Secure remote access using enterprise peer networks

• US 20030046587A1
• Filed: 07/03/2002
• Published: 03/06/2003
• Est. Priority Date: 09/05/2001
• Status: Abandoned Application

• Current Assignee: NetSilica, Inc.
• Original Assignee: NetSilica, Inc.
• Inventors: Prathuri, Chandra, Bheemarasetti, Satyam
• Application Number:
  US10/189,349
• Publication Number:
  US 20030046587A1
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/222 using geographical location information, e.g. messages transmitted or received in proximity of a certain spot or area
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/166 at the transport layer

Abstract

A system for accessing data from any location and any device including those behind firewalls, proxy servers, address translations and other devices, while securing the data and network. The system employs a secure peer network between data sources regardless of their location enabling data access devices to retrieve or submit data from any Internet enabled device from any location. Messages are tunneled to HTML that passes through firewalls. A Queue Manager in the EPN Server software creates a unique queue for data source which can only be accessed by the data source. The user with a browser enabled device can then access the EPN Server by providing the necessary credentials, such as user id and password, and can then access the data in the data sources for which the user is permissioned. The data source maintains a non-persistent connection through a polling algorithm and services the request in the queue.

Claims

1. A distributed computing system for secure remote access by a user'"'"'s access devices to secure data sources on one or more machines comprising

a limited virtual network established between peer machines, said peer machines comprising

a client software program (EPN client) that runs on a user'"'"'s data source,

a server module that does not maintain a persistent connection with the EPN client, and

an access machine,

wherein the server module (EPN server) comprises

an access manager,

a queue manager, and

a file manager.

2. The distributed computing system of claim 1, further comprising a report manager to print detailed and summary reports on usage.

3. The distributed computing system of claim 1, wherein the access manager controls authentication, authorization and management of user communication.

4. The distributed computing system of claim 3, wherein the access manager helps set access lists for user peer machines with data, collects and maintains access lists with permissions in encrypted form on the EPN server, and screens incoming requests from data accessors.

5. The distributed computing system of claim 1, wherein the queue manager manages the creation of queues and secures operations on the queues.

6. The distributed computing system of claim 1, wherein the file manager manages transport of data/files between peers and the EPN Server.

7. The distributed computing system of claim 1, wherein said peer machines comprise

data sources to which the user has access and

the user'"'"'s access devices.

8. The distributed computing system of claim 7, wherein a data source comprises a desktop or a server machine that stores user data.

9. The distributed computing system of claim 1, wherein

said server module comprises

a server that is accessible over the Internet;

and

said access machine comprises

an Internet browser.

10. The distributed computing system of claim 7, wherein said data source, said server, and said browser are connected to the Internet.

11. The distributed computing system of claim 1, wherein

said server module comprises

a server that is accessible over the Internet;

and

said access machine comprises

an extension of the Windows Explorer as a vehicle for requesting data transfers.

12. A method for a user to access remotely via an access machine data contained on a desktop computer comprising

registering online with a server module (EPN server),

obtaining from the EPN server an EPN client program,

installing the client program on the desktop computer, wherein said desktop computer becomes a data source.

13. The method for a user to access data remotely via an access machine of claim 12, wherein the step of registering comprises obtaining an id and password.

14. The method for a user to access data remotely via an access machine of claim 12, wherein the peer machine is on a network and the user has access to the network and

to bypass firewalls the user installs the client software on the computer and opens the installed client, completes a registration and adds folders to be accessed remotely.

15. A method for a user to access remotely via an access machine data contained on a desktop computer comprising

registering online with an EPN server,

obtaining from the EPN server an EPN client program,

installing the client program on the desktop computer, wherein said desktop computer becomes a data source,

starting the EPN client program on the user'"'"'s data source.

16. The method for a user to access remotely via an access machine data contained on a desktop computer of claim 15, wherein the EPN client starts during system startup.

17. The method for a user to access remotely via an access machine data contained on a desktop computer of claim 15, wherein the EPN client programs connects to the EPN server over an HTTP tunnel.

18. The method for a user to access remotely via an access machine data contained on a desktop computer of claim 15, wherein the client uses a simple message protocol to communicate with the EPN server.

19. The method for a user to access remotely via an access machine data contained on a desktop computer of claim 18, wherein the protocol encodes application and user data packets using HTML format.

20. The method for a user to access remotely via an access machine data contained on a desktop computer of claim 19, wherein data packets are encrypted using secure socket layer libraries.

21. The method for a user to access remotely via an access machine data contained on a desktop computer of claim 18, wherein client to server communication is conducted entirely using HTTPS.

22. A method for a user to access remotely, via an access machine, data contained on a desktop computer comprising

registering online with an EPN server,

obtaining from the EPN server an EPN client program,

installing the client program on the desktop computer, wherein said desktop computer becomes a data source,

setting up access controls by the user or a corporate administrator to restrict access by the client to a limited set of data, said access controls comprising a master access list.

23. The method for a user to access remotely, via an access machine, data contained on a desktop computer of claim 22, wherein the master access list is set up using the EPN client on the user'"'"'s peer (data source).

24. The method for a user to access remotely, via an access machine, data contained on a desktop computer of claim 23, wherein the access list is modified within a subset of the master access list by using browser-based access to the EPN server.

25. The method for a user to access remotely, via an access machine, data contained on a desktop computer of claim 24, wherein access permissions are set up at the directory or file level.

26. The method for a user to access remotely, via an access machine, data contained on a desktop computer of claim 25, wherein the access machine is denied access to any other part of the corporate network or any data beyond what is set in the access list.

27. The method for a user to access remotely, via an access machine, data contained on a desktop computer of claim 22, comprising

having the EPN server'"'"'s Access Manager authenticate a peer based on the peer'"'"'s login id and password,

creating request queues for the peer,

having the EPN client polling the EPN server for requests in its request queue.

28. The method for a user to access remotely, via an access machine, data contained on a desktop computer of claim 22, wherein the EPN Client does not maintain persistent connection with EPN Server comprising

opening a network connection with an EPN Server,

picking up any request messages in its request queue or posting messages in the queue of another EPN program and closing the connection.

29. The method for a user to access remotely, via an access machine, data contained on a desktop computer of claim 28, wherein the client communicates with the server at a frequency that is determined based on its stat.

30. The method for a user to access remotely, via an access machine, data contained on a desktop computer of claim 29, wherein the allowed states for an EPN client to be in are

an initial state (S_initial)]

an active state (S_active), and

an inactive state (S_inactive).

31. The method for a user to access remotely, via an access machine, data contained on a desktop computer of claim 30, wherein

in the initial state the client communicates with the EPN server at a frequency interval of T_initial seconds looking for any active messages,

if the EPN client does not find any message to service over F_n enquiries to the EPN Server, the frequency is increased to a maximum of T_inactive (maximum inactive interval) in steps of T_step.

32. The method for a user to access remotely, via an access machine, data contained on a desktop computer of claim 31, wherein T_active<

T_initial<

=T_inactive.

33. The method for a user to access remotely, via an access machine, data contained on a desktop computer of claim 28, wherein the EPN client programs running on a user'"'"'s peer machines polls the EPN server at periodic intervals and closes the connection after each pole.

35. A method for a user with a browser accessing remotely, via an access machine having a browser, data contained on a computer in the peer neighborhood comprising

registering online with an EPN server,

obtaining from the EPN server an EPN client program,

installing the client program on the desktop computer, wherein said desktop computer becomes a data source,

authenticating the user as a peer,

creating a Reply (qB) queue on the EPN server,

selecting a peer machine from the list of peer machines available configured or interfaceable in the peer neighborhood

selecting one or more files to be downloaded to the remote machine from the listing of files that are configured previously on the peer for remote access.

communicating this request to the EPN server,

polling the EPN Server for a response in its reply queue,

having the EPN Server verify the request by looking into the access control list,

entering the request into the request queue for Peer A,

allows the EPN client polling from Peer A to pick up the requested data.

36. The method for a user with a browser accessing remotely, via an access machine having a browser, data contained on a computer in the peer neighborhood of claim 35, further comprising the client

finding and picking up the request message as the EPN client polls qA,

decoding the message to find that a file on the peer machine needs to be picked up and sent out,

uploading the file to the EPN Server over an encrypted channel,

storing the file in a data cache on the EPN Server for subsequent pick up,

sending a response to the EPN server so that the response is deposited in a reply queue for the user coming in from Peer B.

37. The method for a user with a browser accessing remotely, via an access machine having a browser, data contained on a computer in the peer neighborhood of claim 36, further comprising the browser program

finding the response message in its reply queue—

qB,

finding the location of requested data file in EPN server'"'"'s data cache,

downloading the file to the desktop (Peer B), and

upon successful completion the file is cleared from the cache.

38. A method for a user with a windows explorer accessing remotely, via an access machine having a windows explorer, data contained on a computer in the peer neighborhood comprising

registering online with an EPN server,

obtaining from the EPN server an EPN client program,

installing the client program on the desktop computer, wherein said desktop computer becomes a data source,

authenticating the user as a peer,

creating a Reply (qB) queue on the EPN server,

selecting a peer machine from the list of peer machines available configured or interfaceable in the peer neighborhood

selecting one or more files to be downloaded to the remote machine from the listing of files that are configured previously on the peer for remote access.

communicating this request to the EPN server,

polling the EPN Server for a response in its reply queue,

having the EPN Server verify the request by looking into the access control list,

entering the request into the request queue for Peer A,

allows the EPN client polling from Peer A to pick up the requested data.

39. A distributed computing system for secure remote access by a user'"'"'s access devices to secure data sources on one or more machines comprising

a limited virtual network established between peer machines, said peer machines comprising

a client software program (EPN client) that runs on a user'"'"'s data source,

a server module, and

an access machine,

wherein data accessor and data source are disconnected processes joined only by asynchronous communication using queues, and

wherein no changes are required in the corporate firewall or network configurations.

40. A method for using a distributed computing system for secure remote access by a plurality of user'"'"'s access devices to secure data sources on one or more machines comprising a limited virtual network established between peer machines, said peer machines comprising a client software program (EPN client) that runs on a user'"'"'s data source, a server module, and an access machine, said method comprising

downloading and installing the EPN client on a first peer machine (Peer A),

creating a message queue (qA) on the server module (EPN Server),

creating a master access list on Peer A for remote access,

saving the master list to a file and uploading it to the EPN Server,

having the EPN client poll for messages,

causing a second peer machine (Peer B) to log in to the EPN Server using a web browser,

creating a message queue (qB) for Peer B on the EPN Server,

causing Peer B to assign folders for remote access from a subset of the master list and saving the subset as an access list file on the EPN Server.

41. The method for using a distributed computing system for secure remote access of claim 40 further comprising

updating the master access list on Peer A and uploading the updated master list to the EPN server, and

updating the access list file on the EPN server.

42. A distributed computing system for secure remote access by a user'"'"'s access devices to secure data sources on one or more machines comprising

a limited virtual network established between peer machines, said peer machines comprising

a client software program (EPN client) that runs on a user'"'"'s data source,

a central manager server module that maintains request and reply queues to enable asynchronous communication so that no program awaits a response, and

an access machine.

43. An authentication procedure for providing security of a distributed computing system for secure remote access by a user'"'"'s access devices to secure data sources on one or more machines said distributed computing system comprising

a limited virtual network established between peer machines, said peer machines comprising

a client software program (EPN client) that runs on a user'"'"'s data source,

a server module, and

an access machine.

said authentication procedures comprising

setting up users in the EPN system using EPN'"'"'s native authentication system.

44. A method for a user having a computer to access remotely, via an access machine, data contained on an EPN server, comprising

registering online with an EPN server,

obtaining from the EPN server an EPN client program, said EPN server not maintaining a persistent connection with the EPN client,

installing the client program on the computer,

retrieving the data by the user from the EPN server by use of a browser.