US6081900A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Secure intranet access
Assignee: Micro Focus Software Inc
•
Filing: 1999-03-16
•
Granted: 2000-06-27
•
Expires: 2019-03-16
Abstract
Abstract Methods, signals, devices, and systems are provided for secure access to a network from an external client. Requests for access to confidential data may be redirected from a target server to a border server, after which a secure sockets layer connection between the border server and the external client carries user authentication information. After the user is authenticated to the network, requests may be redirected back to the original target server. Web pages sent from the target server to the external client are scanned for non-secure URLs such as those containing "http://" and modified to make them secure. The target server and the border server utilize various combinations of secure and non-secure caches. Although tunneling may be used, the extensive configuration management burdens imposed by virtual private networks are not required.
Inventors
- 👤 Anand Subramaniam
- 👤 Hashem M. Ebrahimi
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-31 05:17
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; G; G06; G06Q; G06Q20/00; G06Q20/38; G06Q20/382; H04L63/08; H04L63/0807; H04L63/16; H04L63/162
Claims Analysis
Total Claims: 33
Claim 1
Independent Claim
157 words
A distributed computing system allowing secure external access to a secure network, the system comprising: a target server within the secure network; a border server within the secure network, the border server connectable to the target server by a first communications link; a client outside the secure network, the client connectable to the border server by a second communications link, the client and the border server configured to support secure sockets layer communication over the second communications link; a user authentication system located at least partially within the secure network, the secure network configured to allow direct access to the target server by a user only after the user is authenticated by the user authentication system; and a uniform resource locator transformer which modifies non-secure uniform resource locators in data being sent from the target server to the client by replacing them with corresponding secure uniform resource locators to promote continued use of secure sockets layer communication.
Claim 2
Dependent Claim
157 words
A distributed computing system allowing secure external access to a secure network, the system comprising: a target server within the secure network; a border server within the secure network, the border server connectable to the target server by a first communications link; a client outside the secure network, the client connectable to the border server by a second communications link, the client and the border server configured to support secure sockets layer communication over the second communications link; a user authentication system located at least partially within the secure network, the secure network configured to allow direct access to the target server by a user only after the user is authenticated by the user authentication system; and a uniform resource locator transformer which modifies non-secure uniform resource locators in data being sent from the target server to the client by replacing them with corresponding secure uniform resource locators to promote continued use of secure sockets layer communication.
Claim 3
Dependent Claim
17 words
The system of claim 1, wherein the uniform resource locator transformer is located on the border server.
Claim 4
Dependent Claim
37 words
The system of claim 1, wherein the uniform resource locator transformer is located on the target server and the system further comprises tunneling software for tunneling between the client and the target server through the border server.
Claim 5
Dependent Claim
41 words
The system of claim 1, wherein the secure network is configured to allow direct access to the target server from network addresses within the secure network while denying direct access to the target server from network addresses outside the secure network.
Claim 6
Dependent Claim
13 words
The system of claim 1, wherein the secure network includes a secured intranet.
Claim 7
Dependent Claim
12 words
The system of claim 1, wherein the client is a multi-user client.
Claim 8
Dependent Claim
16 words
The system of claim 6, wherein at least two user workstations are connected to the client.
Claim 9
Dependent Claim
15 words
The system of claim 1, wherein the user authentication system includes a directory services database.
Claim 10
Dependent Claim
14 words
The system of claim 1, wherein the user authentication system includes a domain directory.
Claim 11
Dependent Claim
32 words
The system of claim 1, wherein the user authentication system authenticates the user to all servers in the secure network after recognizing a single user name and a single corresponding user password.
Claim 12
Dependent Claim
28 words
The system of claim 1, further comprising a redirector for redirecting to the border server a request made by the client for direct access to the target server.
Claim 13
Dependent Claim
14 words
The system of claim 1, wherein the border server includes at least one cache.
Claim 14
Dependent Claim
49 words
The system of claim 12, wherein the border server cache includes data from the target server which contains non-secure uniform resource locators, and the uniform resource locator transformer introduces secure uniform resource locators on the fly without requiring that the transformed data also be cached on the border server.
Claim 15
Dependent Claim
53 words
The system of claim 12, wherein the border server cache includes a non-secure data cache for internal clients and a secure data cache for external clients, the non-secure data cache holding data that contains non-secure uniform resource locators, and the secure data cache holding data that does not contain non-secure uniform resource locators.
Claim 16
Dependent Claim
20 words
The system of claim 12, wherein the border server cache is free of data that contains non-secure uniform resource locators.
Claim 17
Independent Claim
125 words
A method for providing access to a secure network, the method comprising the steps of: receiving a request for access to a target server which is within the secure network, the access request having been made by a user outside the secure network; forming a secure sockets layer connection between the user and a border server which is within the secure network; using the secure sockets layer connection and a user authentication system of the secure network to authenticate the user to the secure network; modifying data by replacing non-secure uniform resource locators in the data with corresponding secure uniform resource locators which promote continued use of secure sockets layer communication; and transmitting the modified data to the user over a secure sockets layer connection.
Claim 18
Independent Claim
125 words
A method for providing access to a secure network, the method comprising the steps of: receiving a request for access to a target server which is within the secure network, the access request having been made by a user outside the secure network; forming a secure sockets layer connection between the user and a border server which is within the secure network; using the secure sockets layer connection and a user authentication system of the secure network to authenticate the user to the secure network; modifying data by replacing non-secure uniform resource locators in the data with corresponding secure uniform resource locators which promote continued use of secure sockets layer communication; and transmitting the modified data to the user over a secure sockets layer connection.
Claim 19
Dependent Claim
45 words
The method of claim 16, wherein the modifying step is preceded by the step of transmitting the data to be modified from the target server to the border server in response to the access request, and the modifying step is performed at the border server.
Claim 20
Dependent Claim
16 words
The method of claim 17, further comprising the step of caching data on the border server.
Claim 21
Dependent Claim
38 words
The method of claim 16, wherein the modifying step is performed at the target server, and the transmitting step transmits the modified data to the user over a secure sockets layer connection which tunnels through the border server.
Claim 22
Dependent Claim
37 words
The method of claim 16, wherein the receiving step includes receiving the access request at the target server and the method further comprises the step of redirecting the request to the border server before the forming step.
Claim 23
Dependent Claim
42 words
The method of claim 16, wherein the forming step includes storing an IP address which indicates the current location of the user, and the step of transmitting the modified data to the user transmits the data only to that same IP address.
Claim 24
Dependent Claim
13 words
The method of claim 16, wherein the forming step forms an SSL connection.
Claim 25
Dependent Claim
21 words
The method of claim 16, wherein the using step includes obtaining from the user a user name and a user password.
Claim 26
Dependent Claim
28 words
The method of claim 16, wherein the step of modifying the data includes replacing the string "http" with the string "https" in at least one uniform resource locator.
Claim 27
Dependent Claim
175 words
A computer storage medium having a configuration that represents data and instructions which will cause performance of method steps for providing access to a secure network, the method comprising the steps of: receiving at a target server which is within the secure network a request for access to the target server, the access request having been made by a user outside the secure network; redirecting the request to a border server which is within the secure network; forming a secure connection between the user and the border server, the secure connection utilizing at least a transport layer protocol and lower level protocols, security in the connection being provided at least by encryption performed above the transport layer protocol; using the secure connection and a user authentication system of the secure network to authenticate the user to the secure network; modifying data by replacing non-secure uniform resource locators in the data with corresponding secure uniform resource locators which promote continued use of secure communication; and transmitting the modified data to the user over a secure connection.
Claim 28
Dependent Claim
175 words
A computer storage medium having a configuration that represents data and instructions which will cause performance of method steps for providing access to a secure network, the method comprising the steps of: receiving at a target server which is within the secure network a request for access to the target server, the access request having been made by a user outside the secure network; redirecting the request to a border server which is within the secure network; forming a secure connection between the user and the border server, the secure connection utilizing at least a transport layer protocol and lower level protocols, security in the connection being provided at least by encryption performed above the transport layer protocol; using the secure connection and a user authentication system of the secure network to authenticate the user to the secure network; modifying data by replacing non-secure uniform resource locators in the data with corresponding secure uniform resource locators which promote continued use of secure communication; and transmitting the modified data to the user over a secure connection.
Claim 29
Dependent Claim
51 words
The configured storage medium of claim 25, wherein the forming step includes storing an IP address and a session identifier which collectively indicate the current location of the user, and the step of transmitting the modified data to the user transmits the data only to that same IP address and session.
Claim 30
Dependent Claim
24 words
The configured storage medium of claim 25, wherein the using step includes obtaining from the user a user name and password for network-wide authentication.
Claim 31
Dependent Claim
47 words
The configured storage medium of claim 25, wherein the modifying step is preceded by the step of transmitting the data to be modified from the target server to the border server in response to the access request, and the modifying step is performed at the border server.
Claim 32
Dependent Claim
21 words
The configured storage medium of claim 28, wherein the method further comprises the step of caching data on the border server.
Claim 33
Dependent Claim
40 words
The configured storage medium of claim 25, wherein the modifying step is performed at the target server, and the transmitting step transmits the modified data to the user over a secure sockets layer connection which tunnels through the border server.
References Cited (Backward Citations)
US5522041A
Cited
US5553239A
Cited
US5550984A
Cited
US5706434A
Cited
US5752022A
Cited
US5745360A
Cited
US5825890A
Cited
US5757924A
Cited
US5761683A
Cited
US5673322A
Cited
US5768271A
Cited
US5727145A
Cited
US5890171A
Cited
US5913025A
Cited
US5805803A
Cited
US5991810A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2003-06-27 | 2003-12-27 | 2004-06-27 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2007-06-27 | 2007-12-27 | 2008-06-27 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2011-06-27 | 2011-12-27 | 2012-06-27 | $7700.00 | Window Closed / Lapsed |