Secure gateway having user identification and password authentication

Claim 2

A computer system for providing access from a client computer over an insecure public network to a destination server on a secure private network, comprising: a firewall system between said insecure network and said secure private network; a proxy server on said insecure network side of said firewall system; an authorization server on said private network side of said firewall system for authenticating a user of said client computer based on a user identification (ID) and password from said user of said client computer; a web server on said insecure network side of said firewall system configured to pass said user ID to said authorization server and to build an authentication cookie when said authorization server authenticates said user of said client computer based on said user ID and password; a gateway on said private network side of said firewall system; and wherein said proxy server is further configured to pass a message from said client computer to said destination server via said gateway when said authentication cookie is valid.

Claim 3

The computer system of claim 1 wherein said proxy server is configured to establish respective, secure connections with said client computer and said gateway, and said web server is configured to establish a respective secure connection with said authorization server.

Claim 4

A computer system for providing access from a client computer over an insecure public network to a destination server on a secure private network executing a corresponding application, said computer system comprising: a firewall system between said insecure network and said secure private network; a proxy server on said insecure network side of said firewall system configured to establish a secure connection over said insecure network with said client computer; an authorization server on said private network side of said firewall system for authenticating a user of said client computer based on a user identification (ID) and password from said user of said client computer; a web server disposed on said insecure network side of said firewall system configured to pass said user ID and password over a secure connection to said authorization server, said web server being further configured to build an authentication cookie when said authorization server authenticates said user of said client computer based on said user ID and password; a gateway disposed between said proxy server and said private network on said private network side of said firewall system; and wherein said proxy server is further configured to pass a message from said client computer to said gateway over a secure connection when said authentication cookie is valid, said gateway being configured to route said message to said destination server.

Claim 5

A computer system for providing access from a client computer over an insecure public network to a destination server on a secure private network executing a corresponding application, said computer system comprising: a firewall system between said insecure network and said secure private network; a proxy server on said insecure network side of said firewall system configured to establish a secure connection over said insecure network with said client computer; an authorization server on said private network side of said firewall system for authenticating a user of said client computer based on a user identification (ID) and password from said user of said client computer; a web server disposed on said insecure network side of said firewall system configured to pass said user ID and password over a secure connection to said authorization server, said web server being further configured to build an authentication cookie when said authorization server authenticates said user of said client computer based on said user ID and password; a gateway disposed between said proxy server and said private network on said private network side of said firewall system; and wherein said proxy server is further configured to pass a message from said client computer to said gateway over a secure connection when said authentication cookie is valid, said gateway being configured to route said message to said destination server.

Claim 6

The computer system of claim 3 wherein said connection to said proxy server through which said user ID and password is received from said client computer is secured using a Secure Sockets Layer (SSL) protocol.

Claim 7

The computer system of claim 3 wherein said authorization server comprises a lightweight directory access protocol (LDAP) capable server.

Claim 8

The computer system of claim 3 wherein said connection between said web server and said authorization server is secured using a Secure Sockets Layer (SSL) protocol, and wherein said web server and said authorization server provide authentication to each other using digital certificates compliant with an industry standard.

Claim 9

The computer system of claim 6 , wherein said industry standard comprises an ITU X.509 standard.

Claim 10

The computer system of claim 3 wherein said connection between said proxy server and said gateway is secured using a Secure Sockets Layer (SSL) protocol, and wherein said proxy server and said gateway provide authentication to each other using digital certificates compliant with an X.509 standard.

Claim 11

The computer system of claim 3 wherein said private network includes a plurality of destination servers each servicing a corresponding application, said proxy server comprising a demilitarized zone (DMZ) proxy server and said web server comprising a DMZ web server, said gateway including a gateway proxy server, said DMZ web server being configured to transmit to said client computer a list of applications for which access by said user of said client computer is authorized according to said response by said authorization server, selection by said user at said client computer of one application from said list being operative to send to said gateway proxy server via said DMZ proxy server a uniform resource locator (URL) comprising a base portion and an identifier appended as a suffix thereto.

Claim 12

The computer system of claim 9 wherein said gateway proxy server is configured to receive said URL, to extract said identifier, and to build a selected-application cookie, said gateway proxy server being further configured to recognize said selected-application cookie and append said identifier to messages from said client computer.

Claim 13

The computer system of claim 10 wherein said gateway proxy server is further configured to route said messages based on said appended identifier.

Claim 16

The method of claim 12 further including the steps of: providing a firewall system between the insecure public network and the secure private network; positioning the proxy server and the web server on the insecure network side of the firewall system; and positioning the authorization server and the gateway server on the private network side of the firewall system.

Claim 17

The method of claim 13 wherein said routing messages step includes the substep of: establishing a third secure connection between the proxy server and the gateway.

Claim 18

The method of claim 14 wherein said steps of establishing a second secure connection and receiving authentication data include communication in accordance with a hypertext transfer protocol secure (HTTPS).

Claim 19

The method of claim 15 wherein said step of routing messages is performed for every message destined for the destination server.