Architecture for serving and managing independent access devices

• US 8,095,624 B2
• Filed: 12/28/2000
• Issued: 01/10/2012
• Est. Priority Date: 12/28/2000
• Status: Active Grant

• Current Assignee: Windstream Intellectual Property Services, Inc. (Windstream Holdings II LLC)
• Original Assignee: CenterBeam, Inc. (EarthLink Incorporated)
• Inventors: Epstein, Marc, Collins, Mark, Barclay, Peter, Karney, Brian, Ricart, Glenn
• Primary Examiner(s): EL CHANTI, HUSSEIN A
• Application Number:
  US09/750,500
• Publication Number:
  US 20020087670A1
• Time in Patent Office: 4,030 Days
• Field of Search: 709/220
• US Class Current: 709/220
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 41/5041 characterised by the time relationship between creation and deployment of a service
• CPC Class Codes: H04L 41/5054 Automatic deployment of services triggered by the service manager, e.g. service implementation by automatic configuration of network components

Abstract

A method of providing services from a service provider to a plurality of independent entities, includes defining a predetermined one way trust relationship, separating first services wherein the relationship runs from the service provider to the serviced entity from second services wherein the relationship runs from the serviced entity to the service provider, thus preventing transitive trust. Preferably, the second services do not trust the first services.

Claims

1. A method for a service provider to provide services to a plurality of client computers, the method comprising:

providing a first set of services on a first set of one or more servers of the service provider to the plurality of client computers by providing secure access to the first set of one or more servers by the plurality of client computers, but prohibiting secure access to the plurality of client computers by the first set of one or more servers; and

providing a second set of services on a second set of one or more servers of the service provider to the plurality of client computers by providing secure access to the plurality of client computers by the second set of one or more servers, but prohibiting secure access to the second set of one or more servers by the plurality of client computers.

2. The method of claim 1 wherein said first set of services comprise data services.

3. The method of claim 2 wherein said second set of services comprise management and configuration services.

4. The method of claim 2 wherein said first set of services comprises at least one service selected from the group consisting of:

virus protection services, remote access, backup, software sharing, and telephony services.

5. The method of claim 3 wherein said second set of services comprises at least one service selected from the group consisting of:

security, password management, software updates, software distribution, and access control.

6. The method of claim 1 further comprising:

preventing any said client computer from securely accessing resources in any other said client computer.

7. The method of claim 3 further comprising:

providing secure access to the first set of one or more servers by the second set of one or more servers.

8. The method of claim 3 further comprising:

preventing said first set of one or more servers from securely accessing resources in said second set of one or more servers.

9. The method of claim 3 wherein said first set of one or more servers providing said data services and said second set of one or more servers providing said management and configuration services are separate.

10. The method of claim 1 further comprising:

connecting said first set of one or more servers to at least one of the group consisting of;

the Internet, a public switched telephone network, and a data network.

11. A system for providing services to a plurality of client computers, the system comprising:

a first set of one or more servers for providing a first set of services to the plurality of client computers by providing secure access to the first set of one or more servers by the plurality of client computers, but prohibiting secure access to the plurality of client computers by the first set of one or more servers; and

a second set of one or more servers for providing a second set of services to the plurality of client computers by providing secure access to the plurality of client computers by the second set of one or more servers, but prohibiting secure access to the second set of one or more servers by the plurality of client computers.

12. The system of claim 11 wherein said first set of services comprise data services.

13. The system of claim 12 wherein said second set of services comprise management and configuration services.

14. The system of claim 12 wherein said first set of services comprises at least one service selected from the group consisting of:

virus protection services, remote access, backup, software sharing, and telephony services.

15. The system of claim 13 wherein said second set of services comprises at least one service selected from the group consisting of:

security, password management, software updates, software distribution, and access control.

16. The system of claim 11 wherein said system is operable to:

prevent any said client computer from securely accessing resources in any other said client computer.

17. The system of claim 13 wherein the system is operable to provide secure access to the first set of one or more servers by the second set of one or more servers.

18. The system of claim 13 wherein said system is operable to:

prevent said first set of one or more servers from securely accessing resources in said second set of one or more servers.

19. The system of claim 13 wherein said first set of one or more servers providing said data services and said second set of one or more servers providing said management and configuration services are separate.

20. The system of claim 11 wherein said first set of one or more servers is connected to at least one of the group consisting of:

the Internet, a public switched telephone network, and a data network.

21. A method for a service provider to provide services to a plurality of client computers, the method comprising:

separating the services provided by the service provider into a first group of services provided by a first group of one or more servers of the service provider, and a second group of services provided by a second group of one or more servers of the service provider;

providing the first set of services from the first set of servers through a one-way trust connection from the first set of servers to the client computers; and

providing the second set of services from the second set of servers to the client computers through a one-way trust connection from the client computers to the second set of servers.

22. The method of claim 21 further comprising:

preventing any said client computer from gaining secure access to any other said client computer.

23. The method of claim 21 wherein said first set of services comprises at least one service selected from the group consisting of:

virus protection services, remote access, backup, software sharing, and telephony services.

24. The method of claim 21 wherein said second set of services comprises at least one service selected from the group consisting of:

security, password management, software updates, software distribution, and access control.

25. A method for providing services from a service provider to a plurality of client computers, the method comprising:

enabling a first set of services on a first set of servers of the service provider through a one-way trust connection from the first set of servers to the plurality of client computers;

enabling a second set of services on a second set of servers of the service provider to the plurality of client computers through a one-way trust connection from the client computers to the second set of servers; and

providing the first and second sets of services.

26. A system for providing services to a plurality of client computers, the system comprising:

a first set of servers for providing a first set of services to the plurality of client computers through a one-way trust relationship from the first set of servers to the plurality of client computers; and

a second set of servers for providing a second set of services to the plurality of client computers through a one-way trust relationship from the plurality of client computers to the second set of servers.