Resource sharing across security boundaries

The present invention relates to a system and method for sharing resources between workstations separated by security measures such as firewalls by employing electronic mail messaging and attachments thereto to transmit tasks and/or functions through firewalls for execution at a destination workstation. A dedicated lightweight SMTP server is preferably deployed at destination workstations to operate on incoming email messages associated with tasks for execution at such workstations.

DETAILED DESCRIPTION FIG. 2 depicts transmission of an email message from an originating workstation for action at a destination workstation according to a preferred embodiment of the present invention. Elements 101 through 105 of FIG. 2 generally correspond to the like numbered elements of FIG. 1 . Specifically, in the embodiment of FIG. 2, a task for execution at a destination device 101 is included in an email message 102 and proceeds through various previously described steps until its arrival at destination email gateway 105 . In a preferred embodiment, the email message is then transmitted 201 to an SMTP server at a destination workstation. The SMTP server concerned in step 201 is preferably dedicated to a particular workstation, thereby enabling email messages to be directed to a specified machine or workstation, rather than merely stored at a server for possible recovery by any one of a number of workstations. A dedicated SMTP server need not be in close physical proximity to the workstation to which it is dedicated, but is preferably operationally coupled therewith. An SMTP server interacting with a workstation in the manner described herein is preferably provided with an ability to demonstrate appropriate authorization to access a particular workstation and to perform a requested action. Preferably, the workstation to which an email having an associated task is directed is coupled to the devices and/or programs able to execute the associated task. For example, where the task embedded or associated with the email in question includes a document to be printed, the SMTP server receiving such an email is preferably dedicated to a workstation which is coupled to a printer suitable for printing the attached document. In a preferred embodiment, server software deployed on the dedicated SMTP server is provided with the ability to process email automatically 202 . Specifically, the dedicated server is preferably able to examine email messages directed to the workstation associated with a dedicated server, determine whether a task or function is associated with an email message, identify the associated task or function if present, and initiate execution of the task or function employing the device, utility, or program suited to the associated task or function without requiring intervention by a user. For example, where the associated or embedded task or function is to print a document, the dedicated server preferably transmits the document included in the received email message along with appropriate commands to a printer coupled to the workstation having an SMTP server and directs the printer to complete the requested printing task 203 . Similarly, where the task is to run a diagnostics program, the dedicated server in receipt of an email associated with this task preferably transmits information pertinent to the task and appropriate commands to a workstation or other computing device able to run the transmitted diagnostics program. In a preferred embodiment, scripts may be included in the email message having an included task or function in order to appropriately instruct a destination workstation what operations to perform in response to an incoming email message. The contents of such scripts will generally vary depending on several factors including but not limited to: the type of task included in the email message, the nature of the device and/or program intended to execute the task, and the nature, if any, of any encryption employed in encoding the email message. The desired scripts may be generated employing common scripting languages or employing a scripting language developed for a particular application. In a preferred embodiment, scripts recognizable to commonly used software routines may be employed in order to enable specific tasks to be precisely identified with a minimum of identifying terms. One example of this practice is the use of “primary verbs” within Microsoft Networks®. Employing this program, any file name ending with a “.doc” extension is preferably recognized as a document for which a common operation is printing. For example, where it is desired to print a document, employing the scripting term “print” would cause the receiving workstation to open a document, print it, and then close the document, all in response to the single term “print.” In this manner, the inventive system may economize on the number of commands to be communicated to the destination device without omitting any specificity in describing the actions to be taken upon receipt on an email message. It will be appreciated that the document to be printed could either be transmitted as an attachment to a transmitted email and/or be resident within a network accessible to a workstation receiving the “print” command. In a preferred embodiment, an email composer tool is deployed to compose email messages including various features enabling email message attachments to be acted upon at a destination workstation without the need for human intervention. The inventive email composition tool (or email composer tool) is preferably able to attach files and associated commands to an email message sufficient to describe a desired operation to a destination workstation. These associated commands are preferably incorporated into an outgoing email message employing scripts so as to enable efficient and accurate communication of desired processing commands to a destination workstation. The email composer tool is preferably further able to incorporate security features such as credential information to enable verification of the identify of a workstation which is the originator of an email message and a requestor of execution of at least one task for execution at a destination device. In addition, the email composer tool is preferably able to encrypt data and command scripts and include digital signatures for identity verification purposes in advance of transmission over a publicly accessible network. In a preferred embodiment, various security measures may be deployed to prevent unauthorized access to resources deployed within a secure controlled-access network and to authenticate the identity of a party (person and/or device) requesting that a destination workstation execute a set of specified commands. One available security measure is the provision of encryption and decryption tools for preventing unauthorized access to information included in an email transmission. One common approach is the use of public key encryption in combination with private key decryption. Alternatively, encryption may be practiced employing private keys for both encryption and decryption. In a preferred embodiment, digital signatures may be employed to verify or authenticate the identity of a workstation transmitting a message. Generally, private key encryption is employed to generate a digital signature and public key decryption employed to authenticate the signature. Alternatively however, private key encryption may be employed for both creation of and decryption of a digital signature. In a preferred embodiment, use of the above security measures would prevent unauthorized control of operations within a controlled-access network. Although a hacker could theoretically transmit an email message to a server dedicated to a workstation within a controlled-access network, such a hacker would not have access to the key or keys with which to produce a uniquely identifying digital signature or to encrypt the data and instructions transmitted. In this manner, the inventive mechanism may prevent unauthorized and potentially destructive access to resources disposed within a controlled-access network. FIG. 3 depicts a firewall adaptable for protection of a controlled-access network. The linked networks 300 depicted in FIG. 3 include the Internet 301 which is coupled to a controlled-access network 310 via router 302 . Router 302 of FIG. 3 is generally included in firewall 104 represented in FIGS. 1 and 2 . Preferably, DNS (Domain Name Server) server 303 HTTP server 304 and SMTP (simple mail transfer protocol) server 305 operate to allow communication between Internet 301 and controlled-access network backbone 310 . DNS server 303 and HTTP server 304 generally allow limited forms of communication between controlled-access network backbone 310 and Internet 301 . Accordingly, the extent of resource sharing generally available among workstations connected to a common controlled-access LAN would generally not be available between Internet 301 and controlled-access network 310 in the embodiment of FIG. 3 . SMTP server 305 preferably allows messages to flow in both directions between Internet 301 and controlled-access network backbone 310 . However, manual user intervention is generally required in order to allow tasks or functions which may be attached to email messages incoming to controlled-access network backbone 310 to be executed by a workstation, such as workstation 307 , connected to controlled-access network backbone 310 . Accordingly, tasks or functions communicated to destination workstation 307 by a workstation connected to controlled-access network 301 via Internet 301 would generally require manual user intervention, thereby preventing the efficiency and convenience of having such tasks or functions executed automatically. FIG. 4 depicts a conventional arrangement of workstations 401 - 1 through 401 -N in communication with SMTP server 309 . Generally one server, such as server 309 , is able to operate email accounts and store email messages associated with a plurality of different accounts. Moreover, email account information stored on SMTP server 309 may generally be accessed employing any one of a plurality of workstations, such as workstations 401 -. 1 through 401 -N. Accordingly, such an arrangement is generally not amenable to receiving an email message directing that a function or task be executed by a particular workstation. FIG. 5 depicts a workstation 503 having a dedicated mail server according to a preferred embodiment of the present invention. As was the case in the embodiment of FIG. 3 , SMTP mail gateway 305 preferably conducts bidirectional email communication with controlled-access network backbone 310 . Mail servers 501 and 502 preferably both operate to forward email messages between controlled-access network backbone 310 and workstation 503 . Mail servers 501 and 502 are generally equivalent to mail server 309 depicted in FIG. 3 . In a preferred embodiment, workstation 503 includes a dedicated SMTP server. SMTP server software could be deployed either within workstation 503 or in a device coupled to workstation 503 . In either case, workstation 503 is preferably provided with a unique email address and the ability to receive and open email directed thereto. In addition, the server software disposed either within or in communication with workstation 503 preferably includes the ability to run executable files attached to email messages (or take appropriate actions on other file types such as documents) arriving at workstation 503 without a need for human intervention, i.e. automatically. This capability is preferably enabled by the provision of an email address specific to the particular workstation and functionality deployed within the dedicated server software for receiving email messages, opening these messages, isolating files attached to incoming email messages, and, where appropriate, running executable files received as attachments to email messages incoming to workstation 503 . In a preferred embodiment, functions or tasks which may be included in such executable files or which may be resident within the SMTP server dedicated to workstation 503 and executable in response to an email including an appropriate identification of such functions or tasks include but are not limited to: printing documents, running diagnostic programs, generating calendar entries, retrieving calendar entries of one or more users having accounts accessible from workstation 503 , conducting database searches, and modifying word processing and other documents. In a preferred embodiment, dedicated server software deployed in a recipient workstation may fully respond to commands including one or more parameters for completion of a command. For example, in addition to specifying that a document is to be printed, a command may specify other parameters such as, for instance, a printer on which to print the document, and the format (such as portrait or landscape) in which to print the document. In a preferred embodiment, in response to an email received at workstation 503 including a command to print or otherwise act upon a document, the inventive mechanism may be employed to act upon either a document attached to the received email, upon a document already resident on a network accessible to workstation 503 , or upon a combination of the foregoing. Likewise, where an email received at workstation 503 includes a command which designates an operation or application to be performed by workstation 503 or a device in communication therewith, the executable code associated with the included command may be included as an attachment to the received email message, already be resident on workstation 503 or at a device in communication with workstation 503 , or a combination of the foregoing, and all such variations are included in the scope of the present invention. Thus, in contrast to the workstations 401 - 1 through 401 -N of FIG. 4 , when using workstation 503 , the opening of incoming email messages and files attached thereto and the execution of files attached to email messages may be accomplished automatically. It will be appreciated that the SMTP server software dedicated to workstation 503 need not be deployed within the hardware which forms workstation 503 or even in a device directly connected to workstation 503 . The dedicated SMTP server software need only be deployed so as to ensure accessibility of the server software over controlled-access network backbone 310 to workstation 503 . It will further be appreciated that workstation 503 is not limited to any particular hardware configuration or operating system. Workstation 503 may be any one of a group which includes but is not limited to: a personal computer running Microsoft Windows, a UNIX machine, and a LINUX machine. In a preferred embodiment, the SMTP server software dedicated to serving workstation 503 includes the ability to act upon a task identified by an email message, whether within the body of such email message or within an attachment to such message, check the authorization of the requesting entity (possibly a workstation) to have this task performed, verify the identity of the requesting party, and determine the authority of an identified requesting party to request execution of a particular function. The identity of a requesting party may be verified by numerous means, such as, for instance, by decrypting a digital signature originally encrypted by the requesting party. In a preferred embodiment, workstation 503 may be coupled to one or more of a plurality of devices for executing tasks identified by an email message, such as, for instance, a printer and a computer for running diagnostic programs and/or updating a calendar based upon information included or attached to the email message. In the prior art, there are generally a restricted group of functions or actions which may be automatically (i.e. without human intervention) performed on an email message received at a workstation, as a consequence of the usual operation of the SMTP protocol. Such activities generally include automatically replying to received email messages as well filtering and/or sorting messages based upon characteristics of the received message. Herein, the term “restricted operations” generally corresponds to this group of functions, which functions are generally limited to manipulation of email communication and the handling and/or storage of received messages. In contrast, the present invention presents a more extensive group of functions which may be performed in response to received email messages which functions extend considerably beyond the mere manipulation of email communication (such as automatic replies) and storage and sorting of email messages. This more extensive group of functions generally includes the ability to perform operations consistent with the extent of resource sharing commonly provided between workstations (and/or between workstation and a service component such as a printer) coupled to the same private network. This more extensive group of operations generally includes operations such as printing a document included within, or attached to, an email message, and executing a routine which may be in a file attached to an email message, included within the body of an email message, or merely identified by data within an email message, but resident within a network to which a recipient workstation is connected. Herein, the terms “extensive operations” and “group of extensive operations” generally correspond to the functions described in this paragraph. FIG. 6 illustrates computer system 600 adapted to use the present invention. Central processing unit (CPU) 601 is coupled to system bus 602 . The CPU 601 may be any general purpose CPU, such as an HP PA - 8200 . However, the present invention is not restricted by the architecture of CPU 601 as long as CPU 601 supports the inventive operations as described herein. Bus 602 is coupled to random access memory (RAM) 603 , which may be SRAM, DRAM, or SDRAM. ROM 604 is also coupled to bus 602 , which may be PROM, EPROM, or EEPROM. RAM 603 and ROM 604 hold user and system data and programs as is well known in the art. The bus 602 is also coupled to input/output (I/O) adapter 605 , communications adapter card 611 , user interface adapter 608 , and display adapter 609 . The I/O adapter 605 connects to storage devices 606 , such as one or more of hard drive, CD drive, floppy disk drive, tape drive, to the computer system. Communications adapter 611 is adapted to couple the computer system 600 to a network 612 , which may be one or more of local are network(LAN), wide-area network (WAN), Ethernet or Internet network. User interface adapter 608 couples user input devices, such as keyboard 613 and pointing device 607 , to the computer system 600 . The display adapter 609 is driven by CPU 601 to control the display device 610 . Although the present invention and its advantages have been described in detail, it should be understood that various changes, substitutions and alterations can be made herein without departing from the spirit and scope of the invention as defined by the appended claims. Moreover, the scope of the present application is not intended to be limited to the particular embodiments of the process, machine, manufacture, composition of matter, means, methods and steps described in the specification. As one of ordinary skill in the art will readily appreciate from the disclosure of the present invention, processes, machines, manufacture, compositions of matter, means, methods, or steps, presently existing or later to be developed that perform substantially the same function or achieve substantially the same result as the corresponding embodiments described herein may be utilized according to the present invention. Accordingly, the appended claims are intended to include within their scope such processes, machines, manufacture, compositions of matter, means, methods, or steps.