NETWORK ARCHITECTURE FOR SECURE DATA COMMUNICATIONS

• US 20100030839A1
• Filed: 07/30/2008
• Published: 02/04/2010
• Est. Priority Date: 07/30/2008
• Status: Active Grant

• Current Assignee: Visa USA, Inc. (Visa, Inc.)
• Original Assignee: Visa USA, Inc. (Visa, Inc.)
• Inventors: JEYARAJ, MELVIN, CERAGIOLI, DENNIS M.
• Granted Patent: US 8,631,134 B2
• Time in Patent Office: Days
• US Class Current: 709/201
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/1036 Load balancing of requests to servers for services different from user content provisioning, e.g. load balancing across domain name servers

Abstract

A network architecture includes a perimeter network connected between an internal network and an external network. The perimeter network includes one or more external edge nodes that are connected to the external network and a plurality of proxy servers that are each connected to one or more of the external edge nodes. One or more internal edge nodes are connected between the plurality of proxy servers and the internal network. The proxy servers are operable to establish a first secure connection between a destination through the external network and a second secure connection to a destination in the internal network. Each of the plurality of proxy servers provide a substantially identical identification for authentication when establishing the first and second secure connections.

Claims

1. A method for secure data communications, comprising:

receiving an indication of a data communication from an external network to a perimeter network, wherein the perimeter network includes one or more external edge nodes, one or more internal edge nodes and a plurality of proxy servers connected between the one or more external edge nodes and the one or more internal edge nodes;

selecting one of the plurality of proxy servers to receive the data communication via a first secure connection, wherein the plurality of proxy servers are configured with substantially similar configuration information;

receiving at least a portion of the data communication over the first secure connection via one or more external edge nodes and the selected proxy server; and

when the selected proxy server becomes unavailable, selecting another one of the plurality of proxy servers to receive a remaining portion of the data communication over the first secure connection.

2. The method of claim 1, further comprising:

transmitting the data communication from the selected one of the plurality of proxy

servers to an internal network over a second secure connection.

3. The method of claim 2, further comprising:

establishing the first secure connection, wherein establishing the first secure connection comprises providing an identification by one of the plurality of proxy servers that includes the substantially similar configuration information; and

establishing the second secure wherein establishing the second secure connection comprises providing an identification by one of the plurality of proxy servers that includes the substantially similar configuration information.

4. The method of claim 3, wherein the identification is a digital certificate provided for authentication and wherein the substantially similar configuration information includes identification information.

5. The method of claim 3, wherein the identification is a digital certificate provided for authentication and wherein the substantially similar configuration information includes encryption information.

6. The method of claim 4, further comprising:

when the first secure connection and second secure connection are not successfully established, determining whether one of the plurality of proxy servers is unavailable;

when one of the plurality of proxy servers is unavailable, removing the unavailable proxy server from a list of available proxy servers; and

establishing the first secure connection and second secure connection with one of a remaining one or more available proxy servers.

7. The method of claim 1, wherein selecting one of the plurality proxy servers to receive the data communication via the first secure connection comprises:

selecting one of a plurality of proxy servers to receive the data communication based on a list of available proxy servers for load balancing and a load balancing algorithm between the plurality of proxy servers.

8. The method of claim 7, further comprising:

maintaining the list of available proxy servers for load balancing; and

when one of the plurality of proxy servers becomes unavailable, removing the unavailable proxy server from the list of available proxy servers for load balancing.

9. The method of claim 8, wherein each of the one or more external edge nodes maintains the list of available proxy servers for load balancing and selects one of the plurality of proxy servers to receive the data communication based on the list of available proxy servers for load balancing and a load balancing algorithm.

10. The method of claim 9, wherein one or more load balancing nodes connected between the one or more external edge nodes and the plurality of proxy servers maintains the list of available proxy servers for load balancing and selects one of the plurality of proxy servers to receive the data communication based on the list of available proxy servers for load balancing and a load balancing algorithm.

11. The method of claim 10, wherein each of the plurality of proxy servers includes a cluster management module that maintains the list of available proxy servers for load balancing and selects one of the plurality of proxy servers to receive the data communication based on the list of available proxy servers for load balancing and a load balancing algorithm.

12. A network system, comprising:

one or more external edge nodes connected to an external network;

one or more internal edge nodes connected to an internal network; and

a plurality of proxy servers connected between the external edge nodes and the internal edge nodes, wherein each of the plurality of proxy servers are operable to receive data communications over a first secure connection from the external network and transmitting the data communications over a second secure connection to the internal network.

13. The network system of claim 12, wherein each of the one or more external edge nodes maintains a list of available proxy servers for load balancing and selects one of the plurality of proxy servers to receive the data communications over the first secure connection based on the list of available proxy servers for load balancing and a load balancing algorithm.

14. The network system of claim 13, wherein each of the one or more external edge nodes is operable to monitor the status of the plurality of proxy servers and when one of the proxy servers becomes unavailable, removes the unavailable proxy server from the list of available proxy servers for load balancing.

15. The network system of claim 14, wherein each of the one or more internal edge nodes maintains a list of available proxy servers for load balancing and selects one of the plurality of proxy servers to receive the data communications over the second secure connection based on the list of available proxy servers for load balancing and a load balancing algorithm.

16. The network system of claim 12, further comprising:

one or more load balancing nodes connected between the one or more external edge nodes and the plurality of proxy servers, wherein the one or more load balancing nodes maintain a list of available proxy servers for load balancing and selects one of the plurality of proxy servers to receive the data communications over the first secure connection based on the list of available proxy servers for load balancing and a load balancing algorithm.

17. The network system of claim 16, further comprising:

one or more load balancing nodes connected between the plurality of proxy servers and the one or more internal edge nodes, wherein the one or more load balancing nodes maintain a list of available proxy servers for load balancing and selects one of the plurality of proxy servers to receive the data communications over the second secure connection based on the list of available proxy servers for load balancing and a load balancing algorithm.

18. The network system of claim 12, wherein each of the plurality of proxy servers includes a cluster management module that maintains a list of available proxy servers and selects one of the plurality of proxy servers to receive data communications based on the list of available proxy servers.

19. The network system of claim 12, further comprising:

a management server connected to the plurality of proxy servers, wherein the management server configures each of the plurality of proxy servers with substantially identical configuration information for establishing the first and second secure connections.

20. The network system of claim 19, wherein the management server includes:

a configuration database that stores configuration information for the plurality of proxy servers; and

a directory database of authorized users of the internal network.