METHODS, SERVER AND PROXY AGENT FOR DYNAMICALLY SETTING UP A SESSION BETWEEN A TARGET RESOURCE IN A PRIVATE NETWORK AND AN APPLICATION ON A DEVICE

• US 20140208393A1
• Filed: 05/13/2011
• Published: 07/24/2014
• Est. Priority Date: 05/13/2011
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Yasukawa, Kenta, Avesand, Stefan, Hjelm, Johan, Matsumura, Takeshi, Murakami, Shingo, Oda, Toshikane
• Granted Patent: US 9,306,950 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 61/2567 for reachability, e.g. inquiring the address of a correspondent behind a NAT server
• CPC Class Codes: H04L 61/2589 over a relay server, e.g. traversal using relay for network address translation [TURN]
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/563 Data redirection of data network streams

Abstract

An object of embodiments of the present invention is to establish a secure connection from a device to a private network, to which the device belongs, when the device may be located remotely from the private network. This is achieved by locating a server in the private network while reusing existing authorization mechanisms in the network. A target resource is in this private network and a device located outside the private network can access the target resource by using the server and a proxy agent which intermediates a request from the device by using a one time session URL.

Claims

1. A method in a server of a private network for dynamically setting up a session between a target resource in the private network and an application on a device, wherein the device belongs to the private network but may be located remotely from the private network, the method comprises

receiving from the application a request to get the target resource in the private network,

checking if a user of the device is authorized to access the server,

identifying a session anchor,

instantiating a proxy agent within the private network with address information of the identified session anchor such that the proxy agent can establish a connection to the session anchor identified by said address information,

receiving a session Universal Resource Locator, URL, in response to said instantiating and performing a mapping between a URL of the target resource and a session URL issued by said session anchor, and

determining whether the device and the target resource are on the same Local Area Network, LAN, such that the application can access the target resource directly if they are on the same LAN, or such that the application can access the target resource via the session anchor by using the session URL if they are not on the same LAN.

2. The method according to claim 1, wherein the identified session anchor is located locally in the private network.

3. The method according to claim 1, wherein the identified session anchor is located in a cloud outside the private network reachable over an IP network.

4. The method according to claim 1, wherein the determining step is performed by sending the session URL to an additional server such that the additional server is used to determine whether the device and the target resource are on the same LAN

5. The method according to claim 4, wherein the additional server is used by:

registering to the additional server, wherein the register comprises the session URL and the URL of the target resource,

receiving in response to said register, a point URL of the additional server,

sending said point URL of the additional server to the application such that the application can inform the additional server of the URL of the device, whereby the additional server can compare the URL of the device with the URL of the target resource to determine whether the device and the target resource are on the same LAN such that the application can access the target resource directly if they are on the same LAN or access the target resource via the session anchor if they are located on different LANs.

7. The method according to claim 1, wherein the identified session anchor is located locally in the private network.

8. The method according to claim 1, wherein the identified session anchor is located in a cloud outside the private network reachable over an IP network.

13. The server according to claim 4, wherein the input/output section is further configured to register to the additional server, wherein the register comprises the session URL and the URL of the target resource, to receive in response to said register, a point URL of the additional server, and to send said point URL of the additional server to the application such that the application can inform the additional server of the URL of the device, whereby the additional server can compare the URL of the device with the URL of the target resource to determine whether the device and the target resource are on the same LAN such that the application can access the target resource directly if they are on the same LAN or access the target resource via the session anchor if they are located on different LANs.

6. A method in a proxy agent of a private network for dynamically setting up a session between a target resource in the private network and an application on a device, wherein the device belongs to the private network but may be located remotely from the private network, the application sends a request to a server in the private network to get the target resource and the server is configured to authorize a user of the device to authorize access to the server and a Universal Resource Locator, URL, of a session anchor is identified by the server, the method comprising:

receiving a request to instantiate the proxy agent with address information of the identified session anchor,

sending a session request to the session anchor,

receiving a session URL from the session anchor and storing a mapping between said session URL and the target resource,

sending the session URL to the server, such that the server can forward the session URL to the client,

receiving a request from the client via the session URL of the session anchor to get the target resource, mapping the session URL to the URL of the target resource, and

sending a request to get the target resource, such that the target resource can be sent to the client.

9. A server of a private network for dynamically setting up a session between a target resource in the private network and an application on a device, wherein the device belongs to the private network but may be located remotely from the private network, the server comprises an input/output section configured to receive from the application a request to get the target resource in the private network, and a processor configured to check if a user of the device is authorized to access the server to identify a session anchor to instantiate a proxy agent within the private network with address information of the identified session anchor such that the proxy agent can establish a connection to the session anchor identified by said address information, wherein the input/output section is further configured to receive a session Universal Resource Locator, URL, in response to said instantiating and performing a mapping between a URL of the target resource and a session URL issued by said session anchor, and wherein the processor is further configured to determine whether the device and the target resource are on the same Local Area Network, LAN, such that the application can access the target resource directly if they are on the same LAN, or such that the application can access the target resource via the session anchor by using the session URL if they are not on the same LAN.

10. The server according to claim 9, wherein the identified session anchor is located locally in the private network.

11. The server according to claim 9, wherein the identified session anchor is located in a cloud outside the private network reachable over an IP network.

12. The server according to claim 9, wherein the processor is further configured to use the input/output section to send the session URL to an additional server such that the additional server is used to determine whether the device and the target resource are on the same LAN

14. A proxy agent of a private network for dynamically setting up a session between a target resource in the private network and an application on a device, wherein the device belongs to the private network but may be located remotely from the private network, the application is configured to send a request to a server in the private network to get the target resource and the server is configured to authorize a user of the device to authorize access to the server and a Universal Resource Locator, URL of a session anchor is identified by the server, the proxy agent comprising an input/output section configured to receive a request to instantiate the proxy agent with address information of the identified session anchor, to send a session request to the session anchor, and to receive a session URL from the session anchor, wherein the proxy agent further comprises a memory configured to store a mapping between said session URL and the target resource, and the input/output section is further configured to send the session URL to the server, such that the server can forward the session URL to the client, and to receive a request from the client via the session URL of the session anchor to get the target resource, wherein the proxy agent further comprises a processor configured to map the session URL to the URL of the target resource, and the input/output section is further configured to send a request to get the target resource, such that the target resource can be sent to the client.

15. The proxy agent according to claim 14, wherein the identified session anchor is located locally in the private network.

16. The proxy agent according to claim 14, wherein the identified session anchor is located in a cloud outside the private network reachable over an IP network.