Abstract:
A system and method for interconnecting a plurality of resource publisher computers with a plurality of rendezvous servers, facilitating resource publishers to dynamically publish content with little or no configuration, further facilitating web based access to the published resources by clients through a rendezvous server. The system organizes users as owners, publishers and/or subscribers of virtual channels, allowing publishers to dynamically publish resource sets to channels, and subscribers to access and/or update resources published to such channels. Resource sets reside at resource publishers, with a rendezvous server facilitating a network path to the resources, enabling resource publishers to have full control over their resources. The system facilitates subscriber clients to connect to a rendezvous server to view the status of the resource sets and access and/or update online resource sets.

Description:
CROSS-REFERENCE 
       [0001]    This application refers to the provisional patent application No. 61/621,547 dated 2012 Apr. 8. 
     
    
     BACKGROUND OF THE INVENTION 
       [0002]    In a typical communication between a web browser and a web server, a network entity designed for serving web pages or files implements a server program that accepts incoming network connections, such that clients or browsers connect to the server&#39;s network service port. In such a scenario the server opens a passive listening port (e.g. TCP port number 80 for incoming HTTP connections or TCP port number 443 for incoming HTTPS connections) and clients connect to the server by actively connecting to the server&#39;s listening port. 
         [0003]    In a typical communication between a web browser and a web server through a web proxy, the network traffic between a client and a server is intercepted by an intermediate web proxy. A web proxy is a network entity designed to function as a server to clients and as a client to servers. From the client&#39;s point of view, a proxy acts as a server to receive incoming connections from clients. From the server&#39;s point of view, it acts as a client by forwarding the incoming connections to the server. A typical set of proxies add value to a network service by load balancing network traffic to the server and/or by off-loading server load by serving locally cached data to clients. 
         [0004]    A firewall is a network entity that is typically placed at the entry/exit point of a computer network as a protection device, and can be configured to allow/disallow network connections based on connection attributes. For instance, a firewall can be placed at the entry point of a server farm or data center and it could be configured to let incoming connections destined to the server&#39;s TCP port 80 (IANA Internet Assigned Numbers Authority&#39;s default HTTP port) to transit through the firewall to the server, whilst dropping incoming connection packets that are unwanted (for example connections with destination port not equal to 80). Another wide spread use of a firewall is at the entry/exit point of small residential networks. For instance, firewall functionality usually comes built-in with home routers used in multitude of human residences. The default role of a home firewall is to disallow incoming network connections whilst allowing outgoing network connections. Such a setup prevents rogue hackers from crafting network attacks on home networks. If a residential user intends to accept incoming connections for a server then the firewall would have to be configured to allow incoming connections for that particular listening port (e.g. TCP protocol port 80). 
         [0005]    One of the current methods uses direct peer to peer connections, wherein a residential computer serves files to users over the interne by running a network server program to listen to incoming requests. This solution may or may not allow a peer to browse the remote peer (hereby termed ‘live browsing’). This solution has the following four disadvantages:
       a. The peer that serves files has to configure a firewall to allow incoming connections,   b. The peer that serves files has to run a program that listens to incoming connections, thereby opening it up to the possibility of various attacks, such as port scanning, denial of service, and hacking, from anyone on the internet,   c. The peer that accesses (or browses) the files connects to the IP address of the serving peer, requiring it to ‘trust’ that it is connected to the correct IP address, and that the IP addresses has not been spoofed,   d. The peer that accesses (or browses) the files has to rely on the provider&#39;s implementation of algorithms for security of the data that travels such connections, given that a web browser will not display the familiar SSL security padlock.       
 
         [0010]    One of the current methods uses server assisted peer to peer connections, wherein peers locate each other&#39;s location or IP address using an intermediate server, after which the connections are established in a direct peer to peer mode as above. This method will have the same disadvantages as mentioned in the direct peer to peer case above. 
         [0011]    One of the current methods uses cloud storage based file sharing, wherein one peer uploads files to an intermediate server for storage, and an accessing-peer downloads from the intermediate server, a typical scenario being a server supplied program that downloads it automatically to the peer&#39;s computer. Methods similar to these are currently implemented by various online sites. While these services overcome the disadvantages of a peer to peer network, they still do not solve the ‘live browsing’ feature, and they require their users to store user files at the service provider. There is a subset of users who do not wish to relinquish their data to a service provider&#39;s storage farm. 
         [0012]    There is a need for a solution that overcomes all the disadvantages of a peer to peer network, and does not require a user to upload their data to a storage farm, and still maintains the advantages of live browsing. The present invention solves this problem by using secure (SSL based) connections, which ensures DNS security, IP address security, Data Security, Live Browsing, without the need to upload files, while providing a secure browsing experience over HTTPS (Secure HTTP protocol). 
         [0013]    The following is a list of items describing how the present invention differs from other inventions:
       1) While U.S. Pat. No. 7,161,947 by the current inventor describes a method of transparently intercepting protocols such as FTP that utilize control and data connections; in contrast, the present invention describes a method of serving a protocol such as HTTP that utilizes one connection per request in a manner such that both the accessing computer and serving computer set up active connections to an intermediate rendezvous server.   2) While patent application Ser. No. 11/871,032 describes a method of sharing computer display screens; in contrast, the present invention describes a method for sharing file folders.   3) While patent application Ser. No. 13/644,659 describes a method of integration between local and remote computing environments for the purpose of sharing remote application; in contrast, the present invention describes a method for sharing file folders and for serving files from remote computers.   4) Patent application Ser. No. 13/595,472 describes a method for mobile devices to negotiate a dynamic rendezvous point using a notification, thereby creating a set of ephemeral rendezvous points.   Such a method would require connection initiation from a first mobile device for each rendezvous with a second mobile device. Furthermore, such a method would imply that a rendezvous point is negotiated for each transfer. Furthermore, such a method would imply that the first mobile device and the second mobile device negotiate a rendezvous point sporadically on an as-needed basis. Furthermore, such a method would imply that such transfers occur in a non-continuous form, wherein even during two consecutive transfers there would a small time window (during negotiation) where the first mobile device is unavailable.   In contrast, the present invention describes a method for continuously serving files and folders from a publisher computer utilizing a rendezvous server, using a control connection and a data connection, such that the control connection always remains connected to a rendezvous server, and data requests are handled using a combination of control and data connections, such that data transfer between the publisher and the rendezvous server occurs using a separate data connection. In the present invention, all the clients utilizing the system connect to a well-known server and browse web pages as though it is served from the rendezvous server, such that publisher computers act as a pseudo servers that serve content for channels through the rendezvous server. Furthermore, in the present invention, published data and associated channels are continuously available for the life of the control connection, such that publisher data is available online for extended periods of time, as long as the publisher program stays connected to the rendezvous server (typically for tens of thousands of requests over many days or weeks).       
 
       SUMMARY OF THE INVENTION 
       [0020]    In the context of this document, for the purposes of computer networking the use of the term ‘rendezvous’ is meant to imply a network location where the user of a resource and the publisher of a resource meet up by connecting over network connections, such that the user can locate the publisher and the publisher can serve the user with a representation of the resource. 
         [0021]    The present invention organizes users as owners, publishers and/or subscribers of virtual channels; wherein requested URLs (Uniform Resource Locators) contain a channel identifier and resource identifier as part of the URL; additionally organizing publishers to dynamically publish resource sets to channels, and subscribers to access and/or update resources published to such channels. For the purpose of this document, the term ‘resource’ implies collected bits of computer data. 
         [0022]    The present invention organizes and allows desktop computers and other mobile devices to register as resource publishers with a rendezvous server in the Internet by actively connecting to the rendezvous server (hereby termed ‘control connection’); such that client users (using web browsers) can fetch or update the content residing on a resource publisher by connecting to the rendezvous server (hereby termed ‘subscriber connection’), wherein the rendezvous server forwards the user&#39;s request over a control connection to the resource publisher, and the resource publisher in turn sends a content response over an active network connection (hereby termed ‘data connection’) to the rendezvous server, which in turn forwards it to the user over the subscriber connection. Additionally, a publisher control connection is kept open across multiple data connections (from the same publisher), such that it handles multiple subscriber requests, such that published data is available online continuously for the life of the control connection. 
         [0023]    As described above, a rendezvous server listens for incoming connections from resource publishers as well as from requesting resource subscriber clients, and it patches the connections together for request and response flows. Thus allowing for content to be served from resource publishers without needing resource publishers to open passive listening ports on resource publisher computers. 
         [0024]    A key difference between the present invention and a generic proxy based solution is that in the present invention the publisher actively connects to a rendezvous server, as opposed passively listening for incoming connections, making it firewall friendly, and enabling easy deployment at a multitude of residential customers. 
         [0025]    A key difference between the present invention and a peer to peer file sharing network is that the present invention uses standard secure protocol (HTTPS), is not open to IP spoofing, is not open to DNS spoofing, does not open a publisher to attacks from the internet. 
         [0026]    A key difference between the present invention and a cloud storage based sharing network is that the present invention allows live browsing of published files without requiring the files to be uploaded and stored at a service provider&#39;s server. 
         [0027]    Such a scheme, therefore, allows for the arrangement of a multitude of resource publishers connected to a set of distributed rendezvous servers, wherein the content resides at various resource publishers, without requiring the content to be placed in a remote data center, or so called cloud of computer servers. 
         [0028]    Additionally, such an arrangement when used for digitally encrypted secure connections, would require Public Key Infrastructure (PKI) digital security certificates (SSL certificates) to be installed only at rendezvous servers instead of at each resource publisher, thereby simplifying the security architecture of the arrangement. 
         [0029]    Such a scheme, allows maximum control of the content by a resource publisher by ensuring that bits of private data are not placed on huge computers in a data center or server cloud, whilst providing a dynamic control over the availability and unavailability of content. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0030]    The foregoing and other objects, features and advantages of the invention will be apparent from the following description of particular embodiments of the invention, as illustrated in the accompanying drawings in which like reference characters refer to the same parts throughout the different views. The drawings are not necessarily to scale, with the emphasis instead being placed upon illustrating the embodiments, principles and concepts of the invention. 
           [0031]      FIG. 1  is a block diagram of a rendezvous server based data communications system, configured according to one embodiment of the invention. 
           [0032]      FIG. 2  is a flow chart of the process of a request and response flow at a rendezvous server of the data communications system, when the system is configured as per  FIG. 1 . 
           [0033]      FIG. 3  is a block diagram of the modules of a rendezvous server, configured according to one embodiment of the invention. 
       
    
    
     DETAILED DESCRIPTION OF THE EMBODIMENTS 
       [0034]    The present invention relates to techniques for arranging resource publishers and rendezvous servers to provide a dynamically controllable resource publication system that is accessible over the interne without the need to set up full scale servers at the various resource publishers. A typical server on the Internet requires a valid domain name, a firewall for protection, and a host of other supporting networking gear. The present invention allows resource publishers to publish resources like software files and directories by simply registering with a rendezvous server, without the need for additional networking gear. The present invention also provides security of the resources at a resource publisher by actively connecting to a rendezvous server, as opposed to passively listening to incoming connections. 
         [0035]      FIG. 1  shows a data communications system configured to operate according to the principles of this invention. The data communications system includes a first computerized device, such as client computer  20 , a computer server device  50 , a second computerized device, such as publisher computer  60 , a third computerized device, such as publisher computer  70 . The direction of arrows in  FIG. 1  indicate the direction in which a connection is initiated, such that the arrowhead is at the listener end of a TCP connection. 
         [0036]    As illustrated in  FIG. 1 , during a typical operation of the data communications system, the user operating the client computer  20  uses a web browser  21  to connect to the rendezvous server  50 . The rendezvous server shows the online or offline status of the various resource publishers that the user has authority to access. If a resource publisher is offline, the user cannot access or browse the associated resources or files. 
         [0037]    Publisher computer  60  can initiate a network connection, hereby termed ‘control connection’  65  to the rendezvous server  50 . By doing so it registers with the rendezvous server  50 , after which point the status of the resource publisher changes to ‘online’. 
         [0038]    Publisher computer  70  can initiate a network connection, hereby termed ‘control connection’  75  to the rendezvous server  50 . By doing so it registers with the rendezvous server  50 , after which point the status of the resource publisher changes to ‘online’. 
         [0039]    If the user has access rights to the resource set  62  published by the publisher computer  60 , the user can access or update the resources in resource set  62 . 
         [0040]    If the user does not have access rights to the resource set  72  published by the publisher computer  70 , the rendezvous server  50  does not allow the user to access the resources in resource set  72 . 
         [0041]    Access rights to resource sets can be implemented in various ways. The method described in this invention implements access rights by associating various resource sets to virtual channels, wherein users who are subscribers of certain channels can access those resources, and users who are publishers of certain channels can publish resource sets to those channels. 
         [0042]    After receiving the HTTP request from web browser  21  over subscriber connection  25  to read a resource belonging to resource set  62 ; if the user has access rights to that set, the rendezvous server  50  forwards the request to the resource publisher  61  over control connection  65 . The resource publisher  61  generates a response and sends the resource (e.g. software copy of a file) to the rendezvous server  50  over data connection  67 . The rendezvous server  50  in turn forwards the response to the web browser  21  over subscriber connection  25 . 
         [0043]    After receiving the HTTP request from web browser  21  over subscriber connection  25  to read a resource belonging to resource set  72 ; if the user does not have access rights to that set, the rendezvous server  50  rejects the request by sending an error response to the web browser  21  over subscriber connection  25 . 
         [0044]      FIG. 2  illustrates a procedure  200  for managing connections at a rendezvous server for a request from a client user, such as web browser  21 , for a resource located at a publisher computer such as  70 . 
         [0045]    In step  202 , the rendezvous server receives a control connection request from the publisher computer  70 . The rendezvous server accepts the connection and adds connection information about resource publisher  71  to its software registry. 
         [0046]    In step  204 , the rendezvous server receives a request from the client web browser  21  over subscriber connection  25 . The rendezvous server accepts the connection and parses the request to find that it is a request to fetch a resource located at the publisher computer  70  in the resource set  72  which can be served by the resource publisher  71 . 
         [0047]    In step  206 , the rendezvous server consults a channel publish-subscribe module to check whether the user is authorized to access the resource. If the user is authorized to access the aforementioned resource the rendezvous server proceeds to step  208 , else it proceeds to step  214 . 
         [0048]    In step  208 , the rendezvous server forwards the subscriber request to the resource publisher  71  over control connection  75 . 
         [0049]    In step  210 , the rendezvous server accepts an incoming data connection  77  from the resource publisher  71  containing a response. A response can contain either a successful result with associated data or an error result with associated error information. 
         [0050]    In step  212 , the rendezvous server forwards the response to the client web browser  21  over the subscriber connection  25 . 
         [0051]    In step  214 , the rendezvous server forwards an authorization failure error response to the client web browser  21  over the subscriber connection  25 . 
         [0052]    In a related embodiment, the rendezvous server can allocate a specific time interval for receiving a response from the resource publisher  71 . In case a response is not received within the specified time interval, the rendezvous server can abort the request processing and send an error response to the client web browser  21  over the subscriber connection  25 . 
         [0053]      FIG. 3  shows a block diagram of a rendezvous server  50  configured according to one embodiment of the invention. The server system includes a database  80  hereby termed ‘channel publish-subscribe module’ for storing various association tables, such as registry  81  for storing user authentication, channel, and resource-set entries, user to channel associations  82 , resource-set to user associations  83 , resource-set to channel associations  84 ; a rendezvous connection table  91 ; a network layer  100  to accept incoming network connections such as subscriber connection  25 , control connection  75 , data connection  77 .  FIG. 3  also depicts publisher computer  70  and web browser  21  which are external to the rendezvous server. The direction of arrows in  FIG. 3  indicate the direction in which a connection is initiated, such that the arrowhead is at the listener end of a TCP connection. 
         [0054]    The rendezvous server  50  receives an incoming control connection  75  from a resource publisher user at the network layer  100 , upon which it validates the user by checking the registry  81 . It further checks if the user is a channel publisher by searching the user to channel association  82 . It further checks if there are any published resource-sets by the user by searching the resource-set to channel association  83 . If all these checks succeed an entry is added to the rendezvous connection table  91 , else the control connection is rejected. 
         [0055]    The rendezvous server  50  receives a request over an incoming subscriber connection  25  from a subscriber user using a web browser client  21  at the network layer  100 , upon which it validates the user by checking the registry  81 . It further checks if the user is allowed to access the requested channel by searching the user to channel association  82 . It further searches the rendezvous connection table  91  to locate a resource publisher control connection  75  associated with the requested channel, upon which it forwards the request along with a unique request identifier to resource publisher  71  over control connection  75 . It further adds a uniquely identifiable entry to the rendezvous connection table  91  for subscriber connection  25 . 
         [0056]    The rendezvous server  50  receives an incoming data connection  77  from resource publisher  71  at the network layer  100 , upon which it searches the rendezvous connection table  91  to find the uniquely identified entry for subscriber connection  25 . If the request on subscriber connection  25  has a data payload it forwards it to the publisher over the data connection  77 . Additionally, it forwards the response received on data connection  77  to the user over subscriber connection  25 . 
         [0057]    In a related embodiment, publisher control connections, publisher data connections, and subscriber connections use encrypted network service, such as SSL (Secure Sockets Layer), further ensuring security of the data. 
         [0058]    In a related embodiment, the subscriber connection request is for storing data to the publisher&#39;s resource-set (e.g. an HTTP POST request), wherein data payload of a request is forwarded to the resource publisher over the data connection and stored in the resource-set at the publisher. Such a configuration can be used to dynamically update the resource set mapped to the channel. Furthermore, such a configuration can be used to distribute data to multiple channel users across multiple computers. 
         [0059]    In a related embodiment, a publisher computer has one resource publisher, but multiple resource sets, such that one resource set is available on one channel, whereas a second resource set is available on a different channel. In such a scenario, the rendezvous server checks whether the client web browser is allowed access to the specific channel before forwarding the request to the resource publisher. 
         [0060]    In a related embodiment, resource publishers are full scale servers located within a network of computers equipped to safely handle incoming traffic, wherein resource publishers dynamically publish content by utilizing a rendezvous server as a means for redirecting client traffic to the appropriate resource publisher. Such a configuration can be deployed for high performance content publishing. 
         [0061]    In a related embodiment, multiple full scale servers with duplicate data are set up as resource publishers connected as slave servers to a main rendezvous server. Such a configuration can be used for a high redundancy web service or for load balancing web content. 
         [0062]    In a related embodiment, multiple full scale servers with differing data are set up as resource publishers connected as slave servers to a main rendezvous server. Such a configuration can be used across geographic regions, wherein various regional resource publishers feed into a centralized rendezvous server. Such a configuration can be used for deploying a content aggregation system. 
         [0063]    In a related embodiment, multiple rendezvous servers are set up within a server cluster, such that they load balance incoming publisher and subscriber connections based on the connection load of the cluster. 
         [0064]    In a related embodiment, multiple rendezvous servers are set up across geographically diverse locations, such that publishers are assigned to a rendezvous server based on the proximity of the publisher with the rendezvous server. 
         [0065]    It is to be understood that the above-described embodiments are simply illustrative of the principles of the invention. Various and other modifications and changes may be made by those skilled in the art which will embody the principles of the invention and fall within the spirit of and scope thereof.