Applet redirection for controlled access to non-orginating hosts

Claim 5

The method as claimed in claim 2, wherein said applets are Java applets, and wherein operation of a Java sandbox security restriction enforces said inherent prohibition.

Claim 6

The method as claimed in claim 2 or 3, wherein: said filter table comprises a plurality of entries, each of said entries comprising: an address of a particular one of said servers other than said first server, and a range of client machine addresses which are authorized to access said particular one; and said checking step further comprises the steps of: extracting a client address from said connect request; locating a particular entry in said table, wherein said address in said particular entry matches said server host address from said connect request; and comparing said extracted client address to said range of addresses from said located entry.

Claim 7

The method as claimed in claim 2, further comprising: executing an add-on function on said first server; and performing further processing of exchanged messages using said add-on function.

Claim 8

The method as claimed in claim 5, wherein said add-on function is a cryptography function for providing secure data transmission between said client machine and said first server, and wherein said performing further processing step further comprises the steps of receiving encrypted data from said applet by said redirector function over said first connection; forwarding said encrypted data from said redirector function to said add-on function; decrypting said encrypted data using said add-on function; returning said decrypted data from said add-on function to said redirector function; forwarding said decrypted data from said redirector function to said selected server over said second connection; receiving unencrypted data from said selected server by said redirector function over said second connection; forwarding said unencrypted data from said redirector function to said add-on function; encrypting said unencrypted data using said add-on function; returning said encrypted data from said add-on function to said redirector function; and forwarding said encrypted data from said redirector function to said applet.

Claim 11

The method as claimed in claim 7, wherein said applets are Java applets, and wherein operation of a Java sandbox security restriction enforces said inherent prohibition.

Claim 12

The method as claimed in claim 7 or 8, wherein: said filter table comprises a plurality of entries, each of said entries comprising: an address of a particular one of said servers other than said first server, and a range of client machine addresses which are authorized to access said particular one; and said checking step further comprises the steps of: extracting a client address from said connect request; and locating a particular entry in said table, wherein said address in said particular entry matches said extracted client address.

Claim 15

The system as claimed in claim 10, wherein said applets are Java applets, and wherein operation of a Java sandbox security restriction enforces said inherent prohibition.

Claim 16

The system as claimed in claim 10 or 11, wherein: said filter table comprises a plurality of entries, each of said entries comprising: an address of a particular one of said servers other than said first server, and a range of client machine addresses which are authorized to access said particular one; and said means for checking further comprises: means for extracting a client address from said connect request; means for locating a particular entry in said table, wherein said address in said particular entry matches said server host address from said connect request; and means for comparing said extracted client address to said range of addresses from said located entry.

Claim 17

The system as claimed in claim 10, further comprising: means for executing an add-on function on said first server; and means for performing further processing of exchanged messages using said add-on function.

Claim 18

The system as claimed in claim 13, wherein said add-on function is a cryptography function for providing secure data transmission between said client machine and said first server, and wherein said means for performing further processing further comprises: means for receiving encrypted data from said applet by said redirector function over said first connection; means for forwarding said encrypted data from said redirector function to said add-on function; means for decrypting said encrypted data using said add-on function; means for returning said decrypted data from said add-on function to said redirector function; means for forwarding said decrypted data from said redirector function to said selected server over said second connection; means for receiving unencrypted data from said selected server by said redirector function over said second connection; means for forwarding said unencrypted data from said redirector function to said add-on function; means for encrypting said unencrypted data using said add-on function; means for returning said encrypted data from said add-on function to said redirector function; and means for forwarding said encrypted data from said redirector function to said applet.

Claim 21

The system as claimed in claim 15, wherein said applets are Java applets, and wherein operation of a Java sandbox security restriction enforces said inherent prohibition.

Claim 22

The system as claimed in claim 15 or 16, wherein: said filter table comprises a plurality of entries, each of said entries comprising: an address of a particular one of said servers other than said first server, and a range of client machine addresses which are authorized to access said particular one; and said means for checking further comprises: means for extracting a client address from said connect request; and means for locating a particular entry in said table, wherein said address in said particular entry matches said extracted client address.

Claim 23

A computer program product on a computer-readable medium in a computer network for enabling applets to communicate with a different server than a first server from which said applet was downloaded, comprising: one or more applets, each of said applets stored on a first server, wherein said applets have an inherent prohibition against directly exchanging messages with any other server except said first server; one or more target resources, each of said target resources being accessible from a server other than said first server; a client machine, onto which a selected one of said applets is downloaded; computer-readable program code means for executing said downloaded selected applet on said client machine; computer-readable program code means for executing a redirector function on said first server; computer-readable program code means for establishing a first connection between said selected applet and said redirector function; computer-readable program code means for sending a connect request from said applet to said redirector function, wherein said connect request specifies (i) a server host address of a selected one of said servers other than said first server and (ii) a port number on said selected server; computer-readable program code means for receiving, by said redirector function, said connect request; computer-readable program code means for checking a filter table, responsive to said computer-readable program code means for receiving, to determine if said client machine is authorized to access said selected server; computer-readable program code means for establishing, by said redirector function, a second connection between said redirector function and said selected server when said computer-readable program code means for checking has a positive result, said second connection being on behalf of said applet; and computer-readable program code means for indirectly exchanging messages between said applet and said selected server using said redirector function to transfer said exchanged messages between said first connection and said second connection.

Claim 24

A computer program product on a computer-readable medium in a computer network for enabling applets to communicate with a different server than a first server from which said applet was downloaded, comprising: one or more applets, each of said applets stored on a first server, wherein said applets have an inherent prohibition against directly exchanging messages with any other server except said first server; one or more target resources, each of said target resources being accessible from a server other than said first server; a client machine, onto which a selected one of said applets is downloaded; computer-readable program code means for executing said downloaded selected applet on said client machine; computer-readable program code means for executing a redirector function on said first server; computer-readable program code means for establishing a first connection between said selected applet and said redirector function; computer-readable program code means for sending a connect request from said applet to said redirector function, wherein said connect request specifies (i) a server host address of a selected one of said servers other than said first server and (ii) a port number on said selected server; computer-readable program code means for receiving, by said redirector function, said connect request; computer-readable program code means for checking a filter table, responsive to said computer-readable program code means for receiving, to determine if said client machine is authorized to access said selected server; computer-readable program code means for establishing, by said redirector function, a second connection between said redirector function and said selected server when said computer-readable program code means for checking has a positive result, said second connection being on behalf of said applet; and computer-readable program code means for indirectly exchanging messages between said applet and said selected server using said redirector function to transfer said exchanged messages between said first connection and said second connection.

Claim 25

The computer program product as claimed in claim 18, wherein said applets are Java applets, and wherein operation of a Java sandbox security restriction enforces said inherent prohibition.

Claim 26

The computer program product as claimed in claim 19 or 18, wherein: said filter table comprises a plurality of entries, each of said entries comprising: an address of a particular one of said servers other than said first server, and a range of client machine addresses which are authorized to access said particular one; and said computer-readable program code means for checking further comprises: computer-readable program code means for extracting a client address from said connect request; computer-readable program code means for locating a particular entry in said table, wherein said address in said particular entry matches said server host address from said connect request; and computer-readable program code means for comparing said extracted client address to said range of addresses from said located entry.

Claim 27

The computer program product as claimed in claim 18, further comprising: computer-readable program code means for executing an add-on function on said first server; and computer-readable program code means for performing further processing of exchanged messages using said add-on function.

Claim 28

The computer program product as claimed in claim 21, wherein said add-on function is a cryptography function for providing secure data transmission between said client machine and said first server, and wherein said computer-readable program code means for performing further processing further comprises: computer-readable program code means for receiving encrypted data from said applet by said redirector function over said first connection; computer-readable program code means for forwarding said encrypted data from said redirector function to said add-on function; computer-readable program code means for decrypting said encrypted data using said add-on function; computer-readable program code means for returning said decrypted data from said add-on function to said redirector function; computer-readable program code means for forwarding said decrypted data from said redirector function to said selected server over said second connection; computer-readable program code means for receiving unencrypted data from said selected server by said redirector function over said second connection; computer-readable program code means for forwarding said unencrypted data from said redirector function to said add-on function; computer-readable program code means for encrypting said unencrypted data using said add-on function; computer-readable program code means for returning said encrypted data from said add-on function to said redirector function; and computer-readable program code means for forwarding said encrypted data from said redirector function to said applet.

Claim 29

A computer program product on a computer-readable medium in a computer network for enabling applets to communicate with a different server than a first server from which said applet was downloaded, comprising: one or more applets, each of said applets stored on a first server, wherein said applets have an inherent prohibition against directly exchanging messages with any other server except said first server; one or more target resources, each of said target resources being accessible from a server other than said first server; a client machine, onto which a selected one of said applets is downloaded; computer-readable program code means for executing said downloaded selected applet on said client machine; computer-readable program code means for executing a redirector function on said first server; computer-readable program code means for establishing a first connection between said selected applet and said redirector function; computer-readable program code means for sending a connect request from said applet to said redirector function, wherein said connect request does not specify a server host address of a target server; computer-readable program code means for receiving, by said redirector function, said connect request; computer-readable program code means for checking a filter table, responsive to said computer-readable program code means for receiving, to determine a default target server to be used with said client machine; computer-readable program code means for establishing, by said redirector function, a second connection between said redirector function and said default target server on behalf of said applet; and computer-readable program code means for indirectly exchanging messages between said applet and said default target server using said redirector function to transfer said exchanged messages between said first connection and said second connection.

Claim 30

A computer program product on a computer-readable medium in a computer network for enabling applets to communicate with a different server than a first server from which said applet was downloaded, comprising: one or more applets, each of said applets stored on a first server, wherein said applets have an inherent prohibition against directly exchanging messages with any other server except said first server; one or more target resources, each of said target resources being accessible from a server other than said first server; a client machine, onto which a selected one of said applets is downloaded; computer-readable program code means for executing said downloaded selected applet on said client machine; computer-readable program code means for executing a redirector function on said first server; computer-readable program code means for establishing a first connection between said selected applet and said redirector function; computer-readable program code means for sending a connect request from said applet to said redirector function, wherein said connect request does not specify a server host address of a target server; computer-readable program code means for receiving, by said redirector function, said connect request; computer-readable program code means for checking a filter table, responsive to said computer-readable program code means for receiving, to determine a default target server to be used with said client machine; computer-readable program code means for establishing, by said redirector function, a second connection between said redirector function and said default target server on behalf of said applet; and computer-readable program code means for indirectly exchanging messages between said applet and said default target server using said redirector function to transfer said exchanged messages between said first connection and said second connection.

Claim 31

The computer program product as claimed in claim 23, wherein said applets are Java applets, and wherein operation of a Java sandbox security restriction enforces said inherent prohibition.

Claim 32

The computer program product as claimed in claim 23 or 24, wherein: said filter table comprises a plurality of entries, each of said entries comprising: an address of a particular one of said servers other than said first server, and a range of client machine addresses which are authorized to access said particular one; and said computer-readable program code means for checking further comprises: computer-readable program code means for extracting a client address from said connect request; and computer-readable program code means for locating a particular entry in said table, wherein said address in said particular entry matches said extracted client address.