Patent ID: 9621405
Date: 2017-04-11
CPC Classifications: H04L

Claim:
1. A method for initiating secure communication between a data store and a client device via a gateway, the method comprising: receiving, from the data store, a request to establish a control channel between the data store and the gateway; receiving, at the gateway, from the client device, a first connection initiation request to establish a first connection between the client device and the gateway, the first connection initiation request including a connection request to the data store; forwarding the connection request included in the first connection initiation request, from the gateway to the data store, via the control channel in response to receiving the first connection initiation request from the client device; receiving, at the gateway, from the data store, a second connection initiation request to establish a second connection between the gateway and the data store; receiving authentication information corresponding to the client device from the gateway at the data store via the control channel; authenticating the client device on the basis of the received authentication information, and thereafter selectively establishing the second connection in dependence on the authentication; joining, at the gateway, the first connection between the client device and the gateway and the second connection between the gateway and the data store; determining, at the gateway, data flow mode for the client device based on a security policy associated with the client device, the data flow modes comprising an inflow only mode, an outflow only mode, and an inflow and outflow mode, wherein the inflow only mode permits inbound flow of data to the data store but does not permit outbound flow of data from the data store, wherein the outflow only mode permits outbound flow of data from the data store but does not permit inbound flow of data to the data store, and wherein the inflow and outflow mode permits inbound flow of data to the data store and outbound flow of data from the data store; in response to receiving inbound data from the client device via the first connection at the gateway: when the data flow mode is determined to be one of the outflow only mode or the inflow and outflow mode, transmitting, from the gateway, the received outbound data to the client device via the first connection; and when the data flow mode is determined to be the inflow only mode, refusing to transmit, from the gateway, the received outbound data to the client device via the first connection.