Relaying messages through a firewall

• US 7,627,681 B2
• Filed: 07/20/2005
• Issued: 12/01/2009
• Est. Priority Date: 07/20/2005
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Ruiz-Meraz, Cesar M., Lee, Alfred McClung IV, Madan, Umesh, Nog, Saurab
• Primary Examiner(s): Najjar; Saleh
• Assistant Examiner(s): Ashraf; Waseem
• Application Number:
  US11/185,347
• Publication Number:
  US 20070022164A1
• Time in Patent Office: 1,595 Days
• Field of Search: 709/206, 709/227, 709/228, 709/230
• US Class Current: 709/228
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 69/24 Negotiation of communication capabilities

Abstract

The present invention extends to methods, systems, and computer program products for relaying messages through firewalls. A message relay negotiates first communication parameters with relay components inside a firewall and (potentially different) second communication parameters with applications outside the firewall. The message relay receives a message from an outside application in accordance with the second negotiated parameters and maps an electronic address in the received message to an inside application. The message relay transforms the message and sends the transformed message over an established connection through the firewall to a relay component in accordance with the first negotiated parameters. The relay component receives the transformed message and transforms the transformed message back into the message. The relay component delivers the message to the inside application in accordance with the second negotiated parameters.

Claims

1. In a computing network that includes a first computer system located outside of a firewall, and a second computer system located inside the firewall, a computer program product comprising computer storage media containing computer-executable instructions for implementing a method of relaying messages through the firewall between a first relay component located outside the firewall and a second relay component located inside the firewall, and wherein the method is comprised of acts of:

the first and second relay components negotiating a first set of communication parameters, the first set of communication parameters which are configured to control how the first relay component is to relay messages through the firewall to the second relay component, including relaying a message from an application running on a first computer system located outside the firewall to an application running on a second computer system located inside the firewall, and wherein the first set of communication parameters include one or more of the following parameters;

encoding parameters, compression parameters, encryption parameters, transfer protocol parameters, security parameters, and ordering guarantee parameters;

said first relay component and said application running on the first computer system negotiating a second set of communication parameters, the second set of communication parameters insufficient for communicating through the firewall, the second set of communication parameters reusing at least one parameter from the first set of communications parameters, the first set of parameters having a first value for the at least one reused parameter and the second set of parameters having a second different value for the at least one reused parameter;

said first computing system sending the message to the first relay component in accordance with the second set of communication parameters, the message intended for delivery to the application running on the second computing system, prior to relaying the message through the firewall to the second relay component located inside the firewall, said first relay component configuring the message for relay through the firewall, including;

transforming the message so that it conforms to the first set of communication parameters, transforming including;

encoding the message and the second set of communication parameters into an encoded element to obscure the meaning of the second set of communication parameters, including the second value for the at least one reused parameter, from the firewall such that the second set of communication parameters can pass through the firewall for subsequent interpretation by the application running on the second computing system but are prevented from interfering with the firewall'"'"'s interpretation of the first communication parameters; and

encapsulating the encoded element in a second message, the second message configured in accordance with the first set of communication parameters, including the first value for the at least one reused parameter; and

mapping the second message to an address for the application running on the second computing system inside the firewall; and

the first relay component then sending the second message through the firewall to the second relay component located inside the firewall in accordance with the first set of communication parameters.

2. The computer program product as recited in claim 1, wherein the method further comprises:

an act of receiving at the first relay component registration data from the application running on the second computing system inside the firewall, the registration data indicating that the application running on the second computing system is to receive messages having a destination that corresponds to said address.

3. The computer program product as recited in claim 1, wherein the act of negotiating said second set of communication parameters comprises selecting the second set of communication parameters from among encoding parameters, compression parameters, encryption parameters, transfer protocol parameters, security parameters, ordering guarantee parameters, to be used for communication between the message relay and outside application.

4. The computer program product as recited in claim 1, wherein the act of sending said message configured in accordance with the second set of communication parameters comprises an act of sending a SOAP message that includes a URI indicating the destination for the SOAP message.

5. The computer program product as recited in claim 1, wherein the act of mapping the second message to an address for the application running on the second computing system inside the firewall comprises an act of mapping a URI to a connection through the firewall.

6. The computer program product as recited in claim 1, wherein the act of encapsulating the encoded element into a second message comprises an act of encapsulating a first SOAP message inside a second SOAP message.

7. The computer program product as recited in claim 1, wherein the first set of negotiated communication parameters define a communication protocol with increased security relative to the second set of negotiated communication parameters such that communication through the firewall has increased security.

8. In a computing network that includes a first computer system located outside of a firewall, and a second computer system located inside the firewall, a computer program product comprising computer storage media containing computer-executable instructions for implementing a method of relaying messages through the firewall between a first relay component located outside the firewall and a second relay component located inside the firewall, and wherein the method is comprised of acts of:

the first and second relay components negotiating a first set of communication parameters, the first set of communication parameters to control how the first relay component is to relay messages through the firewall to the second relay component, including relaying a message from an application running on a first computer system located outside the firewall to an application running on a second computer system located inside the firewall, and wherein the first set of communication parameters include one or more of the following parameters;

encoding parameters, compression parameters, encryption parameters, transfer protocol parameters, security parameters, and ordering guarantee parameters;

said first relay component and said application running on the first computer system negotiating a second set of communication parameters, the second set of communication parameters insufficient for communicating through the firewall, the second set of communication parameters reusing at least one parameter from the first set of communications parameters, the first set of parameters having a first value for the at least one reused parameter and the second set of parameters having a second different value for the at least one reused parameter, the second set of relay components used in configuring messages sent from the application running at the first computing system to the first relay component;

said second relay component receiving a message from the first relay component, the message having been relayed through the firewall in accordance with the first set of communication parameters, the message being mapped by the first relay component to an address for the application running on the second computing system inside the firewall, and transformed by the first relay component so that it conforms to the first set of communication parameters, including the first value for the at least one reused parameter, the transformation including;

an encapsulated encoded element in the message, the encoded element representing another message sent from the application running on the first computer system to the first relay component in accordance with the second set of communication parameters, the encoded element obscuring the meaning of the second set of communication parameters, including the second value for the at least one reused parameter, from the firewall such that the second set of communication parameters can be passed through the firewall for subsequent interpretation by the application running on the second computing system without interfering with the firewall'"'"'s interpretation of the first communication parameters, including the first value for the at least one reused parameter; and

the second relay component then unwrapping the encoded element encapsulated in the received message to reveal the other message so that the other message conforms once again to the second set of communication parameters including the second value for the at least one reused parameter;

the second relay component then delivering the other message to the application running on the second computing system located inside the firewall; and

the second computing system then sending back to the first computing system a reply message configured in accordance with the second set of communication parameters.

9. The computer program product as recited in claim 8, wherein the method further comprises:

an act of establishing a connection between the second relay component and the first relay component through the firewall; and

an act of sending registration data indicating that the application running on the second computing system inside the firewall is to receive messages having a destination that corresponds to said address.

10. The computer program product as recited in claim 8, wherein first message is a first SOAP message and the encoded element is a second SOAP message.

11. The computer program product as recited in claim 10, wherein unwrapping said received message comprises exposing said second SOAP message that was encapsulated in the first SOAP message.

12. The computer program product as recited in claim 8, wherein sending back to the first computing system a reply message comprises sending the reply message in accordance with connection bound bi-directional communication between the applications running at the first and second computing systems.

13. The computer program product as recited in claim 8, wherein the first set of negotiated communication parameters define a communication protocol with increased security relative to the second set of negotiated communication parameters such that communication through the firewall has increased security.

14. In a computing network that includes a first computer system located outside of a firewall, and a second computer system located inside the firewall, a computer program product comprising computer storage media containing computer-executable instructions for implementing a method of relaying messages through the firewall between a first relay component located outside the firewall and a second relay component located inside the firewall, and wherein the method is comprised of acts of:

the first and second relay components negotiating a first set of communication parameters, the first set of communication parameters to control how the first relay component is to relay messages through the firewall to the second relay component, including relaying a message from an application running on a first computer system located outside the firewall to an application running on a second computer system located inside the firewall, and wherein the first set of communication parameters include one or more of the following parameters;

encoding parameters, compression parameters, encryption parameters, transfer protocol parameters, security parameters, and ordering guarantee parameters;

said first relay component and said application running on the first computer system negotiating a second set of communication parameters, the second set of communication parameters insufficient for communicating through the firewall, the second set of communication parameters reusing at least one parameter from the first set of communication parameters, the first set of communication parameters having a first value for the at least one common parameter and the second set of communication parameters having a second different value for the at least one common parameter;

said first computing system sending the message to the first relay component in accordance with the second set of communication parameters, the message intended for delivery to the application running on the second computing system;

prior to relaying the message through the firewall to the second relay component located inside the firewall, said first relay component configuring the message for relay through the firewall, including;

transforming the message so that it conforms to the first set of communication parameters, transforming including;

encoding the message and the second set of communication parameters into an encoded element to obscure the meaning of the second set of communication parameters, including the second value for the at least one reused parameter, from the firewall such that the second set of communication parameters can pass through the firewall for subsequent interpretation by the application running on the second computing system but are prevented from interfering with the firewall'"'"'s interpretation of the first communication parameters, including the first value for the at least one reused parameter; and

encapsulating the encoded element in a second message, the second message configured in accordance with the first set of communication parameters, including the first value for the at least one reused parameter; and

mapping the second message to an address for the application running on the second computing system inside the firewall; and

the first relay component then sending the second message through the firewall to the second relay component located inside the firewall in accordance with the first set of communication parameters, including the first value for the at least one reused parameter;

the second relay component then unwrapping the encoded element form the second message to reveal the message so that the message conforms once again with the second set of communication parameters, including the second value for the at least one reused parameter;

the second relay component then delivering the message to the application running on the second computing system located inside the firewall in accordance with the second set of communication parameters;

the second computing system then sending back to the first computing system a reply message configured in accordance with the second set of communication parameters; and

the first computing system thereafter receiving the reply message.

15. The computer program product of claim 14, wherein said the message is a first SOAP message and the second message is a second SOAP message so that composable protocol elements of the first SOAP message do not interfere with the composable protocol elements of the second SOAP message.