Mobile gateway for secure extension of enterprise services to mobile devices

• US 20050266836A1
• Filed: 05/26/2004
• Published: 12/01/2005
• Est. Priority Date: 05/26/2004
• Status: Active Grant

• Current Assignee: Avaya Incorporated
• Original Assignee: Avaya Technology LLC (Avaya Incorporated)
• Inventors: Shan, Xueshan
• Granted Patent: US 7,289,788 B2
• Time in Patent Office: Days
• US Class Current: 455/417
• CPC Class Codes: H04L 63/0281 Proxies

Abstract

Controlled access to enterprise services is provided for a mobile device in a communication system, via a mobile gateway having a first server and a second server. The first server of the gateway is arranged behind a firewall of the enterprise network and is coupled between the second server and one or more enterprise servers of the enterprise network. The second server is arranged in front of the enterprise firewall and is configured for communication with an operator network associated with the mobile device. The gateway controls interaction between the mobile device and the one or more enterprise servers such that access to one or more associated enterprise services is provided in a secure manner.

Claims

1. An apparatus for use in controlling access to an enterprise service of an enterprise network from a mobile device in a communication system, the apparatus comprising:

a gateway having a first server and a second server;

the first server of the gateway being arranged behind a firewall of the enterprise network and being coupled between the second server and one or more enterprise servers of the enterprise network;

the second server being arranged in front of the enterprise firewall and being configured for communication with an operator network associated with the mobile device;

wherein the gateway controls interaction between the mobile device and the one or more enterprise servers such that access to one or more associated enterprise services is provided in a secure manner.

2. The apparatus of claim 1 wherein the first server comprises a mobile image and presentation server.

3. The apparatus of claim 1 wherein the first server comprises one or more of a mobile service broker, a mobile content converter, and a mobile service image element.

4. The apparatus of claim 3 wherein the mobile service broker comprises a service coordinator configured to provide two-way access control on a per-user, per-device and per-service basis, utilizing a service access control matrix having a user dimension, a device dimension and a service dimension, the service access control matrix being constructed at least in part in conjunction with an initialization procedure based on registration information characterizing users, devices and services.

5. The apparatus of claim 4 wherein the service coordinator is operative to prevent unauthorized access to the enterprise services from the mobile device and from one or more enterprise applications.

6. The apparatus of claim 3 wherein the mobile service broker comprises a service dispatcher which communicates with a service representative.

7. The apparatus of claim 3 wherein the mobile service broker is operative to replicate the mobile service image element in conjunction with a service request from the mobile device.

8. The apparatus of claim 3 wherein the mobile content converter comprises a plurality of device adaptors, each associated with a particular type of mobile device, and a content renderer coupled to the device adaptors, the mobile content converter being operative via one or more of the device adaptors and the content renderer to transform enterprise service content into a format suitable for presentation to a user via the mobile device.

9. The apparatus of claim 1 wherein the first server is coupled to the one or more enterprise servers via a Web Services interface.

10. The apparatus of claim 1 wherein the second server comprises a mobile proxy server.

11. The apparatus of claim 1 wherein the second server comprises a plurality of gateway adaptors, each configured for communication with a corresponding element of the operator network via a specified protocol.

12. The apparatus of claim 11 wherein the specified protocol associated with a given one of the gateway adaptors comprises one of a WAP push protocol, a WAP pull protocol, an SMS protocol and an MMS protocol.

13. The apparatus of claim 1 wherein the second server is configured to communicate with the operator network over the Internet using an SSL protocol.

14. The apparatus of claim 1 wherein the one or more enterprise servers comprise one or more of a web server, an e-mail server, a voice mail server, a speech server and a presence location server.

15. The apparatus of claim 1 wherein associated with each of a plurality of enterprise applications corresponding to respective ones of the enterprise servers is a service extender which supports communication between the enterprise application and the first server of the gateway.

16. The apparatus of claim 1 wherein the first and second servers are implemented on a single common processing element of the system.

17. The apparatus of claim 1 wherein the first and second servers are implemented on respective first and second processing elements of the system that are physically separated from one another.

18. The apparatus of claim 1 wherein the gateway is implemented in the form of one or more processing elements, each of the processing elements comprising a processor coupled to a memory.

19. A method for use in controlling access to an enterprise service of an enterprise network from a mobile device in a communication system, the method comprising the step of:

controlling interaction between the mobile device and one or more enterprise servers of the enterprise network via a gateway having a first server and a second server, such that access to one or more associated enterprise services is provided in a secure manner;

the first server of the gateway being arranged behind a firewall of the enterprise network and being coupled between the second server and one or more enterprise servers of the enterprise network;

the second server being arranged in front of the enterprise firewall and being configured for communication with an operator network associated with the mobile device.

20. An article of manufacture comprising a machine-readable storage medium containing software code for use in controlling access to an enterprise service of an enterprise network from a mobile device in a communication system, wherein the software code when executed implements the step of:

controlling interaction between the mobile device and one or more enterprise servers of the enterprise network via a gateway having a first server and a second server, such that access to one or more associated enterprise services is provided in a secure manner;

the first server of the gateway being arranged behind a firewall of the enterprise network and being coupled between the second server and one or more enterprise servers of the enterprise network;

the second server being arranged in front of the enterprise firewall and being configured for communication with an operator network associated with the mobile device.