Method and apparatus for sharing data between a server and a plurality of clients

• US 7,849,305 B2
• Filed: 08/26/2002
• Issued: 12/07/2010
• Est. Priority Date: 08/26/2002
• Status: Expired due to Fees

• Current Assignee: Axxia Technologies
• Original Assignee: Axxia Technologies
• Inventors: Leoutsarakos, Nicholaos I.
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): GEE, JASON KAI YIN
• Application Number:
  US10/227,351
• Publication Number:
  US 20040039905A1
• Time in Patent Office: 3,025 Days
• Field of Search: 709/229, 713/153
• US Class Current: 713/153
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

A method and apparatus is disclosed for controlling the sharing of data in a network between a plurality of client units and a corporate server using a secure bridging unit. Each of the plurality of client units, the corporate server and the secure bridging unit are identified using an identifier. A client unit communicates with the corporate server using the secure bridging unit. A central management unit manages the plurality of client units, the corporate server and the secure bridging unit.

Claims

1. A method for managing a sharing of data between a plurality of client units and a corporate server located on a wide area network, the method comprising the steps of:

authenticating a client unit connected to said network with a central management server connected to said network, the authenticating comprising the providing of an identification of the client unit to the central management server over said wide area network;

providing from the client unit to the central management server over said wide area network an identification of a corporate server to which the client unit wishes to communicate;

providing from the central management server to the client unit an address on the network of the location of a secure bridging unit using at least the identification of the client unit, said secure bridging unit having a location on said network different from said corporate server and being available to forward traffic to said corporate server;

providing a message to communicate to the secure bridging unit from the client unit over said wide area network, said message comprising said identification of the corporate server to which said client unit wishes to communicate and data to provide to said corporate server;

if said message to communicate with the secure bridging unit is accepted by said secure bridging unit, transferring at least one part of said message to said corporate server over said wide area network;

whereby the use of the central management server and the secure bridging unit enables a control of the communication between the client unit and the corporate server.

2. The method as claimed in claim 1, further comprising the authenticating of said client unit by said corporate server.

3. The method as claimed in claim 1, wherein the authenticating of said client unit by said central management server is performed using a bilateral secure authentication.

4. The method as claimed in claim 3, wherein the bilateral secure authentication is performed using Secure Socket Layer (SSL).

5. The method as claimed in claim 1, wherein said providing from the central management server to the client unit said address on the network of the location of said secure bridging unit using at least said identification of the client unit further comprises providing, from said central management server to the client unit, a corporate server session key encrypting at least one part of said message for said corporate server.

6. The method as claimed in claim 5, wherein said providing from the central management server to the client unit said address on the network of the location of said secure bridging unit using at least said identification of the client unit further comprises providing, from said central management server to the client unit, a secure bridging encryption key for encrypting at least one part of said encrypted message to communicate to said secure bridging unit.

7. The method as claimed in claim 5 wherein said providing of said server session key is performed randomly in time and kept in volatile memory.

8. The method as claimed in claim 6, wherein said providing of said secure bridging encryption key is performed randomly in time and kept in volatile memory.

9. The method as claimed in claim 1, wherein a plurality of client units share data with a plurality of corporate servers.

10. The method as claimed in claim 1, wherein said network is a Wide Area Network (WAN).

11. The method as claimed in claim 10, wherein said Wide Area Network is Internet, further wherein the authenticating is performed by accessing a Web server.

12. The method as claimed in claim 1, wherein said secure bridging unit is chosen according to a location of a secure bridging unit with respect to said client unit and to said corporate server on said network.

13. The method as claimed in claim 1, wherein said secure bridging unit is chosen according to a workload of a secure bridging unit.

14. A method for managing a sharing of data between a plurality of parking lot units and a central management server of a party located on a wide area network, the method comprising the steps of:

authenticating a parking lot unit connected to said network with a central management server connected to said network, the authenticating comprising the providing of an identification of the parking lot unit to the central management server over said wide area network;

providing from the parking lot unit to the central management server an identification of a central computer to which the parking lot unit wishes to communicate;

providing over said wide area network from the central management server to the parking lot unit an address on the network of the location of a secure bridging unit using at least said identification of the parking lot unit, said secure bridging unit having a location on said network different from said central computer and being available to forward traffic to said central computer;

providing a message to communicate to the secure bridging unit from the parking lot unit over said wide area network, said message comprising said identification of the central computer to which said parking lot unit wishes to communicate and data to provide to said central computer;

if said message to communicate with the secure bridging unit is accepted by said secure bridging unit, transferring at least one part of said message to said central computer over said wide area network;

whereby the use of the central computer and the secure bridging unit enables a control of the communication between the parking lot unit and the central computer.

15. The method as claimed in claim 14, further comprising the step of storing at least one part of said message to communicate in said central management server.

16. The method as claimed in claim 15, further comprising the step of sending an invoice to said party having said central management server using said at least one part of said message stored.

17. The method as claimed in claim 14, further comprising the step of providing a new client username and a new client password to said central management server for adding a corresponding new parking lot unit to said plurality of parking lot units and receiving, from said central management server, an identification for said new parking lot unit.

18. The method as claimed in claim 17, wherein said providing of said client username and said client password is performed via a webserver.

19. The method as claimed in claim 17, further comprising the step of providing an encryption key from said central management server to said new parking lot unit.

20. The method as claimed in claim 16, wherein the step of sending an invoice to said party comprises the step of computing using the at least one part of said message stored a number of times said providing said message to communicate to the secure bridging unit from the parking lot unit is performed.

21. The method as claimed in claim 16, wherein the step of sending an invoice to said party comprises the step of computing a number indicative of an amount of data transferred using the at least one part of said message stored, and including said amount of data transferred in said invoice.

22. A system for managing sharing of data between a plurality of client units and a corporate server located on a wide area network, the system comprising:

a plurality of client units connected to said network, each client unit comprising a client unit identifier identifying said client unit, the client unit further comprising a corporate server identifier identifying said corporate server to which said client unit intends to share said data;

a corporate server connected to said network and comprising a corporate server identifier;

a central management server, located on said network, comprising a list of secure bridging unit identifiers, the central management server further comprising an authentication module receiving an authentication request from a client unit for a corporate server and providing over said network, in response, to said client unit, an address on said network of a secure bridging unit according to said list of secure bridging unit identifier;

at least one secure bridging unit having a location on said network different from said corporate server and being available to forward traffic to said corporate server over said network, said secure bridging unit comprising a store of at least one relation between a client unit identifier and a corporate server identifier, the secure bridging unit further comprising a store of an address on said network of said corporate server, the secure bridging unit being operative to receive a communication request from a client unit and forward at least one part of said communication request to said corporate server;

wherein data shared between said corporate server and said client unit are managed using the central management server in combination with the secure bridging unit.

23. The system as claimed in claim 22, wherein the central management server comprises a list of corporate server encryption session keys, further wherein said corporate server comprises a corporate server encryption session key provided from said list of corporate server encryption session keys by said central management server.

24. The system as claimed in claimed in claim 22, wherein the central management server comprises a list of secure bridging unit encryption keys, further wherein said secure bridging unit comprises a secure bridging unit encryption key provided from said list of secure bridging unit encryption keys by said central management server.

25. The system as claimed in claim 22, wherein said authentication module operates using Secure Socket Layer (SSL) protocol.

26. The system as claimed in claim 22, wherein said at least one secure bridging unit, said plurality of client units, said corporate server are identified using a username and a password, the central management server further comprising a list of said username and said password.

27. The system as claimed in claim 22, wherein said plurality of client units are identified using a username and a password, at least one corporate server further comprises a list of said username and said password.

28. The system as claimed in claim 22, wherein Kerberos is used to authenticate.