Method and system to provide and manage secure access to internal computer systems from an external client

• US 20020147927A1
• Filed: 04/06/2001
• Published: 10/10/2002
• Est. Priority Date: 03/16/2001
• Status: Abandoned Application

• Current Assignee: QED Intellectual Property Services Limited, Kleinwort Benson Bank Limited (RHJ International SA)
• Original Assignee: Kleinwort Benson Bank Limited (RHJ International SA)
• Inventors: Tait, John King Frederick
• Application Number:
  US09/826,844
• Publication Number:
  US 20020147927A1
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A method of providing and managing secure access to computer systems or resources from an external client, the method including the steps of a) receiving a message from the client at an authorisation module, b) requesting credentials from the client, c) sending the message and credentials to a session management module, d) checking the credentials of the client, and, if valid, issuing a ticket to the client, the ticket being valid for a plurality of trusted computer systems, e) receiving a further message together with said ticket from the client at the authorisation module, f) checking the validity of the ticket via the session management module, and g) passing the message and ticket to an impersonator module which provides secure communication between the client and the desired destination computer system or resource, the impersonator module also providing usage information to the session management module.

Claims

1. A method of connecting an external client to an internal computer resource through a network firewall by tunnelling, in which the client side of the tunnel comprises an applet running in a window of a web browser.

2. A method of sending non-HTTP compatible data through a network firewall from an external client to an internal computer resource by tunnelling, including encrypting the data and formatting it in a way that is compatible with HTTP tunnelling protocols.