On-premises agent for mobile cloud service

• US 10,193,877 B2
• Filed: 09/18/2017
• Issued: 01/29/2019
• Est. Priority Date: 02/07/2014
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Chizhov, Vladimir Yurievich, Mokeev, Aleksei Vasilievich, van de Loo, Kaj
• Primary Examiner(s): Truong, Thanhnga B
• Application Number:
  US15/708,005
• Publication Number:
  US 20180007027A1
• Time in Patent Office: 498 Days
• Field of Search: 726 12, 726 14, 709228, 709227, 709219, 709237, 709232
• CPC Class Codes: G06F 21/6236 between heterogeneous systems
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 41/0226 Mapping or translating multiple network management protocols
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/565 Conversion or adaptation of application format or content adding application control or application functional data H04L67/561
• CPC Class Codes: H04L 69/08 Protocols for interworking; Protocol conversion
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 12/30 : Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/63 : Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 4/18 : Information format or content conversion, e.g. adaptation by the network of the transmitted or received information for the purpose of wireless delivery to users or terminals

Abstract

Systems, devices, and methods are disclosed for an agent device within a company'"'"'s network firewall to initiate an HTTP connection with a cloud-based gateway and then upgrade the connection to a WebSockets protocol in order to have an interactive session. Over this interactive session, a mobile device, which connects to the cloud-based intermediary, can request data from servers inside the company'"'"'s firewalls. Because the firewall is traversed using HTTP protocols (with WebSockets), it can be as safe as letting employees browse the web from inside the company'"'"'s network.

Claims

1. A method comprising:

receiving, by an application executing on a computer system connected to a network behind a firewall, from a first server computer executing outside the firewall over a connection according to a WebSocket protocol, a first request for data stored on a second server computer behind the firewall on the network, the first request comprising a request uniform resource locator (URL), a request header, and a request body, wherein the first request has a first format compliant for the connection according to the WebSocket protocol;

translating, by the application, the first request received from the first server computer into a second request having a second format according to a hypertext transport protocol (HTTP) for communication with the second server computer on the network, wherein;

translating comprises converting the first format of the first request to the second format of the second request for communication with the second server computer,

converting the first format comprises converting the request URL into a converted request URL, and

the second request comprises the request header, the request body, and the converted request URL;

receiving, by the application, from the second server computer, a first response to the second request sent by the application to the second server computer, wherein the first response has the first format;

based on converting the first response from the second format to the first format, creating, by the application, a second response having the first format; and

sending, by the application, the second response over the connection to the first server computer.

2. The method of claim 1, further comprising:

initiating a hypertext transport protocol (HTTP) connection with the first server computer; and

responsive to initiating the HTTP connection, upgrading the HTTP connection to the connection.

3. The method of claim 1, wherein second server computer is a local web server computer.

4. The method of claim 1, wherein the first response includes a response header and a response body, wherein neither of the response header and the response body are converted for the first response from the second format to the first format, and wherein the second response includes the response header and the response body.

5. The method of claim 1, further comprising:

sending, by the application, the second request to the second server computer.

6. The method of claim 1, further comprising

receiving, at the first server computer, a third request from a mobile device;

reformatting, at the first server computer, the third request from the mobile device into the first request for data over the connection;

receiving, at the first server computer, the second response from the application;

creating, at the first server computer, a third response based on the second response from the application; and

sending the third response to the mobile device.

7. A system comprising:

one or more processors; and

a memory accessible to the one or more processors, the memory storing instructions which, upon execution by the one or more processors, cause the one or more processors to;

receive, by an application executing on the system connected to a network behind a firewall, from a first server computer executing outside the firewall over a connection according to a WebSocket protocol, a first request for data stored on a second server computer behind the firewall on the network, the first request comprising a request uniform resource locator (URL), a request header, and a request body, wherein the first request has a first format compliant for the connection according to the WebSocket protocol;

translate, by the application, the first request received from the first server computer into a second request having a second format according to a hypertext transport protocol (HTTP) for communication with the second server computer on the network, wherein;

translating comprises converting the first format of the first request to the second format of the second request for communication with the second server computer,

converting the first format comprises converting the request URL into a converted request URL, and

the second request comprises the request header, the request body, and the converted request URL;

receive, by the application, from the second server computer, a first response to the second request sent by the application to the second server computer, wherein the first response has the first format;

based on converting the first response from the second format to the first format create, by the application, a second response having the first format; and

send, by the application, the second response over the connection to the first server computer.

8. The system of claim 7, wherein the instructions which, upon execution by the one or more processors, further cause the one or more processors to:

initiate a hypertext transport protocol (HTTP) connection with the first server computer; and

responsive to initiating the HTTP connection, upgrade the HTTP connection to the connection.

9. The system of claim 7, wherein second server computer is a local web server computer.

10. The system of claim 7, wherein the first response includes a response header and a response body, wherein neither of the response header and the response body are converted for the first response from the second format to the first format, and wherein the second response includes the response header and the response body.

11. The system of claim 7, wherein the instructions which, upon execution by the one or more processors, further cause the one or more processors to:

send, by the application, the second request to the second server computer.

12. The system of claim 7, wherein the instructions which, upon execution by the one or more processors, further cause the one or more processors to:

receiving, at the first server computer, a third request from a mobile device;

reformatting, at the first server computer, the third request from the mobile device into the first request for data over the connection;

receiving, at the first server computer, the second response from the application;

creating, at the first server computer, a third response based on the second response from the application; and

sending the third response to the mobile device.

13. A non-transitory machine readable medium storing instructions that are executable by one or more processors to cause the one or more processors to:

receive, by an application executing on a computer system connected to a network behind a firewall, from a first server computer executing outside the firewall over a connection according to a WebSocket protocol, a first request for data stored on a second server computer behind the firewall on the network, the first request comprising a request uniform resource locator (URL), a request header, and a request body, wherein the first request has a first format compliant for the connection according to the WebSocket protocol;

translate, by the application, the first request received from the first server computer into a second request having a second format according to a hypertext transport protocol (HTTP) for communication with the second server computer on the network, wherein;

translating comprises converting the first format of the first request to the second format of the second request for communication with the second server computer,

converting the first format comprises converting the request URL into a converted request URL, and

the second request comprises the request header, the request body, and the converted request URL;

receive, by the application, from the second server computer, a first response to the second request sent by the application to the second server computer, wherein the first response has the first format;

based on converting the first response from the second format to the first format create, by the application, a second response having the first format; and

send, by the application, the second response over the connection to the first server computer.

14. The non-transitory machine readable medium of claim 13, wherein the instructions are executable by the one or more processors to further cause the one or more processors to:

initiate a hypertext transport protocol (HTTP) connection with the first server computer; and

responsive to initiating the HTTP connection, upgrade the HTTP connection to the connection.

15. The non-transitory machine readable medium of claim 13, wherein the first response includes a response header and a response body, wherein neither of the response header and the response body are converted for the first response from the second format to the first format, and wherein the second response includes the response header and the response body.

16. The non-transitory machine readable medium of claim 13, wherein the instructions are executable by the one or more processors to further cause the one or more processors to:

send, by the application, the second request to the second server computer.

17. The non-transitory machine readable medium of claim 13, wherein the instructions are executable by the one or more processors to further cause the one or more processors to:

receiving, at the first server computer, a third request from a mobile device;

reformatting, at the first server computer, the third request from the mobile device into the first request for data over the connection;

receiving, at the first server computer, the second response from the application;

creating, at the first server computer, a third response based on the second response from the application; and

sending the third response to the mobile device.