WO2020065476A1 - Système et procédé d'accès à des données dans une zone interne - Google Patents

Système et procédé d'accès à des données dans une zone interne Download PDF

Info

Publication number
WO2020065476A1
WO2020065476A1 PCT/IB2019/057971 IB2019057971W WO2020065476A1 WO 2020065476 A1 WO2020065476 A1 WO 2020065476A1 IB 2019057971 W IB2019057971 W IB 2019057971W WO 2020065476 A1 WO2020065476 A1 WO 2020065476A1
Authority
WO
WIPO (PCT)
Prior art keywords
dmz
hive
server
proxy
area
Prior art date
Application number
PCT/IB2019/057971
Other languages
German (de)
English (en)
Inventor
Oliver Bollmann
Original Assignee
Cordaware GmbH Informationslogistik
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Cordaware GmbH Informationslogistik filed Critical Cordaware GmbH Informationslogistik
Publication of WO2020065476A1 publication Critical patent/WO2020065476A1/fr

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/50—Allocation of resources, e.g. of the central processing unit [CPU]
    • G06F9/5061—Partitioning or combining of resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0209—Architectural arrangements, e.g. perimeter networks or demilitarized zones
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0281—Proxies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic

Definitions

  • the invention relates to a secure system for accessing data in an internal area.
  • the system comprises a public area and a closed area.
  • the closed area has an internal area, a demilitarized zone (DMZ) and a data center.
  • the internal area includes a variety of devices, such as Mobile phones, tablets, laptops, desktops,
  • the DMZ includes at least one proxy, to which a pool is assigned.
  • the data center comprises at least one server.
  • the invention further relates to a secure method for accessing data.
  • European patent application EP 3 316 545 A1 discloses a method in which a request for a specific service is received by a server outside the firewall (external server) via the firewall from a server inside a firewall (internal server).
  • the firewall is designed in such a way that units within the firewall can connect to units outside the firewall. It is also possible to block connections that originally come from outside the firewall, whereby the service is provided within the firewall.
  • a connection is created with the Outbound Proxy Server (OPS), whereby data is sent to a server within the firewall, which stores the specific service.
  • OPS Outbound Proxy Server
  • Patent application WO 2013/036946 discloses various methods for the secure exchange of private keys for authenticating a user with regard to an RDP service.
  • a request can be received that includes session information to provide a user with access to an RDP service.
  • the method may further include assigning a validity period to the password.
  • the method can generate a first secret key, which is based on user information, and generate a second secret Key based on the first secret key and a salt, and encrypting a packet having the password and the period using the second secret key.
  • Methods include transmitting the user name and the encrypted packet to the device for authenticating the user with respect to the requested RDP service.
  • Patent application WO 2006/046973 discloses a method for controlling access between a computer and a network.
  • Network requests are identified that are assigned to at least one task that runs on said computer.
  • the task is enabled to access the network if network access is currently disabled for the task.
  • at least one device on the network is prevented from accessing at least one port that is currently open on the computer.
  • European patent application EP 2 031 817 A1 discloses a system and a method for streaming an inverted HTTP gateway.
  • a network is also disclosed which also includes this system or method.
  • the reverse HTTP gateway is shielded between two firewalls, ie in the DMZ, by an internal server and the Internet.
  • the system disclosed here communicates via an HTTP protocol.
  • servers are to be regarded as sinks.
  • the client accesses the server.
  • the clients are sources such as cell phones, tablets, laptops or desktops.
  • a complex firewall setting is required to protect the at least one server.
  • the problem with the firewall setting is that depending on the number of required activation of the firewall ports, the overview of the settings made is complicated. So It can happen that an administrator can rule itself out in the event of an error in the firewall settings.
  • the Federal Office for Information Security recommends a two-stage firewall concept from the internal area to the Internet in its IT-Grundschutz catalogs.
  • a firewall separates the Internet from the DMZ and another firewall separates the DMZ from the internal network.
  • a single vulnerability does not immediately compromise the internal network.
  • the two firewalls are from different manufacturers, otherwise a known vulnerability would be sufficient to overcome both firewalls.
  • the filter functions can be performed by a single device; in this case, the filtering system requires at least three network connections: one for each of the two network segments to be connected (e.g. Wide Area Network (WAN) and Local Area Network (LAN)) and a third one for the DMZ.
  • WAN Wide Area Network
  • LAN Local Area Network
  • VLANs Virtual Local Area Network
  • a common exception to this is access from the DMZ to database servers in the internal network.
  • the firewall administrator usually monitors this principle before the rule is activated. This largely reduces the risk potential of a compromised server in the DMZ to attacks: directly on the inner firewall, on other servers in the same DMZ, via security gaps in administration tools such as Telnet or Secure Shell "SSH" and on connections that are regular were set up in the DMZ.
  • SSH describes both a network protocol and corresponding programs, with the help of which one can establish an encrypted network connection with a remote device in a secure manner.
  • This method is often used to make a remote command line available locally. That is, the output from the remote console is output on a local console and the local keyboard inputs are sent to the remote computer. This can be used for example for
  • Port forwardings to the other computers are taken into account and only then the exposed host, or whether the exposed host makes the port forwardings on other computers ineffective.
  • Dirty DMZ Another possibility of protection can be a "dirty DMZ".
  • the “dirty DMZ” or “dirty riet” is usually the network segment between the two
  • Perimeter router and the firewall of the (internal) LAN From the outside, this zone has only the limited security of the perimeter router. This version of the DMZ hampers the data transfer less because the incoming data only have to be filtered (perimeter router).
  • a “protected DMZ” is a DMZ that is connected to a firewall's own LAN interface. This DMZ has the individual security of the firewall. Many firewalls have multiple LAN interfaces to set up multiple DMZs.
  • DMZ public access to data in an internal area
  • the DMZ separates the public area from the internal area.
  • two methods can be used to make data from the internal area accessible to the public.
  • the data is kept in the DMZ. Access to the data via a corridor into the internal area can also be made possible.
  • a public area for example the Internet
  • the system according to the invention enables secure public access to data in an internal area.
  • the system includes a public area, such as the Internet, and a closed area.
  • the closed area is from one internal area, a DMZ and a data center.
  • the internal area includes a variety of devices.
  • the DMZ has at least one proxy, each with an assigned pool.
  • the data center comprises at least one server, with each of the servers being assigned a hive. Any combination of hive and server can provide a protocol-free connection to the public area and a
  • the internal area of the closed area also provides a protocol-free connection to the DMZ of the closed area.
  • the connections provided can enable an incoming data flow through outgoing connections.
  • the internal area and the devices of the internal area are sources.
  • the data center and the at least one combination of one server each with a hive provided in the data center are designed as a source.
  • the DMZ and the at least one proxy, each with an assigned pool, and the public area are sinks.
  • the sources of the system are connected to the sinks via the connections.
  • the designation as a source does not refer to data, but to the possibility of establishing a connection from the source to a sink. The other direction from the valley to the source is not possible.
  • Computers in the sense of the description can be virtual or physical. Private computers are sources. Private networks are also sources. Private computers are in private networks (internal areas). Public computers (such as servers) are sinks. Public networks are also sinks. Public computers are in public networks. A DMZ is public and therefore a sink. Likewise, the Internet with all of its applications is public and therefore a sink. According to a possible embodiment, the DMZ can be provided with a first firewall and a second firewall. The first firewall is a sink for that
  • the second firewall represents a sink for the connections from the data center.
  • the hives that are assigned to the corresponding servers are each clones from a hive previously installed in the data center.
  • the clone of a hive (computer) can be created by simply copying.
  • the clone of the hives can reconnect to the pool of the proxy because the configuration of the clone of the hives has not been changed by copying.
  • Cloning the hives has the advantage that a "hot update" of the server service and / or the operating system is possible. Cloning and updates can run multiple versions at the same time. It is possible to switch off the "old” versions at any time.
  • each hive has access to the server assigned to it.
  • the at least one server and the hive assigned to it can be installed on two separate computers.
  • software for the corresponding hive must be installed on the separate, separate computer.
  • the hive and the server are connected via the access.
  • the at least one server and the hive assigned to it can be a single computer.
  • the hive and the server are installed as software on the single computer.
  • the internal area can comprise at least one server which represents a sink for the hive.
  • the pool and the proxy of the DMZ as well as the hive of the internal area can comprise a server or a virtual server.
  • the pool of the DMZ sends a request to the hive to occupy at least one of the free corridors. If access to the internal area is permitted, a port connects to at least one server in the internal area.
  • the internal area is a sink.
  • a connection to the DMZ can be established by means of a port through the first firewall via at least one external device in the public area that is a source.
  • the proxy of the DMZ sends a message to the pool through the connection to the DMZ established by the first firewall.
  • the pool initiates a message
  • the hive forwards the at least one request from the public area to the server in the internal area via the port and the connection to the at least one server.
  • the inventive method for public access to data in a closed area is characterized by several steps.
  • a public area is provided that is configured as a sink.
  • a closed area is assigned to the public area.
  • the closed area includes an internal area that is a source.
  • a DMZ is a sink.
  • Data center is a source. Protocol-free connections to the sinks are formed by the sources to access data.
  • the advantage of this method is that the connections to the sinks can only be established from sources and data can be exchanged via the connections, so that external access to data or data theft from the internal area (of the sources) is not possible. Data security is thus increased by the invention.
  • the data center comprises at least one server, with each server being assigned a hive via an access.
  • the data center can thus establish at least one protocol-free connection to the public area and at least one protocol-free connection to at least one proxy of the DMZ.
  • the internal area consists of a variety of devices (such as e.g.
  • the DMZ enables data exchange between the data center and the internal area.
  • a pool is assigned to at least one proxy of the DMZ.
  • the at least one hive connects to the pool and the pool configures the at least one proxy of the DMZ. Only proxies and no data are provided in the DMZ. Since the DMZ is configured as a sink, external access can only take place through an open port of the proxy.
  • the DMZ is closed from the inside (sink). A connection to a source is not possible. A notification is sent when a port of the at least one proxy is dynamically closed or opened.
  • Access by the at least one hive to the respectively assigned server is also monitored. If a service is not available, this access of the corresponding server and / or the dynamically opened port of the at least one proxy is closed if there are no connections.
  • the dynamically created ports of a proxy can be closed automatically if there are no connections for the port of the proxy. This is e.g. the case when the combination of server and hive is "down".
  • a particularly advantageous embodiment of the present invention is when the hives used in the system are the clones of a previous hive. Each of the cloned hives can thus connect itself to the pool of the at least one proxy.
  • the DMZ can also be a single computer, e.g. a calculator from one
  • Figure 1 is a schematic representation of a single-stage firewall concept
  • Figure 2 is a schematic representation of a two-stage firewall concept
  • Figure 3 is a schematic representation of a source in the sense of the invention.
  • Figure 4 is a schematic representation of a sink in the sense of the invention.
  • Figure 5A is a schematic representation of an allowed or possible
  • FIG. 5B shows a schematic illustration of a not permitted or not possible
  • Figure 6 is a schematic view of the connection of two sources
  • FIG. 7 shows a schematic representation of a pool in the sense of the invention.
  • FIG. 8 shows a schematic illustration of a hive in the sense of the invention
  • Figure 9 is a schematic representation of the switching of connections to the
  • FIG. 10 shows a schematic illustration of the assignment of public inquiries according to the invention.
  • FIG 11 is a schematic representation of the system according to the invention.
  • Figure 12 is a schematic illustration of an embodiment of the
  • FIG. 13 shows a schematic illustration of a further embodiment of the system according to the invention.
  • Figure 14 is a schematic representation of the combination of server and hive.
  • FIG. 1 shows the representation of a single-stage firewall concept of the prior art.
  • a demilitarized zone 4 (DMZ) is connected to an intranet 2 (such as LAN) via a firewall 6.
  • the intranet 2 is protected by the firewall 6 against other networks 8, e.g. Internet or LAN, shielded.
  • the separation allows access to publicly accessible services (bastion hosts with e.g. e-mail, www, etc.) and at the same time protects the intranet 2 (internal network) against unauthorized access from the other networks 8.
  • the protective effect of the DMZ 4 is achieved by isolating a system from two or more networks.
  • the DMZ 4 can have three servers or systems, e.g. WWW 1 1, SMTP 12 and DNS 13 include.
  • FIG. 2 shows a schematic illustration of a single-stage firewall concept of the prior art.
  • the DMZ 4 is protected by a first firewall 6 and a second firewall 7.
  • the first firewall 6 separates the DMZ 4 from the external networks 8 or the Internet.
  • the second firewall 7 separates the intranet 2 from the DMZ 4.
  • FIG. 3 shows a schematic illustration of a source 20 in the sense of the invention.
  • a source 20 in the sense of the invention can establish connections 21.
  • the source 20 is shown schematically with a solid line 18 and a dashed line 19.
  • a connection 21 can only be established starting from the source 20. In other words, the connection 21 can only come from the dashed line 19 starting out. An acceptance of connections 21 by the source 20 via the solid line 18 is not possible.
  • Via connection 21 data from a sink 22 (see FIG. 4) of the system according to the invention can be sent to the source 20.
  • FIG. 4 schematically shows a depression 22 as used in the system according to the invention.
  • the sink 22 can accept connections 21. It is not possible to set up connections 21 to other elements of the system.
  • the depression 22 can also be represented schematically with a solid line 18 and a dashed line 19. A connection 21 can only be accepted by the sink 22. As illustrated in FIG. 5, the dashed line 19 surrounds the solid line 18.
  • FIG. 5A illustrates the direction in which the establishment of a connection 21 is possible. It does not matter whether sink 22 or source 20, the connection 21 can only from the
  • FIG. 5B illustrates the direction in which the establishment of a connection 21 is not possible.
  • the solid line 18 does not allow a connection 21 to be established. Consequently, a connection 21 from the solid line 18 via the dashed line 19 is not possible.
  • FIG. 6 shows a schematic view of the connection of two sources 20.
  • Two sources 20 can only connect via a sink 22. It is not possible for two sources 20 or two sinks 22 to connect to one another.
  • One of the sources 20 establishes a connection 21 with the sink 22.
  • the other source 20 establishes a connection 21 with the sink 22. Via the established connections 21, data about the sink 22 can now be transmitted from one source 20 to the other source 20
  • FIG. 7 shows a pool 23 which is used in the system according to the invention.
  • a pool 23 is a sink 22 and can accept, collect and manage at least one connection 21.
  • the number of connections shown is 21 merely by way of example and should not be construed as a limitation of the invention.
  • a hive 24 is shown in FIG.
  • the hive 24 is a source 20 of the system, which can establish at least one connection 21.
  • FIG. 9 shows a pool 23 which accesses the proxy 25 with an internal access 26 in order to enable ports of the proxy 25 for the connections (not shown) from the sources 20.
  • 9 shows the basic structure of a DMZ 4. It goes without saying that a DMZ 4 can comprise more than one proxy 25 with pool 23.
  • the illustration shown here is for the purpose of description and is not to be interpreted as a limitation of the invention.
  • FIG. 10 shows a schematic illustration of a possible embodiment of the system 1 of the invention.
  • the DMZ 4 is a sink 22.
  • the DMZ 4 comprises, as already mentioned, the pool 23 and the proxy 25.
  • the pool 23 collects the connections 21 from the internal area 2 (source 20), e.g. Intranet.
  • the management and assignment of the connections 21 (see FIG. 12) from the public area 8 (public networks, Internet; source 20) are carried out by the proxy 25 of the DMZ 4.
  • FIG. 11 shows a schematic and simplified illustration of the system 1 according to the invention and the interaction of sinks 22 and sources 20.
  • the data 28 arrive via the connection 21 to a sink 22 which the DMZ 4 (sink 22) with the at least one proxy 25.
  • the data 28 from the internal area 2 can be routed to the data center 5 (source 20) by means of the connections 21 established via the DMZ 4, which is also a sink 22.
  • the DMZ 4 manages the inquiries (see FIGS. 12 and 13) from the public area 8 and provides the necessary ones
  • FIG. 12 shows a possible embodiment of the system 1 according to the invention.
  • a source 20 which is an internal area 2 (such as a local area network (LAN) or intranet) and a data center 5, which is also a source 20, is the DMZ 4 is provided, which is a depression 22.
  • a closed area 100 of the system 1 according to the invention comprises the internal area 2 (such as a local area network (LAN) or intranet), which is DMZ 4 and the data center 5.
  • the internal area 2 can comprise a multiplicity of devices 32i, 32 2 ,... 32 N , which are also sources 20.
  • the devices 32i, 32 2 ,... 32 N of the internal area 2 can be, for example, mobile telephones, tablets, laptops, desktop computers, a control computer or a device that requires remote maintenance.
  • 32 2 ?? 32 n that requires remote maintenance can be an X-ray device, for example.
  • Public access is defined as access that does not belong to internal area 2.
  • the firewall setting of the individual devices 32i, 32 2 , ... 32 N is static.
  • the DMZ 4 can comprise at least one proxy 25i, 25 2 , ..., 25 P.
  • the at least one proxy 25i, 25 2 , ..., 25 P can be designed as a server and / or a virtual server.
  • the devices 32i, 32 2 ,... 32 N of the internal area 2 can make the connections 21 to the at least one proxy 25i,
  • the at least one proxy 25i, 25 2 , ..., 25 P is open from the outside and closed from the inside.
  • a pool 23 (not shown here; see FIG. 10) can also be assigned to each of the proxy 25i, 25 2 ,... 25 P.
  • the proxy 25i, 25 2 , ..., 25 P are port proxy.
  • the pools 23 are pool proxies.
  • the data center 5 is a source 20 which comprises at least one server 30i, 30 2 , ..., 30 s , each with an associated hive 24i, 24 2 , ..., 24 s .
  • each server 30i, 30 2 , ..., 30 s of the data center 5 can establish a connection 21 to a public area 8, which is, for example, the Internet build up.
  • the public area 8 (Internet) comprises a large number of applications 40i, 40 2 , ..., 40 k , which the system 1 according to the invention can access.
  • connection from the data center 5 (source 20) to the DMZ 4 is established in such a way that at least one hive 24i, 24 2 , ..., 24 s connects to the pool 23 (pool proxy).
  • the at least one hive 24i, 24 2 , ..., 24 s dynamically configures the at least one proxy 25i, 25 2 , ..., 25 P (port proxy) via the pool 23.
  • pool 23 (pool proxy) and the at least one proxy 25i, 25 2 , ..., 25 P (port proxy).
  • Pool 23 (pool proxy) listens to port 8001, for example.
  • Hive 24i connects to port 8001.
  • Hive 24i opens port 443 on proxy 25i (port proxy).
  • Hive 24i is connected to port 443 on the assigned server 30i . This enables data exchange from port 443 of proxy 25i (port proxy) to port 443 of server 30i.
  • the at least one hive 24i, 24 2 , ..., 24 s and the at least one proxy 25i, 25 2 , ..., 25 P are independent of a protocol, such as http.
  • the configuration of the at least one proxy 25i, 25 2 , ..., 25 P is static.
  • the configuration of the at least one assigned hive 24i, 24 2 , ..., 24 s is semi-static, only the port of the at least one proxy 25i, 25 2 , ..., 25 P (port proxy) and the port of the at least one Servers 30i,
  • Notification There is also a notification when a port is closed for at least one proxy 25i, 25 2 , ..., 25 P.
  • Each hive 24i, 24 2 , ..., 24 s that is assigned to the corresponding server 30i, 30 2 , ..., 30 S of the data center can be monitored via an internal access.
  • the access of the corresponding hives 24i, 24 2 , ..., 24 s to the server 30i, 30 2 , ..., 30 s assigned to it can be closed if the
  • the dynamically configured port of the at least one proxy 25i, 25 2 , ..., 25 P (port proxy) can be automatically closed if the Number of connections of at least one proxy 25i, 25 2 , ..., 25 P (port proxy) is zero. This is the case, for example, if the combination of the at least one server 30i, 30 2 , ..., 30 S with the corresponding hive 24i, 24 2 , ..., 24 s is "down", for example due to a power failure .
  • the public area 8 for example the Internet, comprises a large number of external devices and services (not shown).
  • the public area 8 is a sink 22 and is shielded from the data center 5, which is a source 20, by a firewall 6.
  • the data center 5 builds a connection to a proxy server if there are requests from the internal area 2 (such as an intranet) 40 in the public area 8.
  • the applications 40i, 40 2 , ..., 40 K (devices and / or services) of the public area 8 establish connections 21 to the proxy server 40, which is not public. connect to make inquiries to internal area 2.
  • the corresponding connections 21, the first firewall 6 and the second firewall 7 (see FIG. 13) of the DMZ 4 have to be created by the system 1.
  • FIG. 13 shows a further possible embodiment of the system 1 in FIG.
  • the structure of the embodiment in FIG. 13 differs from the structure already described in FIG. 12 in that a second firewall 7 is provided.
  • the proxy server 40 is thus shielded by the first firewall 6 and the second firewall 7.
  • the configuration corresponds to that of a DMZ 4. All other features of the system 1 according to the invention have already been described in detail in the description of FIG. 12.

Landscapes

  • Engineering & Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Signal Processing (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Computing Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Hardware Design (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

L'invention concerne un système (1) et un procédé d'accès public à des données dans une zone interne (2) qui est protégée contre une entrée non autorisée. Le système (1) comprend une zone fermée (100) qui comporte une zone interne (2), une zone DMZ (4) et un centre de calcul (5). La zone fermée (100) possède une zone interne (2) pourvue d'une pluralité d'unités (321, 322,..., 32N), une zone DMZ (4) comportant au moins un proxy (251, 252,..., 25P) et un pool associé (23) ainsi qu'un centre de calcul (5) comportant au moins un serveur (301, 302,..., 30S). Un Hive (241, 242,..., 24S) est associé à chaque serveur (301, 302,…,30S) du centre de calcul (5), chaque combinaison de Hive (241, 242,..., 24S) et de serveur (301, 302,..., 30S) établissant une liaison sans protocole (21) à la zone publique (8) et une liaison sans protocole (21) à la zone DMZ (4) de la zone fermée (100). La zone interne (2) de la zone fermée (100) établit une liaison sans protocole (21) à la zone DMZ (4) de la zone fermée (100).
PCT/IB2019/057971 2018-09-26 2019-09-20 Système et procédé d'accès à des données dans une zone interne WO2020065476A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
DE102018123692.1A DE102018123692A1 (de) 2018-09-26 2018-09-26 System und Verfahren für einen öffentlichen Zugriff auf Daten in einem internen Bereich
DE102018123692.1 2018-09-26

Publications (1)

Publication Number Publication Date
WO2020065476A1 true WO2020065476A1 (fr) 2020-04-02

Family

ID=68290282

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/IB2019/057971 WO2020065476A1 (fr) 2018-09-26 2019-09-20 Système et procédé d'accès à des données dans une zone interne

Country Status (2)

Country Link
DE (1) DE102018123692A1 (fr)
WO (1) WO2020065476A1 (fr)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2006046973A1 (fr) 2004-10-26 2006-05-04 International Business Machines Corporation Ordinateur et procede permettant de controler l'acces au reseau sur demande
US20060200572A1 (en) * 2005-03-07 2006-09-07 Check Point Software Technologies Ltd. Scan by data direction
EP2031817A1 (fr) 2007-08-30 2009-03-04 Software Ag Systèmes et/ou procédé de passerelle HTTP à flux inversé, et réseau l'utilisant
WO2013036946A1 (fr) 2011-09-09 2013-03-14 Stoneware, Inc. Procede et appareil de partage cle via le protocole secure ou remote desktop
EP3316545A1 (fr) 2016-10-28 2018-05-02 Entit Software LLC Demandes de service d'acheminement depuis des serveurs mandataires sortants vers des serveurs distants à l'intérieur de pare-feu

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2006046973A1 (fr) 2004-10-26 2006-05-04 International Business Machines Corporation Ordinateur et procede permettant de controler l'acces au reseau sur demande
DE112005002614T5 (de) 2004-10-26 2007-09-27 International Business Machines Corp. Computer und Verfahren zur Netzwerkzugriffssteuerung auf Anforderung
US20060200572A1 (en) * 2005-03-07 2006-09-07 Check Point Software Technologies Ltd. Scan by data direction
EP2031817A1 (fr) 2007-08-30 2009-03-04 Software Ag Systèmes et/ou procédé de passerelle HTTP à flux inversé, et réseau l'utilisant
WO2013036946A1 (fr) 2011-09-09 2013-03-14 Stoneware, Inc. Procede et appareil de partage cle via le protocole secure ou remote desktop
DE112012003731T5 (de) 2011-09-09 2014-08-07 Stoneware Inc. Verfahren und Vorrichtung zum Schlüssel-Sharing in Verbindung mit dem Remote Desktop Protocol
EP3316545A1 (fr) 2016-10-28 2018-05-02 Entit Software LLC Demandes de service d'acheminement depuis des serveurs mandataires sortants vers des serveurs distants à l'intérieur de pare-feu

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
JEFFERSON TAN ET AL: "A Virtual Connectivity Layer for Grids", IEEE INTERNATIONAL CONFERENCE ON E-SCIENCE, 9 December 2009 (2009-12-09), pages 307 - 312, XP031610387, ISBN: 978-0-7695-3877-8 *

Also Published As

Publication number Publication date
DE102018123692A1 (de) 2020-03-26

Similar Documents

Publication Publication Date Title
DE102016124383B4 (de) Computersystem-Architektur sowie Computernetz-Infrastruktur, umfassend eine Mehrzahl von solchen Computersystem-Architekturen
DE19740547B4 (de) Vorrichtung und Verfahren zum Sicherstellen sicherer Kommunikation zwischen einer anfordernden Entität und einer bedienenden Entität
DE60212289T2 (de) Verwaltung privater virtueller Netze (VPN)
DE60216218T2 (de) Persönlicher Firewall mit Platzabhängiger Funktionalität
DE60019997T2 (de) Ggesicherte Kommunikation mit mobilen Rechnern
DE60203099T2 (de) Eine Methode, ein Netzwerkszugangsserver, ein Authentifizierungs-, Berechtigungs- und Abrechnungsserver, ein Computerprogram mit Proxyfunktion für Benutzer-Authentifizierung, Berechtigung und Abrechnungsmeldungen über einen Netzwerkszugangsserver
DE10052312A1 (de) Automatische Sperre gegen unberechtigten Zugriff im Internet (Snoop Avoider) für virtuelle private Netze
DE102007025162A1 (de) Alarmgesteuerte Zugriffskontrolle in einem Unternehmensnetz
EP1417820B1 (fr) Procede et systeme informatique permettant la protection de la communication dans des reseaux
DE112004000125T5 (de) Gesichertes Client-Server-Datenübertragungssystem
EP3151503B1 (fr) Procede et systeme d'authentification d'une application web environnante par une application web a inserer
WO2020065476A1 (fr) Système et procédé d'accès à des données dans une zone interne
EP2680497B1 (fr) Accès externe à une unité de commande domestique basée sur IP dans un réseau local
WO2006076752A1 (fr) Systeme de securite informatique
DE60127187T2 (de) System und verfahren zur bereitstellung von diensten in virtuellen privatnetzen
DE60031004T2 (de) Elektronisches sicherheitssystem und verfahren für ein kommunikationsnetz
EP2898635B1 (fr) Système et procédé de maintenance d'une machine-outil
EP2929672B1 (fr) Procédé de travail d'un système ainsi que système
EP2436166B1 (fr) Interface de service
EP1496665B1 (fr) Procédé de configuration de sécurité dans un réseau d'automatisation
DE10234562B4 (de) Sichere Netzwerkarchitektur
DE10138865C2 (de) Verfahren und Computersystem zur Sicherung der Kommunikation in Netzwerken
DE102004025056B4 (de) Verfahren und Vorrichtung zur Gewährleistung eines Zugriffsschutzes in einem Shared-Medium-Netz
DE102005050336B4 (de) Verfahren und Anordnung zum Betreiben eines Sicherheitsgateways
DE60313195T2 (de) Verfahren, system und computerprogrammprodukt zum übertragen eines media-stroms zwischen client-endgeräten

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19790280

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 19790280

Country of ref document: EP

Kind code of ref document: A1