the Internet (Wi-Fi, 3G, etc.) such as tablets and smartphones.

It would be interesting to have a more ergonomic and convenient, but still secure to access content from the remote company.

PRESENTATION OF THE INVENTION

According to a first aspect, the present invention thus relates to a system for access from equipment to contents stored on at least one server of a secure local network, the equipment being connected to the local network via the Internet network, the system being characterized in that it comprises at least one publisher connected to the equipment via the Internet and an aggregation server connected to said server via the local network;

in that, when the publication server receives from the equipment a request for access to said contents of the server, the request comprising at least one valid connection identifier, said publication server is able to establish a secure connection with said server; 'aggregation ; and in that the aggregation server implements a content aggregation engine capable of collecting, on request, contents of the server via said local network, and aggregating and then transmitting to the publishing server said collected content. According to other advantageous and nonlimiting features:

• The content collected by the aggregation server is aggregated is a form adapted to the equipment;

· The LAN is connected to the Internet through a proxy configured to allow a secure connection between the Publisher and the aggregation server.

• the equipment is a touch pad or a mobile terminal;

• the connection between the device and the Publisher is also a secure connection;

• the Publisher is connected over the Internet to an authentication server where valid login credentials are listed;

The aggregation server is connected to a server via a connector, each connector being able to convert a content flow from a specific language to a language of said aggregation engine, and vice versa;

The equipment, the publication server and the aggregation server communicate via the Extensible Markup Language (XML) format, the aggregation server comprising means for converting said aggregation engine language into XML, and vice versa;

The equipment has an interface in which connection identifiers of a user of the equipment are stored, said interface comprising suitable identification means, when the user has validly identified on the equipment, associating said user identifiers with a request to access said server contents;

The contents of the at least one server are selected from work documents, journal review articles, enterprise social network data. According to a second and a third aspect, the invention relates to methods, in particular a method of transferring content present on at least one server connected to a local network to a device connected to the Internet network, characterized in that it comprises steps of: - Sending a request to transfer said content from the equipment to a publication server connected to the network Internet, the request comprising at least one connection identifier;

- Verification of the connection identifier by the publisher;

If the connection identifier is valid, transfer of said request from the publication server to an aggregation server connected to said local network;

- Collection of said content on the server or servers by the aggregation server;

Aggregating the contents in a form adapted to the equipment by an aggregation engine implemented by the aggregation server;

- Transfer of aggregated content to the equipment via the Publisher. The other method is a method of transferring contents from a device connected to the Internet network to a server connected to a local network, characterized in that it comprises steps of:

- Sending a request to transfer said at least one content from the device to a publication server connected to the Internet, the request comprising the content and at least one connection identifier;

- Verification of the connection identifier by the publisher;

If the identifier is valid, transferring said request from the publication server to an aggregation server connected to said local network;

- Transfer of said contents to the server from the aggregation server. PRESENTATION OF FIGURES

Other features and advantages of the present invention will appear on reading the following description of a preferred embodiment. This description will be given with reference to the appended drawings in which:

- Figure 1 is a diagram of the system according to the invention;

FIG. 2 represents an example of aggregated contents displayed on a piece of equipment thanks to the system according to the invention.

DETAILED DESCRIPTION

Network Architecture

With reference to the drawings and in particular to FIG. 1, the invention relates to a system comprising, on the one hand, a piece of equipment 1 and a server 3 called a publication server connected to the Internet network 10, and on the other hand at least one server 5 and a so-called aggregation server 4 connected to a local network 20 of an enterprise.

As explained above, the local network 20 of the company is in particular a private and secure network, which means that it is connected to the Internet network 10 via one or more proxies 2 (or "proxy servers") in French, which implement filtering and firewall functions which "isolate" the local network 20 from the rest of the Internet 10, so as to prevent access from outside, in particular to the servers 5. It will be understood that these servers 5 can be any server of the company having storage means on which are stored contents (for example working documents such as presentations or spreadsheets, plans, administrative documents, but also documents such as directories, news, schedules, corporate social network data, and any other data whose dissemination may be interesting within the company's intranet, but not intended for use other than internal). The servers 5 can thus be any workstation of the company, or even dedicated servers delivering content streams.

The equipment 1 can be any computer equipment capable of connecting to the Internet 10, such as a laptop. However, preferably, it is a nomadic device such as a touch pad or a mobile terminal (a smartphone). These devices are indeed able to connect to a network very easily (via 3G, a Wi-Fi access point, etc.) and offer a specific ergonomic interface that can be advantageously exploited to improve the comfort of a user trying to access his professional content. In contrast, known techniques are generally not compatible with computer equipment other than a computer. In addition, these techniques generally only allow the display of an inconvenient interface.

It will be understood later in this description that "access" to local network content of the company should not be understood as the only consultation ("download") of these contents, but also their modification, or even the adding content ("upload"). The connectivity offered by the system according to the invention is two-way.

Publisher

The server of publication 3 is the server which will allow the diffusion of the contents to the authorized equipments, that is why it is said of "publication".

This publication server 3 can be any web server having data processing means, data storage means and network connectivities. It is able, when it receives from the equipment 1 a request for access to contents of the server 5 associated with at least one valid connection identifier, to establish a connection secure (by secure, it means in particular encrypted) with the aggregation server 4.

As can be seen in FIG. 1, it is indeed the end of the single connection channel between the Internet network 10 and the local network 20 enabled by the system according to the invention. This channel is similar to the tunnel implemented by a VPN (the proxy 2 is thus advantageously configured to allow this secure connection between the publication server 3 and the aggregation server 4, unlike the vast majority of other connections upwards), with the difference that it does not imply here the equipment 1 which seeks to connect, nor the server 5 which contains the targeted contents. When the secure connection is established, the data packets circulate encapsulated in an encrypted communication protocol such as SSL ("Secure Socket Layer") or TLS ("Transport Layer Security") in particular in 128 bits.

The connection of the equipment 1 to the publication server 3 is itself also advantageously secured, so that there is no point of vulnerability in the local network 20. This connection is made for example via the HTTPS protocol (" HyperText Transfer Protocol Secure ", that is, secure hypertext transfer protocol), which is HTTP again with a SSL or TLS encryption layer, especially 128-bit.

As explained, a content request sent from the device 1 contains one or more connection identifiers. These are for example a personal identification couple ("login") / password of an employee of the company. Their mandatory entry prevents third parties from accessing the internal contents even if they have stolen the equipment 1 from the user. The login identifiers entered and therefore attached to the request (regardless of the form of the request) are verified at the level of the publication server 3. This verification can take many forms such as the implementation of an algorithm calculating a request. expected password from an identifier, but advantageously the publication server is connected to a server called authentication (in a server implementing a Lightweight Directory Access Protocol (LDAP) directory, for example Microsoft Active Directory) on which is stored a database of valid login credentials, for example all the passwords of employees of the company. This authentication server can be local (connected to the network 20) or not (directly connected to the Internet 10).

A request issued by the equipment 1 can take many forms. It can be the request for a particular content, for example a working document, or the request for a set of contents not specifically identified, for example the latest news of the company. The query can, as will be seen, contain data to modify a content, or even a new complete content. The system according to the invention thus makes it possible, following a first request to display a content, to post via a second request comments from a news article, a message in a corporate social network, etc. Such a request does not necessarily wait for a return if it is not an update of the content (display of the posted message for example).

In a particularly preferred manner, the equipment 1 has an interface (in particular specific to the type of apparatus that is the equipment 1) in which connection identifiers of a user of the equipment 1 are stored, said interface comprising suitable identification means, when the user has validly identified on the equipment 1, to associate said user's credentials to a request for access to said contents of the server 5.

For example, it may be an application that the user downloads and installs on his equipment 1, the first use of which is proposed to the user to enter for memorization his pair of personal identifier / word of pass, as well as a personal PIN. Regularly and / or each time the user launches this interface, his PIN code is requested again. In the case of a touch pad, the means of identification of the user of the equipment then consist for example in a virtual keypad which is displayed and on which it suffices to enter his PIN to confirm his identity. If the PIN is good, the interface will automatically fill in the login credentials of the user in the next request (s) issued. It is, however, of course possible to implement a manual mode in which the user must enter his identifiers at the opening of the interface.

This simplified identification greatly reduces the time required to establish the secure connection and to obtain the desired content compared to what was necessary with a VPN. A much more spontaneous use becomes possible.

Aggregation server

The aggregation server 4 is the counterpart in the local network 20 of the publication server 3. In addition to its access point function in the contents of the server or servers 5, it has the specificity of implementing an aggregation engine. content (hence its name) capable of collecting on request the contents of the server 5 via said local network 20, and especially to aggregate these contents in a format adapted to the equipment 1.

As with portals, aggregating content means having a plurality on a single page in a compact and ergonomic way. For example, in the case where the contents are news articles, the aggregation engine is capable, in the case of a request for news content, of generating a page comprising for example for each article a block of news items. 'preview including a photo and some lines. This aggregate format is further advantageously adapted to the equipment 1. It will be understood here by "adapted to the equipment" that the format of the aggregated contents is readable in terms of encoding, resolution, functionalities (for example hypertext zones adapted to a touch interface) to the types of apparatus intended to be used as equipment 1. In the case where the equipment has a specific interface, it is possible to indicate to the aggregation server 4 which type is the equipment 1, and to refine the aggregation accordingly. This customization of the content format is very significant in terms of ergonomics for users.

By way of example, FIG. 2 represents contents of the type of enterprise news aggregated in a manner adapted to a touch pad. For example, we can see a left-hand section with articles "on the front page" with a number of articles, a photo and a preview, and a bar with all selected articles on the right. In the "landscape" format as shown, the contents view can be converted into a "portrait" format where the right bar disappears in favor of a larger number of articles in one.

Connectors and format conversion

The equipment 1, the publication server 3 and the aggregation server 4 communicate advantageously via the XML (Extensible Markup Language) format. URLs ("Uniform Resource Locator") are inserted into XML messages for images and other data that are not textual. The latter are transferred in specific binary packages and load after the rest of the content, so that the user can upon receipt of the text begin to take cognizance of the content without being possibly hampered by the loading time of any heavy images.

This simple and widespread language XML allows to gain speed in the display especially on tablets.

The content streams from the servers 5 are for their part in a plurality of formats most often proprietary. In order to facilitate the aggregation of the contents, the aggregation server 4 of the system according to the invention advantageously has "connectors", that is to say software modules able to ensure the conversion of a given language. flow to a working language of the aggregation engine, and vice versa. For example, a Sharepoint connector provides a Sharepoint document access service and RSS feed integration. Newsgator. It is possible to envisage an architecture in which the aggregation server 4 thus has a connector for each type of service.

The working language of the aggregation engine mentioned above is advantageously an object language, which is converted into XML (via algorithms themselves realized in object language, for example C #) at the output of the aggregation engine by another connector.

Once in aggregate form, the contents are transmitted encapsulated and encrypted by the same channel as the request. They pass through the proxy 2 and are sent to the publication server 3 which retransmits them securely to the device 1 (more specifically the dedicated interface if it has one) which will display them, for consultation by the user or modification. A new request is issued for each new navigation action made by the user. This is entirely transparent to the user who feels he has access to corporate resources as easily (or more efficiently through data aggregation) than if he was directly connected to the local network. .

Processes The present invention relates according to a second and a third aspect of content transfer methods, respectively in the downward direction (transfer from the server 5 to the equipment 1, that is to say "download") and in the upward direction (transfer from the equipment 1 to the server 5, that is to say "upload").

The first method is therefore a method of transferring content on at least one server 5 connected to a local area network 20 to a device 1 connected to the Internet network 10. It comprises, as previously explained, steps of:

Sending a request to transfer said contents from the equipment to a publication server 3 connected to the network

Internet 10 (in particular thanks to a secure protocol of HTTPS), the request comprising at least one connection identifier;

- Verification of the connection identifier by the publication server 3 (for example by comparison with the databases of identifiers of an authentication server LDAP);

If the connection identifier is valid, transfer of said request from the publication server 3 to an aggregation server 4 connected to said local network 20, the connection between these servers 3 and 4 being in particular a tunnel offering an encrypted connection;

- Collection of said content on the server or servers 5 by the aggregation server;

Aggregating the contents in a form adapted to the equipment 1 by an aggregation engine implemented by the aggregation server 4;

- Transfer of the aggregated contents to the equipment 1 via the publication server 3 (by going up the established secure channels).

Conversely, the second method is a method of transferring contents from a device 1 connected to the Internet 10 to a server 5 connected to a local area network 20, which comprises a number of steps common to the first method, in particular steps of:

Sending a request to transfer said at least one content from the equipment 1 to a publication server 3 connected to the Internet network 10, the request comprising the content and at least one connection identifier;

- Verification of the connection identifier by the Publisher 3;

If the identifier is valid, transfer of said request from the publication server 3 to an aggregation server 4 connected to said local network (20);

It is then distinguished in that it includes only one step of: Transfer of said contents to the server 5 from the aggregation server 4.

Claims

1. System for access from a device (1) to contents stored on at least one server (5) of a secure local area network (20), the equipment (1) being connected to the local area network (20) via the Internet network (10), the system being characterized in that it comprises at least one publication server (3) connected to the equipment (1) via the Internet network (10) and an aggregation server (4) connected to said server (5) via the local area network (20);

in that, when the publication server (3) receives from the equipment (1) an access request to said contents of the server (5), the request comprising at least one valid connection identifier, said publication server (3). ) is able to establish a secure connection with said aggregation server (4); and

in that the aggregation server (4) implements a content aggregation engine capable of collecting, on request, contents of the server (5) via said local network (20), and aggregating and then transmitting it to the publication server (3) said collected contents.

2. System according to the preceding claim, wherein the contents collected by the aggregation server (4) are aggregated are a form adapted to the equipment (1).

3. System according to one of the preceding claims, wherein the local network (20) is connected to the Internet network (10) via a proxy (2) configured to allow a secure connection between the Publisher (3) and the server aggregation (4).

4. System according to one of the preceding claims, wherein the equipment (1) is a touch pad or a mobile terminal.

5. System according to one of the preceding claims, wherein the connection between the equipment (1) and the publisher (3) is also a secure connection.

6. System according to one of the preceding claims, wherein the publication server (3) is connected via the Internet network (10) to an authentication server in which are listed the valid login credentials.

7. System according to one of the preceding claims, wherein the aggregation server (4) is connected to a server (5) via a connector, each connector being able to convert a content flow of a specific language to a server. language of said aggregation engine, and vice versa.

8. System according to one of the preceding claims, wherein the equipment (1), the publisher (3) and the aggregation server (4) communicate via the XML (Extensible Markup Language) format, the server aggregation (4) comprising means for converting said aggregation engine language into XML, and vice versa.

9. System according to one of the preceding claims, wherein the equipment (1) has an interface in which connection identifiers of a user of the equipment (1) are stored, said interface comprising means of identification suitable, when the user has validly identified on the equipment (1), to associate said user's credentials to a request for access to said contents of the server (5).

10. System according to one of the preceding claims, wherein the contents of the at least one server (5) are selected from working papers, newspaper review articles, corporate social network data.

11. A method for transferring content on at least one server (5) connected to a local area network (20) to a device (1) connected to the Internet network (10), characterized in that it comprises steps of:

- Sending a request to transfer said content from the equipment (1) to a publication server (3) connected to the Internet network

(10), the request comprising at least one connection identifier;

- Verification of the connection identifier by the publisher

(3);

If the connection identifier is valid, transferring said request from the publication server (3) to an aggregation server (4) connected to said local network (20);

- Collecting said content on the server or servers (5) by the aggregation server;

- Aggregating contents in a form adapted to the equipment (1) by an aggregation engine implemented by the aggregation server

(4);

- Transfer of the aggregated contents to the equipment (1) via the publication server (3).

12. Method of transferring contents from equipment

(1) connected to the Internet network (10) to a server (5) connected to a local area network (20), characterized in that it comprises steps of:

- Sending a request to transfer said at least one content from the equipment (1) to a publication server (3) connected to the Internet network (10), the request comprising the content and at least one connection identifier; - Verification of the connection identifier by the publisher (3);

If the identifier is valid, transferring said request from the publication server (3) to an aggregation server (4) connected to said local network (20);

- Transfer of said content to the server (5) from the aggregation server (4).