Secure network resource access system

• US 7,827,293 B2
• Filed: 03/01/2001
• Issued: 11/02/2010
• Est. Priority Date: 03/01/2000
• Status: Expired due to Fees

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: PrinterOn Incorporated (Samsung Electronics Co. Ltd.)
• Inventors: Pidduck, Patrick, Lehan, Tim, Martin, Christopher, Spicer, Steven, Onischke, Mark, Coutts, Steven, Grassick, Clayton, Hatten, Philip Von, Kuhl, Larry, Hollander, Brian
• Primary Examiner(s): Mesfin; Yemane
• Application Number:
  US09/926,436
• Publication Number:
  US 20020143773A1
• Time in Patent Office: 3,533 Days
• Field of Search: 709/203, 709/217, 709/219, 709/220, 709/223, 709225-229, 713200-202, 726 2- 4, 726/11, 726/12, 370/346, 370/349, 710/46, 710/220
• US Class Current: 709/229
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 47/70 Admission control; Resource allocation
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 69/08 Protocols for interworking; Protocol conversion
• CPC Class Codes: H04L 69/32 Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level

Abstract

A secure network resource access system facilitates network access by network terminals to network resources located behind an enterprise firewall, and comprises a proxy server and a polling server. The proxy server is located logically outside the enterprise firewall for receiving application data from the network terminals. The polling server is located logically behind the enterprise firewall, and is configured to poll the proxy server to initiate transmission of the received application data from the proxy server to the polling server, to receive application data and associated network resource data from the proxy server in response to the poll, and to direct the application data to one of the network resources in accordance with the associated network resource data.

Claims

1. A secure network resource access system for facilitating access by a network terminal across a communication network to a network resource located behind a firewall, the network terminal for providing application data for subsequent processing by the network resource, the secure network resource access system comprising:

an authorization server configured to communicate with the network terminal over the communications network and to provide the network terminal with a resource name and an authorization password for the network resource, the authorization password for providing access to the network resource located behind the firewall;

a proxy server located logically outside the firewall and configured to receive the application data and associated network resource data, the proxy server configured to store the received application data in a queue, the application data being associated with the network resource via the network resource data, the network resource data including the resource name of the network resource;

a polling server located logically behind the firewall, the polling server configured to poll the proxy server to determine a status of the queue and to receive the application data and the associated network resource data across the firewall from the queue of the proxy server, the polling server to inhibit exposure to security breaches associated with firewall access ports; and

an enterprise server configured to decrypt and decompress the application data to extract the authorization password, and transmit the application data to the network resource.

2. The secure network resource access system according to claim 1, wherein the network resource includes a network printer having a network address, the received application data includes the network address of the network printer, and the polling server is configured to direct the received application data to the network printer in accordance with the network address, the application data further including at least one of text data or image data.

3. The system of claim 2, wherein the network address uniquely identifies a physical network location of the network printer and is associated with a physical property of the network printer.

4. The system of claim 2, wherein the received application data includes multimedia data.

5. The system of claim 1, wherein the proxy server is integrated with the authorization server.

6. The system of claim 1, wherein the proxy server is located on-site at the enterprise responsible for administering the network resource.

7. The system of claim 1, wherein the proxy server is located off-site from the enterprise responsible for administering the network resource.

8. The system of claim 1, wherein the network terminal is a personal computer or a wireless communication device.

9. The system of claim 1, wherein the application data is selected from the group comprising:

image data, audio data and multimedia data.

10. The system of claim 1, wherein the network resource comprises a data communication device.

11. The system of claim 10, wherein the data communication device is selected from the group comprising:

a facsimile machine, image server, and file server.

12. The system of claim 10, wherein the data communication device is selected from the group comprising:

a printing device, and an IPP compliant printer.

13. The system of claim 10, wherein the data communication device is a land based communication device or a wireless communication device.

14. The system of claim 1, wherein the network resource is selected from the group comprising:

a printer, an image server, and a file server.

15. The system of claim 1, wherein the network resource is selected from the group comprising:

an e-mail pager, and an e-mail enabled wireless telephone.

16. The system of claim 1, wherein the network terminal is a wireless enabled personal data assistant or an email enabled wireless telephone.

17. The system of claim 1, wherein the resource name identifies the physical location and properties of the network resource.

18. The system of claim 1, wherein the authorization password facilitates access to the network resource configured for authorized access.

19. The system of claim 1, wherein the authorization password is included as part of the application data forwarded to the network resource from the network terminal.

20. The system of claim 1, wherein the polling server extracts the network address and transmits the application data to the enterprise server or to the network resource for processing thereof.

26. The system of claim 1, wherein the system facilitates access to a plurality of network resources.

28. The system of claim 1, wherein the network resource is associated with a user of the network terminal.

21. A method for facilitating access by a network terminal across a communication network to a network resource located behind a firewall, the network terminal for providing application data for subsequent processing by the network resource, the secure network resource access system comprising:

providing the network terminal with a resource name and an authorization password for the network resource, the authorization password for providing access to the network resource located behind the firewall;

receiving the application data and associated network resource data, and storing the received application data in a queue of a proxy server, the application data being associated with the network resource via the network resource data, the network resource data including the resource name of the network resource;

polling the proxy server located logically outside the firewall by a polling server located logically inside the firewall, the polling to determine a status of the queue and to receive, across the firewall, application data and the associated network resource data from the queue of the proxy server to the polling server, the polling server for inhibiting exposure to security breaches associated with firewall access ports; and

decrypting and decompressing the application data to extract the authorization password, and transmit the application data to the network resource.

22. The method according to claim 21, wherein the network resource includes a network printer having a network address, and the received application data includes the network address of the network printer, the application data further including at least one of text data or image data.

23. The method according to claim 22 further comprising the step of directing the received application data to the network printer in accordance with the associated network address.

24. The method of claim 22, wherein the network address uniquely identifies a physical network location of the network printer and is associated with a physical property of the network printer.

25. The method of claim 22, wherein the received application includes multimedia data.

27. The method of claim 21, wherein the method facilitates secure access to a plurality of network resource.

29. The method of claim 21, wherein the network resource is associated with a user of the network terminal.

30. The method of claim 21, wherein the proxy server is integrated with the authorization server.

31. The method of claim 21, wherein the proxy server is located on-site at the enterprise responsible for administering the network resource.

32. The method of claim 21, wherein the proxy server is located off-site from the enterprise responsible for administering the network resource.

33. The method of claim 21, wherein the network terminal is a personal computer or a wireless communication device.

34. The method of claim 21, wherein the application data is selected from the group comprising:

image data, audio data and multimedia data.

35. The method of claim 21, wherein the network resource comprises a data communication device.

36. The method of claim 35, wherein the data communication device is selected from the group comprising:

a facsimile machine, image server, and file server.

37. The method of claim 35, wherein the data communication device is selected from the group comprising:

a printing device, and an IPP compliant printer.

38. The method of claim 35, wherein the data communication device is a land based communication device or a wireless communication device.

39. The method of claim 21, wherein the network resource is selected from the group comprising:

a printer, an image server, and a file server.

40. The method of claim 21, wherein the network resource is selected from the group comprising:

an e-mail pager, and an e-mail enabled wireless telephone.

41. The method of claim 21, wherein the network terminal is a wireless enabled personal data assistant or an email enabled wireless telephone.

42. The method of claim 21, wherein the resource name identifies the physical location and properties of the network resource.

43. The method of claim 21, wherein the authorization password facilitates access to the network resource configured for authorized access.

44. The method of claim 21, wherein the authorization password is included as part of the application data forwarded to the network resource from the network terminal.

45. The method of claim 21, wherein the polling server extracts the network address and transmits the application data to the enterprise server or to the network resource for processing thereof.