System and method for connecting to a device on a protected network

• US 6,970,934 B2
• Filed: 05/25/2004
• Issued: 11/29/2005
• Est. Priority Date: 12/20/1999
• Status: Expired due to Fees

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: King, David A., Remer, Eric B., Remer, David L.
• Primary Examiner(s): Caldwell, Andrew
• Assistant Examiner(s): Nguyen, Hai V.
• Application Number:
  US10/852,799
• Publication Number:
  US 20040215967A1
• Time in Patent Office: 553 Days
• Field of Search: 709/200, 709/229, 709/238, 709/250, 707/9, 713/175, 713/201
• US Class Current: 709/229
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

A novel system and method for connecting to an entity behind a firewall or proxy enhances network security and eliminates the costs and risks associated with modifying the firewall or proxy. The invention uses a trusted arbitrator as an intermediary between (1) a local area network protected by an access control mechanism such as a firewall or proxy and (2) external entities seeking to connect with an entity within the network. Requests from external entities are routed to the trusted arbitrator, which communicates with a connection entity located behind the firewall or proxy.

Claims

1. A system, comprising:

a local area network, said local area network including

a local entity,

a connection entity coupled to the local entity, and

an access control mechanism coupled to the connection entity;

a remote entity; and

a trusted arbitrator, coupled to the access control mechanism and to the remote entity via a wide area network, to receive a first request which is sent by the remote entity across the wide area network and being directed at least in part to the local entity on the local area network,

wherein the connection entity regularly polls the trusted arbitrator via the access control mechanism across the wide area network to determine whether any requests directed to devices on the local area network are pending in the trusted arbitrator, the trusted arbitrator sends a first response via the wide area network to the connection entity on the local area network, the first response including the first request from the remote entity and being in response to polling by the connection entity, and the connection entity forwards at least a portion of the first request to the local entity.

2. The system according to claim 1, wherein the first request is a query that conforms at least substantially to a Hypertext Transfer Protocol.

3. The system according to claim 1, wherein the first response is a response that conforms at least substantially to a Hypertext Transfer Protocol.

4. The system according to claim 1, wherein the access control mechanism is a firewall.

5. The system according to claim 1, wherein the access control mechanism is a proxy server.

6. The system according to claim 1, wherein the access control mechanism is coupled to the trusted arbitrator at least in part through the Internet.

7. The system according to claim 1, wherein the remote entity is coupled to the trusted arbitrator at least in part through the Internet.

8. The system according to claim 1, wherein if the connection entity does not receive the first response within a predetermined period of a time of the sending of the first request, the sending of the first request is repeated.

9. A method, comprising:

receiving a first request at a trusted arbitrator from a remote entity, the first request being directed to a local entity;

storing the first request on the trusted arbitrator, the first request being sent by the remote entity across a wide area network to the trusted arbitrator and being directed at least in part to a local entity on a local area network;

receiving regular polling, from a connection entity on the local area network, to determine whether any requests directed to devices on the local area network are pending in the trusted arbitrator; and

sending a first response from the trusted arbitrator across the wide area network to the connection entity on the local area network, the first response including a first request from the remote entity and being in response to polling of the connection entity, wherein the connection entity forwards at least a portion of the first request from the connection entity to the local entity.

10. The method according to claim 9, the method further comprising certifying the first request, said certifying being completed prior to a time of sending the first response.

11. The method according to claim 9, wherein the first request is stored in an area associated with the connection entity.

12. The method according to claim 9, wherein sending a first response from the trusted arbitrator to a connection entity comprises passing the first response through an access control mechanism.

13. A data storage medium having machine-readable code stored thereon, the machine-readable code comprising instructions executable by logic elements, the instructions defining a method comprising:

storing a first request on a trusted arbitrator, the first request being sent by a remote entity across a wide area network to the trusted arbitrator and being directed at least in part to a local entity on a local area network;

receiving regular polling, from a connection entity on the local area network, to determine whether any requests directed to devices on the local area network are pending in the trusted arbitrator; and

sending a first response from the trusted arbitrator across the wide area network to the connection entity on the local area network, the first response including the first request from the remote entity and being in response to polling by the connection entity, wherein the connection entity forwards at least a portion of the first requst from the connection entity to the local entity.

14. The medium according to claim 13, the method further comprising certifying the first request, said certifying being completed prior to a time of sending the first response.

15. The medium according to claim 13, wherein the first request is stored in an area associated with the connection entity.

16. The medium according to claim 13, wherein sending a first response from the trusted arbitrator to a connection entity comprises passing the first response through an access control mechanism.