Internet Access Server for Isolating the Internal Network from the External Network and A Process Method thereof

• US 20090222535A1
• Filed: 01/11/2007
• Published: 09/03/2009
• Est. Priority Date: 05/30/2006
• Status: Active Grant

• Current Assignee: Haisheng Ni, Lin Zhu
• Original Assignee: Haisheng Ni, Lin Zhu
• Inventors: Zhu, Lin, Ni, Haisheng
• Granted Patent: US 8,051,147 B2
• Time in Patent Office: Days
• US Class Current: 709/219
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212

Abstract

A internet access server for isolating the internal network from the external network and a process method thereof, the server is used to isolate the user computer from internet. The computer server universal-based includes a graphics terminal service module, a graphics terminal network transmission module, a internal network transmission control module, a document transmission control module, a system configuration and user management module, and a internet access transmission module. By using the invention, the isolation and security of the internal network and the external network are realized by the special access mode and transmission control. All the authorized computer in the internal network could access the internet via the internet access server which includes a image terminal.

Claims

1. An internet access server for isolating the internal network from the external network, which connects the internal network composed of a number of user computers and the internet, which isolates the user computers from the internet, and which is built upon an ontology server, wherein:

it includes a graphics terminal service module, a graphics terminal network transmission module, a internal network transmission control module, a document transmission control module, a system configuration and user management module, and a internet access transmission module;

wherein the graphics terminal service module is connected to the graphics terminal network transmission module, providing graphics terminal service to its clients;

the internal network transmission control module which is connected to the above mentioned ontology server strictly controls network session, ensuring the validity of session between the clients within the network and the internet access server;

the document transmission control module which is connected to the ontology server is intended to manage the files and data transmission between any user computer'"'"'s local disc and the user'"'"'s private storage space on the internet access server;

the system configuration and user management module which is connected to the ontology server is used to add, delete or modify user setting, upload process design and set system parameters;

the internet access transmission module which is connected to the ontology server is intended to provide transmission control management for the above mentioned graphics terminal service module to access internet.

2. The internet access server for isolating the internal network from the external network according to claim 1, further comprising two network interfaces, one for user computers to access internet graphics terminals, and the other for connecting and accessing internet.

3. The internet access server for isolating the internal network from the external network according to claim 1, wherein the said graphics terminal service module includes www web explorer, E-mail client terminal and FTP client terminal.

4. The internet access server for isolating the internal network from the external network according to claim 1, wherein the data transmission controlled by the internal network transmission control module between the clients and the internet server has four types of data session, including graphics terminal network protocol, valid download from the server onto its clients, controlled upload from clients onto the internet access server, control instructions.

5. The internet access server for isolating the internal network from the external network according to claim 1, wherein the said document transmission control module is composed of download component and upload component.

6. A method of registration on client-side in the internet access server according to claim 1 includes the following steps:

obtain data identification number and user'"'"'s authorization information by program initialization on client terminal, register the data identification number on the internet access server and get authorization;

the internet access server will record the registration and announce this registration finished after confirming the authorization, or directly announce registration finished if the authorization is not confirmed.

7. A method of filtering data package in the internet access server according to claim 1 includes the following steps:

on receipt of a data package, judge if it has the correct data identification number;

as for those with correct data identification number, obtain client terminal and server addresses from the package, and judge if it has been properly authorized and if the type of data is valid;

if so, transmit the data package to the correct address and announce transmission terminated;

if not, discard the package;

as for those without correct data identification number, discard the data package directly and announce transmission terminated.

8. A method for users to download data from internet onto client computers in the internet access server according to claim 1 includes the following steps:

after users download files onto their private storage space via www web explorer at graphics terminal, or E-mail client terminal, or FTP client terminal, the file transfer module provides a list of all the files to the clients in accordance with the list of files on the specific space on the server after the download link initialization, from which users can choose to download;

having read the target directory defined by the user, the transfer module transmits the data to the right local directory that the user has specified in his/her computer on the internal network via authorized data transfer channels.

9. A method of upload control in the internet access server according to claim 1 includes the following steps:

when the transmission link is initialized and an authorized user uploads a file as a file, the uploaded file will be saved in the server'"'"'s security space for screening;

the file that passes the screening will be transferred from the security space to the user'"'"'s personal storage space and the process is announced over;

if the file fails the screening, the failure will be recorded and the process over.

10. An internet access server for isolating the internal network from the external network according to in claim 1, wherein the said internal network transmission control module, the graphics terminal service module, the document transmission control module, the system configuration and user management module, and the internet access transmission module are set in different ontology servers in a predetermined manner.