Secure connections between a proxy server and a base station device

• US 9,052,861 B1
• Filed: 03/27/2011
• Issued: 06/09/2015
• Est. Priority Date: 03/27/2011
• Status: Active Grant

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Pizot, Laurent, Chapple, Loren D., Srinivasmurthy, Venugopal Kumarahalli, Kulkarni, Sudhindra Venkatesh, Chackalackal, Jojee Thomas, Ramachandran, Deepak
• Primary Examiner(s): Gillis, Brian J
• Assistant Examiner(s): Keller, Michael A
• Application Number:
  US13/072,722
• Time in Patent Office: 1,535 Days
• Field of Search: 709/203, 709217-229
• US Class Current: 1/1
• CPC Class Codes: G06F 21/608 Secure printing
• CPC Class Codes: G06F 3/1285 Remote printer device, e.g. being remote from client or server
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/08 Access security

Abstract

Systems and methods of establishing a secure connection between a proxy server and a base station device are disclosed. An example of a method includes providing a proxy server with a session token for a mobile device from a cloud service. The method also includes providing a session code directly to the mobile device from the cloud service based on the session token. The method also includes providing access by the proxy server to the base station device if the proxy server provides the session code to the cloud service.

Claims

1. A method comprising:

sending, by a cloud service that is part of a cloud network to a proxy server, a session token for a mobile device, wherein the proxy server is outside the cloud network;

sending, by the cloud service, a session code based on the session token directly to the mobile device;

receiving, by the cloud service from the proxy server, the session code received by the proxy server from the mobile device, the session code sent by the proxy server to the cloud service to access a base station device that is separate from the proxy server;

enabling, by the cloud service, access by the proxy server to the base station device in response to the receiving of the session code by the cloud service from the proxy server; and

providing, by the cloud service, a job from the proxy server to the base station device, the job initiated at the proxy server by the mobile device.

2. The method of claim 1, further comprising registering the base station device with the cloud service.

3. The method of claim 2, wherein registering the base station device includes at least associating a device identification (ID) of the base station device at the cloud service.

4. The method of claim 1, further comprising:

receiving, by the cloud service from the proxy server, a request for the session token for the proxy server to access the base station device, wherein the request received from the proxy server is responsive to a request by the mobile device.

wherein the sending of the session token by the cloud service to the proxy server is responsive to the request.

5. The method of claim 4, further comprising:

receiving, by the cloud service from the mobile device, the session token received by the mobile device from the proxy server; and

validating, by the cloud service, the session token received by the cloud service from the mobile device, wherein the sending of the session code to the mobile device is in response to the validating.

6. The method of claim 1, further comprising combining the session token and a secret to generate the session code.

7. The method of claim 1, further comprising expiring the session token based on an event.

8. The method of claim 1, further comprising preauthorizing the mobile device to receive the session code before the mobile device is identified to the cloud service as an authorized device.

9. The method of claim 1, further comprising a three-way authorization process including:

the proxy server requesting the session token from the cloud service, and the proxy server sending the session token to the mobile device; and

the cloud service receiving a request from the mobile device to validate the session token received from the proxy server, the cloud service providing the session code to the mobile device, and the proxy server receiving, from the mobile device, the session code received by the mobile device from the cloud service, and the proxy server providing the session code back to the cloud service.

10. The method of claim 1, further comprising

the cloud service confirming the proxy service is authorized to access the base station device via the cloud service by comparing the session code received from the proxy service with the session code the cloud service sent to the mobile device,

wherein the cloud service enabling the proxy service to access the base station device is in response to the comparing.

11. The method of claim 1, wherein the cloud service is implemented by a computer server that is separate from the proxy server, and the base station device is separate from the cloud service, and wherein:

the cloud service sends the session token to the proxy server over a network; and

the cloud service enabling access by the proxy server to the base station device enables the proxy server to send data to the base station device over the network.

12. A system comprising:

a cloud service including a computer server that is part of a cloud network and configured to;

generate a session token for a mobile device,

deliver the session token to a proxy server that is outside the cloud network,

generate a session code based on the session token received from the mobile device,

deliver the session code directly to the mobile device, receive, from the proxy server, the session code received by the proxy server from the mobile device, the session code sent by the proxy server to the cloud service to access a base station device that is separate from the proxy server;

enable access by the proxy server to the base station device in response to the receiving the session code by the cloud service from the proxy server; and

provide a job from the proxy server to the base station device, the job initiated at the proxy server by the mobile device.

13. The system of claim 12, wherein the base station device is registered with the cloud service.

14. The system of claim 13, wherein the cloud service is to receive a registration request from the base station device while the base station device has a trusted connection established with the mobile device.

15. The system of claim 12, wherein the cloud service is configured to assign the base station device a device identification (ID).

16. The system of claim 12, wherein the session token expires after a predetermined time.

17. The system of claim 12, wherein the session code is derived from the session token and is different from the session token.

18. The system of claim 12, wherein the computer server is separate from the proxy server, and the base station device is separate from the cloud service, and wherein:

the cloud service is configured to deliver the session token to the proxy server over a network; and

the cloud service enabling access by the proxy server to the base station device enables the proxy server to access the base station device over the network.

19. The system of claim 12, wherein the cloud service is configured to further:

receive, from the proxy server, a request for the session token for the proxy server to access the base station device, wherein the request received from the proxy server is responsive to a request by the mobile device,

wherein the generating of the session token by the cloud service is responsive to the request.

20. The system of claim 19, wherein the cloud service is configured to further:

receive, from the mobile device, the session token received by the mobile device from the proxy server; and

validate the session token received by the cloud service from the mobile device, wherein the generating of the session code is in response to the validating.

21. A non-transitory computer-readable storage medium storing instructions that upon execution cause a system to:

execute a cloud service including a computer server that is part of a cloud network to;

generate a session token for a mobile device;

send the session token to a proxy server over a network, the proxy server being outside the cloud network;

receive, from the mobile device, the session token that was sent by the proxy server to the mobile device;

generate a session code based on the session token received from the mobile device;

send the session code to the mobile device, to cause the mobile device to send the session code to the proxy server;

receive, from the proxy server, the session code received by the proxy server from the mobile device, the session code sent by the proxy server to the cloud service to access a printer device that is separate from the proxy server;

enable access by the proxy server to the printer device over the network in response to the receiving of the session code from the proxy server, wherein the computer server of the cloud service is separate from the proxy server, and the printer device is separate from the cloud service.

22. The non-transitory computer-readable storage medium of claim 21, wherein the cloud service is configured to establish a trusted relationship with the printer device during a registration process including the mobile device.

23. The non-transitory computer-readable storage medium of claim 21, wherein the mobile device is removable from the printer device to provide access by the proxy server to the printer device even when the mobile device is at a physically distant location from the printer device.

24. The non-transitory computer-readable storage medium of claim 21, wherein the instructions cause the system to execute the cloud service to further:

receive, from the proxy server, a request for the session token for the proxy server to access the base station device, wherein the request received from the proxy server is responsive to a request by the mobile device,

wherein the generating of the session token by the cloud service is responsive to the request.

25. The non-transitory computer-readable storage medium of claim 24, wherein the instructions cause the system to execute the cloud service to further:

validate the session token received by the cloud service from the mobile device, wherein the generating of the session code is in response to the validating.

26. A method comprising:

receiving, by a cloud service that is part of a cloud network from a proxy server that is outside the cloud network, a request for a session token for the proxy server to access a base station device, wherein the request received from the proxy server in responsive to a request by a mobile device;

sending, by the cloud service to the proxy server, the session token for the mobile device;

receiving, by the cloud service from the mobile device, the session token received by the mobile device from the proxy server;

sending, by the cloud service, a session code based on the session token directly to the mobile device;

receiving, by the cloud service from the proxy server, the session code received by the proxy server from the mobile device, the session code sent by the proxy server to the cloud service to access a base station device;

enabling, by the cloud service, access by the proxy server to the base station device in response to the receiving of the session code by the cloud service; and

providing, by the cloud service, a job from the proxy server to the base station device, the job initiated at the proxy server by the mobile device.