WO2020065476A1 - Système et procédé d'accès à des données dans une zone interne - Google Patents
Système et procédé d'accès à des données dans une zone interne Download PDFInfo
- Publication number
- WO2020065476A1 WO2020065476A1 PCT/IB2019/057971 IB2019057971W WO2020065476A1 WO 2020065476 A1 WO2020065476 A1 WO 2020065476A1 IB 2019057971 W IB2019057971 W IB 2019057971W WO 2020065476 A1 WO2020065476 A1 WO 2020065476A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- dmz
- hive
- server
- proxy
- area
- Prior art date
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/46—Multiprogramming arrangements
- G06F9/50—Allocation of resources, e.g. of the central processing unit [CPU]
- G06F9/5061—Partitioning or combining of resources
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0209—Architectural arrangements, e.g. perimeter networks or demilitarized zones
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
- H04L63/0281—Proxies
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
Definitions
- the invention relates to a secure system for accessing data in an internal area.
- the system comprises a public area and a closed area.
- the closed area has an internal area, a demilitarized zone (DMZ) and a data center.
- the internal area includes a variety of devices, such as Mobile phones, tablets, laptops, desktops,
- the DMZ includes at least one proxy, to which a pool is assigned.
- the data center comprises at least one server.
- the invention further relates to a secure method for accessing data.
- European patent application EP 3 316 545 A1 discloses a method in which a request for a specific service is received by a server outside the firewall (external server) via the firewall from a server inside a firewall (internal server).
- the firewall is designed in such a way that units within the firewall can connect to units outside the firewall. It is also possible to block connections that originally come from outside the firewall, whereby the service is provided within the firewall.
- a connection is created with the Outbound Proxy Server (OPS), whereby data is sent to a server within the firewall, which stores the specific service.
- OPS Outbound Proxy Server
- Patent application WO 2013/036946 discloses various methods for the secure exchange of private keys for authenticating a user with regard to an RDP service.
- a request can be received that includes session information to provide a user with access to an RDP service.
- the method may further include assigning a validity period to the password.
- the method can generate a first secret key, which is based on user information, and generate a second secret Key based on the first secret key and a salt, and encrypting a packet having the password and the period using the second secret key.
- Methods include transmitting the user name and the encrypted packet to the device for authenticating the user with respect to the requested RDP service.
- Patent application WO 2006/046973 discloses a method for controlling access between a computer and a network.
- Network requests are identified that are assigned to at least one task that runs on said computer.
- the task is enabled to access the network if network access is currently disabled for the task.
- at least one device on the network is prevented from accessing at least one port that is currently open on the computer.
- European patent application EP 2 031 817 A1 discloses a system and a method for streaming an inverted HTTP gateway.
- a network is also disclosed which also includes this system or method.
- the reverse HTTP gateway is shielded between two firewalls, ie in the DMZ, by an internal server and the Internet.
- the system disclosed here communicates via an HTTP protocol.
- servers are to be regarded as sinks.
- the client accesses the server.
- the clients are sources such as cell phones, tablets, laptops or desktops.
- a complex firewall setting is required to protect the at least one server.
- the problem with the firewall setting is that depending on the number of required activation of the firewall ports, the overview of the settings made is complicated. So It can happen that an administrator can rule itself out in the event of an error in the firewall settings.
- the Federal Office for Information Security recommends a two-stage firewall concept from the internal area to the Internet in its IT-Grundschutz catalogs.
- a firewall separates the Internet from the DMZ and another firewall separates the DMZ from the internal network.
- a single vulnerability does not immediately compromise the internal network.
- the two firewalls are from different manufacturers, otherwise a known vulnerability would be sufficient to overcome both firewalls.
- the filter functions can be performed by a single device; in this case, the filtering system requires at least three network connections: one for each of the two network segments to be connected (e.g. Wide Area Network (WAN) and Local Area Network (LAN)) and a third one for the DMZ.
- WAN Wide Area Network
- LAN Local Area Network
- VLANs Virtual Local Area Network
- a common exception to this is access from the DMZ to database servers in the internal network.
- the firewall administrator usually monitors this principle before the rule is activated. This largely reduces the risk potential of a compromised server in the DMZ to attacks: directly on the inner firewall, on other servers in the same DMZ, via security gaps in administration tools such as Telnet or Secure Shell "SSH" and on connections that are regular were set up in the DMZ.
- SSH describes both a network protocol and corresponding programs, with the help of which one can establish an encrypted network connection with a remote device in a secure manner.
- This method is often used to make a remote command line available locally. That is, the output from the remote console is output on a local console and the local keyboard inputs are sent to the remote computer. This can be used for example for
- Port forwardings to the other computers are taken into account and only then the exposed host, or whether the exposed host makes the port forwardings on other computers ineffective.
- Dirty DMZ Another possibility of protection can be a "dirty DMZ".
- the “dirty DMZ” or “dirty riet” is usually the network segment between the two
- Perimeter router and the firewall of the (internal) LAN From the outside, this zone has only the limited security of the perimeter router. This version of the DMZ hampers the data transfer less because the incoming data only have to be filtered (perimeter router).
- a “protected DMZ” is a DMZ that is connected to a firewall's own LAN interface. This DMZ has the individual security of the firewall. Many firewalls have multiple LAN interfaces to set up multiple DMZs.
- DMZ public access to data in an internal area
- the DMZ separates the public area from the internal area.
- two methods can be used to make data from the internal area accessible to the public.
- the data is kept in the DMZ. Access to the data via a corridor into the internal area can also be made possible.
- a public area for example the Internet
- the system according to the invention enables secure public access to data in an internal area.
- the system includes a public area, such as the Internet, and a closed area.
- the closed area is from one internal area, a DMZ and a data center.
- the internal area includes a variety of devices.
- the DMZ has at least one proxy, each with an assigned pool.
- the data center comprises at least one server, with each of the servers being assigned a hive. Any combination of hive and server can provide a protocol-free connection to the public area and a
- the internal area of the closed area also provides a protocol-free connection to the DMZ of the closed area.
- the connections provided can enable an incoming data flow through outgoing connections.
- the internal area and the devices of the internal area are sources.
- the data center and the at least one combination of one server each with a hive provided in the data center are designed as a source.
- the DMZ and the at least one proxy, each with an assigned pool, and the public area are sinks.
- the sources of the system are connected to the sinks via the connections.
- the designation as a source does not refer to data, but to the possibility of establishing a connection from the source to a sink. The other direction from the valley to the source is not possible.
- Computers in the sense of the description can be virtual or physical. Private computers are sources. Private networks are also sources. Private computers are in private networks (internal areas). Public computers (such as servers) are sinks. Public networks are also sinks. Public computers are in public networks. A DMZ is public and therefore a sink. Likewise, the Internet with all of its applications is public and therefore a sink. According to a possible embodiment, the DMZ can be provided with a first firewall and a second firewall. The first firewall is a sink for that
- the second firewall represents a sink for the connections from the data center.
- the hives that are assigned to the corresponding servers are each clones from a hive previously installed in the data center.
- the clone of a hive (computer) can be created by simply copying.
- the clone of the hives can reconnect to the pool of the proxy because the configuration of the clone of the hives has not been changed by copying.
- Cloning the hives has the advantage that a "hot update" of the server service and / or the operating system is possible. Cloning and updates can run multiple versions at the same time. It is possible to switch off the "old” versions at any time.
- each hive has access to the server assigned to it.
- the at least one server and the hive assigned to it can be installed on two separate computers.
- software for the corresponding hive must be installed on the separate, separate computer.
- the hive and the server are connected via the access.
- the at least one server and the hive assigned to it can be a single computer.
- the hive and the server are installed as software on the single computer.
- the internal area can comprise at least one server which represents a sink for the hive.
- the pool and the proxy of the DMZ as well as the hive of the internal area can comprise a server or a virtual server.
- the pool of the DMZ sends a request to the hive to occupy at least one of the free corridors. If access to the internal area is permitted, a port connects to at least one server in the internal area.
- the internal area is a sink.
- a connection to the DMZ can be established by means of a port through the first firewall via at least one external device in the public area that is a source.
- the proxy of the DMZ sends a message to the pool through the connection to the DMZ established by the first firewall.
- the pool initiates a message
- the hive forwards the at least one request from the public area to the server in the internal area via the port and the connection to the at least one server.
- the inventive method for public access to data in a closed area is characterized by several steps.
- a public area is provided that is configured as a sink.
- a closed area is assigned to the public area.
- the closed area includes an internal area that is a source.
- a DMZ is a sink.
- Data center is a source. Protocol-free connections to the sinks are formed by the sources to access data.
- the advantage of this method is that the connections to the sinks can only be established from sources and data can be exchanged via the connections, so that external access to data or data theft from the internal area (of the sources) is not possible. Data security is thus increased by the invention.
- the data center comprises at least one server, with each server being assigned a hive via an access.
- the data center can thus establish at least one protocol-free connection to the public area and at least one protocol-free connection to at least one proxy of the DMZ.
- the internal area consists of a variety of devices (such as e.g.
- the DMZ enables data exchange between the data center and the internal area.
- a pool is assigned to at least one proxy of the DMZ.
- the at least one hive connects to the pool and the pool configures the at least one proxy of the DMZ. Only proxies and no data are provided in the DMZ. Since the DMZ is configured as a sink, external access can only take place through an open port of the proxy.
- the DMZ is closed from the inside (sink). A connection to a source is not possible. A notification is sent when a port of the at least one proxy is dynamically closed or opened.
- Access by the at least one hive to the respectively assigned server is also monitored. If a service is not available, this access of the corresponding server and / or the dynamically opened port of the at least one proxy is closed if there are no connections.
- the dynamically created ports of a proxy can be closed automatically if there are no connections for the port of the proxy. This is e.g. the case when the combination of server and hive is "down".
- a particularly advantageous embodiment of the present invention is when the hives used in the system are the clones of a previous hive. Each of the cloned hives can thus connect itself to the pool of the at least one proxy.
- the DMZ can also be a single computer, e.g. a calculator from one
- Figure 1 is a schematic representation of a single-stage firewall concept
- Figure 2 is a schematic representation of a two-stage firewall concept
- Figure 3 is a schematic representation of a source in the sense of the invention.
- Figure 4 is a schematic representation of a sink in the sense of the invention.
- Figure 5A is a schematic representation of an allowed or possible
- FIG. 5B shows a schematic illustration of a not permitted or not possible
- Figure 6 is a schematic view of the connection of two sources
- FIG. 7 shows a schematic representation of a pool in the sense of the invention.
- FIG. 8 shows a schematic illustration of a hive in the sense of the invention
- Figure 9 is a schematic representation of the switching of connections to the
- FIG. 10 shows a schematic illustration of the assignment of public inquiries according to the invention.
- FIG 11 is a schematic representation of the system according to the invention.
- Figure 12 is a schematic illustration of an embodiment of the
- FIG. 13 shows a schematic illustration of a further embodiment of the system according to the invention.
- Figure 14 is a schematic representation of the combination of server and hive.
- FIG. 1 shows the representation of a single-stage firewall concept of the prior art.
- a demilitarized zone 4 (DMZ) is connected to an intranet 2 (such as LAN) via a firewall 6.
- the intranet 2 is protected by the firewall 6 against other networks 8, e.g. Internet or LAN, shielded.
- the separation allows access to publicly accessible services (bastion hosts with e.g. e-mail, www, etc.) and at the same time protects the intranet 2 (internal network) against unauthorized access from the other networks 8.
- the protective effect of the DMZ 4 is achieved by isolating a system from two or more networks.
- the DMZ 4 can have three servers or systems, e.g. WWW 1 1, SMTP 12 and DNS 13 include.
- FIG. 2 shows a schematic illustration of a single-stage firewall concept of the prior art.
- the DMZ 4 is protected by a first firewall 6 and a second firewall 7.
- the first firewall 6 separates the DMZ 4 from the external networks 8 or the Internet.
- the second firewall 7 separates the intranet 2 from the DMZ 4.
- FIG. 3 shows a schematic illustration of a source 20 in the sense of the invention.
- a source 20 in the sense of the invention can establish connections 21.
- the source 20 is shown schematically with a solid line 18 and a dashed line 19.
- a connection 21 can only be established starting from the source 20. In other words, the connection 21 can only come from the dashed line 19 starting out. An acceptance of connections 21 by the source 20 via the solid line 18 is not possible.
- Via connection 21 data from a sink 22 (see FIG. 4) of the system according to the invention can be sent to the source 20.
- FIG. 4 schematically shows a depression 22 as used in the system according to the invention.
- the sink 22 can accept connections 21. It is not possible to set up connections 21 to other elements of the system.
- the depression 22 can also be represented schematically with a solid line 18 and a dashed line 19. A connection 21 can only be accepted by the sink 22. As illustrated in FIG. 5, the dashed line 19 surrounds the solid line 18.
- FIG. 5A illustrates the direction in which the establishment of a connection 21 is possible. It does not matter whether sink 22 or source 20, the connection 21 can only from the
- FIG. 5B illustrates the direction in which the establishment of a connection 21 is not possible.
- the solid line 18 does not allow a connection 21 to be established. Consequently, a connection 21 from the solid line 18 via the dashed line 19 is not possible.
- FIG. 6 shows a schematic view of the connection of two sources 20.
- Two sources 20 can only connect via a sink 22. It is not possible for two sources 20 or two sinks 22 to connect to one another.
- One of the sources 20 establishes a connection 21 with the sink 22.
- the other source 20 establishes a connection 21 with the sink 22. Via the established connections 21, data about the sink 22 can now be transmitted from one source 20 to the other source 20
- FIG. 7 shows a pool 23 which is used in the system according to the invention.
- a pool 23 is a sink 22 and can accept, collect and manage at least one connection 21.
- the number of connections shown is 21 merely by way of example and should not be construed as a limitation of the invention.
- a hive 24 is shown in FIG.
- the hive 24 is a source 20 of the system, which can establish at least one connection 21.
- FIG. 9 shows a pool 23 which accesses the proxy 25 with an internal access 26 in order to enable ports of the proxy 25 for the connections (not shown) from the sources 20.
- 9 shows the basic structure of a DMZ 4. It goes without saying that a DMZ 4 can comprise more than one proxy 25 with pool 23.
- the illustration shown here is for the purpose of description and is not to be interpreted as a limitation of the invention.
- FIG. 10 shows a schematic illustration of a possible embodiment of the system 1 of the invention.
- the DMZ 4 is a sink 22.
- the DMZ 4 comprises, as already mentioned, the pool 23 and the proxy 25.
- the pool 23 collects the connections 21 from the internal area 2 (source 20), e.g. Intranet.
- the management and assignment of the connections 21 (see FIG. 12) from the public area 8 (public networks, Internet; source 20) are carried out by the proxy 25 of the DMZ 4.
- FIG. 11 shows a schematic and simplified illustration of the system 1 according to the invention and the interaction of sinks 22 and sources 20.
- the data 28 arrive via the connection 21 to a sink 22 which the DMZ 4 (sink 22) with the at least one proxy 25.
- the data 28 from the internal area 2 can be routed to the data center 5 (source 20) by means of the connections 21 established via the DMZ 4, which is also a sink 22.
- the DMZ 4 manages the inquiries (see FIGS. 12 and 13) from the public area 8 and provides the necessary ones
- FIG. 12 shows a possible embodiment of the system 1 according to the invention.
- a source 20 which is an internal area 2 (such as a local area network (LAN) or intranet) and a data center 5, which is also a source 20, is the DMZ 4 is provided, which is a depression 22.
- a closed area 100 of the system 1 according to the invention comprises the internal area 2 (such as a local area network (LAN) or intranet), which is DMZ 4 and the data center 5.
- the internal area 2 can comprise a multiplicity of devices 32i, 32 2 ,... 32 N , which are also sources 20.
- the devices 32i, 32 2 ,... 32 N of the internal area 2 can be, for example, mobile telephones, tablets, laptops, desktop computers, a control computer or a device that requires remote maintenance.
- 32 2 ?? 32 n that requires remote maintenance can be an X-ray device, for example.
- Public access is defined as access that does not belong to internal area 2.
- the firewall setting of the individual devices 32i, 32 2 , ... 32 N is static.
- the DMZ 4 can comprise at least one proxy 25i, 25 2 , ..., 25 P.
- the at least one proxy 25i, 25 2 , ..., 25 P can be designed as a server and / or a virtual server.
- the devices 32i, 32 2 ,... 32 N of the internal area 2 can make the connections 21 to the at least one proxy 25i,
- the at least one proxy 25i, 25 2 , ..., 25 P is open from the outside and closed from the inside.
- a pool 23 (not shown here; see FIG. 10) can also be assigned to each of the proxy 25i, 25 2 ,... 25 P.
- the proxy 25i, 25 2 , ..., 25 P are port proxy.
- the pools 23 are pool proxies.
- the data center 5 is a source 20 which comprises at least one server 30i, 30 2 , ..., 30 s , each with an associated hive 24i, 24 2 , ..., 24 s .
- each server 30i, 30 2 , ..., 30 s of the data center 5 can establish a connection 21 to a public area 8, which is, for example, the Internet build up.
- the public area 8 (Internet) comprises a large number of applications 40i, 40 2 , ..., 40 k , which the system 1 according to the invention can access.
- connection from the data center 5 (source 20) to the DMZ 4 is established in such a way that at least one hive 24i, 24 2 , ..., 24 s connects to the pool 23 (pool proxy).
- the at least one hive 24i, 24 2 , ..., 24 s dynamically configures the at least one proxy 25i, 25 2 , ..., 25 P (port proxy) via the pool 23.
- pool 23 (pool proxy) and the at least one proxy 25i, 25 2 , ..., 25 P (port proxy).
- Pool 23 (pool proxy) listens to port 8001, for example.
- Hive 24i connects to port 8001.
- Hive 24i opens port 443 on proxy 25i (port proxy).
- Hive 24i is connected to port 443 on the assigned server 30i . This enables data exchange from port 443 of proxy 25i (port proxy) to port 443 of server 30i.
- the at least one hive 24i, 24 2 , ..., 24 s and the at least one proxy 25i, 25 2 , ..., 25 P are independent of a protocol, such as http.
- the configuration of the at least one proxy 25i, 25 2 , ..., 25 P is static.
- the configuration of the at least one assigned hive 24i, 24 2 , ..., 24 s is semi-static, only the port of the at least one proxy 25i, 25 2 , ..., 25 P (port proxy) and the port of the at least one Servers 30i,
- Notification There is also a notification when a port is closed for at least one proxy 25i, 25 2 , ..., 25 P.
- Each hive 24i, 24 2 , ..., 24 s that is assigned to the corresponding server 30i, 30 2 , ..., 30 S of the data center can be monitored via an internal access.
- the access of the corresponding hives 24i, 24 2 , ..., 24 s to the server 30i, 30 2 , ..., 30 s assigned to it can be closed if the
- the dynamically configured port of the at least one proxy 25i, 25 2 , ..., 25 P (port proxy) can be automatically closed if the Number of connections of at least one proxy 25i, 25 2 , ..., 25 P (port proxy) is zero. This is the case, for example, if the combination of the at least one server 30i, 30 2 , ..., 30 S with the corresponding hive 24i, 24 2 , ..., 24 s is "down", for example due to a power failure .
- the public area 8 for example the Internet, comprises a large number of external devices and services (not shown).
- the public area 8 is a sink 22 and is shielded from the data center 5, which is a source 20, by a firewall 6.
- the data center 5 builds a connection to a proxy server if there are requests from the internal area 2 (such as an intranet) 40 in the public area 8.
- the applications 40i, 40 2 , ..., 40 K (devices and / or services) of the public area 8 establish connections 21 to the proxy server 40, which is not public. connect to make inquiries to internal area 2.
- the corresponding connections 21, the first firewall 6 and the second firewall 7 (see FIG. 13) of the DMZ 4 have to be created by the system 1.
- FIG. 13 shows a further possible embodiment of the system 1 in FIG.
- the structure of the embodiment in FIG. 13 differs from the structure already described in FIG. 12 in that a second firewall 7 is provided.
- the proxy server 40 is thus shielded by the first firewall 6 and the second firewall 7.
- the configuration corresponds to that of a DMZ 4. All other features of the system 1 according to the invention have already been described in detail in the description of FIG. 12.
Landscapes
- Engineering & Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Software Systems (AREA)
- Signal Processing (AREA)
- Computer Networks & Wireless Communication (AREA)
- Computing Systems (AREA)
- Computer Security & Cryptography (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Computer Hardware Design (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
- Computer And Data Communications (AREA)
Abstract
L'invention concerne un système (1) et un procédé d'accès public à des données dans une zone interne (2) qui est protégée contre une entrée non autorisée. Le système (1) comprend une zone fermée (100) qui comporte une zone interne (2), une zone DMZ (4) et un centre de calcul (5). La zone fermée (100) possède une zone interne (2) pourvue d'une pluralité d'unités (321, 322,..., 32N), une zone DMZ (4) comportant au moins un proxy (251, 252,..., 25P) et un pool associé (23) ainsi qu'un centre de calcul (5) comportant au moins un serveur (301, 302,..., 30S). Un Hive (241, 242,..., 24S) est associé à chaque serveur (301, 302,…,30S) du centre de calcul (5), chaque combinaison de Hive (241, 242,..., 24S) et de serveur (301, 302,..., 30S) établissant une liaison sans protocole (21) à la zone publique (8) et une liaison sans protocole (21) à la zone DMZ (4) de la zone fermée (100). La zone interne (2) de la zone fermée (100) établit une liaison sans protocole (21) à la zone DMZ (4) de la zone fermée (100).
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
DE102018123692.1A DE102018123692A1 (de) | 2018-09-26 | 2018-09-26 | System und Verfahren für einen öffentlichen Zugriff auf Daten in einem internen Bereich |
DE102018123692.1 | 2018-09-26 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2020065476A1 true WO2020065476A1 (fr) | 2020-04-02 |
Family
ID=68290282
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/IB2019/057971 WO2020065476A1 (fr) | 2018-09-26 | 2019-09-20 | Système et procédé d'accès à des données dans une zone interne |
Country Status (2)
Country | Link |
---|---|
DE (1) | DE102018123692A1 (fr) |
WO (1) | WO2020065476A1 (fr) |
Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2006046973A1 (fr) | 2004-10-26 | 2006-05-04 | International Business Machines Corporation | Ordinateur et procede permettant de controler l'acces au reseau sur demande |
US20060200572A1 (en) * | 2005-03-07 | 2006-09-07 | Check Point Software Technologies Ltd. | Scan by data direction |
EP2031817A1 (fr) | 2007-08-30 | 2009-03-04 | Software Ag | Systèmes et/ou procédé de passerelle HTTP à flux inversé, et réseau l'utilisant |
WO2013036946A1 (fr) | 2011-09-09 | 2013-03-14 | Stoneware, Inc. | Procede et appareil de partage cle via le protocole secure ou remote desktop |
EP3316545A1 (fr) | 2016-10-28 | 2018-05-02 | Entit Software LLC | Demandes de service d'acheminement depuis des serveurs mandataires sortants vers des serveurs distants à l'intérieur de pare-feu |
-
2018
- 2018-09-26 DE DE102018123692.1A patent/DE102018123692A1/de not_active Ceased
-
2019
- 2019-09-20 WO PCT/IB2019/057971 patent/WO2020065476A1/fr active Application Filing
Patent Citations (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2006046973A1 (fr) | 2004-10-26 | 2006-05-04 | International Business Machines Corporation | Ordinateur et procede permettant de controler l'acces au reseau sur demande |
DE112005002614T5 (de) | 2004-10-26 | 2007-09-27 | International Business Machines Corp. | Computer und Verfahren zur Netzwerkzugriffssteuerung auf Anforderung |
US20060200572A1 (en) * | 2005-03-07 | 2006-09-07 | Check Point Software Technologies Ltd. | Scan by data direction |
EP2031817A1 (fr) | 2007-08-30 | 2009-03-04 | Software Ag | Systèmes et/ou procédé de passerelle HTTP à flux inversé, et réseau l'utilisant |
WO2013036946A1 (fr) | 2011-09-09 | 2013-03-14 | Stoneware, Inc. | Procede et appareil de partage cle via le protocole secure ou remote desktop |
DE112012003731T5 (de) | 2011-09-09 | 2014-08-07 | Stoneware Inc. | Verfahren und Vorrichtung zum Schlüssel-Sharing in Verbindung mit dem Remote Desktop Protocol |
EP3316545A1 (fr) | 2016-10-28 | 2018-05-02 | Entit Software LLC | Demandes de service d'acheminement depuis des serveurs mandataires sortants vers des serveurs distants à l'intérieur de pare-feu |
Non-Patent Citations (1)
Title |
---|
JEFFERSON TAN ET AL: "A Virtual Connectivity Layer for Grids", IEEE INTERNATIONAL CONFERENCE ON E-SCIENCE, 9 December 2009 (2009-12-09), pages 307 - 312, XP031610387, ISBN: 978-0-7695-3877-8 * |
Also Published As
Publication number | Publication date |
---|---|
DE102018123692A1 (de) | 2020-03-26 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
DE19740547B4 (de) | Vorrichtung und Verfahren zum Sicherstellen sicherer Kommunikation zwischen einer anfordernden Entität und einer bedienenden Entität | |
DE60212289T2 (de) | Verwaltung privater virtueller Netze (VPN) | |
DE60216218T2 (de) | Persönlicher Firewall mit Platzabhängiger Funktionalität | |
DE60019997T2 (de) | Ggesicherte Kommunikation mit mobilen Rechnern | |
DE60203099T2 (de) | Eine Methode, ein Netzwerkszugangsserver, ein Authentifizierungs-, Berechtigungs- und Abrechnungsserver, ein Computerprogram mit Proxyfunktion für Benutzer-Authentifizierung, Berechtigung und Abrechnungsmeldungen über einen Netzwerkszugangsserver | |
DE69232799T2 (de) | Netzwerksicherheitsverfahren und-vorrichtung | |
DE102016124383A1 (de) | Computersystem-Architektur sowie Computernetz-Infrastruktur, umfassend eine Mehrzahl von solchen Computersystem-Architekturen | |
DE10052312A1 (de) | Automatische Sperre gegen unberechtigten Zugriff im Internet (Snoop Avoider) für virtuelle private Netze | |
EP1417820B1 (fr) | Procede et systeme informatique permettant la protection de la communication dans des reseaux | |
EP1128615A2 (fr) | Procédé et dispositif de chiffrement de courrier électronique | |
EP3105898B1 (fr) | Procédé de communication entre des systèmes informatiques sécurisés et infrastructure de réseau informatique | |
EP2680497B1 (fr) | Accès externe à une unité de commande domestique basée sur IP dans un réseau local | |
EP3151503B1 (fr) | Procede et systeme d'authentification d'une application web environnante par une application web a inserer | |
WO2020065476A1 (fr) | Système et procédé d'accès à des données dans une zone interne | |
WO2006076752A1 (fr) | Systeme de securite informatique | |
EP2436166B1 (fr) | Interface de service | |
DE60127187T2 (de) | System und verfahren zur bereitstellung von diensten in virtuellen privatnetzen | |
EP2898635B1 (fr) | Système et procédé de maintenance d'une machine-outil | |
EP2929672B1 (fr) | Procédé de travail d'un système ainsi que système | |
EP1496665B1 (fr) | Procédé de configuration de sécurité dans un réseau d'automatisation | |
DE10234562B4 (de) | Sichere Netzwerkarchitektur | |
DE10138865C2 (de) | Verfahren und Computersystem zur Sicherung der Kommunikation in Netzwerken | |
DE102004025056B4 (de) | Verfahren und Vorrichtung zur Gewährleistung eines Zugriffsschutzes in einem Shared-Medium-Netz | |
DE102005050336B4 (de) | Verfahren und Anordnung zum Betreiben eines Sicherheitsgateways | |
DE60313195T2 (de) | Verfahren, system und computerprogrammprodukt zum übertragen eines media-stroms zwischen client-endgeräten |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 19790280 Country of ref document: EP Kind code of ref document: A1 |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 19790280 Country of ref document: EP Kind code of ref document: A1 |