# US 8,788,674 B2 · Buffering proxy for telnet access > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,788,674 B2 - Document ID: US8788674B2 - Status: Granted - Kind: B2 - Application number: 11/034,150 - Filed: 2005-01-12 - Published: 2006-07-13 - Granted: 2014-07-22 - Earliest claimed: 2005-01-12 - Assignees: Blue Coat Systems, Inc. - Applicants: David Grunwald; Kartik Ayyar - Inventors: David Grunwald; Kartik Ayyar - Web page: https://patentgrep.com/patent/US8788674B2 ## CPC - H04L 67/08: specially adapted for terminal emulation, e.g. Telnet - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04L 67/56: Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54) - H04L 67/131: Protocols for games, networked simulations or virtual reality - H04L 67/562: Brokering proxy services - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A single- or multi-protocol buffering proxy accepts communication option negotiation commands from a client before establishing a connection between the client and a host. The proxy negotiates a limited set of options with the client before the connection is established and buffers (accepts and temporarily stores without responding to) other option negotiation commands from the client. The proxy accepts credentials from a user and establishes, or denies the connection based on the credentials. If the connection is established, the proxy buffers option negotiation commands sent by the host. After the proxy logs in to the host on behalf of the user or the user logs in directly, the proxy sends each party's buffered option negotiation commands to the other party, ceases buffering option negotiation commands and enters a “pass-through” mode, in which the proxy passes characters and commands between the parties until the session ends. The proxy uses the credentials to allow or deny subsequent connection requests, without re-prompting for credentials. ## Claims ### Claim 1 A buffering communication protocol proxy for connection between a first party and a second party, comprising: a data store; a first communication protocol proxy system for authentication operative, in response to receipt of at least one communication option negotiation request from the first party before a communication connection is established between the first party and the second party, to store the received at least one communication option negotiation request in the data store; and a second communication protocol proxy system for setup operative to establish a communication connection to the second party and to send the stored at least one communication option negotiation request to the second party after the communication connection is established: wherein the first communication protocol proxy system for authentication and the second communication protocol proxy system for setup are operative to pass data through the communication protocol proxy, between the first party and the second party, after the communication connection is established. ### Claim 2 (depends on 1) The buffering communication protocol proxy of claim 1, wherein: the at least one communication option negotiation request is a Telnet option negotiation request; and the communication connection to the second party is a Telnet connection. ### Claim 3 (depends on 1) The buffering communication protocol proxy of claim 1, wherein the data is character data. ### Claim 4 (depends on 1) The buffering communication protocol proxy of claim 1, wherein the first party is a Telnet client. ### Claim 5 (depends on 1) The buffering communication protocol proxy of claim 1, wherein the first party is a Telnet proxy. ### Claim 6 (depends on 1) The buffering communication protocol proxy of claim 1, wherein the second party is a Telnet server. ### Claim 7 (depends on 1) The buffering communication protocol proxy of claim 1, wherein the second party is a Telnet proxy. ### Claim 8 (depends on 1) The buffering communication protocol proxy of claim 1, wherein the second communication protocol proxy system for setup is further operative to send the stored at least one communication option negotiation request to the second party after an account entity is logged in to the second party over the communication connection. ### Claim 9 (depends on 1) The buffering communication protocol proxy of claim 1, wherein: the first communication protocol proxy system for authentication is further operative, in response to receipt of data from the first party before the communication connection is established, to store the received data in the data store; and the second communication protocol proxy system for setup is further operative to send the stored data to the second party after the communication connection is established. ### Claim 10 (depends on 9) The buffering communication protocol proxy of claim 9, wherein the second communication protocol proxy system for setup is further operative to send the stored data to the second party after an account entity is logged in to the second party over the communication connection. ### Claim 11 (depends on 1) The buffering communication protocol proxy of claim 1, wherein the first communication protocol proxy system for authentication is further operative, in response to receipt of valid user credentials from the first party, to establish the communication connection. ### Claim 12 (depends on 11) The buffering communication protocol proxy of claim 11, further comprising an authentication database, wherein the first communication protocol proxy system for authentication is further operative to validate the user credentials by accessing the authentication database. ### Claim 13 (depends on 12) The buffering communication protocol proxy of claim 12, wherein the authentication database is directly connected to the buffering communication protocol proxy. ### Claim 14 (depends on 12) The buffering communication protocol proxy of claim 12, wherein the authentication database comprises an authentication server connected to the buffering communication protocol proxy via a network. ### Claim 15 (depends on 12) The buffering communication protocol proxy of claim 12, wherein the authentication database stores user credentials for an account on the second party, and the second communication protocol proxy system for setup is further operative, in response to establishment of the communication connection, to send the user credentials stored in the authentication database to the second party to thereby log in to the second party on behalf of the first party. ### Claim 16 (depends on 15) The buffering communication protocol proxy of claim 15, wherein the second communication protocol proxy system for setup is further operative, in response to the second communication protocol proxy system for setup logging in to the second party on behalf of the first party, to send the stored at least one communication option negotiation request to the second party. ### Claim 17 (depends on 15) The buffering communication protocol proxy of claim 15, wherein: the first communication protocol proxy system for authentication is further operative, in response to the second communication protocol proxy system for setup logging in to the second party on behalf of the first party, to receive data from the first party and to store the received data in the data store; and the second communication protocol proxy system for setup is further operative, in response to the second communication protocol proxy system for setup logging in to the second party on behalf of the first party, to send the stored data to the second party. ### Claim 18 (depends on 1) The buffering communication protocol proxy of claim 1, further comprising a log, wherein the first communication protocol proxy system for authentication and the second communication protocol proxy system for setup are operative to write information into the log when at least one predetermined event related to the first party occurs. ### Claim 19 (depends on 18) The buffering communication protocol proxy of claim 18, wherein the at least one predetermined event related to the first party is receipt of valid user credentials. ### Claim 20 (depends on 18) The buffering communication protocol proxy of claim 18, wherein the at least one predetermined event related to the first party is receipt of invalid user credentials. ### Claim 21 (depends on 18) The buffering communication protocol proxy of claim 18, wherein the at least one predetermined event related to the first party is successful establishment of the communication connection. ### Claim 22 (depends on 18) The buffering communication protocol proxy of claim 18, wherein the at least one predetermined event related to the first party is a failure to establish the communication connection. ### Claim 23 (depends on 1) The buffering communication protocol proxy of claim 1, wherein the first communication protocol proxy system for authentication is operative to receive and store the received at least one communication option negotiation request in the data store without responding to the first party. ### Claim 24 A method of establishing a communication connection between a first party and a second party, comprising: receiving at least one communication option negotiation request from the first party; storing the received at least one communication option negotiation request; after storing the at least one communication option negotiation request, establishing the communication connection between the first party and the second party: after establishing the communication connection, sending the stored at least one communication option negotiation request to the second party and passing data between the first party and the second party. ### Claim 25 (depends on 24) The method of claim 24, wherein: the at least one communication option negotiation request is a Telnet option negotiation request; and the communication connection between the first party and the second party is a Telnet connection. ### Claim 26 (depends on 24) The method of claim 24, wherein the data is character data. ### Claim 27 (depends on 24) The method of claim 24, wherein sending the stored at least one communication option negotiation request to the second party comprises sending the stored at least one communication option negotiation request to the second party after an account entity is logged in to the second party over the communication connection. ### Claim 28 (depends on 24) The method of claim 24, further comprising: before the communication connection is established, receiving data from the first party; storing the received data; and after the communication connection is established, sending the stored data to the second party. ### Claim 29 (depends on 28) The method of claim 28, wherein sending the stored data to the second party comprises sending the stored data to the second party after an account entity is logged in to the second party over the communication connection. ### Claim 30 (depends on 28) The method of claim 28, further comprising: logging in to the second party on behalf of the first party; and wherein sending the stored data to the second party comprises sending the stored data to the second party after logging in to the second party on behalf of the first party. ### Claim 31 (depends on 24) The method of claim 24, further comprising: receiving user credentials from the first party; and wherein establishing the communication connection comprises establishing the communication connection only if the user credentials are valid. ### Claim 32 (depends on 31) The method of claim 31, further comprising validating the received user credentials by accessing a local authentication database. ### Claim 33 (depends on 31) The method of claim 31, further comprising validating the received user credentials by accessing an authentication server via a network. ### Claim 34 (depends on 24) The method of claim 24, further comprising logging in to the second party on behalf of the first party. ### Claim 35 (depends on 24) The method of claim 24, wherein sending the stored at least one communication option negotiation request to the second party comprises sending the stored at least one communication option negotiation request to the second party after logging in to the second party on behalf of the first party. ### Claim 36 (depends on 24) The method of claim 24, further comprising: detecting at least one predetermined event related to the first party; and in response to detecting the at least one predetermined event related to the first party, writing information into a log. ### Claim 37 (depends on 36) The method of claim 36, wherein detecting at least one predetermined event comprises receiving valid user credentials. . ### Claim 38 (depends on 36) The method of claim 36, wherein detecting at least one predetermined event comprises receiving invalid user credentials. ### Claim 39 (depends on 36) The method of claim 36, wherein detecting at least one predetermined event comprises successfully establishing the communication connection. ### Claim 40 (depends on 36) The method of claim 36, wherein detecting at least one predetermined event comprises failing to establish the communication connection. ### Claim 41 (depends on 24) The method of claim 24, wherein receiving the at least one communication option negotiation request and storing the received at least one communication option negotiation request comprises receiving and storing the at least one communication option negotiation request without responding to the first party. ### Claim 42 An article of manufacture, comprising: a non-transitory computer-readable medium storing computer instructions for: receiving at least one communication option negotiation request from a first party; storing the received at least one communication option negotiation request; after storing the at least one communication onion negotiation request, establishing a communication connection between the first party and a second party; after establishing the communication connection, sending the stored at least one communication option negotiation request to the second party and passing data between the first party and the second party. ### Claim 43 (depends on 42) The article of manufacture of claim 42, wherein: the at least one communication option negotiation request is a Telnet option negotiation request; and the communication connection to the second party is a Telnet connection. ### Claim 44 (depends on 42) The article of manufacture of claim 42, wherein the data is character data. ### Claim 45 An authenticating multi-protocol proxy, comprising: a data store; and a proxy operative to establish a connection according to one of a plurality of protocols between a first party having an identifier and a second party, wherein the plurality of protocols includes Telnet, HTTP and FTP, the proxy being further operative to: prompt for user credentials before establishing a first connection between the first party and the second party; based on entered user credentials, obtain data indicative of user access rights; store the obtained information indicative of user access rights in the data store and associate the stored information with the identity of the first party; based on the data indicative of user access rights, either establish or not establish the first connection between the first party and the second party; and subsequently use the stored information to determine whether to establish or not establish a second connection between the first party and another party, without prompting for user credentials. ### Claim 46 (depends on 45) The authenticating multi-protocol proxy of claim 45, wherein the first party is a client. ### Claim 47 (depends on 45) The authenticating multi-protocol proxy of claim 45, wherein the first party is a proxy. ### Claim 48 (depends on 45) The authenticating multi-protocol proxy of claim 45, wherein the second party is a server. ### Claim 49 (depends on 45) The authenticating multi-protocol proxy of claim 45, wherein the second party is a proxy. ### Claim 50 (depends on 45) The authenticating multi-protocol proxy of claim 45, wherein the identifier of the first party is an Internet protocol (IP) address. ### Claim 51 (depends on 45) The authenticating multi-protocol proxy of claim 45, wherein the data indicative of user access rights identifies at least one second party to which a connection is permitted. ### Claim 52 (depends on 45) The authenticating multi-protocol proxy of claim 45, wherein: the data indicative of user access rights includes user credentials for an account on the second party; and the proxy is further operative, in response to establishment of the first connection, to send the user credentials in the data indicative of user access rights to the second party to thereby log in to the second party on behalf of the first party. ### Claim 53 (depends on 45) The authenticating multi-protocol proxy of claim 45, further comprising: a Telnet server for authentication operative, in response to receipt of at least one Telnet option negotiation request from the first party before a Telnet connection is established between the first party and the second party, to store the received at least one Telnet option negotiation request in the data store; and a Telnet client for setup operative to establish a Telnet connection to the second party and to send the stored at least one Telnet option negotiation request to the second party after the Telnet connection is established; wherein the Telnet server for authentication and a Telnet client for setup are operative to pass character data through the Telnet proxy, between the first party and the second party, after the Telnet connection is established.