Abstract:
A relay server is located outside a firewall and provides access to a server inside the firewall. Both the server and a client (the client is outside the firewall) initiate a connection with the relay server. The relay server then sets up a connection between the server and client, to thereby enable the server and client to communicate. Such communication is enabled without needing an inbound port in the firewall, thereby enhancing security.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
       [0001]    The present application claims the benefit of U.S. Provisional Patent Application No. 60/814,872 filed on Jun. 20, 2006, which is incorporated herein by reference in its entirety. 
     
     BACKGROUND OF THE INVENTION 
       [0002]    1. Field of the Invention 
         [0003]    The present invention generally relates to networking. In particular, the present invention relates to techniques for establishing communications with a secured enterprise network from a remote user agent. 
         [0004]    2. Background Art 
         [0005]    High-end mobile communication devices provide a number of services aside from simple voice telephony. One popular area of use for such devices, particularly in business applications, is as mobile user agents for e-mail communications, as well as other popular applications in device management, security, or custom applications. 
         [0006]    In order to access corporate services such as, by way of example, e-mail, it is necessary to have an enterprise sever in addition to a traditional mail server that manages the communications between the mail server and a user agent, such as a cellular phone device. The enterprise server constantly monitors the mail server in a manner similar to other user e-mail clients within the same corporate network. When mail is received by the mail server, it is retrieved by the enterprise server and stored locally for subsequent transmission to the user agent. The mail is then transmitted to the user agent over the Internet and, in the case of wireless user agents such as cellular phones, over a wireless network. 
         [0007]    The previous enterprise server software design suffers from the need to initiate communications from the user agent to the enterprise server. Turning to  FIG. 1 , enterprise servers such as enterprise server  100  are generally located behind a protective firewall  102  configured to block many incoming communications. In order to initiate communications with an enterprise server  100  located behind such a firewall  102 , it is necessary to open a port for inbound communications at the firewall. Unfortunately, by opening a firewall port to accept desired inbound communications, the corporate network is opened up to undesired inbound communications, soliciting hacking attempts upon the enterprise server  100  itself and the rest of the corporate network. 
         [0008]    One solution in the prior art is to provide a staging server in the demilitarized zone (DMZ), the area of the network outside of the firewall  102 . The enterprise server  100  is still required to access the mail server (or other service) within the corporate network, and the staging server must be able to establish a connection to the enterprise server  100 , so firewall ports must be opened for inbound connections. While certain security measures can be taken to ensure that only the staging server is able to communicate through those ports, the enterprise server  100  now becomes very vulnerable to attacks, as may the rest of the enterprise network. The staging server is also very vulnerable to attacks as it is located entirely within the DMZ. This is especially critical because the prior art solution requires that the staging server retrieve and store a copy of mail messages from the enterprise server  100  for subsequent transmission to a user agent  108  over the Internet  104  and a wireless communication network  106 , since the user agent  108  does not have a persistent connection to the wireless communication network  106 . 
         [0009]    Accordingly, what is desired is a method, system, and computer program product for the access of corporate enterprise services without the need to breach the corporate firewall. Furthermore, it is desired that the proposed method, system, and computer program product not retain sensitive mail messages and/or other data objects on any system located within the DMZ for security reasons. Finally, it is desired that the proposed method, system, and computer program product function as seamlessly as possible with existing networking platforms. 
       BRIEF SUMMARY OF THE INVENTION 
       [0010]    The invention includes a method of initiating communication between a user agent and an enterprise server through a firewall. The firewall is configured to allow the enterprise server to initiate a first connection to a relay server. A second connection is initiated from the user agent to the relay server. The two connections are then associated with each other, and subsequent data is relayed between the user agent and the enterprise server. 
         [0011]    The invention also includes a system for implementing secure communications between a user agent and an enterprise server through a firewall. The system includes a client such as the user agent, a server such as the enterprise server, and a relay server. The relay server is connected to the client by a connection established by the client, and to the server through the firewall by a connection established by the server. The relay server is configured to relay data from the connection between itself and the server to the connection between itself and the client, as well as from the connection between itself and the client to the connection between itself and the server. 
         [0012]    The invention further includes a computer program product having control logic (software) that comprises first and second receiving means. The first receiving means enables a processor to receive a communication request from a server, and the second receiving means enables a processor to receive a communication request from a client. The control logic further comprises an association means that enables a processor to associate the communication request from the server to the communication request from the client, and a first and second relaying means. The first relaying means enables a processor to relay communications from the client to the server, and the second relaying means enables a processor to relay communications from the server to the client. 
     
     
       BRIEF DESCRIPTION OF THE DRAWINGS/FIGURES 
         [0013]    The accompanying drawings, which are incorporated herein and form part of the specification, illustrate the present invention and, together with the description, further serve to explain the principles of the invention and to enable a person skilled in the relevant art(s) to make and use the invention. 
           [0014]      FIG. 1  illustrates the components of a prior art network that facilitates communications between a user agent and an enterprise server. 
           [0015]      FIG. 2  illustrates the components of a network that facilitates communications between a user agent and an enterprise server in accordance with an embodiment of the present invention. 
           [0016]      FIG. 3  illustrates a sequence diagram of the steps to establish communications between an enterprise server and a user agent through a relay server in accordance with an embodiment of the present invention. 
           [0017]      FIGS. 4A and 4B  illustrate data mappings maintained by a relay server and an enterprise server in accordance with an embodiment of the present invention. 
           [0018]      FIG. 5  illustrates the components of a network that facilitates communications between one or more user agents, each user agent belonging to one of one or more companies, and one or more enterprise servers, each enterprise server belonging to one of the one or more companies, in accordance with an embodiment of the present invention. 
           [0019]      FIG. 6  illustrates the components of a network that facilitates communications between a user agent and a plurality of enterprise servers wherein a relay server distributes a load among each of the plurality of enterprise servers, in accordance with an embodiment of the present invention. 
           [0020]      FIG. 7  illustrates the components of a network that facilitates communications between a user agent and an enterprise server wherein a plurality of relay servers process user agent connections in a load-distributing arrangement, in accordance with an embodiment of the present invention. 
       
    
    
       [0021]    The features and advantages of the present invention will become more apparent from the detailed description set forth below when taken in conjunction with the drawings, in which like reference characters identify corresponding elements throughout. In the drawings, like reference numbers generally indicate identical, functionally similar, and/or structurally similar elements. The drawing in which an element first appears is indicated by the leftmost digit(s) in the corresponding reference number. 
       DETAILED DESCRIPTION OF THE INVENTION 
     I. Relay Server—Overview 
       [0022]      FIG. 2  illustrates an exemplary network that facilitates communications with a secured enterprise environment. As shown in  FIG. 2 , the network includes an enterprise server  200  that is connected to a relay server  210  through a firewall  202 . The relay server is connected to a wireless communication network  206  through the Internet  204 . The wireless communication network  206  further provides communications with a client user agent  208 . In accordance with an embodiment of the present invention, the user agent  208  is a mobile device offering such as Windows Mobile, Palm, or Nokia, although the invention is not limited to these examples (such examples being provided solely for purposes of illustration, and not limitation). It should be noted that while the invention is described herein using the example of wireless communications over wireless communication network  206 , the invention is not limited to this example embodiment. The user agent  208  need not be a wireless device, and nothing in this specification should be construed such as to limit embodiments of the user agent  208  to wireless devices. Also, persons skilled in the relevant arts will further appreciate that the relay server  210  need not be located in close topological or geographical proximity to the enterprise server  200  and/or firewall  202  as shown in  FIG. 2 , and may be separated by intervening network nodes. Persons skilled in the relevant arts will further appreciate that the term “enterprise” as applied throughout the specification is used in reference to a typical corporate network, but may further include, by way of example, a similarly configured personal network, and should not be interpreted as limited to a corporate network. 
         [0023]    In accordance with an embodiment of the present invention, the enterprise server  200  is configured to provide data to client systems within a corporate network (or other type of network organization) and to the user agent  208 . This data may include, by way of example, e-mail messages, although the invention is not limited to this example embodiment and can include any type of data or object. The firewall  202  is configured in a manner consistent with ensuring the safety of systems within the corporate network, including the enterprise server  200 . Accordingly, it is desired that the firewall  202  be configured in order to open the fewest number of ports for inbound and outbound communications. In accordance with an embodiment of the present invention, the firewall  202  is configured to deny all incoming connections and allow a single outbound connection from the enterprise server  200  to the relay server  210 . One skilled in the relevant arts will appreciate that other unrelated services located behind the firewall  202  may necessitate the opening of additional ports within the firewall  202  for proper interaction with clients other than the user agent  208 . 
         [0024]    In accordance with another embodiment of the present invention, the relay server  210  is configured to listen for communication requests from the enterprise server  200  as well as from the user agent  208 . The relay server  210  is not required to initiate any communications itself. 
         [0025]      FIG. 3  illustrates the process by which communications between the user agent  208  and the enterprise server  200  are established through the relay server  210  in accordance with an embodiment of the present invention. At step  300 , the enterprise server  200  initiates a connection to the relay server  210  through an open communications port in the firewall  202 . Step  300  is performed at the initialization of the enterprise server  200 , and the established connection remains permanently active in accordance with an embodiment of the present invention. In accordance with another embodiment of the present invention, step  300  is performed whenever more connections are needed, and the established connection may be closed after it is used. One skilled in the relevant arts will appreciate that there may be additional relevant ways of establishing a connection in accordance with step  300 . At step  302 , the user agent  208  initiates a connection to the relay server  210 , requesting a connection with the enterprise server  200 . At step  304 , the relay server  210  notifies the enterprise server  200  that the user agent  208  has established a connection to the relay server  210 , and further provides the enterprise server  200  with any requests issued by the user agent  208  in its initial communication with the relay server  210 . 
         [0026]    At step  306 , the enterprise server  200  replies to the communication request issued by the user agent  208  by sending a reply to the relay server  210 . The relay server  210  forwards this reply to the user agent  208  at step  308 . As will be described in more detail herein (see Section II), the relay server  210  at this point has established a communication link between the user agent  208  and the enterprise server  200 . At step  310  and beyond, the user agent  208  and enterprise server  200  continue communications with each other by means of this established connection. 
         [0027]    While  FIGS. 2 &amp; 3  only show a single user agent  208 , it is possible for many user agents such as user agent  208  to simultaneously connect to the enterprise server  200  in a similar manner as user agent  208 . As will be described in more detail herein, the relay server  210  maintains information on each established connection between itself and a user agent such as user agent  208  as well as between itself and the enterprise server  200 . As will also be described in more detail herein, it is further possible for multiple enterprise servers such as enterprise server  200  to establish connections to the relay server  210 , and the relay server  210  maintains distinguishing information regarding each established connections. 
       II. Relay Server Design 
       [0028]    In accordance with an embodiment of the present invention, the relay server  210  manages connections from one or more user agents  208  and one or more enterprise servers  200  by maintaining identifying information and other information for the established connections, such maintained information shown as  410  in  FIG. 4   a . In accordance with an embodiment of the present invention, this identifying information includes a map  413  of server identifiers  412  to free channel lists  414 . Each enterprise server  200  connected to the relay server  210  has a unique server identifier  412 . Furthermore, each connected enterprise server  200  is associated  413  with a free channel list  414 . The free channel list  414  identifies channels (each channel being an established connection session between an enterprise server  200  and the relay server  210 ) associated with a particular enterprise server  200 . The relay server  210  additionally maintains a mapping  417  of an enterprise server session number  416  to a server identifier  418 , where the enterprise server session number  416  is a unique identifier used to reference the connection established with the particular enterprise server  200  referred to by the server identifier  418 . Whereas the mapping  413  is a one-to-many relationship from a particular enterprise server  200  to free channels  414 , the mapping  417  is a one-to-one mapping from the enterprise server session number  416  to the particular enterprise server  200  connected via the established connection. Similarly, the relay server  210  maintains a mapping  421  of a user agent session number  420  to a server identifier  422 , where the user agent session number  420  is a unique identifier used to reference the connection established by the particular user agent  208  connected to the particular enterprise server  200  identified by the server identifier  422 . It should be noted that the server identifier is shown as elements  412 ,  418 , and  422  in  FIG. 4   a  because there may be more than one server identifier (corresponding to different enterprise servers) known to the relay server  210 . One skilled in the relevant arts will notice that there may be additional ways to associate the several connections to each other, and the above referenced mappings should not be construed as the only manner by which a particular user agent  208  may be operable to communicate with a particular enterprise server  200 . Accordingly, the above examples are provided solely for purposes of illustration, and not limitation. 
         [0029]    The relay server  210  is further capable of maintaining status information  424  for each connected enterprise server  200 . The information may include, for example, the enterprise server&#39;s GUID  426  when running on a Microsoft Windows platform, or the enterprise server&#39;s IP address. One skilled in the relevant arts will appreciate that similar unique identifying information may be recorded on any operating system platform, and implementation of the relay server  210  is not bound to any particular operating system. Furthermore, one skilled in the relevant arts will recognize that the status information  424  may comprise additional information  428  known by the relay server  210  that further describes the enterprise server  200 . 
         [0030]    Additionally, each enterprise server  200  maintains information about its connections with the relay server  210 , in accordance with an embodiment of the present invention, such information shown as  400  in  FIG. 4   b . For each relay server  210  represented by a relay identifier  402 , the enterprise server  200  maintains a mapping  403  of the number of free channels  404  from the enterprise server  200  available for use by the relay server  210 , for ensuring that sufficient free channels are provided at all times by the enterprise server  200  to the relay server  210 . Furthermore, the enterprise server  200  retains another mapping  405  for each relay identifier  402  about the current state  406  of the relay server  210  as it is known to the enterprise server  200 . In accordance with an embodiment of the present invention, the enterprise server  200  implements states known as “waiting”, “initialized”, “reset”, and “OK” to denote the current state  406  of the relay server  210 . The states are summarized below:
       Waiting—the enterprise server  200  has not received a first ping response from the relay server  210 .   Initialized—the enterprise server  200  has received at least one ping response from the relay server  210 , and the relay server  210  is awaiting a first set or an additional set of free channels.   Reset—the enterprise server  200  has determined that the relay server  210  believes the enterprise server  200  has been restarted due to a GUID (or equivalent) mismatch.   OK—the relay server  210  is up and running.       
 
         [0035]    The process for establishing a connection between an enterprise server  200  and a user agent  208  through the use of a relay server  210  shall now be described with continued reference to  FIGS. 2 ,  3 ,  4   a , and  4   b . At step  300 , the enterprise server  200  establishes a connection to the relay server  210  as identified by relay identifier  402 , and adds the established connection to the relay server&#39;s associated  403  free channel count  404 . In accordance with an embodiment of the present invention, the connecting step  300  is only performed if the relay server  210  identified by relay identifier  402  has an associated  405  relay state  406 , as shown above, that permits the enterprise server  200  to provide an additional connection. 
         [0036]    At step  302 , the user agent  208  establishes a connection to the relay server  210 . This established connection is identified by the relay server  210  with a user agent session number  420 . When the relay server  210  receives data from the user agent  208  connected with the user agent session number  420 , the relay server  210  checks the mapping  421  to determine if there is an associated enterprise server  200  identified by server identifier  422 . If there is an associated  421  server identifier  422 , communications proceed with step  304 . Otherwise, if there is no associated  421  server identifier  422 , the relay server  210  selects an enterprise server  200  to service the user agent  208  as further described in Section IV. The elected enterprise server  200  is associated with a service identifier  412  which in turn is associated  413  with a list of free channels  414 . The relay server  210  then selects one of the free channels (an enterprise server session number  416 ) from the list of free channels  414  over which to provide communications with the user agent  208  for the enterprise server  200 . The enterprise server  200  identified by server identifier  418 , as associated  417  with the enterprise server session number  416  used for the created connection, is subsequently associated  421  with the user agent session number  420  as the server identification  422  with which the user agent  208  will communicate. 
         [0037]    Continuing at step  304 , the relay server  210  forwards communications from the user agent  208  received over a particular user agent session number  420  to the associated  421  enterprise server  200  identified by the server identifier  422 . As previously described, the enterprise server  200  provides a response to the relay server  210  at step  306 , which then forwards the reply to the user agent  208  at step  308 , with subsequent communications following at step  310 . At no point is the relay server  210  required to store the actual data communicated between user agent  208  and the enterprise server  200 , merely relaying the information. 
         [0038]    In accordance with an embodiment of the present invention, the relay server  210  is deployed as a stand-alone system running software to perform relaying services. In accordance with another embodiment of the present invention, relaying services at the relay server  210  are provided as part of a plug-in to a stand-alone web server, such as Apache or Microsoft&#39;s IIS. Other implementations of relay server  210  will be apparent to persons skilled in the relevant arts. 
         [0039]    In accordance with another embodiment of the present invention, each enterprise server  200  has a set of public and private keys associated with it. When the enterprise server  200  establishes a connection to the relay server  210 , it transmits its public key, which is stored at the relay server  210 . When the user agent  208  establishes a connection to the relay server  210 , the relay server  210  sends a copy of the enterprise server&#39;s  200  public key to the user agent  208 . Further communication by the user agent  208  can be encrypted using the public key and decoded by the enterprise server  200  using its associated private key. 
       III. Multi-Tenancy of Relay Servers 
       [0040]      FIG. 5  illustrates a situation in which a hosted relay server  510  is configured to process communications between enterprise servers belonging to one or more companies  500   a - 500   c  and user agents belonging to one or more companies  508   a - 508   c  in what is termed a multi-tenant environment. The enterprise servers from each company  500   a - 500   c  establish a connection to the hosted relay server  510  through the respective company&#39;s firewall  502   a - 502   c . As previously noted, the connection to the hosted relay server  510  may include intervening network nodes, such as the Internet  504 . In an embodiment, user agents from each company  508   a - 508   c  connect through a wireless communication network  506  to the Internet  504  in order to establish communications with the hosted relay server  510  as before. 
         [0041]    The hosted relay server  510  is labeled as “hosted” due to the common usage of servers in a multi-tenant environment. A “hosted” facility is usually one in which a third party owns the facility (in this case, the hosted relay server  510 ), often for the use of one or more customers, such as the multiple companies shown in  FIG. 5 . One skilled in the relevant arts will recognize that the hosted relay server  510  need not be owned by a third party, and the one or more companies shown in  FIG. 5  may actually be part of the same single company. It is possible, in accordance with an embodiment of the present invention, to use the multi-tenancy facilities of the relay server  510  to partition the use of enterprise servers  500   a - 500   c  between the user agents  508   a - 508   c  where all of the enterprise servers  500   a - 500   c  and user agents  508   a - 508   c  are commonly owned and operated. Such partitioning may be used within a single company in order to, for example, control the information available to certain sets of user agents  508   a - 508   c , though a person skilled in the relevant arts will recognize other uses for the multi-tenant environment. 
         [0042]    In an implementation such as the one illustrated in  FIG. 5 , it is desired that the user agents associated with a particular company  508   a - 508   c  only establish communications with enterprise servers associated with the same company  500   a - 500   c . For example, a user agent from Company  1   508   a  should only be allowed to establish communications with an enterprise server from Company  1   500   a . This is resolved by identifying each company with a unique Company ID string. 
         [0043]    In accordance with an embodiment of the present invention, the user agents  508   a - 508   c  and enterprise servers  500   a - 500   c  are configured by default to use Company ID “0” for all communications (or some other mutually agreed upon identifier). This configuration allows operation in the degenerate case of a single company without the need to configure user agents  508   a - 508   c  and enterprise servers  500   a - 500   c  to operate with a specific company. In accordance with another embodiment of the present invention, in order to support a multi-tenant environment, user agents  508   a - 508   c  are assigned a Company ID that uniquely identifies enterprise servers  500   a - 500   c  associated with their respective companies. 
         [0044]    In reference to the communication sequence shown in  FIG. 3 , and using Company  2  from  FIG. 5  as an example, the enterprise server  500   b  establishes a connection with the hosted relay server  510  at step  300 . When establishing the connection, the enterprise server  500   b  transmits to the relay server  510  its unique Company ID. Similarly, a user agent  508   b  connects to the hosted relay server  510  at step  302  and notifies the hosted relay server  510  of its Company ID. In step  304 , the relay server  510  will then establish a connection between the user agent  408   b  and an enterprise server from the same company, i.e., enterprise server  400   b.    
         [0045]    As configuration of support for multiple companies is optional, the Company ID field has no meaning in the case of a single company. Therefore, in accordance with an embodiment of the present invention, it is possible for the enterprise server  500   a - 500   c  to not include a Company ID in its communications with the relay server  510 . Similarly, it is not necessary for the user agent  508   a - 508   c  to include a Company ID in its communications with the relay server  510 . In the event that a Company ID is not included in communications, the relay server  510  assumes a Company ID of “0” (or some other mutually agreed upon common string) for that particular communication. In the degenerate case of a single company, an enterprise server  500   a - 500   c  in its default configuration state will receive all communications directed to Company ID “0”. 
         [0046]    In an embodiment, when an enterprise server such as enterprise server  500   a  first establishes a connection to the relay server  510  as in step  300 , it transmits to the relay server  510  public key information for that particular enterprise server  500   a , as discussed above. In a multi-tenant environment, in an embodiment, the public key sent by enterprise server  500   a  is associated with the enterprise server&#39;s  500   a  respective company, rather than with the server itself. Therefore, in accordance with this embodiment, all of the enterprise servers  500   a  within a particular company must share the same set of public keys. 
       IV. Load-Balancing of Enterprise Servers 
       [0047]    Turning now to  FIG. 6 , as previously noted it is possible to connect multiple enterprise servers  600   a - 600   c  to a single relay server  610 , even in a non-multi-tenant environment. The multiple enterprise servers  600   a - 600   c  may be multiple enterprise servers within a single company (as identified by a common Company ID, above) or may be the only enterprise servers in the network altogether (as identified by the default Company ID). As before, each enterprise server  600   a - 600   c  establishes a connection to the relay server  610  through a firewall  602 . One skilled in the relevant arts will recognize that it is not necessary that all of the enterprise servers  600   a - 600   c  be behind a common firewall, or behind a firewall at all. Also, in  FIG. 6 , enterprise servers  600   a - 600   c  are simply shown as part of the same local network for purposes of illustration, and should not be interpreted as a limitation. 
         [0048]    Again as before, in the illustrative embodiment, a user agent  608  establishes a connection to the relay server  610  through a wireless communication network  606  and the Internet  604 . The user agent  608  is associated with a set of one or more enterprise servers  600   a - 600   c  depending on its Company ID, if available in a multi-tenant environment. 
         [0049]    With continued reference to  FIGS. 3-5 , whenever an enterprise server  600   a - 600   c  establishes a connection to the relay server  610  as in step  300 , the enterprise server  600   a - 600   c  provides a set of free channels for communication. As previously noted, the relay server  610  keeps a list of the free channels  414  associated  413  with each enterprise server  600   a - 600   c , as identified by server identifier  412 . When a new connection is established for the user agent  608 , the new connection is routed to one of the free channels  414  by selecting a server identifier  412 . In an embodiment, such selection of a free channel is made in a round robin manner. One skilled in the relevant arts will appreciate that there are additional ways of distributing a load that could alternately be used. Once a connection is established between the user agent  608  and the associated enterprise server  600   a - 600   c , the relay server maps  421  the communication session  420  between the user agent  608  and the relay server  610  to the associated enterprise server  600   a - 600   c  as identified by server identifier  422 . All further communication within that session occurs between the user agent  608  and the same enterprise server  600   a - 600   c  with which it established the initial connection, as identified by the server identifier  422 , in accordance with an embodiment of the present invention. 
         [0050]    A benefit of the use of multiple enterprise servers  600   a - 600   c  in a load balancing configuration as just described is evident when many user agents such as user agent  608  connect to the enterprise servers  600   a - 600   c . Whereas a single enterprise server, such as enterprise server  600   a , may not be able to handle communications with a very large number of user agents such as user agent  608  by itself, the disclosed configuration of enterprise servers  600   a - 600   c  allows for the straightforward introduction of additional enterprise servers to the environment to handle additional user agents such as user agent  608 . 
       V. Load Balancing of Relay Servers 
       [0051]    With reference now to  FIG. 7 , it is additionally possible to provide multiple relay servers  710   a - 710   c  in order to distribute communication loads that would otherwise be handled by a single relay server. As one skilled in the relevant arts will appreciate, the relay servers  710   a - 710   c  in a load balancing configuration may be utilized in conjunction with the multi-tenancy and/or enterprise server load balancing configurations disclosed above. 
         [0052]    Returning to  FIG. 3 , at step  300  an enterprise server  700  establishes a connection through firewall  702  to a relay server, such as one of  710   a - 710   c . Assuming by way of example that the enterprise server  700  has established a connection to relay server  710   a , in a relay server load balancing configuration, relay server  710   a  transmits to enterprise server  700  a list of addresses for the additional relay servers  710   b - 710   c . The enterprise server  700  then establishes a connection to each of the additional relay servers  710   b - 710   c.    
         [0053]    In accordance with an embodiment of the present invention, enterprise server  700  may establish its initial connection to a relay server, such as relay server  710   a , by way of a common address. When a connection is attempted by the enterprise server  700  to the common address, the connection is routed to one of the plurality of relay servers  710   a - 710   c . One skilled in the relevant arts will appreciate that the routing mechanism may select one of the relay servers  710   a - 710   c  in several manners, such as, by way of example, a round robin selection. 
         [0054]    Similarly, a user agent  708  establishes a connection through a wireless communication  706  and the Internet  704  to one of the relay servers  710   a - 710   c . In accordance with an embodiment of the present invention, in order to load balance relay server communications, the user agent  708  is only connected to a single relay server, such as relay server  710   a.    
         [0055]    In accordance with another embodiment of the present invention, the user agent  708  does not know the address of the particular relay server, such as relay server  710   a , to which it is connected. Instead, in order to facilitate load balancing of the relay server, the user agent  708  attempts to establish a connection to an address that is common to the plurality of relay servers  710   a - 710   c . When the connection is attempted by the user agent  708 , the connection is routed to one of the plurality of relay servers  710   a - 710   c . One skilled in the relevant arts will appreciate that the routing mechanism may select one of the relay servers  710   a - 710   c  in several manners, such as, by way of example, a round robin selection. 
       VI. Conclusion 
       [0056]    While various embodiments of the present invention have been described above, it should be understood that they have been presented by way of example only, and not limitation. It will be understood by those skilled in the relevant art(s) that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined in the appended claims. Accordingly, the breadth and scope of the present invention should not be limited by any of the above-described exemplary embodiments, but should be defined only in accordance with the following claims and their equivalents.