US 6,606,708 B1Granted

Secure server architecture for Web based data management

AssigneeWorldCom, Inc.

InventorsCarol Y. Devine, Gerald A. Shifrin, Richard W. Shoulberg

Life of this patent

Estimating the term…

Loading patent…

Abstract

A double firewalled system is disclosed for protecting remote enterprise servers that provide communication services to telecommunication network customers from unauthorized third parties. A first router directs all connection requests to one or more secure web servers, which may utilize a load balancer to efficiently distribute the session connection load among a high number of authorized client users. On the network side of the web servers, a second router directs all connection requests to a dispatcher server, which routes application server calls to a proxy server for the application requested. A plurality of data security protocols are also employed. The protocols provide for an identification of the user, and an authentication of the user to ensure the user is who he/she claims to be and a determination of entitlements that the user may avail themselves of within the enterprise system. Session security is described, particularly as to the differences between a remote user's copper wire connection to a legacy system and a user's remote connection to the enterprise system over a “stateless”public Internet, where each session is a single transmission, rather than an interval of time between logon and logoff, as is customary in legacy systems.

Claims26

Dependent claims

A system for securing an enterprise communications network, said system having client access through the public Internet, said system comprising:

(a) a first Internet firewall for accepting service requests from an enterprise client and routing said requests to one or more preselected addresses behind said firewall, said firewall permitting access in compliance with a first set of filtering rules;
(b) at least one secure web server for receiving said service requests and managing a secure client session over the public Internet, said secure server providing session management for said service request, said session management including client identification, validation and a session identifier to link said session with said client, wherein said session identifier is a web cookie generated by a separate server during an entitlements communications, after identification and validation of the client;
(c) a second Internet/Internet firewall for accepting service requests from a secure web server and routing said requests to one or more preselected addresses behind said firewall corresponding to dispatcher servers, said firewall permitting access in compliance with a second set of filtering rules;
(d) at least one dispatcher server for communicating with said secure web server through a second firewall, said second firewall accepting services requests from said secure web server and routing said requests to said dispatcher server in compliance with a second set of filtering rules, said dispatcher server providing system access to said enterprise communications network after client entitlements have been verified;
and
(e) a plurality of proxy services linking said dispatcher server to a plurality of system resources over said communications network, said plurality of system resources providing communications network management capabilities for said enterprise client, said system resources responsive to service requests from said enterprise client to generate client data or instructions relating to said communications network.

3 more elements

A system for securing an enterprise communications network, said system having client access through the public Internet, said system comprising:

(a) a first Internet firewall for accepting service requests from an enterprise client and routing said requests to one or more preselected addresses behind said firewall, said firewall permitting access in compliance with a first set of filtering rules;
(b) a plurality of web servers having said preselected addresses for receiving said service requests and managing a plurality of client sessions over the public Internet, a load of said client sessions per each of said web servers is balanced by web balancers, each of said web servers providing session management for said service request, said session management including client identification, validation and a session identifier to link a session with a client, wherein said session identifier is a web cookie generated by a separate server during an entitlements communications, after identification and validation of the client;
(c) at least one dispatcher server for communicating with said web servers through a second firewall, said second firewall accepting services requests from said web servers and routing said requests to said dispatcher server in compliance with a second set of filtering rules, said dispatcher server providing system access to said enterprise communications network after client entitlements have been verified;
and
(d) a plurality of proxy servers linking said dispatcher server to a plurality of application servers within said communications network, said application servers communicating with a plurality of system resources to provide communications network management capabilities for said enterprise clients.

2 more elements

A method of securing an enterprise communications network having public access via the public Internet, said method enabling access by a plurality of enterprise clients, said method comprising:

(a) routing all public access requests to one or more first preselected addresses for response via a first set of routing rules;
(b) authenticating a secure web server in response to said request for access and initiating a secure session with a client browser over the Internet;
(c) encrypting communications between said client browser and said secure server with a first security protocol;
(d) routing a request for client authentication and a set of client entitlements from said secure server to a second preselected address at log-on via a second set of routing rules, wherein said client authentication and client and entitlements are provided by an authentication server;
(e) encrypting communications within said network with a second security protocol;
and
(f) creating a session management object at each log-on to authenticate the client's browser to the enterprise network at each communication from the browser during the communications session, said session management object including client identification, validation and a session identifier to link a session with a client, wherein said session identifier is a unique web cookie generated by a separate server during an entitlements communications, after identification and validation of the client.

4 more elements

Dependencies are inferred from the claim text.

Facts

Application: 09/159,406Filed 24 Sep 1998 · us provisional application
Priority: 26 Sep 1997
Granted: 12 Aug 2003
Term ends: Not estimatedThe source records don’t support an estimate.

Classification147 codes

H04L 63/02
Network architectures or network communication protocols for network security: for separating internal from external traffic, e.g. firewalls
G06F 11/0709
The processing taking place on a specific hardware platform or in a specific software environment: in a distributed system consisting of a…
G06F 11/0769
Error or fault reporting or storing: readable error formats, e.g. cross-platform generic formats, human understandable formats
G06F 11/0775
Error or fault reporting or storing: content or structure details of the error report, e.g. specific table structure, specific error fields