On-premises agent for mobile cloud service

• US 9,769,139 B2
• Filed: 09/10/2014
• Issued: 09/19/2017
• Est. Priority Date: 02/07/2014
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Chizhov, Vladimir Yurievich, Mokeev, Aleksei Vasilievich, Van De Loo, Kaj
• Primary Examiner(s): Truong, Thanhnga B
• Application Number:
  US14/771,745
• Publication Number:
  US 20160028688A1
• Time in Patent Office: 1,105 Days
• Field of Search: 726 12, 726 14, 709228, 709227, 709219, 709237, 709232
• CPC Class Codes: G06F 21/6236 between heterogeneous systems
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06Q 10/10 Office automation; Time management
• CPC Class Codes: H04L 41/0226 Mapping or translating multiple network management protocols
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/565 Conversion or adaptation of application format or content adding application control or application functional data H04L67/561
• CPC Class Codes: H04L 69/08 Protocols for interworking; Protocol conversion
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 12/30 : Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/63 : Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 4/18 : Information format or content conversion, e.g. adaptation by the network of the transmitted or received information for the purpose of wireless delivery to users or terminals

Abstract

Systems, devices, and methods are disclosed for an agent device within a company'"'"'s network firewall to initiate an HTTP connection with a cloud-based gateway and then upgrade the connection to a WebSockets protocol in order to have an interactive session. Over this interactive session, a mobile device, which connects to the cloud-based intermediary, can request data from servers inside the company'"'"'s firewalls. Because the firewall is traversed using HTTP protocols (with WebSockets), it can be as safe as letting employees browse the web from inside the company'"'"'s network.

Claims

1. A method of facilitating offsite access to an enterprise computer network, the method comprising:

initiating, by an agent executing on a computer behind a firewall on an enterprise network, a hypertext transport protocol (HTTP) connection with a cloud-based gateway outside of the firewall;

responsive to initiating the HTTP connection, automatically upgrading the HTTP connection with the cloud-based gateway to a WebSocket protocol connection;

receiving, from the cloud-based gateway, by the agent, over the WebSocket protocol connection, a first request for data stored on a server behind the firewall on the enterprise network, wherein the first request has a WebSocket format compliant for the WebSocket protocol connection;

translating, by the agent, the first request received from the cloud-based gateway into a second request having an HTTP format for communication with the server on the enterprise network, wherein translating includes converting the WebSocket format of the first request to the HTTP format for the second request for communication with the server;

sending, from the agent, the second request to the server on the enterprise network;

receiving, by the agent, a first response to the second request from the server, the first response having the HTTP format;

creating, by the agent, a second response having the WebSocket format, wherein the second response is created based on converting the first response from the HTTP format to the WebSocket format; and

sending, by the agent, over the WebSocket protocol connection, to the cloud-based gateway, the second response.

2. The method of claim 1 further comprising:

receiving, at the cloud-based gateway, a third request from a mobile device;

reformatting, at the cloud-based gateway, the third request from the mobile device into the first request for data over the WebSocket protocol connection;

receiving, at the cloud-based gateway, the second response from the agent;

creating, at the cloud-based gateway, a third response from the second response from the agent; and

sending the third response to the mobile device.

3. The method of claim 1 further comprising:

packaging, by the agent, the first response from the server into a string, a binary object, or an ArrayBuffer of the second response before sending the second response.

4. The method of claim 1 wherein the server is a local web server.

5. The method of claim 1 wherein the server is running an enterprise application.

6. The method of claim 1 wherein the WebSocket protocol connection is a secure WebSocket protocol connection.

7. The method of claim 1 further comprising:

checking, by the agent with the cloud-based gateway, for an update of an agent software;

downloading, to the agent, a software update; and

installing, at the agent, the downloaded software update.

8. The method of claim 7 further comprising:

determining a time window acceptable or unacceptable for the software update; and

performing the checking, downloading, or installing based on the determined time window.

9. The method of claim 7 further comprising:

rolling back the installing of the downloaded software update to a previous version of the agent software.

10. A machine-readable non-transitory medium embodying information indicative of instructions for causing one or more machines to perform operations comprising:

initiating, by an agent executing on a computer behind a firewall on an enterprise network, a hypertext transport protocol (HTTP) connection with a cloud-based gateway outside of the firewall;

responsive to initiating the HTTP connection, automatically upgrading the HTTP connection with the cloud-based gateway to a WebSocket protocol connection;

receiving, from the cloud-based gateway, by the agent, over the WebSocket protocol connection, a first request for data stored on a server behind the firewall on the enterprise network, wherein the first request has a WebSocket format compliant for the WebSocket protocol connection;

translating, by the agent, the first request received from the cloud-based gateway into a second request having an HTTP format for communication with the server on the enterprise network, wherein translating includes converting the WebSocket format of the first request to the HTTP format for the second request for communication with the server;

sending, from the agent, the second request to the server on the enterprise network;

receiving, by the agent, a first response to the second request from the server, the first response having the HTTP format;

creating, by the agent, a second response having the WebSocket format, wherein the second response is created based on converting the first response from the HTTP format to the WebSocket format; and

sending, by the agent, over the WebSocket protocol connection, to the cloud-based gateway, the second response.

11. The machine-readable non-transitory medium of claim 10 wherein the operations further comprise:

receiving, at the cloud-based gateway, a third request from a mobile device;

reformatting, at the cloud-based gateway, the third request from the mobile device into the first request for data over the WebSocket protocol connection;

receiving, at the cloud-based gateway, the second response from the agent;

creating, at the cloud-based gateway, a third response from the second response from the agent; and

sending the third response to the mobile device.

12. The machine-readable non-transitory medium of claim 10 wherein the operations further comprise:

checking, by the agent with the cloud-based gateway, for an update of an agent software;

downloading, to the agent, a software update; and

installing, at the agent, the downloaded software update.

13. The machine-readable non-transitory medium of claim 12 wherein the operations further comprise:

determining a time window acceptable or unacceptable for the software update; and

performing the checking, downloading, or installing based on the determined time window.

14. A system for facilitating offsite access to an enterprise computer network, the system comprising:

at least one processor; and

a memory operatively coupled with the at least one processor, the at least one processor executing instructions from the memory for;

initiating, by an agent executing on a computer behind a firewall on an enterprise network, a hypertext transport protocol (HTTP) connection with a cloud-based gateway outside of the firewall;

responsive to initiating the HTTP connection, automatically upgrading the HTTP connection with the cloud-based gateway to a WebSocket protocol connection;

receiving, from the cloud-based gateway, by the agent, over the WebSocket protocol connection, a first request for data stored on a server behind the firewall on the enterprise network, wherein the first request has a WebSocket format compliant for the WebSocket protocol connection;

translating, by the agent, the first request received from the cloud-based gateway into a second request having an HTTP format for communication with the server on the enterprise network, wherein translating includes converting the WebSocket format of the first request to the HTTP format for the second request for communication with the server;

sending, from the agent, the second request to the server on the enterprise network;

receiving, by the agent, a first response to the second request from the server, the first response having the HTTP format;

creating, by the agent, a second response having the WebSocket format, wherein the second response is created based on converting the first response from the HTTP format to the WebSocket format; and

sending, by the agent, over the WebSocket protocol connection, to the cloud-based gateway, the second response.

15. The system of claim 14 wherein the instructions from the memory further comprise:

receiving, at the cloud-based gateway, a third request from a mobile device;

reformatting, at the cloud-based gateway, the third request from the mobile device into the first request for data over the WebSocket protocol connection;

receiving, at the cloud-based gateway, the second response from the agent;

creating, at the cloud-based gateway, a third response from the second response from the agent; and

sending the third response to the mobile device.

16. The system of claim 14 wherein the server is a local web server.

17. The system of claim 14 wherein the server is running an enterprise application.