WO2007038338A2 - Systemes et procedes d'etablissement et de validation de sessions d'un reseau securise - Google Patents
Systemes et procedes d'etablissement et de validation de sessions d'un reseau securise Download PDFInfo
- Publication number
- WO2007038338A2 WO2007038338A2 PCT/US2006/037098 US2006037098W WO2007038338A2 WO 2007038338 A2 WO2007038338 A2 WO 2007038338A2 US 2006037098 W US2006037098 W US 2006037098W WO 2007038338 A2 WO2007038338 A2 WO 2007038338A2
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- client
- central server
- value
- status field
- agent
- Prior art date
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/14—Session management
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
- H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
- H04L69/161—Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
- H04L69/162—Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields involving adaptations of sockets based mechanisms
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/08—Protocols specially adapted for terminal emulation, e.g. Telnet
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/10—Protocols in which an application is distributed across nodes in the network
- H04L67/1095—Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
- H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
Definitions
- the present application relates generally to systems and methods for establishing and validating secure network connections.
- SSL Secure Sockets Layer
- privacy e.g., secrecy
- authentication e.g., confidence that a computer's and/or user's asserted identity is true
- SSL technology is now built into many Internet browsers and web servers. The SSL protocol works by encrypting data passing between computers through use of encryption keys and associated encryption techniques. Despite the existence of SSL, additional solutions are required in order to meet the computer security needs of many organizations. The present invention provides such solutions.
- a user In order to access typical business software applications (e.g., MS Word, Excel, or PowerPoint), a user is typically required to purchase a license for the software from the software owner, and install the software on the user's computer equipment.
- the user is tasked with performing: (i) periodic data backups in order to ensure that data is recoverable in the event of a system failure; (ii) applications maintenance in order to ensure that updates and new versions are promptly installed on the user's equipment; and (iii) equipment installation/maintenance including, in some instances, internal network configuration.
- performance of these functions requires that costly IT personnel be on staff at the business.
- the present invention offers an alternative methodology which allows individuals and businesses to securely access business software applications that are hosted and maintained on a remote server by a service provider.
- the service provider performs functions currently performed by in-house IT staff at many businesses, including data backups and equipment/software maintenance.
- the present application is directed to a method and system for establishing a TCP/IP connection between a client and an application server associated with a Remote Agent.
- a request to establish a session is sent from the client to a central server.
- the central server randomly selects at least first and second ports at a Master Agent from a list of available ports.
- a connection request record having a status field and port fields is created in a database at the central server.
- the status field is set to a first value, and the port fields are set to values corresponding to the randomly selected ports.
- the connection request record has a unique signature known to the Remote Agent.
- the Master Agent monitors the database for new connection request records having a status field set to the first value.
- the Master Agent Upon detection of the connection request record, the Master Agent opens the randomly selected port and sends the central server an acknowledgement that the randomly selected ports are open. Upon receipt of the acknowledgement at the central server, the central server sets the status field to a second value. In response to detection by the client that the status field is set to the second value, the client establishes a first TCP/IP connection between the client and the first randomly selected port. In response to detection by the Remote Agent that the status field is set to the second value, the Remote Agent establishes a second TCP/IP connection between the Remote Agent and Master Agent using the second randomly selected port. The Master Agent detects that the first and second TCP/IP connections are established on both random ports and then sends an acknowledgement indicating success to the central server.
- the central server Upon receipt of the acknowledgement at the central server, the central server sets the status field to a third value. In response to detection by the client that the status field is set to the third value, the client sends a validation signal to the central server. Upon receipt of the validation signal, the central server sets the status filed to a fourth value. In response to detection by the Remote Agent that the status field is set to the fourth value, the TCP/IP session between the client and the application server is established.
- the application server hosts one or more business software applications for the client, and the client accesses the one or more business software applications at the application server using the established TCP/IP session. Files created by the client using the one or more business software applications at the application server are maintained and backed-up periodically at the application server by a service provider on behalf of the client.
- the central server applies address filtering to limit the list of available ports from which the randomly selected ports are chosen.
- a SSH tunnel may be used for secure authentication, wherein the server side of the tunnel is implemented with the Remote Agent.
- a firewall is provided for protecting the Remote Agent, and the Master Agent at the central server is used to chain together the request from the client to the Remote Agent to the application server.
- the port definitions for the firewall are known to the Master Agent and used by the Master Agent to eliminate any need for the Remote Agent to define firewall ports as part of establishing the session.
- FIG. 1 is a diagram illustrating a method for establishing a TCP/IP connection in accordance with the present invention. Detailed Description of the Preferred Embodiment
- FIG. 1 there is shown a diagram illustrating a method for establishing a TCP/IP connection between a client computer (e.g., a workstation or personal computer) and an application server associated with a Remote Agent, over a computer network such as the internet, in accordance with the present invention.
- the client sends a request to a central server to establish the session.
- the central server randomly selects two ports at a Master Agent from a pre-defined port range (e.g., if the port range is 9000-9050, two available ports within this range are randomly selected), and a connection request record having a status field and both port fields is created in a database at the central server.
- the status field is set to a first value, and the port fields are set to values corresponding to the randomly selected ports.
- the connection request record has a unique signature known to the Master Agent and Remote Agent.
- filtering is applied at the central server in a manner that limits the list of available ports in the port range from which the randomly selected ports are chosen.
- the Master Agent continuously monitors the database (step 14) for new connection request records having a status field set to the first value.
- step 16 upon detection by the Master Agent of the connection request record (i.e., the Master Agent detects a connection request record having a status field set to the first value in the database), the Master Agent opens both randomly selected ports.
- step 18 the Master Agent sends an acknowledgement to the central server, that the randomly selected ports are open.
- step 20 upon receipt of the acknowledgement at the central server, the central server sets the status field of the connection record to a second value.
- the client retrieves from the central server the value identifying the first randomly selected port.
- the client then uses the first randomly selected port value in step 24 to establish a TCP/IP connection between the client and the first randomly selected port at the Master Agent.
- the Remote Agent retrieves from the central server the value identifying the second randomly selected port.
- the Remote Agent uses the second randomly selected port value in step 28 to establish a TCP/IP connection between the Remote Agent and the second randomly selected port at the Master Agent.
- the Master Agent sends an acknowledgement to the central server, that the sessions are established, which causes the central server to set the status field to a third value.
- the client sends a validation signal to the central server in step 34; the central server then updates the status field of the connection record to reflect receipt of the validation signal from the client (e.g., the central server updates the value of the status field to a fourth value (different from the first, second and third values) that reflects receipt of the validation signal from the client.)
- step 36 the Remote Agent monitors the status field of the connection request record.
- the Remote Agent In response to detection by the Remote Agent that the status field is set to the fourth value, the Remote Agent establishes a TCP/IP connection with the application server in step 38.
- the Remote Agent terminates the session in step 38 if the Remote Agent fails to confirm detect that the status field has been set to the fourth value within a predetermined period of time following transmission by the Master Agent to the central server of the acknowledgement that the randomly selected ports were open (i.e., a predetermined time following step 18).
- the present invention is implemented by separate software that resides on each of the central server, the Master Agent, the Remote Agent and the client.
- the software resident at the central server manages the database connection records (described above) and provides functionality that allows software on the Master Agent (the master agent software), Remote Agent (the remote agent software) and the client (the client software) to extract request records from the central server database.
- the master and remote agent software run on the Remote Agent as a Microsoft Windows Services.
- the master agent software includes functionality for defining various configuration values used by the system.
- the remote agent software includes functionality for defining various configuration values used by the system.
- the present invention is built upon the Microsoft .NET framework, which provides many of the internal interfaces for facilitating the infrastructure of the present invention including: SQL Server for database storage, .NET WEB Services for component communications, ADSI for authentication queries and .NET Cyprtographic Services for encryption.
- the database at the central server stores configuration records for the master and remote agent software that resides on each Master Agent and Remote Agent in the system, and acts as a centralized request queue for functions performed by the system.
- all requests to extract information from the database at the central server are made through the central server software, and all calls to the central server and all data passed between the central server and the Master Agent, the Remote Agent or client are encrypted in accordance with the SSL protocol.
- the server side of the tunnel is implemented with the Remote Agent.
- the status field of each connection record is used for communicating status information to the Master Agent, the Remote Agent and the client during the process of establishing a session.
- the status field of each connection record is set to a value of 101 in step 12 when the central server first creates a new connection record in response to a client request to establish a connection; the status field of the connection record is set to a value of 1 in step 20 following receipt of the acknowledgement from the Master Agent that the randomly selected ports are open; the status field of the connection record is set to a value of 2 in step 30 following receipt of the acknowledgement from the Master Agent that the TCP/IP sessions are established; and the status value of the connection record is set to a value of 3 in response to receipt of a validation signal from the client in step 34.
- other values of the status field may be used for communicating the various stages of the connection request, and such other values are considered to be within the scope of the present invention.
- the present invention is able to maintain the outside TCP/IP ports of the Master Agent closed until the time that they are required and open no outside TCP/IP ports for the Remote Agent.
- the system then performs the series of validation steps described above to ensure that the connection is opened and managed securely. If the validation steps fail to occur in the proper sequence, or in a specified period of time, the connection is automatically terminated.
- a firewall (not shown) is provided for protecting the Remote Agent including, for example, a Remote Agent running as part of a small business network.
- a Master Agent at the central server may be used to chain together a request from the client to the Remote Agent running in the small business network.
- the port definitions for the firewall associated with the Remote Agent are known to the Master Agent, and used by the Master Agent to eliminate any need for the Remote Agent to define firewall ports as part of establishing/validating the session.
- the system of Figure 1 may be used by an employee for accessing a private computer network maintained by his employer (the company).
- the private computer network includes a first application server at the company's home office and a second application server at one of the company's satellite offices, and the employee desires to use his home computer to access the second application server at the satellite office over the internet.
- the central server corresponds to a node on the internet
- the Master Agent is associated with the first application server at the company's home office
- the Remote Agent is associated with the second application server at the company's satellite office.
- the port definitions for the firewall associated with the second application server are known to the first application server (at the home office), and used by the Master Agent to eliminate any need for the Remote Agent to define firewall ports as part of establishing/validating the session.
- inventive sequence for establishing a session described in Figure 1 can also be used to securely allow users over a network or the Internet to remotely execute and run applications (e.g., Word, Excel, PowerPoint) as on a desktop computer.
- this aspect of the invention provides secure internet access from either a pre- configured internet device or from any Web browser, anywhere in the world, to remotely hosted business software applications.
- a rental/subscription business model may be used for providing this service to users.
- a service provider e.g., a telephone company or cable provider
- the service provider will be responsible for hardware and maintenance and upgrades at the application server, as well as back-up of client files/data (created using the business application software) maintained at the service provider's application server.
- a comprehensive suite of application software may be made available on a monthly subscription basis to support the needs of a wide variety of user interests. Internet access fees may be separate or bundled depending on the business model of the service provider.
- a client device (which will be referred to as a Network Computer appliance) is sent by the service provider to the user/consumer pre-configured with all the initial settings and applications initially ordered by the customer/user to allow for simple installation.
- the Network Computer appliance includes a thin client device which includes a processor, keyboard and mouse along with software for accessing the application server over a network.
- the Network Computer can be connected to several viewing options such as a consumer television, standard computer monitor, Plasma or LCD display.
- Each user account may set up in a manner that provides a primary user with the ability to add sub accounts as required.
- the primary user controls permissions and access to the business application software by the sub account users. For example, a consumer could establish an account for the household which has sub accounts for each of two children and a fourth for a grandparent who lives several states away and does not have the same Internet Service Provider.
- Each account and sub account is configured to permit access to the applications software desired by the individual user. So the primary user, a teenager, a toddler, and a grandparent would have access to the different applications they need. Additionally, access to applications software can be turned on and off as required by the primary user. The user sets the permissions for each sub account.
- a wide variety of user parameters can be modified as required. These include establishing start and end times during which application access is allowed and/or the total time that application access is allowed.
- a further feature of the Network Computer is "shadowing or desktop sharing.” With shadowing, the primary user can actually take full control of the desktop or application of a sub account in real time. Thus a parent at a remote location could actually assist a child working on a school report at the library.
- the service provider Since, in the rental/subscription business model being described, all of the business software applications reside on the applications servers of the service provider, the service provider handles all applications updates and upgrades centrally, including all operating system maintenance. Thus the consumer is no longer burdened with all the periodic maintenance typically required by a standard personal computer. Automatic data backup, with integrated version control, allows data restoration as it existed previously.
- the service provider preferably integrates necessary system protections such as spyware control, disk defragmentation, Windows registry maintenance, cookie maintenance, adware, and real-time anti-virus checking. Thus, the consumer is not burdened with these tasks.
- users have the same functionality as they would expect on a stand-alone personal computer while totally avoiding the acquisition process, costs, set-up and maintenance for both the hardware and software.
- the consumer is preferably provided an option to select among different available email clients.
- the service provider manages anti-spam filtering and provides real time anti-virus protection. Because the user account is mobile, records of both incoming and sent messages are viewable from any computer regardless of whether they were sent from the Network Computer or any other workstation. Thus, home email can be monitored and replied to from work home with the resulting sent message always viewable.
- the rental/subscription business model is preferably implemented with a technical support module that allows a technician to see the user screen so any required steps can be taken to resolve a service issue. This capability is called shadowing and works on the same concept that allows a user to control the desktop or application of a sub account as discussed above.
- Individual application packages offered by the provider are discretionary. Any application available for Windows, LINUX or other operating systems can be made available.
- the provider may offer individual access for premium applications and develop "packages" of software offerings which would appeal to their individual markets.
- a business package could include all office productivity applications such as word processors, spreadsheets, or presentation tools.
- the concept of applications on demand may be implemented, meaning that the consumer can order a software application and have remote access to the application made immediately available. No waiting for delivery, no installation, no registration, just ready to use. Additionally, an application can be rented for only the time required. For example, a database program could be made available for a limited time to support a work project or a statistical analysis application for several months to support a student working on a thesis.
- USB uniform serial bus
- the service provider will preferably determine the amount of data storage they wish to make available to each user account and any price structure to support storage requirements.
- printing is easily accomplished via the parallel or USB port on the Network Computer or personal computer.
- a comprehensive printer driver database is preferably maintained by the service provider to support a wide array of printers and manufacturers.
- the rental/subscription business model can be used to provide turn-key application access that is precisely tailored to the specific requirements of each individual user in an organization. For example, a 100 user installation could be operational in the time it takes to plug in and connect the Network Computers to an existing wired or wireless network. In one embodiment, no special client-side software is needed. Unlike other remote access technologies, secure access may be provided by means of a standard Web browser.
- the rental/subscription business model may be implemented using a broadband, cable, DSL or dial-up access provider as the service provider. It must be noted however, that a separate hosting company working independent of an Internet access provider could implement this method. This is due to the facts that no specific type of Internet access is required and that the entire system is not captive to any specific provider's access point.
- the user login process is used to verify that the user is correct and entitled to access.
- the user is then connected to his personal "desktop" on the provider's applications server and from there forward the communications are direct point to point.
- all processing is performed on the provider's equipment thus dramatically reducing the volume of data that needs to be transmitted between the server and the user.
- only the Windows screen is sent to the user and none of the application or data.
- a standard 56K dial-up connection can offer the apparent speed of a high speed broadband connection.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Hardware Redundancy (AREA)
- Computer And Data Communications (AREA)
Abstract
La présente invention concerne un procédé et un système qui utilisent un serveur central en association avec une base de données et un agent principal pour établir une connexion TCP/IP entre un client et un serveur d'applications associé à un agent hors site. Le serveur d'applications héberge une ou plusieurs applications logicielles commerciales pour le client et le client accède à cette/ces applications logicielles commerciales au niveau du serveur d'applications au moyen de la session TCP/IP établie. Des fichiers créés par le client au moyen d'au moins une des applications logicielles commerciales au niveau du serveur d'applications sont maintenues à jour et sauvegardées périodiquement au niveau du serveur d'applications par un fournisseur de service pour le compte dudit client.
Applications Claiming Priority (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US71948705P | 2005-09-22 | 2005-09-22 | |
US60/719,487 | 2005-09-22 | ||
US11/495,049 US20060265506A1 (en) | 2004-04-08 | 2006-07-28 | Systems and methods for establishing and validating secure network sessions |
US11/495,049 | 2006-07-28 |
Publications (2)
Publication Number | Publication Date |
---|---|
WO2007038338A2 true WO2007038338A2 (fr) | 2007-04-05 |
WO2007038338A3 WO2007038338A3 (fr) | 2008-06-26 |
Family
ID=37900332
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/US2006/037098 WO2007038338A2 (fr) | 2005-09-22 | 2006-09-22 | Systemes et procedes d'etablissement et de validation de sessions d'un reseau securise |
Country Status (1)
Country | Link |
---|---|
WO (1) | WO2007038338A2 (fr) |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6134591A (en) * | 1997-06-18 | 2000-10-17 | Client/Server Technologies, Inc. | Network security and integration method and system |
US20030236985A1 (en) * | 2000-11-24 | 2003-12-25 | Nokia Corporation | Transaction security in electronic commerce |
US20040064568A1 (en) * | 2002-09-26 | 2004-04-01 | Arora Akhil K. | Presence detection using distributed indexes in peer-to-peer networks |
-
2006
- 2006-09-22 WO PCT/US2006/037098 patent/WO2007038338A2/fr active Application Filing
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6134591A (en) * | 1997-06-18 | 2000-10-17 | Client/Server Technologies, Inc. | Network security and integration method and system |
US20030236985A1 (en) * | 2000-11-24 | 2003-12-25 | Nokia Corporation | Transaction security in electronic commerce |
US20040064568A1 (en) * | 2002-09-26 | 2004-04-01 | Arora Akhil K. | Presence detection using distributed indexes in peer-to-peer networks |
Also Published As
Publication number | Publication date |
---|---|
WO2007038338A3 (fr) | 2008-06-26 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US8572254B2 (en) | Systems and methods for establishing and validating secure network sessions | |
US20210352135A1 (en) | System and method for providing data and application continuity in a computer system | |
US20030069848A1 (en) | A User interface for computer network management | |
US7467211B1 (en) | Remote computer system management through an FTP internet connection | |
US9225767B2 (en) | Method and system for providing secure remote access and control | |
US7415509B1 (en) | Operations architectures for netcentric computing systems | |
US8321921B1 (en) | Method and apparatus for providing authentication and encryption services by a software as a service platform | |
EP1986096A1 (fr) | Transmission par flots d'un bureau virtuel contenant plusieurs applications pour un affichage à distance pour un utilisateur authentifié d'un appareil client | |
US20090287831A1 (en) | Application distribution control system, application distribution control method, information processing apparatus, and client terminal | |
US8131830B2 (en) | System and method for providing support services using administrative rights on a client computer | |
US10911299B2 (en) | Multiuser device staging | |
AU2006302251A1 (en) | Apparatus system and method for real-time migration of data related to authentication | |
US20060143301A1 (en) | Systems and methods for establishing and validating secure network sessions | |
WO2008016370A2 (fr) | Systèmes et procédés pour établir et valider des sessions de réseau sécurisées | |
US6839708B1 (en) | Computer system having an authentication and/or authorization routing service and a CORBA-compliant interceptor for monitoring the same | |
US9231827B2 (en) | Formalizing, diffusing and enforcing policy advisories and monitoring policy compliance in the management of networks | |
US20150296051A1 (en) | Methods, remote access systems, client computing devices, and server devices for use in remote access systems | |
US20040103320A1 (en) | Multiple network access | |
Cisco | Cisco Centri Firewall Version 4.0.2 Release Notes | |
Cisco | PIX Firewall Manager Version 4.2(5) Release Notes | |
Cisco | PIX Firewall Manager Version 4.2(4) Release Notes | |
WO2007038338A2 (fr) | Systemes et procedes d'etablissement et de validation de sessions d'un reseau securise | |
Cisco | CiscoSecure ACS 2.1 for UNIX Release Notes | |
JP2009517781A (ja) | 単純な多目的通信装置および情報クライアント | |
Stanek | Web Server Administration: The Personal Trainer for IIS 7.0 and IIS 7.5 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application | ||
DPE2 | Request for preliminary examination filed before expiration of 19th month from priority date (pct application filed from 20040101) | ||
NENP | Non-entry into the national phase in: |
Ref country code: DE |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 06825087 Country of ref document: EP Kind code of ref document: A2 |