Mobile gateway for secure extension of enterprise services to mobile devices

• US 7,289,788 B2
• Filed: 05/26/2004
• Issued: 10/30/2007
• Est. Priority Date: 05/26/2004
• Status: Active Grant

• Current Assignee: Avaya Incorporated
• Original Assignee: Avaya Technology Corporation Miami Lakes FLA US
• Inventors: Shan, Xueshan
• Primary Examiner(s): Trost, William
• Assistant Examiner(s): BALAOING, ARIEL A
• Application Number:
  US10/853,962
• Publication Number:
  US 20050266836A1
• Time in Patent Office: 1,252 Days
• Field of Search: 455/414.1, 455/410, 709/229, 726/3, 726/27
• US Class Current: 455/410
• CPC Class Codes: H04L 63/0281 Proxies

Abstract

Controlled access to enterprise services is provided for a mobile device in a communication system, via a mobile gateway having a first server and a second server. The first server of the gateway is arranged behind a firewall of the enterprise network and is coupled between the second server and one or more enterprise servers of the enterprise network. The second server is arranged in front of the enterprise firewall and is configured for communication with an operator network associated with the mobile device. The gateway controls interaction between the mobile device and the one or more enterprise servers such that access to one or more associated enterprise services is provided in a secure manner.

Claims

1. An apparatus for use in controlling access to an enterprise service of an enterprise network from a mobile device in a communication system, the apparatus comprising:

a gateway having a first server and a second server;

the first server of the gateway being arranged behind a firewall of the enterprise network and being coupled between the second server and one or more enterprise servers of the enterprise network;

the second server being arranged in front of the firewall and being configured for communication with an operator network associated with the mobile device;

wherein the gateway controls interaction between the mobile device and the one or more enterprise servers such that access to one or more associated enterprise services is provided in a secure manner;

wherein the gateway is configured to provide access control based on a stored multi-dimensional service access control matrix comprising at least a user dimension, a service dimension and a device dimension, the device dimension identifying mobile devices assigned to users identified by the user dimension, the service dimension identifying services accessible to said users via the mobile devices identified by the device dimension, a given entry in the service access control matrix comprising a particular permissible combination of a user identifier, a service identifier and a device identifier;

the gateway is configured to create at least one mobile service image based at least in part on the service access control matrix;

the gateway is configured to update the at least one mobile service image upon receipt of at least one of a notification or a service request; and

wherein the gateway is configured to deny a given access attempt initiated by one of the users identified by the user dimension from one of the mobile devices identified by the device dimension unless a combination of its associated user identifier, service identifier and device identifier corresponds to an entry in the service access control matrix.

2. The apparatus of claim 1 wherein the first server comprises a mobile image and presentation server.

3. The apparatus of claim 1 wherein the first server comprises one or more of a mobile service broker, a mobile content converter, and a mobile service image element.

4. The apparatus of claim 3 wherein the mobile service broker comprises a service coordinator configured to provide two-way access control utilizing the service access control matrix, the service access control matrix being constructed at least in part in conjunction with an initialization procedure based on registration information characterizing users, devices and services.

5. The apparatus of claim 4 wherein the service coordinator is operative to prevent unauthorized access to the enterprise services from the mobile device and from one or more enterprise applications.

6. The apparatus of claim 3 wherein the mobile service broker comprises a service dispatcher which communicates with a service representative.

7. The apparatus of claim 3 wherein the mobile service broker is operative to replicate the mobile service image element in conjunction with a service request from the mobile device.

8. The apparatus of claim 3 wherein the mobile content converter comprises a plurality of device adaptors, each associated with a particular type of mobile device, and a content renderer coupled to the device adaptors, the mobile content convener being operative via one or more of the device adaptors and the content renderer to transform enterprise service content into a format suitable for presentation to a user via the mobile device.

9. The apparatus of claim 1 wherein the first server is coupled to the one or more enterprise servers via a Web Services interface.

10. The apparatus of claim 1 wherein the second server comprises a mobile proxy server.

11. The apparatus of claim 1 wherein the second server comprises a plurality of gateway adaptors, each configured for communication with a corresponding element of the operator network via a specified protocol.

12. The apparatus of claim 11 wherein the specified protocol associated with a given one of the gateway adaptors comprises one of a WAP push protocol, a WAP pull protocol, an SMS protocol and an MMS protocol.

13. The apparatus of claim 1 wherein the second server is configured to communicate with the operator network over the Internet using an SSL protocol.

14. The apparatus of claim 1 wherein the one or more enterprise servers comprise one or more of a web server, an e-mail server, a voice mail server, a speech server and a presence location server.

15. The apparatus of claim 1 wherein associated with each of a plurality of enterprise applications corresponding to respective ones of the enterprise servers is a service extender which supports communication between the enterprise application and the first server of the gateway.

16. The apparatus of claim 1 wherein the first and second servers are implemented on a single common processing element of the system.

17. The apparatus of claim 1 wherein the first and second servers are implemented on respective first and second processing elements of the system that are physically separated from one another.

18. The apparatus of claim 1 wherein the gateway is implemented in the form of one or more processing elements, each of the processing elements comprising a processor coupled to a memory.

19. A method for use in controlling access to an enterprise service of an enterprise network from a mobile device in a communication system, the method comprising the step of:

controlling interaction between the mobile device and one or more enterprise servers of the enterprise network via a gateway having a first server and a second sewer, such that access to one or more associated enterprise services is provided in a secure manner;

the first server of the gateway being arranged behind a firewall of the enterprise network and being coupled between the second server and one or more enterprise servers of the enterprise network;

the second server being arranged in front of the firewall and being configured for communication with an operator network associated with the mobile device;

wherein the gateway is configured to provide access control based on a stored multi-dimensional service access control matrix comprising at least a user dimension, a service dimension and a device dimension, the device dimension identifying mobile devices assigned to users identified by the user dimension, the service dimension identifying services accessible to said users via the mobile devices identified by the device dimension, a given entry in the service access control matrix comprising a particular permissible combination of a user identifier, a service identifier and a device identifier;

the gateway is configured to create at least one mobile service image based at least in part on the service access control matrix;

the gateway is configured to update the at least one mobile service image upon receipt of at least one of a notification or a service request; and

wherein the gateway is configured to deny a given access attempt initiated by one of the users identified by the user dimension from one of the mobile devices identified by the device dimension unless a combination of its associated user identifier, service identifier and device identifier corresponds to an entry in the service access control matrix.

20. An article of manufacture comprising a machine-readable storage medium encoded with software code for use in controlling access to an enterprise service of an enterprise network from a mobile device in a communication system, wherein the software code when executed implements the step of:

controlling interaction between the mobile device and one or more enterprise servers of the enterprise network via a gateway having a first server and a second server, such that access to one or more associated enterprise services is provided in a secure manner;

the first server of the gateway being arranged behind a firewall of the enterprise network and being coupled between the second server and one or more enterprise servers of the enterprise network;

the second server being arranged in front of the firewall and being configured for communication with an operator network associated with the mobile device;

wherein the gateway is configured to provide access control based on a stored multi-dimensional service access control matrix comprising at least a user dimension, a service dimension and a device dimension, the device dimension identifying mobile devices assigned to users identified by the user dimension, the service dimension identifying services accessible to said users via the mobile devices identified by the device dimension, a given entry in the service access control matrix comprising a particular permissible combination of a user identifier, a service identifier and a device identifier;

the gateway is configured to create at least one mobile service image based at least in part on the service access control matrix;

the gateway is configured to update the at least one mobile service image upon receipt of at least one of a notification or a service request; and

wherein the gateway is configured to deny a given access attempt initiated by one of the users identified by the user dimension from one of the mobile devices identified by the device dimension unless a combination of its associated user identifier, service identifier and device identifier corresponds to an entry in the service access control matrix.