Firewall tunneling and security service

• US 20050132221A1
• Filed: 12/11/2003
• Published: 06/16/2005
• Est. Priority Date: 12/11/2003
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Marcjan, Cezary
• Granted Patent: US 7,346,925 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 2212/00 Encapsulation of packets
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

A data-sharing scheme between entities disposed behind respective firewalls. A sharor of the data subscribes to a public service that enables a secure connection (similar to a peer-to-peer network) between at least one requester and the data sharor. By subscribing, the sharor provides information to the service that enables the service to generate a private key. When the request is received from the requester, the service retrieves the corresponding private key, authenticates the requester, and transmits the key to the requestor thereby facilitating a secure tunnel for communicating the shared data. The requestor can then access the data directly from the sharor without the need for copying or moving the shared data to a server outside the firewall or for emailing.

Claims

1. A system that facilitates data sharing, comprising:

a request component that receives a request to access data stored behind a firewall; and

an authorization component that verifies if the request is associated with a key that permits access to the data.

2. The system of claim 1, further comprising a communications component that establishes a secure tunnel to a requestor of the data.

3. The system of claim 2, the data communicated through the tunnel is encrypted.

4. The system of claim 2, the communications component only permits access to the particular data.

5. The system of claim 2, the communications component only permits uni-directional flow of the data after the request is processed.

6. The system of claim 1, further comprising a permissions component that determines one or more levels of access permitted to entities outside the firewall.

7. The system of claim 6, the one or more levels of access include a complete access level.

8. The system of claim 6, the one or more levels of access include a plurality of limited access levels.

9. The system of claim 1 provides for authorizing storage of the data from outside to behind the firewall.

10. The system of claim 1, the request is received from a requestor located behind a requestor firewall, wherein a secure tunnel is created and extended from the data behind the firewall through the requestor firewall to the requester.

11. A computer system that includes a computer readable medium having stored thereon the components of claim 1.

12. A computer readable medium having stored thereon computer executable instructions for carrying out the system of claim 1.

13. The system of claim 1, the data is shared based upon at least one of a location ID, a personal ID, a globally unique ID, and a uniform resource identifier.

14. A system that facilitates the sharing of data, comprising:

a request component that receives a request from a requestor to access data stored behind a firewall; and

a communications component that establishes a secure tunnel from the data to the requestor of the data.

15. The system of claim 14, further comprising a permissions component that determines one or more levels of access permitted to entities outside the firewall, the one or more levels of access include a complete access level and a plurality of limited access levels.

16. The system of claim 14, further comprising a classifier that automatically performs at least one of load balancing of the data sharing process, learning a level of access of the requestor, determining levels of priority for scheduling the sharing of the data, and analyzing content of the data to determine permission levels.

17. The system of claim 14, the request is used to determine the location of the data.

18. The system of claim 14 is in the form of a service that is at least one of local to the data and remote from the data.

19. The system of claim 14, at least one of a sharor of the data and the requestor opens a TCP connection to the system via an HTTP-based proxy.

20. The system of claim 14, further comprising an authorization component that uses the request to determine a location of the data.

21. The system of claim 14 determines that both the requestor and a sharor of the data are online and authenticated before establishing the secure tunnel therebetween.

22. The system of claim 21 monitors the sharing of the data, and shuts down the secure tunnel after the data sharing has completed.

23. The system of claim 14, further comprising a cache that facilitates expeditious data transfer and request processing.

24. The system of claim 14, the data includes a class of different data files.

25. A method that facilitates data sharing, comprising:

receiving a request from a requestor to access data of a sharor stored behind a firewall;

verifying if the request is associated with a key that permits access to the data;

determining one or more levels of access for the requester; and

establishing a secure tunnel between a sharor of the data and the requestor.

26. The method of claim 25, further comprising monitoring the status of the secure tunnel with a monitor file such that the tunnel is closed based on the monitor file, which file is independent of an overseeing service.

27. The method of claim 25, further comprising transmitting rules data with the shared data such that the shared data can be manipulated only in conformity with the rules data.

28. The method of claim 25, further comprising creating a mirror of the data at the requester for at least the purpose of collaboration where the data is edited.

29. The method of claim 28, the sharor receives the edited data and at least one of overwrites the data and creates a new version thereof.

30. A system that facilitates data sharing, comprising:

means for receiving a plurality of requests from at least one requestor to access data of a sharor stored behind a firewall;

means for routing the plurality of requests to one or more available services;

means for verifying if the request is associated with a key that permits access to the data; and

means for establishing a secure tunnel between a sharor of the data and the requestor.

31. The system of claim 30, further comprising means for determining which of the one or more available services to route select ones of the plurality of requests.

32. The system of claim 30, further comprising means for load balancing the plurality of requests between the one or more available services.

33. The system of claim 30, further comprising means for automatically estimating a level of security of an environment of the sharor i which the data is stored.

34. A computer-readable medium having computer-executable instructions for performing a method of sharing data, the method comprising:

receiving a request from a requestor to access data of a sharor stored behind a firewall;

verifying if the request is associated with a key that permits access to the data;

determining one or more levels of access for the requester; and

establishing a secure tunnel between a sharor of the data and the requester.

35. The method of claim 34, the requester must store the data with at least the same level of security in which the data is stored at the sharor.

36. The method of claim 34, the data is communicated between the sharor and the requestor by at least one of the sharor pushing the data to the requester and the requestor pulling the data from the sharor.

37. The method of claim 34, further comprising dynamically creating a shared space for the shared data based on information that includes at least one of a physical location, a network location, date and time, and a virtual location.

38. The method of claim 37, further comprising automatically altering a share name of the shared space using the information.

39. The method of claim 37, further comprising automatically creating an additional code that facilitates redirection to and access of the shared data.