Providing secure access to network services

• US 20010042215A1
• Filed: 07/03/2001
• Published: 11/15/2001
• Est. Priority Date: 03/13/1998
• Status: Active Grant

• Current Assignee: Schlumberger Technology Corporation (Schlumberger NV)
• Original Assignee: Omnes
• Inventors: Sullivan, James M., Keddie, James A.
• Granted Patent: US 6,877,041 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A computer network includes one or more service computers configured to provide multiple network services via the network, and one or more connection devices that allow multiple network client computers to access the services via the network. The network also includes a single routing computer that serves as a firewall through which all traffic between the network services and the network client computers must pass.

Claims

1. A computer network comprising:

one or more service computers configured to provide multiple network services via the network,

one or more connection devices that allow multiple network client computers to access the services via the network, and

a single routing computer that serves as a firewall through which all traffic between the network services and the network client computers must pass.

2. The computer network of

claim 1

, wherein the routing computer includes a static route table containing predefined rules that govern the flow of traffic between the network services and the network client computers.

3. The computer network of

claim 1

, further comprising at least one other routing computer that acts as a firewall through which all traffic between the computer network and the network client computers must pass.

4. The computer network of

claim 3

, wherein the other routing computer includes a static route table containing predefined rules that govern the flow of traffic between the computer network and the network client computers.

5. The computer network of

claim 1

, wherein the connection device is configured to allow access via a public frame relay.

6. The computer network of

claim 1

, wherein the connection device is configured to allow access via a PPP link.

7. The computer network of

claim 1

, wherein the connection device is configured to allow access via an ISDN link.

8. The computer network of

claim 1

, wherein the connection device is configured to allow access via the Internet.

9. The computer network of

claim 8

, further comprising another routing computer that acts as a firewall through which all traffic between the network services and the Internet must pass.

10. A method for use in providing network services via a computer network to multiple network client computers, the method comprising:

allowing the network client computers to access the services via one or more connection devices in the network, and

requiring all traffic between the network services and the network client computers to pass through a single routing computer that acts as a firewall.

11. The method of

claim 10

, wherein the routing computer includes a static route table containing predefined rules that govern the flow of traffic between the network services and the network client computers.

12. The method of

claim 10

, further comprising requiring all traffic between the computer network and the network client computers to pass through at least one other routing computer that acts as a firewall.

13. The method of

claim 12

, wherein the other routing computer includes a static route table containing predefined rules that govern the flow of traffic between the computer network and the network client computers.

14. The method of

claim 10

, further comprising allowing the network client computers to access the network via a public frame relay.

15. The method of

claim 10

, further comprising allowing the network client computers to access the network via a PPP link.

16. The method of

claim 10

, further comprising allowing the network client computers to access the network via an ISDN link.

17. The method of

claim 10

, further comprising allowing the network client computers to access the network via the Internet.

18. The method of

claim 10

, further comprising requiring all traffic between the network services and the Internet to pass through another routing computer that acts as a firewall.

19. A computer network comprising:

a service computer configured to provide a network service to multiple network client computers via the computer network,

two routing computers, each of which acts as a firewall through which all traffic between the computer network and one of the network client computers must pass, and

another routing computer that acts as a firewall through which all traffic between the network service and the network client computers must pass.

20. The computer network of

claim 19

, further comprising a static route policy that governs the flow of traffic between the network services and the network client computers.

21. The computer network of

claim 20

, wherein the route policy comprises multiple route tables, each stored in one of the routing computers.

22. A method for use in providing a network service to multiple network client computers via a computer network, the method comprising:

requiring all traffic between the computer network and each of the network client computers to pass through one of two routing computers that act as firewalls, and

requiring all traffic between the network service and the network client computers to pass through another routing computer that acts as a firewall.

23. The method of

claim 22

, further comprising applying a static route policy to govern the flow of traffic between the network services and the network client computers.

24. The method of

claim 23

, further comprising distributing the route policy among multiple route tables, each stored in one of the routing computers.