US6606708B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Secure server architecture for Web based data management
Assignee: Verizon Patent and Licensing Inc
•
Filing: 1998-09-24
•
Granted: 2003-08-12
•
Expires: 2018-09-24
Abstract
Abstract A double firewalled system is disclosed for protecting remote enterprise servers that provide communication services to telecommunication network customers from unauthorized third parties. A first router directs all connection requests to one or more secure web servers, which may utilize a load balancer to efficiently distribute the session connection load among a high number of authorized client users. On the network side of the web servers, a second router directs all connection requests to a dispatcher server, which routes application server calls to a proxy server for the application requested. A plurality of data security protocols are also employed. The protocols provide for an identification of the user, and an authentication of the user to ensure the user is who he/she claims to be and a determination of entitlements that the user may avail themselves of within the enterprise system. Session security is described, particularly as to the differences between a remote user's copper wire connection to a legacy system and a user's remote connection to the enterprise system over a "stateless"public Internet, where each session is a single transmission, rather than an interval of time between logon and logoff, as is customary in legacy systems.
Inventors
- 👤 Carol Y. Devine
- 👤 Gerald A. Shifrin
- 👤 Richard W. Shoulberg
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-24 19:29
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; G; G06; G06F; G06F11/00; G06F11/07; G06F11/0703; G06F11/0706; G06F11/0709; G06F11/0766; G06F11/0769; G06F11/0775; G06F11/0781; G06F11/0784; G06F11/30; G06F11/32; G06F11/324; G06F11/327; G06F11/34; G06F11/3466; G06F11/3495; G06F16/00; G06F16/90; G06F16/95; G06F16/958; G06F16/972; G06F21/00; G06F21/30; G06F21/31; G06F21/41; G06F21/50; G06F21/55; G06F21/552; G06Q; G06Q10/00; G06Q10/10; G06Q10/107; G06Q20/00; G06Q20/08; G06Q20/10; G06Q20/102; G06Q20/38; G06Q20/382; G06Q30/00; G06Q30/02; G06Q30/06; G06Q30/0601; G06Q30/0609; G06Q30/0633; G06Q30/0635; G06Q99/00; H04L12/00; H04L12/02; H04L12/14; H04L12/1428; H04L41/00; H04L41/02; H04L41/0213; H04L41/0233; H04L41/024; H04L41/0246; H04L41/0253; H04L41/08; H04L41/0803; H04L41/0876; H04L41/0879; H04L41/14; H04L41/142; H04L41/18; H04L41/22; H04L41/28; H04L41/50; H04L41/5003; H04L41/5019; H04L41/5022; H04L41/5061; H04L41/5064; H04L41/5067; H04L41/5074; H04L41/508; H04L41/5083; H04L41/5096; H04L43/00; H04L43/02; H04L43/022; H04L43/024; H04L43/06; H04L43/08; H04L43/0805; H04L43/0817; H04L43/0823; H04L43/0829; H04L43/091; H04L51/00; H04L51/04; H04L51/21; H04L51/222; H04L63/0209; H04L63/0227; H04L63/0236; H04L63/0272; H04L63/0281; H04L63/04; H04L63/0428; H04L63/0442; H04L63/0464; H04L63/08; H04L63/0807; H04L63/0823; H04L63/083; H04L63/16; H04L63/162; H04L63/166; H04L63/168; H04L63/18; H04L65/00; H04L65/40; H04L65/401; H04L65/80; H04M; H04M15/00; H04M15/41; H04M15/43; H04M15/44; H04M15/49; H04M15/51; H04M15/58; H04M15/70; H04M15/705; H04M15/72; H04M15/721; H04M15/745; H04M15/80; H04M15/8044; H04M15/83; H04M15/835; H04M15/8351; H04M15/84; H04M3/00; H04M3/42; H04M3/50; H04M3/51; H04M3/5175; H04M3/5183; H04M3/5191; G06F11/0751; G06F11/0754; G06F11/0757; G06F11/16; G06F11/20; G06F11/202; G06F11/328; G06F2201/00; G06F2201/81; G06F2201/86; G06F2201/875; G06F2221/00; G06F2221/21; G06F2221/2137; G06F2221/2149; H04L41/06; H04L41/0681; H04L41/0895; H04L41/12; H04L41/122; H04L41/5009; H04L41/5029; H04L41/5032; H04L43/04; H04L43/045; H04L43/062; H04L43/065; H04L43/067; H04L43/0811; H04L43/0847; H04L43/0852; H04L43/0876; H04L43/0888; H04L43/0894; H04L43/10; H04L43/106; H04L43/16; H04L63/0218; H04L63/0815; H04M2215/00; H04M2215/01; H04M2215/0104; H04M2215/0108; H04M2215/0152; H04M2215/0164; H04M2215/0168; H04M2215/0176; H04M2215/018; H04M2215/0188; H04M2215/42; H04M2215/46; H04M2215/54; H04M2215/70; H04M2215/7009; H04M2215/7036; H04M2215/7045; H04M2215/74; H04M2215/745; H04M2215/81; H04M2215/8104; H04M2215/8108; H04M2215/8129; H04M2215/82; Y; Y10; Y10S; Y10S379/00; Y10S379/90; Y10S707/00; Y10S707/99931; Y10S707/99937; Y10S707/99938; Y10S707/99939; Y10S707/99941; Y10S707/99944; Y10S715/00; Y10S715/961; Y10S715/965; Y10S715/969
Claims Analysis
Total Claims: 29
Claim 1
Independent Claim
296 words
A system for securing an enterprise communications network, said system having client access through the public Internet, said system comprising: (a) a first Internet firewall for accepting service requests from an enterprise client and routing said requests to one or more preselected addresses behind said firewall, said firewall permitting access in compliance with a first set of filtering rules; (b) at least one secure web server for receiving said service requests and managing a secure client session over the public Internet, said secure server providing session management for said service request, said session management including client identification, validation and a session identifier to link said session with said client, wherein said session identifier is a web cookie generated by a separate server during an entitlements communications, after identification and validation of the client; (c) a second Internet/Internet firewall for accepting service requests from a secure web server and routing said requests to one or more preselected addresses behind said firewall corresponding to dispatcher servers, said firewall permitting access in compliance with a second set of filtering rules; (d) at least one dispatcher server for communicating with said secure web server through a second firewall, said second firewall accepting services requests from said secure web server and routing said requests to said dispatcher server in compliance with a second set of filtering rules, said dispatcher server providing system access to said enterprise communications network after client entitlements have been verified; and (e) a plurality of proxy services linking said dispatcher server to a plurality of system resources over said communications network, said plurality of system resources providing communications network management capabilities for said enterprise client, said system resources responsive to service requests from said enterprise client to generate client data or instructions relating to said communications network.
Claim 2
Independent Claim
296 words
A system for securing an enterprise communications network, said system having client access through the public Internet, said system comprising: (a) a first Internet firewall for accepting service requests from an enterprise client and routing said requests to one or more preselected addresses behind said firewall, said firewall permitting access in compliance with a first set of filtering rules; (b) at least one secure web server for receiving said service requests and managing a secure client session over the public Internet, said secure server providing session management for said service request, said session management including client identification, validation and a session identifier to link said session with said client, wherein said session identifier is a web cookie generated by a separate server during an entitlements communications, after identification and validation of the client; (c) a second Internet/Internet firewall for accepting service requests from a secure web server and routing said requests to one or more preselected addresses behind said firewall corresponding to dispatcher servers, said firewall permitting access in compliance with a second set of filtering rules; (d) at least one dispatcher server for communicating with said secure web server through a second firewall, said second firewall accepting services requests from said secure web server and routing said requests to said dispatcher server in compliance with a second set of filtering rules, said dispatcher server providing system access to said enterprise communications network after client entitlements have been verified; and (e) a plurality of proxy services linking said dispatcher server to a plurality of system resources over said communications network, said plurality of system resources providing communications network management capabilities for said enterprise client, said system resources responsive to service requests from said enterprise client to generate client data or instructions relating to said communications network.
Claim 3
Dependent Claim
28 words
The system for securing an enterprise communications network as claimed in claim 1 wherein said secure web server communicates with said dispatcher server over an encrypted socket connection.
Claim 4
Dependent Claim
27 words
The system for securing an enterprise communications network as claimed in claim 2 wherein said system includes encryption between said secure web server and said dispatcher server.
Claim 5
Dependent Claim
55 words
The system for securing an enterprise communications network as claimed in claim 3 wherein said system includes a first encryption algorithm for transmission of all customer data between said secure web server and said dispatcher server, and a second encryption algorithm for transmission of all data between said secure web server and said enterprise client.
Claim 6
Dependent Claim
46 words
The system for securing an enterprise communications network as claimed in claim 1 , wherein said system further comprises a plurality of secure web servers and a load balancing device for managing and distributing a plurality of client sessions across said plurality of secure web servers.
Claim 7
Dependent Claim
66 words
The system for securing an enterprise communications network as claimed in claim 1 wherein said web cookie is wrapped and unwrapped by said secure web server at each service request to link a session with said client through a plurality of discrete client service requests in said session to verify said client to said dispatcher server at each transmission of a service request in said session.
Claim 8
Dependent Claim
40 words
The system for securing an enterprise communications network as claimed in claim 6 which further includes a web browser for said client which provides secure socket layer encryption of client identification, authentication and said web cookie at each service request.
Claim 9
Dependent Claim
27 words
The system for securing an enterprise communications network as claimed in claim 7 wherein said web cookies provide simultaneous session management for a plurality of system resources.
Claim 10
Independent Claim
257 words
A system for securing an enterprise communications network, said system having client access through the public Internet, said system comprising: (a) a first Internet firewall for accepting service requests from an enterprise client and routing said requests to one or more preselected addresses behind said firewall, said firewall permitting access in compliance with a first set of filtering rules; (b) a plurality of web servers having said preselected addresses for receiving said service requests and managing a plurality of client sessions over the public Internet, a load of said client sessions per each of said web servers is balanced by web balancers, each of said web servers providing session management for said service request, said session management including client identification, validation and a session identifier to link a session with a client, wherein said session identifier is a web cookie generated by a separate server during an entitlements communications, after identification and validation of the client; (c) at least one dispatcher server for communicating with said web servers through a second firewall, said second firewall accepting services requests from said web servers and routing said requests to said dispatcher server in compliance with a second set of filtering rules, said dispatcher server providing system access to said enterprise communications network after client entitlements have been verified; and (d) a plurality of proxy servers linking said dispatcher server to a plurality of application servers within said communications network, said application servers communicating with a plurality of system resources to provide communications network management capabilities for said enterprise clients.
Claim 11
Independent Claim
257 words
A system for securing an enterprise communications network, said system having client access through the public Internet, said system comprising: (a) a first Internet firewall for accepting service requests from an enterprise client and routing said requests to one or more preselected addresses behind said firewall, said firewall permitting access in compliance with a first set of filtering rules; (b) a plurality of web servers having said preselected addresses for receiving said service requests and managing a plurality of client sessions over the public Internet, a load of said client sessions per each of said web servers is balanced by web balancers, each of said web servers providing session management for said service request, said session management including client identification, validation and a session identifier to link a session with a client, wherein said session identifier is a web cookie generated by a separate server during an entitlements communications, after identification and validation of the client; (c) at least one dispatcher server for communicating with said web servers through a second firewall, said second firewall accepting services requests from said web servers and routing said requests to said dispatcher server in compliance with a second set of filtering rules, said dispatcher server providing system access to said enterprise communications network after client entitlements have been verified; and (d) a plurality of proxy servers linking said dispatcher server to a plurality of application servers within said communications network, said application servers communicating with a plurality of system resources to provide communications network management capabilities for said enterprise clients.
Claim 12
Dependent Claim
48 words
The system for securing an enterprise communications network as claimed in claim 9 wherein said web servers are secure servers which encrypt each of said service requests with a first algorithm before transmission to said dispatcher server and a selected one of said proxy and said application servers.
Claim 13
Dependent Claim
32 words
The system for securing an enterprise communications network as claimed in claim 9 , said communications network further including an authentication server which determines application server entitlements for said client following authentication.
Claim 14
Dependent Claim
38 words
The system for securing an enterprise communications network as claimed in claim 9 , wherein said system further comprises a load balancing device for managing and distributing a plurality of client sessions across said plurality of web servers.
Claim 15
Dependent Claim
67 words
The system for securing an enterprise communications network as claimed in claim 9 wherein said unique web cookie is wrapped and unwrapped by said secure web server at each service request to link a session with said client through a plurality of discrete client service requests in said session to verify said client to said dispatcher server at each transmission of a service request in said session.
Claim 16
Dependent Claim
41 words
The system for securing an enterprise communications network as claimed in claim 10 which further includes a web browser for said client which provides secure socket layer (SSL) encryption of client identification, authentication and said web cookie at each service request.
Claim 17
Dependent Claim
55 words
The system for securing an enterprise communications network as claimed in claim 14 wherein said system includes RSA encryption for transmission of all customer data between said plurality of secure web servers and said dispatcher server, and SSL encryption for transmission of all data between said secure web servers and said plurality of enterprise clients.
Claim 18
Independent Claim
220 words
A method of securing an enterprise communications network having public access via the public Internet, said method enabling access by a plurality of enterprise clients, said method comprising: (a) routing all public access requests to one or more first preselected addresses for response via a first set of routing rules; (b) authenticating a secure web server in response to said request for access and initiating a secure session with a client browser over the Internet; (c) encrypting communications between said client browser and said secure server with a first security protocol; (d) routing a request for client authentication and a set of client entitlements from said secure server to a second preselected address at log-on via a second set of routing rules, wherein said client authentication and client and entitlements are provided by an authentication server; (e) encrypting communications within said network with a second security protocol; and (f) creating a session management object at each log-on to authenticate the client's browser to the enterprise network at each communication from the browser during the communications session, said session management object including client identification, validation and a session identifier to link a session with a client, wherein said session identifier is a unique web cookie generated by a separate server during an entitlements communications, after identification and validation of the client.
Claim 19
Independent Claim
220 words
A method of securing an enterprise communications network having public access via the public Internet, said method enabling access by a plurality of enterprise clients, said method comprising: (a) routing all public access requests to one or more first preselected addresses for response via a first set of routing rules; (b) authenticating a secure web server in response to said request for access and initiating a secure session with a client browser over the Internet; (c) encrypting communications between said client browser and said secure server with a first security protocol; (d) routing a request for client authentication and a set of client entitlements from said secure server to a second preselected address at log-on via a second set of routing rules, wherein said client authentication and client and entitlements are provided by an authentication server; (e) encrypting communications within said network with a second security protocol; and (f) creating a session management object at each log-on to authenticate the client's browser to the enterprise network at each communication from the browser during the communications session, said session management object including client identification, validation and a session identifier to link a session with a client, wherein said session identifier is a unique web cookie generated by a separate server during an entitlements communications, after identification and validation of the client.
Claim 20
Dependent Claim
53 words
The method of securing an enterprise communications network as claimed in claim 16 , said method further comprising the step of providing a plurality of application resources to one of said plurality of enterprise clients within said network in accordance with entitlements determined for said one of said plurality of clients at authentication.
Claim 21
Dependent Claim
40 words
The method of securing an enterprise communications network as claimed in claim 16 which further includes the step of balancing a plurality of client requests across a plurality of secure web servers to improve response time for each client session.
Claim 22
Independent Claim
33 words
The method of securing an enterprise communications network as claimed in claim, 17 , said method further comprising the steps of packet filtering communications between said client browser and said secure web server.
Claim 23
Dependent Claim
39 words
The method of securing an enterprise communications network as claimed in claim 19 , said method further comprising the step of creating a proxy to filter communications between said secure web server and an application resource within said network.
Claim 24
Dependent Claim
32 words
The method of securing an enterprise communications network as claimed in claim 18 , wherein said method further includes public key encryption for encrypting communications between the client browser and the network.
Claim 25
Dependent Claim
37 words
The method of securing an enterprise communications network as claimed in claim 18 which uses a negotiated SSL protocol to authenticate the secure web server and encrypt communications between the client browser and the secure web server.
Claim 26
Dependent Claim
28 words
The method of securing an enterprise communications network as claimed in claim 18 , wherein public key encryption is used for said second security protocol within said network.
Claim 27
Dependent Claim
57 words
The method of securing an enterprise communications network as claimed in claim 16 , wherein said method further includes the step of embedding calls to Java applets in a logon page presented to a one of said plurality of clients at log on, one of said applets creating said session management object in said one client browser.
Claim 28
Dependent Claim
53 words
The method of securing an enterprise communications network as claimed in claim 17 , wherein said method further includes the step of downloading a collection of Java objects to said client browser for session management following a successful log on, said collection of objects enabling communications with said application resources during said session.
Claim 29
Dependent Claim
31 words
The method of securing an enterprise communications network as claimed in claim 24 , further comprising the step of examining said unique cookie at each session transmission to maintain session security.
References Cited (Backward Citations)
US4160129A
Cited
US4345315A
Cited
US4817050A
Cited
US4893248A
Cited
US5475836A
Cited
US5075771A
Cited
US4972504A
Cited
US5490060A
Cited
US5041972A
Cited
US5136707A
Cited
US5228076A
Cited
US5287270A
Cited
US5325290A
Cited
US5313598A
Cited
US5131020A
Cited
US5262760A
Cited
US5555290A
Cited
US5812750A
Cited
US5223699A
Cited
US5245533A
Cited
US5832519A
Cited
US5734709A
Cited
US5812654A
Cited
US5315093A
Cited
US5491779A
Cited
US5537611A
Cited
US5285494A
Cited
US5815080A
Cited
US5452446A
Cited
US5586260A
Cited
US5506893A
Cited
US5361259A
Cited
US5974396A
Cited
US5666481A
Cited
US5327486A
Cited
US5369571A
Cited
US5481542A
Cited
US5953389A
Cited
US5848399A
Cited
US5548726A
Cited
US5483596A
Cited
US5787412A
Cited
US5812533A
Cited
US5533108A
Cited
US5793762A
Cited
US5721913A
Cited
US5694546A
Cited
US5566351A
Cited
US5539734A
Cited
US6161102A
Cited
US5563805A
Cited
US5621727A
Cited
US5742905A
Cited
US5530744A
Cited
US5526257A
Cited
US5778377A
Cited
US5623601A
Cited
US5551025A
Cited
US5610915A
Cited
US5689645A
Cited
US5787160A
Cited
US5630066A
Cited
US5781632A
Cited
US5982891A
Cited
US5790797A
Cited
US5671354A
Cited
US5696906A
Cited
US5825769A
Cited
US5649182A
Cited
US20010001014A1
Cited
US5699403A
Cited
US5659601A
Cited
US5650994A
Cited
US5802320A
Cited
US5742762A
Cited
US6145001A
Cited
US5692030A
Cited
US5757900A
Cited
US5745754A
Cited
US6154744A
Cited
US5721908A
Cited
US5708780A
Cited
US5974441A
Cited
US6094655A
Cited
US5793964A
Cited
US5883948A
Cited
US5826269A
Cited
US5710882A
Cited
US6115458A
Cited
US6052450A
Cited
US5852812A
Cited
US5825890A
Cited
US5850517A
Cited
US5884032A
Cited
US5692181A
Cited
US6240450B1
Cited
US5930764A
Cited
US5966695A
Cited
US5826029A
Cited
US5699528A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2006-08-11 | 2007-02-10 | 2007-08-12 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2010-08-11 | 2011-02-10 | 2011-08-12 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2014-08-11 | 2015-02-10 | 2015-08-12 | $7700.00 | Window Closed / Lapsed |