Patent Publication Number: US-8977691-B2

Title: Implementation of an extranet server from within an intranet

Description:
BACKGROUND OF THE INVENTION 
     1. Field of the Invention 
     This invention relates to the implementation of an extranet server from within an intranet. 
     2. Description of Related Art 
     Many corporations maintain an intranet or internal network for use within their organizations in order to protect the loss of proprietary data through unrestricted access to data by outsiders and to protect the internal network from viruses, worms, etc., which can be delivered by email. 
     This sometimes presents severe limitations when the objective is to allow a user on an extranet (e.g., the Internet) outside the intranet to obtain information (e.g., access to databases) and access services (e.g., perform functions), which are available on the intranet but not outside the intranet. 
     This is especially problematic when the user is an employee of the intranet owner, but is not in a position to enter the intranet through a secure gateway. 
     What is needed in the art, then, is a method of providing the services outside the intranet without compromising the security concerns described above. The present invention satisfies that need. 
     SUMMARY OF THE INVENTION 
     The present invention discloses a method, apparatus and article of manufacture for processing a request for information or services available on an intranet to users on an extranet outside the intranet. 
     An email is generated in an external server outside the intranet in response to a request for information or services, and then sent from an external server to an internal server inside the intranet via an email server. The email is processed at the internal server in order to generate a response to the request for information or services that is then returned by the internal server to the external server. 
     The email comprises one or more approved forms based on the request, wherein specifics of the request for information or services are embedded into the body of the email. In one embodiment, the request may comprise inserts, queries, reports or updates against a proprietary database, wherein the specifics of the request identify which records to add, retrieve or update in the proprietary database. 
     The internal server invokes and executes one or more predefined programs to process the email, wherein the predefined programs perform one or more approved functions based on the form of the email and the specifics of the request that are embedded into a body of the email. 
     This response sent from the internal server to the external server in a reply email that is automatically created in response to the email received from the external server. The response includes an attachment to the reply email containing the results of one or more functions performed by the internal server when responding to the request for information or services. The attachment is in a form readable only by the internal server and external server. 
     The response is processed in the external server, wherein the external server allows the user to access the results via some appropriate subset of functions performed by an external graphical user interface. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       Referring now to the drawings in which like reference numbers represent corresponding parts throughout: 
         FIG. 1  illustrates an exemplary hardware and software environment according to the preferred embodiment of the present invention. 
         FIG. 2  is a flowchart that illustrates the steps performed in an initial setup of the system according to the preferred embodiment of the present invention. 
         FIG. 3  is a flowchart that illustrates the steps performed in handling incoming requests according to the preferred embodiment of the present invention. 
         FIG. 4  is a flowchart that illustrates the steps performed in handling outgoing information according to the preferred embodiment of the present invention. 
     
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 
     In the following description of the preferred embodiment, reference is made to the accompanying drawings which form a part hereof, and in which is shown by way of illustration a specific embodiment in which the invention may be practiced. It is to be understood that other embodiments may be utilized and structural changes may be made without departing from the scope of the present invention. 
     Technical Description 
       FIG. 1  illustrates an exemplary hardware and software environment according to the preferred embodiment of the present invention. 
     In this exemplary environment is an intranet  10  including a mail server  12  and an internal server  14  managing a proprietary database  16  and providing an internal user graphical user interface (GUI)  18 . Also in this exemplary environment is an extranet  20  including an external server  22  providing an external user GUI  24 . Separating the intranet  10  from the extranet  20  is a firewall  26 , which is a hardware or software gateway that limits access between the networks  10 ,  20 , in accordance with a predefined security policy, in order to protect the resources of the intranet  10  from users of the extranet  20 . 
     This exemplary environment performs a computer-implemented method of processing a request for information or services available on an intranet to users outside the intranet. 
     Moreover, in the present invention, the internal server  12  performs the following functions that are available to users on the intranet  10 : 
     1. The internal user GUI  18  and accompanying programs that accept information from users and stores the information into the proprietary database  16 . 
     2. The internal user GUI  18  and accompanying programs that allow users to view and manipulate the information stored in the proprietary database  16 . 
     3. The internal user GUI  18  and accompanying programs that allow the users to filter and extract information from the proprietary database  16 . 
     Initial System Setup 
       FIG. 2  is a flowchart that illustrates the steps performed in an initial setup of the system according to the preferred embodiment of the present invention. 
     Block  200  represents the external server  22  being set up on the extranet  20  outside the intranet  10 . 
     Block  202  represents the administrative privileges for the external server  22  being provided to the internal server  14 . Essentially, the internal server  14  logs onto the external server  22 , in order to administer users. 
     Block  204  represents the external server  22  being configured such that some appropriate subset of functions performed by the internal user GUI  18  may be performed by the external user GUI  24 . 
     Handling Incoming Requests 
       FIG. 3  is a flowchart that illustrates the steps performed in handling incoming requests (e.g., a request for the input or output of data) according to the preferred embodiment of the present invention. 
     Block  300  represents the external server  22  generating an email in response to a request for information or services, using available system functions, and according to one or more outgoing email restrictions. These restrictions may include the following:
         1. The email can only be sent from the external server  22  to the internal server  14  via the email server  12 .   2. The email comprises one or more approved forms, based on the user&#39;s request. For example, using the functions of the external user GUI  24 , the user generates requests for inserts, queries, reports, updates, etc., against the proprietary database  16 , which are then used to select the form of the email.   3. The body of the email is created by the functions of the external user GUI  24 , based on the user&#39;s request. For example, the specifics of the user&#39;s request, e.g., identifying which records to add, retrieve or update in the proprietary database  16 , are embedded into the body of the email.   4. The email is then sent from the external server  22  to the internal server  14  via the email server  12 . In one embodiment, the email can only be sent from the external server to the internal server.       

     Block  302  represents the mail server  12  accepting the email from the external server  22  and routing it to the internal server  14 . 
     Block  304  represents the internal server  14  processing the email in order to generate a response to the request for information or services. This may entail the internal server  14  invoking and executing one or more predefined programs to process the email, wherein the predefined programs perform one or more approved functions based on the form of the email and the specifics of the request that are embedded into the body of the email. The results of these functions are handled in a manner described in more detail below. 
     Handling Outgoing Information 
       FIG. 4  is a flowchart that illustrates the steps performed in handling outgoing information according to the preferred embodiment of the present invention. 
     Block  400  represents the internal server  14  processing the email in order to generate a response to the request for information or services, as represented above in Block  304 . Preferably, the functions performed by the predefined programs may comprise inserts, queries, reports, updates, etc., against the proprietary database  16 . 
     Block  402  represents the internal server  14  loading the results of the functions into a file. In one embodiment, the file is in a form readable only by the internal server  14  and external server  22  for security purposes. 
     Block  404  represents the internal server  14  automatically creating an outgoing email in reply to the email received from the external server  22 , wherein the file is added as an attachment to the email. This reply email and its file attachment comprises the response to the user&#39;s request for information and services. 
     Block  406  represents the reply email then being sent from the internal server  14  to the external server  22 . This reply email can be sent to the external server  22  through the mail server  12 , or can be sent directly to the external server  22  if the internal server  14  has a direct connection to the extranet  20 . 
     Block  408  represents the external server  22  processing the reply email, including the file added as an attachment to the email. Specifically, the external server  22  unloads the results from the file, and allows the user to access the results via some appropriate subset of functions performed by the external user GUI  24 . 
     Consequently, the architecture of the present invention allows a corporation to provide some of the functions available on its intranet  10  and access to restricted parts of its proprietary database  16  to accredited users outside the intranet  10 , with a single point of administration. Security can be explicitly administrated on a single system (i.e., internal server  14 ) or by the normal intranet  10  structure. 
     Modifications and Variations 
     Although  FIG. 1  shows the internal server  14  as a separate server that is dedicated to handling requests from the external server  22 , alternative embodiments may have the functions of the internal server  14  performed by the mail server  12  or the functions of the mail server  12  performed by the internal server  14 . 
     To establish and maintain security, the administration of the interplay the mail server  12 , internal server  14 , and external server  22  is performed at the internal server  14 . The set of administration functions performed by the internal server  14  include:
         Identifying users whose mail can be forwarded from the mail server  12  to the internal server  14 . This is a list of the employees who can make queries, etc.   Specifying rules for handling exceptions. For example, if an unauthorized user attempts to perform a function on the external server  22  that results in the external server  22  generating an email as describe above, the email may be ignored and an exception or error message will be sent to administrator about unauthorized access.   Identifying the functions that are allowed in the email requests. Other functions will automatically be denied, any associated email will be ignored, and an exception or error message will be sent to administrator with unauthorized function request.   Coordinating encryption functions. When new encryption keys are to be implemented, the new key, encrypted in the existing key, along with start date and time, are sent by the administrator to the authorized users&#39; internal mail accounts.       

     These types of administration functions are necessary to satisfy security concerns. 
     To enhance overall security, especially as it relates to incoming email, it is best to include security functions on the mail server  12 . In addition, the internal server  14  can be configured to accept only email that has been forwarded from the mail server  12  and/or originated from the external server  22 , so that the internal server  14  only needs to check whether the email is one of the accepted forms. 
     Security can also be enhanced by programs that implement authentication functions and determine the correctness of the data supplied by any requests. Once the data is approved, it can then be entered into the proprietary database  16 . 
     A number of steps are involved in handling control of access to the external server  22 , and thus access to these programs provided by the internal server  14  to the external server  22 . For example, all control of access to the external server  22  may be by specific login-password controls. Moreover, the administration of these controls should be performed by the internal server  14 . In this regard, the internal server  14  will download the necessary files to the external server  22  for proper access control, security and authentication. 
     CONCLUSION 
     This concludes the description of the preferred embodiment of the invention. The following paragraphs describe some alternative embodiments for accomplishing the same invention. 
     In one alternative embodiment, any type of computer or configuration of computers could be used to implement the present invention. In addition, any number of different applications could be used with the present invention. 
     The foregoing description of the preferred embodiment of the invention has been presented for the purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise form disclosed. Many modifications and variations are possible in light of the above teaching. It is intended that the scope of the invention be limited not by this detailed description, but rather by the claims appended hereto.