Method and apparatus for secure internet communications

• US 20040249958A1
• Filed: 06/04/2003
• Published: 12/09/2004
• Est. Priority Date: 06/04/2003
• Status: Abandoned Application

• Current Assignee: Matsushita Electric Industrial Company Limited (Panasonic Holdings Corporation)
• Original Assignee: Matsushita Electric Industrial Company Limited (Panasonic Holdings Corporation)
• Inventors: Thukral, Amit, Ozdemir, Hasan Timucin, Lee, Kou Chu
• Application Number:
  US10/454,336
• Publication Number:
  US 20040249958A1
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

Network communication from a client computer accessing an application service computer through use of the Internet (where the application service computer is normally protected from general Internet access by a firewall) is enabled by validating each computer message instance between the client computer and the application service computer against a first message permissive in a message address confirmation computer and a second message permissive in a firewall-tunnel computer. The firewall-tunnel computer and the message address confirmation computer interface directly to the Internet via secure protocol. The approach enables bi-directional multi-protocol communications by using HTTP protocol communications to the Internet in a computer systems infrastructure without need for re-configuration of firewall or NAT devices installed between the Internet and a network otherwise protected by a firewall or NAT device.

Claims

1. A method for network communication from a client computer accessing an application service computer through use of the Internet, comprising:

validating each computer message instance between said client computer and said application service computer against a first message permissive in a message address confirmation computer and a second message permissive in a firewall-tunnel computer wherein said firewall-tunnel computer interfaces said application service computer to said Internet and said message address confirmation computer interfaces to said Internet.

2. The method of claim 1 wherein said first message permissive comprises an identifier for said firewall-tunnel computer in relation to an identifier for said client computer.

3. The method of claim 2 wherein said first message permissive further comprises an identifier for said application service computer in relation to said identifier for said firewall-tunnel computer and said identifier for said client computer.

4. The method of claim 3 wherein said identifier is a logical identifier for said application service computer.

5. The method of claim 3 wherein said identifier is a logical identifier for an application of said application service computer.

6. The method of claim 1 wherein said second message permissive comprises an identifier for said application service computer.

7. The method of claim 6 wherein said second message permissive further comprises an identifier for said client computer.

8. The method of claim 1 wherein said first message permissive is defined in said message address confirmation computer by said firewall-tunnel computer.

9. The method of claim 1 further comprising validating a password of said client computer by said application service computer.

10. The method of claim 1 further comprising validating a password of said firewall-tunnel computer by said message address confirmation computer.

11. The method of claim 1 wherein said message address confirmation computer is owned by a first owner and said application service computer and said firewall-tunnel computer are owned by a second owner, said method further comprising said first and second owners agreeing that said first owner will not edit said first message permissive.

12. The method of claim 1 wherein said firewall-tunnel computer interfaces to said Internet through a firewall port connection configured to enable an outbound HTTP protocol communication to proceed by said firewall, said firewall essentially permanently configured to block any inbound communication which is not reciprocal to said outbound communication so that reconfiguration of said firewall port is not needed for enabling bi-directional messaging through said firewall.

23. The method of claim 1 wherein said firewall-tunnel computer. executes a bridge computer program and wherein an application program in said application service computer controls said bridge computer program such that an HTTP message transport mechanism is created with said message address confirmation computer.

24. The method of claim 12 wherein said firewall-tunnel computer executes a bridge computer program, said bridge computer program creates a bridge software instance by initiating an HTTP connection to said message address confirmation server and by initiating an HTTP connection to said application service computer, and said message address confirmation server authenticates said bridge software instance.

25. The method of claim 12 wherein said firewall-tunnel computer executes a bridge computer program, said bridge computer program creates a bridge software instance by initiating an HTTP connection to said message address confirmation server and by initiating an HTTP connection to said application service computer, said bridge computer program defines a message buffer pair set such that a send message buffer and a receive message buffer pair is defined for each said HTTP connection, and said message buffer pair set transfers messages bi-directionally between a bridge services computer program executing in said message address confirmation computer and a bridge services computer program executing in said application service computer.

26. The method of claim 12 wherein said firewall-tunnel computer executes a bridge computer program having a transport layer and a message processing layer, said transport layer initiates a first HTTP connection to said message address confirmation server and a second HTTP connection to said application service computer, said message processing layer defines a message buffer pair set such that a send message buffer and a receive message buffer pair is defined for each said HTTP connection, said transport layer retrieves a first message in a communication from said message address confirmation server via said first connection, said message processing layer executes permission rules on said first message, said message processing layer moves said first said message from the receive message buffer of said first connection to the send message buffer of said second connection, said transport layer sends said first message to said application service computer via said second connection, said transport layer retrieves a second message in a communication from said application service computer via said second connection, said message processing layer executes permission rules on said second message, said message processing layer moves said second message from the receive message buffer of said second connection to the send message buffer of said first connection, and said transport layer sends said first message to said message address confirmation server via said first connection.

27. The method of claim 12 wherein messages of said messaging are structured according to differentiated protocols respective to differentiated applications.

28. The method of claim 12 wherein said firewall-tunnel computer executes a bridge computer program having a transport layer and a message processing layer, said transport layer multiplexing the sending of a plurality of messages to said message address computer and to said application service computer.

29. The method of claim 12 wherein said firewall-tunnel computer executes a bridge computer program having a transport layer and a message processing layer, said transport layer receive multiplexing a plurality of messages from a bridge service program in said message address computer and from a bridge service program in said application service computer.

30. The method of claim 12 wherein said firewall-tunnel computer executes a bridge computer program having a transport layer and a message processing layer, said transport layer creating a sufficient plurality of HTTP connections with said message address computer and a sufficient plurality of HTTP connections with said application service computer such that overall message latency is sustained below a predefined latency value and overall message throughput is sustained below a predefined throughput value.

31. The method of claim 12 wherein a plurality of firewall-tunnel computers are in communication with said message address confirmation server and wherein each firewall-tunnel computer executes a bridge computer program enabling said messaging.

32. The method of claim 1 wherein a plurality of firewall-tunnel computers are in communication with said message address confirmation server, each firewall-tunnel computer executes a bridge computer program enabling said messaging, and said message address confirmation server executes a bridge service program in communication with the bridge computer programs in said plurality of firewall-tunnel computers.

13. A method for network communication from a client computer accessing an application service computer through use of the Internet, comprising:

providing a firewall-tunnel computer in data communication to said application service computer and to said Internet;

providing a message address confirmation computer in data communication to said firewall-tunnel computer through said Internet and in data communication to said client through said Internet; and

validating each computer message instance of said communication between said client computer and said application service computer against a first permissive database in said message address confirmation computer and a second permissive database in said firewall-tunnel computer.

14. The method of claim 13 wherein said first message permissive database comprises a data record having an identifier for said firewall-tunnel computer in relation to an identifier for said client computer wherein said data record addresses are defined in said first message permissive database from said firewall-tunnel computer.

15. The method of claim 14 wherein said data record further comprises an identifier for said application service computer.

16. The method of claim 13 wherein said second message permissive database comprises a data record having an identifier for said application service computer.

17. The method of claim 16 wherein said second message permissive database further has an identifier for said client computer.

18. An apparatus for network communication from a client computer accessing an application service computer through use of the Internet, comprising:

a firewall-tunnel computer in data communication to said application service computer and to said Internet, said firewall-tunnel computer programmed to validate each computer message instance of said communication between said client computer and said application service computer; and

a message address confirmation computer in data communication to said firewall-tunnel computer through said Internet and in data communication to said client through said Internet, said message address confirmation computer programmed to validate each computer message instance of said communication between said client computer and said application service computer.

19. The apparatus of claim 18 wherein said message address confirmation computer has a permissive database having an identifier for said firewall-tunnel computer in relation to an identifier for said client computer.

20. The apparatus of claim 19 wherein said message address confirmation computer and said firewall-tunnel computer are programmed to enable said firewall-tunnel computer to modify said permissive database in said message address confirmation computer.

21. An apparatus for network communication from a client computer accessing an application service computer through use of the Internet, comprising:

means for validating each computer message instance between said client computer, and said application service computer against a first message permissive in a message address confirmation computer and a second message permissive in a firewall-tunnel computer wherein said firewall-tunnel computer interfaces to said Internet and said message address confirmation computer interfaces to said Internet.

22. The apparatus of claim 21 further comprising means for defining said first message permissive by said firewall-tunnel computer.

33. The apparatus of claim 21 wherein said means for validating each computer message instance further comprises a bridge computer program in each said firewall-tunnel computer and a bridge service program in said message address confirmation computer, wherein said bridge service program defines a send message buffer for each said bridge computer program, and said bridge service program buffers each message instance communicated to each said bridge computer program in its respective said send message buffer.

34. The apparatus of claim 33 wherein said bridge service program buffers a plurality of messages sent from one said bridge computer program.

35. The apparatus of claim 21 wherein said means for validating each computer message instance further comprises a bridge computer program in each said firewall-tunnel computer and a bridge service program in said message address confirmation computer, wherein said bridge service program is capable of accepting a plurality of messages sent by each bridge computer program, said bridge service program defines a send message buffer for each said bridge computer program, said bridge service program buffers each message instance communicated to each said bridge computer program in its respective said send message buffer, and said bridge service program forwards each message to a commensurate application message queue.