SECURE ACCESS

• US 20100031317A1
• Filed: 10/11/2007
• Published: 02/04/2010
• Est. Priority Date: 10/31/2006
• Status: Abandoned Application

• Current Assignee: British Telecommunications PLC (BT Group PLC)
• Original Assignee: British Telecommunications PLC (BT Group PLC)
• Inventors: Howe, Simon, Doyle, Richard, Paterson, Colin R., Mason, Jeremy R.
• Application Number:
  US12/446,658
• Publication Number:
  US 20100031317A1
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

Secure access is provided to a resource hosted in a first domain. A first web server provides access to the resource. A second web server is provided in a second domain for receiving requests from a user for access to the resource. A browser is arranged for authentication and authorization for access to resources in the second domain and for forwarding requests from the user to the second web server. A reverse proxy is provided for publishing, with a resource identifier identifying the second domain, the resource to the second web server. The reverse proxy is arranged to forward to the first web server for access to the resource requests received from the second browser.

Claims

1. A system for providing secure access to a resource hosted in a first domain, in which the first domain comprises a first web server for providing access to the resource, said system comprising:

a second web server for operating in a second domain for receiving requests from a user for access to the resource;

a browser arranged in use to be authenticated and authorized to access resources in the second domain and to forward requests from the user to the second web server; and

a reverse proxy for publishing, with a resource identifier identifying the second domain, the resource to the second web server.

2. A system as claimed in claim 1 in which the reverse proxy is arranged to forward to the first web server for access to the resource requests received from the second browser.

3. A system as claimed in claim 1 in which the request comprises a resource identifier specifying the second domain and the reverse proxy is arranged in use to replace the resource identifier received with the request with a resource identifier specifying the first domain.

4. A system as claimed in claim 1 in which the reverse proxy is a plug-in to the second server.

5. A system as claimed in claim 1 in which the first domain comprises a policy for supporting access from the second domain.

6. A system as claimed in claim 1 in which the policy is arranged to access user information from a database also accessible from the second domain.

7. A system as claimed in claim 1 in which the policy is arranged to use user information also used by a policy in the second domain.

8. A system as claimed in claim 1 comprising filter means for blocking access to the resource by a user in the second domain using a resource identifier identifying the first domain.

9. A reverse proxy for a second domain for providing a secure access to a resource hosted in a first domain, in which the reverse proxy is arranged in use to:

publish the resource in the second domain with a resource identifier identifying the second domain;

receive a request specifying the resource identifier from a user in the second domain for access to the resource;

replace in the request the received resource identifier with a resource identifier identifying the first domain; and

forward the requests to the first domain.

10. A method of securely accessing from a second domain a resource in a first domain, the method comprising:

publishing the resource in the second domain with a resource identifier identifying the second domain.

11. A method as claimed in claim 10, further comprising:

receiving a request specifying the source identifier from a user in the second domain for access to the resource;

replacing in the request the received resource identifier with a resource identifier identifying the first domain; and

forwarding the request to the first domain.

12. A method as claimed in claim 10 further comprising setting up a policy in the first domain to support access from the second domain.

13. A method as claimed in claim 10 in which the policy accesses user information from a database also accessed from the second domain.

14. A method as claimed in claim 10 in which the policy uses user information also used by a policy in the second domain.

15. A method as claimed in claim 10 further comprising blocking access to the resource using a resource identifier identifying the first domain by a user in the second domain.

16. A method as claimed in claim 10 further comprising differentiating the resource identifier identifying the first domain from a third resource identifier identifying the first domain for access to the resource from the first domain.

17. A computer-readable storage medium containing a computer program or suite of computer programs which, when executed by one or more computers, performs the method steps as set out in claim 10.