Patent Document

BACKGROUND 
     It is not unusual for a person using a mobile user equipment to wish to access computing resources. For example, a person traveling may wish to access computing resources of an enterprise network associated with the traveler&#39;s regular place of business. Because of concerns about security, the enterprise network may be protected by a “firewall,” a system that is intended to prevent unauthorized and undesired access to the enterprise network. For example, the firewall may deny access except from specific “trusted” devices. 
     If a traveling user with a notebook computer that is trusted by the network wishes, for example, to print a document that is stored on the enterprise network to a printer outside the firewall, the user may download the file to the trusted notebook computer, and then send the file from the notebook computer to the printer in a separate transaction not implicating the firewall. 
     However, many people use devices such as a wireless e-mail device or a “smart phone” with e-mail or text messaging capability that does not allow the downloading of a document for printing. It is a common experience to receive an e-mail with an attached document, and be unable to open or read the attachment because the mobile device does not have sufficient memory capacity or display capability to handle the attachment. 
     One solution to this problem is “print by reference,” in which the user sends to a print server associated with the printer a reference to a document that is to be printed, which may be in the form of a network address such as an internet URL and a filename, and the print server retrieves the document directly from the enterprise server, bypassing the limited capability of the mobile device. However, with a strong firewall there may be no way of permitting the print server to retrieve the file through the firewall. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this specification, illustrate embodiments of the invention and together with the description serve to explain the principles of the invention. 
       In the drawings: 
         FIG. 1  is a block diagram parts of a computer network. 
         FIG. 2  is a flowchart of an embodiment of a method according to the invention. 
     
    
    
     DETAILED DESCRIPTION 
     Reference will now be made in detail to various embodiments of the present invention, example of which is illustrated in the accompanying drawings. 
     Referring to the drawings, and initially to  FIG. 1 , one embodiment of a computer system indicated generally by the reference numeral  10  comprises a public network  12  connecting various devices. 
     The devices connected to the network  12  may include a wireless transmitter/receiver  16 , which may define a hotspot  18  or may be, for example, part of a cellular network providing general wireless coverage, a printing system comprising a print server  20  controlling a printer  22 , and an enterprise network  23  comprising an enterprise server  24 . 
     The print server  20  may include application software capable of interpreting data file formats from common application programs and a printer driver for the printer  22  so that the printer  22  and print server  20  together can receive, interpret, and print a file that is received in the user data saving format of common application programs such as word processors, spreadsheets, graphics packages, etc. 
     In an embodiment, the public network  12  is, includes, or is in communication with, the internet, and the enterprise network  23  may be anywhere on the internet. The enterprise network  23  is protected by a firewall  26 , which may be implemented as a separate device or may be a logical function of the enterprise server  24 . The enterprise server  24  may be part of an enterprise intranet (not shown) behind the firewall  26 . The enterprise server  24  stores files including a document  28 . 
     A mobile user equipment  30 , which may be, for example, a smart phone, may be present in the hotspot  18 , and may be in communication with the transmitter/receiver  16  and thereby with the network  12 . Alternatively, the user equipment  30  may be connected to the public network  12  in another way, for example, by a wired connection. As shown in  FIG. 1 , especially in the case of the hotspot  18 , the printer  22  may be near to the transmitter/receiver  16 . Alternatively, the printer  22  may be anywhere on the network  12 , especially if a document to be printed is for the use of a person other than a user of the user equipment  30 . 
     The user equipment  30  is trusted by the firewall  26 , and is equipped to establish and maintain a secure connection with enterprise server  24 , shown symbolically by a chain-dotted line  32  in  FIG. 1 . The secure connection  32  may form a Virtual Private Network (VPN) effectively extending the enterprise network  23  to include the user equipment  30 . Once the secure connection  32  is established and the user equipment  30  has authenticated itself to the firewall  26 , the user equipment  30  is permitted to access and retrieve the document  28 . 
     The user equipment  30  is also equipped to establish connections with other devices on the network  12 , for example, with the print server  20 . 
     Referring now to  FIG. 2 , in a method embodiment of the invention, a user equipment  30 , for example, a wireless e-mail device, first connects itself to the public network  12 . The connection process may comply with the standard protocols of the network and, in the interests of simplicity, is not shown in  FIG. 2 . 
     In step  52  the user equipment  30  establishes a IP connection with a print server  20  that controls a printer  22   
     In step  54 , the user equipment  30  authenticates itself to the firewall  26  and establishes a VPN connection  32  with the enterprise server  24 . Steps  52  and  54  may occur in either order. For example, the user of the user equipment  30  may be connected to the enterprise server  24  to check e-mail, and may connect to the print server  20  only when the user finds that he or she needs to print out a document  28  that is an e-mail attachment. For example, the user equipment  30  may be attached to the network  12 , including a nearby printer  22 , for purposes that do not require the VPN connection  32 , and may establish the VPN connection  32  only when it becomes necessary for the user to access the document  28 . For example, the user may already know about the document  28 , and may establish the connection to the print server  20  and the VPN connection  32  to the enterprise server  24  only when the user wishes to print out the document. 
     In step  56 , the user equipment  30  optionally obtains a reference identifying the document  28 , which may comprise a filename for the document  28  and a location of the document  28  within the VPN comprising the enterprise server  24 . In the embodiment shown in  FIG. 2 , the user equipment contacts the enterprise server  24  to obtain, or at least verify, the existence and location of the document  28 , so step  56  is shown as following step  54 . Alternatively, the user equipment  30  may receive a precise reference to the document  28  before establishing the secure connection to the enterprise server  24  in step  54 . For example, the location of the document  28  may already be stored on the user equipment  30  or known to the user of the user equipment  30 . 
     In step  58 , the user equipment  30  sends to the print server  20  instructions to print the document  28  and a reference to the document  28  located on the enterprise server  24 . The reference sent to the print server  20  includes the current address of the user equipment  30  within the public network  12 . The reference sent to the print server  20  may also include the filename and address of the document  28  within the enterprise network  23 . Alternatively, the reference sent to the print server  20  may be in a form meaningful only to the user equipment  30 , in order not to disclose publicly unnecessary information about the internal structure of the private network. 
     In step  60 , the print server  20  sends to the user equipment  30  a request for the enterprise server  24  to supply the print server  20  with a copy of the document  28 . In the request, the print server  20  identifies the document  28  by the reference provided in step  58 . The user equipment  30 , which is acting effectively as part of the enterprise network  23 , may read the message to confirm that it consists solely of a proper request for the document  28 , and no undesirable content has been added by the print server  20  or by any intermediate device between the print server  20  and the user equipment  30 . 
     If the reference to the document  28  in the request does not contain the location and filename of the document  28  on the enterprise server  24 , the user equipment provides that information. The user equipment  30  then sends the request on to the enterprise server  24 . The enterprise server  24  receives the request, and perceives the request as coming from the user equipment  30 . The user equipment  30  is within the enterprise network  23  and entitled to obtain the document  28 , so the enterprise server  24  complies with the request and sends the document  28 . When the document  28  arrives at the user equipment  30 , the user equipment  30  routes the packets of the document  28  to the print server  20 . 
     In the embodiment shown in  FIG. 2 , a large file is transmitted as a stream of packets, each of which is sufficiently small to be handled by the user equipment  30 . The user equipment  30  receives the packets from the enterprise server  24  and forwards the packets to the print server  20  as they are received, without attempting to treat the document  28  as a whole. The user equipment  30  can thus route an indefinitely large document  28  from the enterprise server  24  to the print server  20  without being constrained by the limited memory capacity of the user equipment  30 . In addition, the document  28  may be stored on the enterprise server  24  in an editable format, which may be small compared with, for example, a rasterized printer format. The user equipment  30  can pass the packets forming the document  28  out without prejudicing the security of the enterprise network  23 . The user equipment  30  does not permit any packets or other messages to enter the enterprise network  23 . If return packets are required for verification as part of the transmission protocol being used, then the user equipment  30  receives the verification packets from the print server  20  independently of sending verification packets to the enterprise server  24 . 
     In step  62 , the print server  20  converts the document  28 , if necessary, into a printer format, and sends the document  28  to the printer  22 . The printer  22  prints the document. Once the entire document  28  has arrived at the print server  20 , the VPN connection  32  between the enterprise server  24  and the user equipment  30 , and/or any communication channel between the user equipment  30  and the print server  20 , may be closed. Alternatively, one or both of those connections may be kept open for future use and/or for other uses. 
     Various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention. For example, in the interests of simplicity,  FIG. 1  does not show in detail components of network  12  that merely serve to route messages between the print server  20 , the enterprise server  24 , and the user equipment  30 , but such components may be present. Similarly, additional servers that may be consulted to obtain address or routing information, or that may contain location data about available printers  22 , are not shown but may be present. 
     In  FIG. 1 , the transmitter/receiver  16  and the print server  20  are shown as being independently connected to the network  12 . In a hotspot  18 , the transmitter/receiver  16  and the print server  20  may physically be in a single unit with a common point of connection to the network  12 , or may be in a smaller network with a common point of connection to the network  12 . 
     In  FIG. 1 , the printer  22  and the print server  20  are shown as separate units. The print server  20  may alternatively be a functionality of the printer  22 . 
     Thus, it is intended that the present invention cover the modifications and variations of this invention provided they come within the scope of the appended claims and their equivalents.

Technology Category: 5