Accessing Resources in Private Networks

• US 20170142129A1
• Filed: 11/17/2015
• Published: 05/18/2017
• Est. Priority Date: 11/17/2015
• Status: Active Grant

• Current Assignee: Successfactors Incorporated (SAP SE)
• Original Assignee: Successfactors Incorporated (SAP SE)
• Inventors: Peng, Yang
• Granted Patent: US 10,171,240 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 47/72 using reservation actions during connection setup
• CPC Class Codes: H04L 47/781 Centralised allocation of resources
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

Some embodiments provide a non-transitory machine-readable medium that stores a program. The program receives a queue message from a computing device. The queue message includes a request to perform a set of actions on a resource in a private network and a security signature generated from an authentication operation. The program also stores the queue message in a message queue for later retrieval when the queue message is determined to be valid based on the security signature. The program further sends the queue message to a queue monitor for the queue monitor to instruct the resource to perform the set of actions. Upon receiving a response associated with the queue message from the queue monitor, the program forwards the response associated with the queue message to the computing device.

Claims

1. A non-transitory machine-readable medium storing a program executable by at least one processing unit of a device, the program comprising sets of instructions for:

receiving a queue message from a computing device, the queue message comprising a request to perform a set of actions on a resource in a private network and a security signature generated from an authentication operation;

storing the queue message in a message queue for later retrieval when the queue message is determined to be valid based on the security signature;

sending the queue message to a queue monitor for the queue monitor to instruct the resource to perform the set of actions; and

upon receiving a response associated with the queue message from the queue monitor, forwarding the response associated with the queue message to the computing device.

2. The non-transitory machine-readable medium of claim 1, wherein the program further comprises a set of instructions for dropping the queue message when the queue message is determined to be not valid based on the security signature.

3. The non-transitory machine-readable medium of claim 1, wherein the program further comprises a set of instructions for receiving a request for the queue message from the queue monitor;

wherein the queue message is sent to the queue monitor in response to receiving the request for the queue message from the queue monitor.

4. The non-transitory machine-readable medium of claim 1, wherein determining that the queue message is valid based on the security signature comprises decrypting the security signature with a public key generated during a key exchange between the computing device and a security manager in the private network.

5. The non-transitory machine-readable medium of claim 4, wherein the authentication operation generates the security signature by encrypting the security signature with a public key generated during the key exchange.

6. The non-transitory machine-readable medium of claim 1, wherein the computing device belongs to a network different than the private network.

7. The non-transitory machine-readable medium of claim 1, wherein the device belongs to a perimeter network of the private network.

8. A method comprising:

receiving a queue message from a computing device, the queue message comprising a request to perform a set of actions on a resource in a private network and a security signature generated from an authentication operation;

storing the queue message in a message queue for later retrieval when the queue message is determined to be valid based on the security signature;

sending the queue message to a queue monitor for the queue monitor to instruct the resource to perform the set of actions; and

upon receiving a response associated with the queue message from the queue monitor, forwarding the response associated with the queue message to the computing device.

9. The method of claim 8 further comprising dropping the queue message when the queue message is determined to be not valid based on the security signature.

10. The method of claim 8 further comprising receiving a request for the queue message from the queue monitor;

wherein the queue message is sent to the queue monitor in response to receiving the request for the queue message from the queue monitor.

11. The method of claim 8, wherein determining that the queue message is valid based on the security signature comprises decrypting the security signature with a public key generated during a key exchange between the computing device and a security manager in the private network.

12. The method of claim 11, wherein the authentication operation generates the security signature by encrypting the security signature with a public key generated during the key exchange.

13. The method of claim 8, wherein the computing device belongs to a network different than the private network.

14. The method of claim 8, wherein the device belongs to a perimeter network of the private network.

15. A system comprising:

a queue manager configured to receive a queue message from a computing device, the queue message comprising a request to perform a set of actions on a resource in a private network and a security signature generated from an authentication operation, the queue manager further configured to store the queue message in a message queue for later retrieval when the queue message is determined to be valid based on the security signature; and

a queue monitor configured to retrieve the queue message from the message queue, instruct the resource to perform the set of actions, and send a response associated with the queue message to the message queue,

the queue manager further configured to forward the response associated with the queue message to the computing device.

16. The system of claim 15, wherein the queue manager is further configured to drop the queue message when the queue message is determined to be not valid based on the security signature

17. The system of claim 15, wherein determining that the queue message is valid based on the security signature comprises decrypting the security signature with a public key generated during a key exchange between the computing device and a security manager in the private network.

18. The system of claim 17, wherein the authentication operation generates the security signature by encrypting the security signature with a public key generated during the key exchange.

19. The system of claim 15, wherein the computing device belongs to a network different than the private network.

20. The system of claim 15, wherein the device belongs to a perimeter network of the private network.