Abstract:
A novel system and method for connecting to an entity behind a firewall or proxy enhances network security and eliminates the costs and risks associated with modifying the firewall or proxy. The invention uses a trusted arbitrator as an intermediary between (1) a local area network protected by an access control mechanism such as a firewall or proxy and (2) external entities seeking to connect with an entity within the network. Requests from external entities are routed to the trusted arbitrator, which communicates with a connection entity located behind the firewall or proxy.

Description:
BACKGROUND OF THE INVENTION  
         [0001]    1. Field of the Invention  
           [0002]    The present invention is directed to connecting to a device on a network. More specifically, the present invention is directed to connecting to a device on a network that is protected by an access control mechanism.  
           [0003]    2. Description of Related Art and General Background  
           [0004]    A network is a system of computers that are connected to each other (and possibly to terminals and other peripheral devices) by communications lines which may be physical and/or wireless. Each computer on a network may be generally classified as a ‘client’ (i.e. a computer that initiates requests) or a ‘server’ (i.e. a computer that receives and responds to requests), although a single computer may also perform different roles at different times. Transfers of information across the network are typically conducted in compliance with one or more network protocols to ensure that the information may be properly delivered and interpreted. One such protocol is the Hypertext Transfer Protocol or HTTP, an application-level protocol that provides a basis for information transfer across the Internet and is specified e.g. in RFC 2616 (“Hypertext Transfer Protocol—HTTP/1.1”), R. Fielding et al., June 1999, which document is available at http://www.ietf.org/rfc/rfc2616.txt. As shown in FIG. 1, HTTP is a query/response protocol in which an entity such as a client  30  directs a query for information to a specific resource (such as a file or web page, as identified by a Universal Resource Locator or URL) and another entity such as a server  40  forwards an appropriate response associated with that resource.  
           [0005]    A local area network (or ‘LAN’) allows computers or terminals that are located near one another to share resources such as storage devices, printers, and other peripheral equipment. A LAN that is connected to a larger network may include one or more access points (or ‘gateways’) through which devices within the LAN may communicate with devices outside the LAN. Access control mechanisms (or ‘ACMs’) provide security against unauthorized access to the LAN by controlling or restricting the flow of information across the access points. FIG. 2, for example, shows a LAN  230  that is connected to the Internet  250  only through an ACM  20   a . Due to the presence of ACM  20   a  at this access point, a remote computer  20   c  that is connected to the Internet  250  may not freely interact with devices connected to LAN  230  such as computer  10   a . Any request for information that is sent by remote computer  20   c  to computer  10   a  will be scrutinized by ACM  20   a  and may be rejected.  
           [0006]    One type of ACM is a firewall. The term ‘firewall’ indicates a protective layer that separates a computer network from external network traffic, and this layer may be implemented in software, hardware, or any combination of the two. For example, firewall application software may be installed on a server to create a combination called a ‘firewall server.’ 
           [0007]    Another type of ACM is a server (possibly a firewall server) running an application program that evaluates incoming requests according to a predefined set of rules. Such a device is called a ‘proxy server’ or simply a ‘proxy.’ To entities outside the network, the proxy may act as a server, receiving and evaluating incoming transmissions. To devices within the network, the proxy may act as a client, forwarding the incoming transmissions which conform to its rules. For example, the proxy may prevent executable files from entering the LAN but may pass all responses to HTTP queries that were sent by devices within the LAN.  
           [0008]    Unfortunately, the characteristics that make firewalls or proxies effective in controlling the flow of information into the network also lead to increased complexity and cost. For example, when an entity outside the LAN, such as remote computer  20   c , seeks to be connected with an entity within the LAN, such as computer  10   a , complex and/or costly changes to the ACM may be necessary to permit the connection. In addition, a significant amount of processing resources must be expended to perform the task of evaluating all gateway traffic to ensure compliance with the network&#39;s security rules and thereby protect the network from potentially harmful traffic.  
           [0009]    Some solutions to these problems of overhead—such as setting aside a dedicated, open port in the firewall through which external traffic may enter—may create unacceptable security risks. Other, more secure solutions include virtual private networks (VPNs), which use encryption to allow users on different networks to exchange information with each other in a secure manner over the Internet. This encryption effectively creates a secure “tunnel” between sender and receiver so that even though the information may pass through many other entities during transmission, it is accessible only to the sender and the receiver.  
           [0010]    Although a VPN offers a higher level of security, no reduction in overhead processing is thereby achieved, as network traffic entering the LAN through the VPN must still pass through and be evaluated by the ACM. Adding a VPN to an existing network also involves a significant investment in resources and may introduce bugs or errors into a stable system. Furthermore, in many network installations it may not be feasible to reconfigure an existing ACM to support communication with every new external entity that may be desired, as such modifications require extensive resources and testing. To avoid these costs and risks, another approach is desired.  
         SUMMARY  
         [0011]    A system and method according to an embodiment of the invention allows an external entity to communicate with a device within a network protected by an access control mechanism. The external entity sends a request directed to the device to an intermediary (hereinafter a “trusted arbitrator”). The trusted arbitrator communicates the request to a connection entity which is located within the protected network. The trusted arbitrator communicates this request to the connection entity by attaching it to a response to a request from the connection entity. The connection entity then forwards the request to the device. 
       
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0012]    [0012]FIG. 1 illustrates the flow of data in a HTTP query and response.  
         [0013]    [0013]FIG. 2 shows a block diagram of a system including a local area network and a remote computer.  
         [0014]    [0014]FIG. 3 shows a block diagram of a system according to an embodiment of the invention.  
         [0015]    [0015]FIG. 4 shows a flow chart for a method according to an embodiment of the invention.  
         [0016]    [0016]FIG. 5 shows a flow chart for a method according to another embodiment of the invention.  
         [0017]    [0017]FIG. 6 shows a flow chart for an extension of a method according to an embodiment of the invention. 
     
    
     DETAILED DESCRIPTION  
       [0018]    [0018]FIG. 3 shows an overall perspective view of a first embodiment of the invention. A remote computer  20   c  is connected to a network such as the Internet  250 . A LAN  230  comprises various components including a local computer  10   a  and a connection entity  10   b  (discussed below). Other components such as additional computers, printers, and file servers may also be connected to LAN  230 . LAN  230  is connected to the Internet  250  through ACM  20   a , which protects components within LAN  230  from external network traffic by intercepting communication requests that are sent directly to these components from entities outside the network.  
         [0019]    A trusted arbitrator  20   b  is also connected to the Internet  250 . Subject to the restrictions dictated by ACM  20   a , information may thereby flow among entities connected to LAN  230 , remote computer  20   c , and trusted arbitrator  20   b . (The term ‘entity’ as used herein refers to any device or process that originates or terminates a request for information. For example, an entity may be a computer, an application program, or an embedded processor.)  
         [0020]    One of the entities connected to LAN  230  is a connection entity  10   b , which interacts with trusted arbitrator  20   b  regarding communication requests sent by external entities (such as remote computer  20   c ) to devices within LAN  230 . Connection entity  10   b  may reside on a device such as a router, on a dedicated computer, or on a computer that performs other tasks as well (for example, ACM  20   a  and connection entity  10   b  may reside on the same entity). Regardless of the form of connection entity  10   b , this device contacts trusted arbitrator  20   b  periodically in order to determine whether an external entity (such as remote computer  20   c ) has sought to communicate with an entity within LAN  230  (such as local computer  10   a ). If such request has been made, connection entity  10   b  establishes a communication link with trusted arbitrator  20   b  to retrieve the request. Upon retrieving the request, connection entity  10   b  forwards the request to the appropriate entity within LAN  230 .  
         [0021]    In this embodiment of the invention, remote computer  20   c  sends communication requests for local computer  10   a  to trusted arbitrator  20   b  over the Internet  250 , rather than directly to local computer  10   a  through ACM  20   a . Remote computer  20   c  sends these requests (e.g. in response to a user&#39;s keyboard or mouse requests, or as directed by an application program) to trusted arbitrator  20   b  through the arbitrator&#39;s website, which is accessed by using its Universal Resource Locator (URL). Connection entity  10   b  may also exchange information with trusted arbitrator  20   b  through this or another URL associated with the trusted arbitrator.  
         [0022]    Before remote computer  20   c  is permitted to communicate with an entity within LAN  230 , trusted arbitrator  20   b  performs a certification process in order to establish the validity of the request sent by remote computer  20   c . In one implementation, trusted arbitrator  20   b  certifies the request by verifying the identity of remote computer  20   c . By virtue of such a certification process, an impostor may not assume the identity of remote computer  20   c  without running afoul of trusted arbitrator  20   b . In another implementation, trusted arbitrator  20   b  assigns an authentication identity to remote computer  20   c  upon certification. In a further implementation, trusted arbitrator  20   b  certifies the request by verifying that remote computer  20   c  is capable of transmitting and receiving information in a secure manner.  
         [0023]    Before a first request is made by trusted arbitrator  20   b  to connection entity  10   b , a basis for identification of trusted arbitrator  20   b  by connection entity  10   b  (or, alternatively, a basis for identification of connection entity  10   b  by trusted arbitrator  20   b ) is also established. Connection entity  10   b  may initiate the identification process by selecting trusted arbitrator  20   b  as its intermediary for all requests directed to entities within LAN  230 . In one embodiment, connection entity  10   b  connects to trusted arbitrator  20   b  through the trusted arbitrator&#39;s website, exchanging information with trusted arbitrator  20   b  that will allow the two entities to continue to communicate with each other in the future. For example, trusted arbitrator  20   b  may provide connection entity  10   b  with an authentication identity that connection entity  10   b  can use in future communication with trusted arbitrator  20   b.    
         [0024]    Thus, in order to request communication with an entity within LAN  230  such as local computer  10   a , remote computer  20   c  transmits a request through a network such as the Internet  250  to trusted arbitrator  20   b . In one implementation, remote computer  20   c  makes this request by contacting trusted arbitrator  20   b  through its website and thereby supplying the trusted arbitrator with information about the request: for example, the identity or location of LAN  230 , the nature of the request, and the particular entity within the LAN to which the request is directed.  
         [0025]    [0025]FIG. 4 illustrates the flow of data in a system according to an embodiment of the invention. In block P 110 , upon receiving a request from remote computer  20   c , trusted arbitrator  20   b  certifies a request by remote computer  20   c  by, for example, verifying the identity of remote computer  20   c . In one implementation, trusted arbitrator  20   b  certifies the request by verifying identification information which remote computer  20   c  forwards along with the request. If the certification is successful, then trusted arbitrator  20   b  processes the request; otherwise, trusted arbitrator  20   b  rejects the request.  
         [0026]    If trusted arbitrator  20   b  determines that it has received a valid request from remote computer  20   c , then in block P 120  trusted arbitrator  20   b  organizes the request for forwarding to connection entity  10   b . In this implementation, trusted arbitrator  20   b  adds the request to a queue in a secure area within its website that may be designated for connection entity  10   b  (i.e. for LAN  230 ).  
         [0027]    As shown in block P 130 , connection entity  10   b  regularly polls trusted arbitrator  20   b  to determine whether any requests directed to devices within LAN  230  are currently stored. In this embodiment, connection entity polls trusted arbitrator  20   b  by sending a HTTP query to its website. If no response indicating the presence of requests is received, connection entity  10   b  waits for a predetermined delay period before polling trusted arbitrator  20   b  again.  
         [0028]    If trusted arbitrator  20   b  indicates that requests for devices within LAN  230  are currently present, then these requests are forwarded to connection entity  10   b . In this implementation, for example, connection entity  10   b  sends a HTTP query to trusted arbitrator  20   b  (block P 150 ) to open a HTTP pipe between the two entities. Trusted arbitrator  20   b  then forwards the request to connection entity  10   b  in the form of packets attached to the HTTP response to that query (block P 160 ). Because this HTTP response is associated with a HTTP query that connection entity  10   b  initiated, it passes through ACM  20   a  without being evaluated. In addition, because the HTTP response originated from an entity that is trusted by connection entity  10   b , connection entity  10   b  is assured that the HTTP response is secure. As indicated in block P 170 , connection entity  10   b  routes the information within the HTTP response to the appropriate device within LAN  230  (e.g. as indicated within the response). If the response indicates that the information relates to records that are located on a storage medium of local computer  10   a , for example, connection entity  10   b  routes the information to local computer  10   a  for processing.  
         [0029]    In one exemplary use, remote computer  20   c  may wish to send a HTTP query to local computer  10   a . Because remote computer  20   c  is not known to ACM  20   a , a query sent by remote computer  20   a  directly to local computer  10   a  will not reach its destination. If the query is sent as a payload to a HTTP query by trusted arbitrator  20   b  as described above, however, then it will be admitted by ACM  20   a  and forwarded to local computer  20   a  as desired by connection entity  10   b . Thus the overhead of configuring the system to allow direct secure communication with remote computer  20   c  is avoided without compromising the security of LAN  230 .  
         [0030]    In an alternative embodiment as shown in FIG. 5, connection entity  10   b  polls trusted arbitrator explicitly via a HTTP query (block P 135 ). If the queue is empty, no response need be sent. If the queue contains pending requests for devices within LAN  230 , then these requests are forwarded back to connection entity  10   b  immediately in a HTTP response to that query.  
         [0031]    As shown in FIG. 6, any response to the incoming information that is subsequently generated by the target device (in this case, local computer  1 O a ) may be forwarded back to remote computer  20   c  in an analogous fashion. In block P 210 , local computer  10   a  sends the response information to connection entity  10   b . In block P 220 , connection entity  10   b  forwards this information to trusted arbitrator  20   b  via, e.g., a HTTP query. Trusted arbitrator  20   b  extracts the information destined for remote computer  20   c  and stores it in a secure area within its website. Trusted arbitrator  20   b  may also acknowledge receipt of the query in a HTTP response to connection entity  10   b.    
         [0032]    After sending its request as described above, remote computer  20   c  polls trusted arbitrator  20   b  periodically in order to determine whether a response is available. In block P 230  of the implementation shown in FIG. 6, for example, polling is performed via HTTP queries. If a response has been received from local computer  10   a  through connection entity  10   b  (block P 240 ), then the information is forwarded to remote computer  20   c . In this example (block P 250 ), the information is sent in a HTTP response to the polling query. Alternatively, remote computer  20   c  may open a HTTP pipe to trusted arbitrator  20   b  only after trusted arbitrator  20   b  has indicated that a response to the request of remote computer  20   c  is available.  
         [0033]    As described above, a method or apparatus according to an embodiment of the invention allows a secure connection to be established with an entity outside a LAN without changing the infrastructure of the LAN and while reducing monitoring costs. In one implementation, this connection is supported by communication through a trusted third-party website, thereby minimizing the risk of damage to the LAN due to breaches by unauthorized entities.  
         [0034]    The foregoing description is provided to enable any person skilled in the art to make or use the present invention. Various modifications to these embodiments are possible, and the generic principles presented herein may also be applied to other embodiments. For example, an embodiment of the invention may use a connection entity that is implemented as any combination of (1) hardware such as a computer or a device for processing network traffic such as a router, (2) firmware loaded into non-volatile storage, and/or (3) software loaded into random-access memory in the form of machine-readable code, such code being executable by an array of logic elements such as a microprocessor or other digital signal processing unit. The connection entity may also reside on a dedicated computer or may be simply one among several tasks executing on one computer. Thus, the present invention is not intended to be limited to the embodiments shown above, but rather, is to be accorded the widest scope consistent with the principles and novel features disclosed in any fashion herein.