Method and apparatus for accessing Web services and URL resources for both primary and shared users over a reverse tunnel mechanism

• US 20070174454A1
• Filed: 01/23/2006
• Published: 07/26/2007
• Est. Priority Date: 01/23/2006
• Status: Abandoned Application

• Current Assignee: Bungee Labs, Inc.
• Original Assignee: Bungee Labs, Inc.
• Inventors: Hamilton, Scott, Mitchell, David, Ekstrom, Joseph, Salisbury, Lin
• Application Number:
  US11/337,279
• Publication Number:
  US 20070174454A1
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

A method and apparatus for accessing Web services and URL resources for both primary and shared users over a reverse tunnel mechanism are provided. Current limitations on accessing Web services and URL resources located behind firewalls or otherwise made secure and largely inaccessible are overcome through a novel use of a “reverse tunneling” mechanism. The mechanism uses an Agent to obfuscate physical address endpoints of Web services and other resources, as well as to package SOAP service requests in such a way that they can be passed through firewalls unimpeded. All of this data transfer is made secure through encryption, strong authentication, and by making use of the security environment on both a user'"'"'s individual device and the LAN proper. In addition, a primary user may share data access rights within the secure LAN environment to a secondary user and, using the present invention, provide only those access rights to the shared user over the open Internet.

Claims

1. In a computing environment comprising a secure device or network, the secure device or network comprising one or more data or application sources together providing both Web services and URL resources, an apparatus for providing remote access to said services and resources comprising:

an agent on said secure device or network capable of interfacing with said secure device or network and with said Web services and URL resources contained within either or both; and

a secure middleware server configured to communicate with a user and pass communications securely between said user and said agent bi-directionally.

2. The apparatus of claim 1, wherein said agent is configured to allow remote access to said secure device or network without imposing a requirement for an administrator of said secure device or network to expose said services and resources through an end point or Web server destination.

3. The apparatus of claim 2, wherein said agent comprises a standards-based mechanism for secure external access of said Web services and URL resources.

4. The apparatus of claim 3, wherein said external access comprises passing Web services communications and URL resources over a tunneling mechanism, wherein said Web services communications and URL resources are passed over a standard communications protocol.

5. The apparatus of claim 4, wherein said tunneling mechanism comprises passing said Web services communications and URL resources as clear text.

7. The apparatus of claim 5, wherein said tunneling mechanism comprises passing said clear text within an encrypted envelope, compressed, or both.

8. The apparatus of claim 4, wherein said tunneling mechanism is configured to provide a user secure semantic and logical data access of said secure device or network from a remote location.

10. The apparatus of claim 1, wherein said agent comprises a data hiding mechanism to disguise physical address endpoints of said Web services and URL resources.

12. The apparatus of claim 1, wherein said agent is configured to pass said middleware server an identification token by which said agent is identified in a manner that obscures the final destination of communications between said middleware server and said agent.

13. The apparatus of claim 12, wherein said middleware server is configured to match said user'"'"'s middleware logon credentials to said corresponding agent identification token to access said agent, wherein said user'"'"'s login credentials for said secure device or network are never transmitted external to said device or network, even in an encrypted form.

15. The apparatus of claim 1, wherein said agent is configured as a multi-user agent, wherein agent access rights are granted to one or more individual users possessing rights to access said Web services and URL resources on said secure device or network.

18. The apparatus of claim 1, wherein said middleware server is configured to pass two types of Web service requests to said agent;

a first type of request petitioning for access to Web services contained within said agent, and a second type of request petitioning for access to Web services contained within said secure device or network, but not within said agent.

20. The apparatus of claim 18, wherein said agent is configured to provide access to said Web services corresponding to said second type of requests through programmatic discovery of said Web services, or because an authorized user on said secure device or network registers interfaces and locations of said Web services in said agent.

30. The apparatus of claim 1, wherein said middleware server is configured to allow said user to access multiple agents within a single application context.

31. The apparatus of claim 1, wherein said agent is configured to append a unique identifier to a URL for the purpose of uniquely identifying a second user to whom said user has granted a portion of said user'"'"'s access rights, wherein said unique identifier identifies both said user who has granted said portion of rights, and also said second user.

32. The apparatus of claim 31, wherein said agent is configured to allow usage rights and roles to be communicated with Web service and URL resource requests and responses.

34. The apparatus of claim 1, wherein said agent is configured to initiate communication with said middleware server by making a work request which said middleware server responds to only at such time as said user makes a request for access to said Web services or said URL resources.

35. The apparatus of claim 34, wherein said apparatus functions as a reverse tunnel mechanism, and wherein said reverse tunnel mechanism is a secure mechanism for access of said Web services and URL resources because access to said secure device or network is initiated only internally.

40. The apparatus of claim 4, wherein said tunneling mechanism is configured to generate a tunneling URL that is passed back to said user interface, wherein said tunneling URL is created dynamically.

41. The apparatus of claim 1, wherein said agent is configured to provide a Web service which said middleware server accesses through Web service calls.

42. The apparatus of claim 41, wherein said agent is configured to receive from said middleware server updates to said agent with functionality for said agent, and to install said functionality as a Web service, and wherein said middleware server sends updated versions of Web services provided in said agent, and wherein said middleware server installs new services within said agent, all while said agent is running and without interruption of services.

43. The apparatus of claim 1, wherein the entire apparatus is configured to run within the confines of said secure device or network, and-wherein said middleware server provides only to users internal to said device or network access to said Web services and URL resources contained within said secure device or network.

91. The apparatus of claim 1 wherein the middleware server comprises a broker component.

6. (canceled)

9. (canceled)

11. (canceled)

14. (canceled)

16. (canceled)

17. (canceled)

19. (canceled)

21. (canceled)

22. (canceled)

23. (canceled)

24. (canceled)

25. (canceled)

26. (canceled)

27. (canceled)

28. (canceled)

29. (canceled)

33. (canceled)

36. (canceled)

37. (canceled)

38. (canceled)

39. (canceled)

44. (canceled)

45. (canceled)

46. In a computing system, a method for remotely accessing Web services and URL resources located on a secure device or network, the method comprising:

interfacing with said Web services and URL resources from a remote location wherein said interfacing is managed locally via an agent located on said secure device or network; and

passing communications securely back and forth between said Web services and a remote user via a communications path comprising said agent and a middleware server.

47. The method of claim 46, wherein said communications path comprises traversing any firewalls seamlessly to allow remote access to said secure device or network without imposing a requirement for an administrator of said secure device or network to expose said services and resources through an end point or Web server destination.

48. The method of claim 47, wherein accessing said Web services and URL resources via said agent comprises a standards-based method for secure access from an external location.

49. The method of claim 48, wherein enabling said external access comprises passing Web services communications and URL resources over a tunneling mechanism, wherein said Web services communications and URL resources are passed over a standard communications protocol.

50. The method of claim 49, wherein enabling said tunneling mechanism to access said Web services and URL resources comprises passing said Web services communications and URL resources as clear text.

52. The method of claim 50, wherein enabling said tunneling mechanism to access said Web services and URL resources comprises passing said clear text within an encrypted envelope, compressed, or both.

53. The method of claim 49, wherein enabling said tunneling mechanism to access said Web services and URL resources comprises providing a user secure semantic and logical data access of said secure device or network from a remote location.

55. The method of claim 46, wherein enabling said agent to keep said device or network secure comprises using a data hiding mechanism to disguise physical address endpoints of said Web services and URL resources.

57. The method of claim 46, wherein enabling said agent to keep said device or network secure comprises said agent passing said middleware server an identification token by which said agent is identified in a manner that obscures the final destination of communications between said middleware server and said agent.

58. The method of claim 57, wherein keeping said device or network secure comprises configuring said middleware server to match said user'"'"'s middleware logon credentials to said corresponding agent identification token in order to access said agent, wherein said user'"'"'s login credentials for said secure device or network are never transmitted external to said device or network, even in an encrypted form.

60. The method of claim 46, wherein providing access to said Web services and URL resources comprises configuring said agent as a multi-user agent, wherein agent access rights are granted to one or more individual users possessing rights to access said Web services and URL resources on said secure device or network.

63. The method of claim 46, wherein providing access to said Web services and URL resources comprises configuring said middleware server to pass two types of Web service requests to said agent;

a first type of requests petitioning for access to Web services contained within said agent; and

a second type of request petitioning for access to Web services contained within said secure device or network, but not within said agent.

65. The method of claim 63, wherein passing and handling said second type of request comprises configuring said agent to provide access to said Web services through programmatic discovery of said Web services, or because an authorized user on said secure device or network registers interfaces and locations of said Web services in said agent.

75. The method of claim 46, wherein providing secure access to said Web services and URL resources comprises configuring said middleware server to allow said user to access multiple agents within a single application context.

76. The method of claim 46, wherein is configured to append a unique identifier to a URL for the purpose of uniquely identifying a second user to whom said user has granted a portion of said user'"'"'s access rights, wherein said unique identifier identifies both said user who has granted said portion of rights, and also said second user.

77. The method of claim 76, wherein said agent is configured to allow usage rights and roles to be communicated with Web service and URL resource requests and responses.

79. The method of claim 46, wherein remotely accessing said Web services and URL resources comprises configuring said agent to initiate communication with said middleware server by making a work request which said middleware server responds to only at such time as said user makes a request for access to said Web services or said URL resources.

80. The method of claim 79, wherein said method creates a reverse tunnel mechanism, wherein said reverse tunnel mechanism provides a secure methodology for access of said Web services and URL resources because access to said secure device or network is initiated only internally.

85. The method of claim 49, wherein passing Web services communications and URL resources over a tunneling mechanism comprises configuring said tunneling mechanism to generate a tunneling URL that is passed back to said user interface, wherein said tunneling URL is created dynamically.

86. The method of claim 46, wherein remotely accessing said agent comprises configuring said agent to provide a Web service which said middleware server accesses through Web service calls.

87. The method of claim 86, wherein updating said agent comprises configuring said agent to receive updates from said middleware server with functionality for said agent and to install such functionality as a Web service, and wherein said middleware server sends updated versions of Web services provided in said agent, and wherein said middleware server installs new services within said agent, all while said agent is running and without interruption of services.

88. The method of claim 46, wherein accessing said Web services and URL resources comprises enabling said method to run within the confines of said secure device or network, and wherein said middleware server provides only to users internal to said device or network access to said Web services and URL resources contained within said secure device or network.

92. The method of claim 46, wherein the middleware server comprises a broker component.

51. (canceled)

54. (canceled)

56. (canceled)

59. (canceled)

61. (canceled)

62. (canceled)

64. (canceled)

66. (canceled)

67. (canceled)

68. (canceled)

69. (canceled)

70. (canceled)

71. (canceled)

72. (canceled)

73. (canceled)

74. (canceled)

78. (canceled)

81. (canceled)

82. (canceled)

83. (canceled)

84. (canceled)

89. (canceled)

90. (canceled)