US6510464B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Secure gateway having routing feature
Assignee: Intellectual Ventures II LLC
•
Filing: 1999-12-23
•
Granted: 2003-01-21
•
Expires: 2019-12-23
Abstract
Abstract A computer system provides authenticated access for a client computer over an insecure, public network to one of a plurality of destination servers on private, secure network, through the use of a client-side X.509 digital certificate. A firewall is disposed between the insecure, public network and the private network. A demilitarized zone (DMZ) proxy server intercepts messages destined for the destination servers, and forwards the intercepted messages through the firewall to a gateway on the private network. The gateway is configured to create a cookie, based on the selection of one of a several applications available on the private network. The cookie contains an identifier sufficient to identify the destination server corresponding to the selected application. Messages from the client computer include the cookie. The gateway processes the cookie and appends the identifier on a destination URL portion of the messages for routing. An alternate computer system authenticates a user of a remote client computer on the insecure network side of the firewall using a user identification and password.
Inventors
- 👤 David R. Grantges, Jr.
- 👤 Lawrence R. McGrath
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-04 15:07
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; H04L63/0281; H04L61/00; H04L61/30; H04L67/00; H04L67/01; H04L67/02; H04L67/50; H04L67/60; H04L67/63; H04L2101/00; H04L2101/30; H04L2101/33; H04L63/04; H04L63/0428; H04L63/08; H04L63/0823
Claims Analysis
Total Claims: 21
Claim 1
Independent Claim
127 words
A computer system for providing access from a client computer over an insecure public network to a selected one of a plurality of destination servers on a secure private network each executing a corresponding application, said computer system comprising: a proxy server configured to establish a secure connection with said client computer over said insecure network; and, a gateway disposed between said proxy server and said private network, wherein said gateway includes means for appending, prior to routing, an identifier to a message received from said client computer destined for said selected destination server, said identifier being associated with a respective application with which said selected destination server is associated, and means for routing said message to said selected destination server as a function of said identifier.
Claim 2
Dependent Claim
127 words
A computer system for providing access from a client computer over an insecure public network to a selected one of a plurality of destination servers on a secure private network each executing a corresponding application, said computer system comprising: a proxy server configured to establish a secure connection with said client computer over said insecure network; and, a gateway disposed between said proxy server and said private network, wherein said gateway includes means for appending, prior to routing, an identifier to a message received from said client computer destined for said selected destination server, said identifier being associated with a respective application with which said selected destination server is associated, and means for routing said message to said selected destination server as a function of said identifier.
Claim 3
Dependent Claim
13 words
The computer system of claim 1 wherein said identifier comprises a character string.
Claim 4
Dependent Claim
28 words
The computer system of claim 2 said message comprises a hypertext transfer protocol (HTTP) uniform resource locator (URL), said identifier being appended to said message as a suffix.
Claim 5
Dependent Claim
15 words
The computer system of claim 3 wherein said identifier further comprises a slash character prefix.
Claim 6
Dependent Claim
79 words
The computer system of claim 1 further comprising: a firewall system between said insecure network and said private network; and, an authorization server for authenticating a user of said client system and indicating whether said user is authorized to access said selected destination server; said proxy server being disposed on said insecure network side of said firewall system, and said gateway, said authorization server and said destination servers are disposed on said private network side of said firewall system.
Claim 7
Dependent Claim
39 words
The computer system of claim 1 wherein said client computer has a digital certificate compliant with an X.509 standard associated therewith, said proxy server being configured to determine whether said digital certificate was issued from a valid certificate authority.
Claim 8
Dependent Claim
33 words
The computer system of claim 6 wherein said proxy server is further configured to insert said digital certificate into a hypertext transfer protocol (HTTP) header, and to transmit said header to said gateway.
Claim 9
Dependent Claim
33 words
The computer system of claim 7 wherein said gateway is configured to extract said digital certificate from said HTTP, and to authenticate said user using said extracted digital certificate with said authorization server.
Claim 10
Dependent Claim
19 words
The computer system of claim 8 wherein said authorization server comprises a lightweight directory access protocol (LDAP) capable server.
Claim 11
Dependent Claim
66 words
The computer system of claim 1 wherein said proxy server comprises a demilitarized zone (DMZ) proxy server, and said gateway includes a gateway proxy server and a gateway web server, said gateway web server being configured to transmit to said client computer a list including a plurality of applications executing on said destination servers for which access by a user of said client computer is authorized.
Claim 12
Dependent Claim
55 words
The computer system of claim 10 wherein selection at said client computer of one application from said list defines said selected destination server, said selection being further operative to send a uniform resource locator (URL) to said gateway proxy server, said URL comprising a domain name portion and said identifier appended as a suffix thereto.
Claim 13
Dependent Claim
25 words
The computer system of claim 11 wherein said gateway proxy server is configured to receive said URL, extract said identifier, and build a selected-application cookie.
Claim 14
Dependent Claim
38 words
The computer system of claim 12 wherein said appending means of said gateway comprises a plug-in associated with said gateway proxy server configured to recognize said selected-application cookie, and in response thereto, append said identifier to said message.
Claim 15
Dependent Claim
186 words
A computer system for providing access from a client computer over an insecure public network to a selected one of a plurality of destination servers on a secure private network each executing a corresponding application, said computer system comprising: a firewall system between said insecure network and said secure private network; a proxy server disposed on said insecure network side of said firewall system, said proxy server being configured to establish a secure connection over said insecure network to said client computer; a gateway disposed between said proxy server and said private network on said private network side of said firewall system; an authorization server for authenticating a user of said client system, and indicating whether said user is authorized to access said selected destination server; and, wherein said gateway includes means for appending, prior to routing, an identifier to a message received from said client computer destined for said selected destination server said identifier being associated with a respective application with which said selected destination server is associated and means for routing said message to said selected destination server as a function of said identifier.
Claim 16
Dependent Claim
186 words
A computer system for providing access from a client computer over an insecure public network to a selected one of a plurality of destination servers on a secure private network each executing a corresponding application, said computer system comprising: a firewall system between said insecure network and said secure private network; a proxy server disposed on said insecure network side of said firewall system, said proxy server being configured to establish a secure connection over said insecure network to said client computer; a gateway disposed between said proxy server and said private network on said private network side of said firewall system; an authorization server for authenticating a user of said client system, and indicating whether said user is authorized to access said selected destination server; and, wherein said gateway includes means for appending, prior to routing, an identifier to a message received from said client computer destined for said selected destination server said identifier being associated with a respective application with which said selected destination server is associated and means for routing said message to said selected destination server as a function of said identifier.
Claim 17
Dependent Claim
103 words
The computer system of claim 14 wherein said proxy server comprises a demilitarized zone (DMZ) proxy server, and said gateway includes a gateway proxy server and a gateway web server configured to transmit to said client computer a list including a plurality of applications executing on said destination servers for which access by said user is authorized, selection at said client computer of one application from said list being operative to (i) define said selected destination server and (ii) send to said gateway proxy server a uniform resource locator (URL) comprising a domain name portion and said identifier appended as a suffix thereto.
Claim 18
Dependent Claim
66 words
The computer system of claim 15 wherein said gateway proxy server is configured to receive said URL, to extract said identifier, and to build a selected-application cookie for transmission to said client computer, and wherein said appending means of said gateway comprises a plug-in associated with said gateway proxy server configured to recognize said selected-application cookie, and in response thereto, append said identifier to said message.
Claim 19
Independent Claim
149 words
A method for providing access from a client computer over an insecure public network to one of a plurality of destination servers on a secure private network each executing a corresponding application, said method comprising the steps of: (A) determining one or more applications from the plurality of applications executing on the destination servers for which access by a user of the client computer is authorized; (B) associating a uniform resource locator (URL) having an identifier appended thereto with each determined application; (C) building an application cookie using the identifier portion of the URL corresponding to a selected one of the applications determined in step (A); (D) appending the identifier to a message from the client computer destined for the destination server using the application cookie; and, (E) routing the message to one of the plurality of destination servers executing the selected application as function of the appended identifier.
Claim 20
Independent Claim
149 words
A method for providing access from a client computer over an insecure public network to one of a plurality of destination servers on a secure private network each executing a corresponding application, said method comprising the steps of: (A) determining one or more applications from the plurality of applications executing on the destination servers for which access by a user of the client computer is authorized; (B) associating a uniform resource locator (URL) having an identifier appended thereto with each determined application; (C) building an application cookie using the identifier portion of the URL corresponding to a selected one of the applications determined in step (A); (D) appending the identifier to a message from the client computer destined for the destination server using the application cookie; and, (E) routing the message to one of the plurality of destination servers executing the selected application as function of the appended identifier.
Claim 21
Dependent Claim
16 words
The method of claim 17 wherein said identifier comprises a character string appended as a suffix.
References Cited (Backward Citations)
US5826014A
Cited
US5872915A
Cited
US6144990A
Cited
US5923756A
Cited
US6167522A
Cited
US5805803A
Cited
US5991810A
Cited
US6357010B1
Cited
US6182142B1
Cited
US6088796A
Cited
US6205480B1
Cited
US6324648B1
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2006-01-20 | 2006-07-22 | 2007-01-21 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2010-01-20 | 2010-07-22 | 2011-01-21 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2014-01-20 | 2014-07-22 | 2015-01-21 | $7700.00 | Window Closed / Lapsed |