Secure gateway having user identification and password authentication

• US 6,324,648 B1
• Filed: 12/23/1999
• Issued: 11/27/2001
• Est. Priority Date: 12/14/1999
• Status: Expired due to Term

• Current Assignee: Intellectual Ventures II LLC (Intellectual Ventures LLC)
• Original Assignee: GTE Service Corporation (Verizon Communications Inc.)
• Inventors: Grantges, Jr., David R.
• Primary Examiner(s): Wright, Norman M.
• Application Number:
  US09/471,901
• Time in Patent Office: 705 Days
• Field of Search: 713/200-202, 713/183, 713/157, 713/168-171, 380/21, 709/229
• US Class Current: 726/12
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A computer system provides authenticated access for a client computer over an insecure, public network to one of a plurality of destination servers on private, secure network, through the use of a client-side X.509 digital certificate. A firewall is disposed between the insecure, public network and the private network. A demilitarized zone (DMZ) proxy server intercepts messages destined for the destination servers, and forwards the intercepted messages through the firewall to a gateway on the private network. The gateway is configured to create a cookie, based on the selection of one of a several applications available on the private network. The cookie contains an identifier sufficient to identify the destination server corresponding to the selected application. Messages from the client computer include the cookie. The gateway processes the cookie and appends the identifier on a destination URL portion of the messages for routing. An alternate computer system authenticates a user of a remote client computer on the insecure network side of the firewall using a user identification and password.

Claims

1. A computer system for providing access from a client computer over an insecure public network to a destination server on a secure private network, comprising:

a firewall system between said insecure network and said secure private network;

a proxy server on said insecure network side of said firewall system;

an authorization server on said private network side of said firewall system for authenticating a user of said client computer based on a user identification (ID) and password from said user of said client computer;

a web server on said insecure network side of said firewall system configured to pass said user ID to said authorization server and to build an authentication cookie when said authorization server authenticates said user of said client computer based on said user ID and password;

a gateway on said private network side of said firewall system; and

wherein said proxy server is further configured to pass a message from said client computer to said destination server via said gateway when said authentication cookie is valid.

2. The computer system of claim 1 wherein said proxy server is configured to establish respective, secure connections with said client computer and said gateway, and said web server is configured to establish a respective secure connection with said authorization server.

3. A computer system for providing access from a client computer over an insecure public network to a destination server on a secure private network executing a corresponding application, said computer system comprising:

a firewall system between said insecure network and said secure private network;

a proxy server on said insecure network side of said firewall system configured to establish a secure connection over said insecure network with said client computer;

an authorization server on said private network side of said firewall system for authenticating a user of said client computer based on a user identification (ID) and password from said user of said client computer;

a web server disposed on said insecure network side of said firewall system configured to pass said user ID and password over a secure connection to said authorization server, said web server being further configured to build an authentication cookie when said authorization server authenticates said user of said client computer based on said user ID and password;

a gateway disposed between said proxy server and said private network on said private network side of said firewall system; and

wherein said proxy server is further configured to pass a message from said client computer to said gateway over a secure connection when said authentication cookie is valid, said gateway being configured to route said message to said destination server.

4. The computer system of claim 3 wherein said connection to said proxy server through which said user ID and password is received from said client computer is secured using a Secure Sockets Layer (SSL) protocol.

5. The computer system of claim 3 wherein said authorization server comprises a lightweight directory access protocol (LDAP) capable server.

6. The computer system of claim 3 wherein said connection between said web server and said authorization server is secured using a Secure Sockets Layer (SSL) protocol, and wherein said web server and said authorization server provide authentication to each other using digital certificates compliant with an industry standard.

7. The computer system of claim 6, wherein said industry standard comprises an ITU X.509 standard.

8. The computer system of claim 3 wherein said connection between said proxy server and said gateway is secured using a Secure Sockets Layer (SSL) protocol, and wherein said proxy server and said gateway provide authentication to each other using digital certificates compliant with an X.509 standard.

9. The computer system of claim 3 wherein said private network includes a plurality of destination servers each servicing a corresponding application, said proxy server comprising a demilitarized zone (DMZ) proxy server and said web server comprising a DMZ web server, said gateway including a gateway proxy server, said DMZ web server being configured to transmit to said client computer a list of applications for which access by said user of said client computer is authorized according to said response by said authorization server, selection by said user at said client computer of one application from said list being operative to send to said gateway proxy server via said DMZ proxy server a uniform resource locator (URL) comprising a base portion and an identifier appended as a suffix thereto.

10. The computer system of claim 9 wherein said gateway proxy server is configured to receive said URL, to extract said identifier, and to build a selected-application cookie, said gateway proxy server being further configured to recognize said selected-application cookie and append said identifier to messages from said client computer.

11. The computer system of claim 10 wherein said gateway proxy server is further configured to route said messages based on said appended identifier.

12. A method for providing access by a client computer over an insecure public network through a proxy server to a destination server residing on a secure private network, said method comprising the steps of:

(A) receiving at the proxy server a request for authentication from a user of the client computer;

(B) establishing a first secure connection between the proxy server and the client computer;

(C) obtaining at a web server via the proxy server a user identification (ID) and password from the user of the client computer;

(D) establishing a second secure connection between the web server and an authorization server for transmission of the user ID and password;

(E) obtaining authentication data from the authorization server using the user ID and password;

(F) building an authentication cookie using the authentication data; and

(G) routing messages from the client computer through the proxy server through a gateway to the destination server when the authentication cookie is valid.

13. The method of claim 12 further including the steps of:

providing a firewall system between the insecure public network and the secure private network;

positioning the proxy server and the web server on the insecure network side of the firewall system; and

positioning the authorization server and the gateway server on the private network side of the firewall system.

14. The method of claim 13 wherein said routing messages step includes the substep of:

establishing a third secure connection between the proxy server and the gateway.

15. The method of claim 14 wherein said steps of establishing a second secure connection and receiving authentication data include communication in accordance with a hypertext transfer protocol secure (HTTPS).

16. The method of claim 15 wherein said step of routing messages is performed for every message destined for the destination server.