Secured FTP architecture

• US 7,308,710 B2
• Filed: 12/05/2001
• Issued: 12/11/2007
• Est. Priority Date: 09/28/2001
• Status: Active Grant

• Current Assignee: JP Morgan Chase Bank, N.A. (JP Morgan Chase & Co)
• Original Assignee: JP Morgan Chase Bank, N.A. (JP Morgan Chase & Co)
• Inventors: Yarborough, William Jordan
• Primary Examiner(s): Vu; Kim
• Assistant Examiner(s): PAN, PEILIANG
• Application Number:
  US10/006,484
• Publication Number:
  US 20030065950A1
• Time in Patent Office: 2,197 Days
• Field of Search: 713/200, 713/201, 713/188, 713/194, 713/1, 713/2, 713/151, 713/152, 713/150, 710 1- 3, 711101-104, 709/222, 709/227, 709/229, 709/230, 726/2, 726/11, 380/200, 380/201, 380/255, 380/277, 176/2, 715/748
• US Class Current: 726/11
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Abstract

A system for providing secured file transfer protocol (“FTP”) services between a passive FTP client system coupled to a private network and a FTP server coupled to a public communication network, such as the Internet. The passive FTP client system requests a communication session with a first proxy server that is coupled to the private network. The passive FTP client system submits to the first proxy server the uniform resource locator (“URL”) of a desired FTP server. The first proxy server initiates an outbound request from the private network, through a single port on a firewall, to a second proxy server that is coupled to the public communication network. The first proxy server submits the URL to the second proxy server. The second proxy server uses the URL to establish a FTP session with the desired FTP server. Upon receiving an identified socket provided by the FTP server for the data channel, the first proxy server changes the received data packets from the FTP server by substituting its own IP address for the FTP server'"'"'s IP address, thus identifying a new socket on the first proxy server. The passive FTP client system transmits a FTP data request to the new socket on the first proxy server. The first proxy server forwards the data request to the FTP server via the outbound connection established with the second proxy server. All FTP data flows through a single port on the firewall.

Claims

1. A system providing secure transfer of data, said system comprising:

a client system;

a server;

a security system interposed between said client system and said server for controlling communications between said client system and said server, said security system including;

a first proxy system and a second proxy system, said first proxy system coupled between said client system and said second proxy system, and said second proxy system coupled between said server and said first proxy system;

a firewall coupled between said first proxy system and said second proxy system, said firewall restricting data flow between said first proxy system and said second proxy system to outbound communications through a single port on said firewall;

wherein all FTP data are transferred between said client system and said server through said single port on said firewall.

2. The system of claim 1, wherein said client system provides an identification of said server to said first proxy system;

said first proxy system forwards said identification to said second proxy system through said single port on said firewall; and

said second proxy system uses said identification to establish a data transfer session with said server.

3. The system of claim 2, wherein said server establishes a command channel with said client system through said security system.

4. The system of claim 2, wherein said server transmits a representation of a socket to be used for a data channel to said client system.

5. The system of claim 4, wherein prior to forwarding said represented socket to said client system, said first proxy system modifies said representation of said socket by substituting said first proxy system'"'"'s IP address for said server'"'"'s IP address.

6. The system of claim 5, wherein said client system transmits a request through said security system for data located on said server.

7. The system of claim 6, wherein said first proxy system forwards said modified request through said single port on said firewall to said server.

8. The system of claim 7, wherein said second proxy system modifies said request by substituting said server'"'"'s IP address for said first proxy system'"'"'s IP address.

9. The system of claim 8, wherein said server transmits data corresponding to said request to said second proxy system, and said data corresponding to said request for data is forwarded by said second proxy system through said single port on said firewall to said first proxy system.

10. The system of claim 9, wherein said first proxy system forwards said data corresponding to said request for data to said client system.

11. The system of claim 1, further comprising a plurality of servers and a plurality of client systems, wherein all data transferred between said plurality of servers and said plurality of clients are transferred through said single port on said firewall.

12. A method for providing secure transfer of data, said method comprising:

using a client system to request data;

using a server to provide data;

controlling communications between said client system and said server using a security system, said security system including;

a first proxy system and a second proxy system, said first proxy system coupled between said client system and said second proxy system, and said second proxy system coupled between said server and said first proxy system;

a firewall coupled between said first proxy system and said second proxy system, said firewall restricting data flow between said first proxy system and said second proxy system to outbound communications through a single port on said firewall;

using said security system to transfer said data between said client and said server; and

restricting all flow of FTP data passing through said security system through a single port on said firewall.

13. The method of claim 12, further comprising providing to said first proxy system an identification of said server by said client system;

forwarding said identification to said second proxy system by said first proxy system through said single port on said firewall; and

using said identification by said second proxy system to establish a data transfer session with said server.

14. The method of claim 13, further comprising establishing a command channel by said server with said client system through said security system.

15. The method of claim 13, further comprising transmitting a representation of a socket to be used for a data channel by said server to said client system.

16. The method of claim 15, further comprising modifying said representation of said socket by said first proxy system.

17. The method of claim 16, wherein said modifying step further comprises substituting said first proxy system'"'"'s IP address for said server'"'"'s IP address.

18. The method of claim 17, further comprising forwarding said modified represented socket to said client system.

19. The method of claim 18, further comprising transmitting a request through said security system for data located on said server by said client system.

20. The method of claim 19, further comprising modifying said request by said first proxy system, prior to forwarding said request.

21. The method of claim 20, wherein said modifying step further comprises substituting said server'"'"'s IP address for said first proxy system'"'"'s IP address.

22. The method of claim 21, further comprising forwarding said modified request through said single port on said firewall by said first proxy system to said server.

23. The method of claim 22, further comprising transmitting data corresponding to said request to said second proxy system by said server, and forwarding said data corresponding to said request by said second proxy system through said single port on said firewall to said first proxy system.

24. The method of claim 22, further comprising forwarding said data corresponding to said request by said first proxy system to said client system.

25. The method of claim 12, further comprising requesting data on a plurality of servers by a plurality of client systems.