[go: up one dir, main page]

WO1998032077A1 - Procede de raccordement de plusieurs ordinateurs heterogenes a des reseaux publics par une connexion physique unique - Google Patents

Procede de raccordement de plusieurs ordinateurs heterogenes a des reseaux publics par une connexion physique unique Download PDF

Info

Publication number
WO1998032077A1
WO1998032077A1 PCT/US1998/001248 US9801248W WO9832077A1 WO 1998032077 A1 WO1998032077 A1 WO 1998032077A1 US 9801248 W US9801248 W US 9801248W WO 9832077 A1 WO9832077 A1 WO 9832077A1
Authority
WO
WIPO (PCT)
Prior art keywords
computers
public network
network
computer
physical connection
Prior art date
Application number
PCT/US1998/001248
Other languages
English (en)
Inventor
Bruce Cornett
Mike Harding
Original Assignee
Bruce Cornett
Mike Harding
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Bruce Cornett, Mike Harding filed Critical Bruce Cornett
Priority to AU62471/98A priority Critical patent/AU6247198A/en
Publication of WO1998032077A1 publication Critical patent/WO1998032077A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/104—Grouping of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/2866—Architectures; Arrangements
    • H04L67/289—Intermediate processing functionally located close to the data consumer application, e.g. in same machine, in same home or in same sub-network
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/56—Provisioning of proxy services
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/50—Network services
    • H04L67/56—Provisioning of proxy services
    • H04L67/564—Enhancement of application control based on intercepted application data

Definitions

  • This invention relates to computer inter-networking, specifically a method of connecting multiple heterogeneous computers configured as a local area network (LAN) to a public network using one physical connection.
  • LAN local area network
  • the current state of the art consists of using data packet routing as the interconnection between two or more networks .
  • This method uses the Network layer in the OSI model as the driver in determining actions. Indeed, there are at least a dozen hardware devices and nearly as many software solutions to this problem in available today. Two methods exist for connecting multiple computers to public networks, leased line solutions and multiple access solutions. Both of these methods rely on data packet routing for communications. There are over 130 prior art references related to data packet routing listed under US Patent Class 395/200.15.
  • the typical data packet routing solution for connecting multiple heterogeneous computers to a public network involves procuring some sort of physical connection, most often a leased line of 56kb bandwidth or higher.
  • This solution uses a data packet router as the interface between the LAN and the public network. Additionally, most entities using this method of inter-connection install and maintain some sort of security mechanism most often a firewall.
  • Data packet routing also requires a knowledgeable technician to install, configure, and maintain each device and oversee the interaction of all nodes on the network for proper performance and configuration. It is very demanding work to keep the LAN and the public network as discreet entities using data packet routing, though it can be accomplished. This is an expensive and time-consuming process.
  • data packet routing evaluates each data packet and then sends it to the appropriate destination. This method is ineffective for handling requests since a data request consists of many individual packets. It is unrealistic and very difficult to use a data packet routing method to evaluate requests as a resul .
  • Using data packet routing for a small number of computers is not cost effective today due to its complexity, the cost of the components, and the need for skilled technicians to design, install, configure, and maintain this method of connecting multiple heterogeneous computers to public networks.
  • FIG. 1 shows the OSI Model with associated layers.
  • FIGS. 2 and 3 show a network topology that represents the current methods for connecting LANs to a public network.
  • FIG. 4 shows a network topology that represents the new method for connecting LANs to a public network.
  • FIG. 5 shows a flow chart detailing the method.
  • FIGS. 6, 7, 8, 9,10, and 11 show a network topology that demonstrates the method contained in the ARR computer program using a single physical connection to a public network.
  • FIG. 12 shows a network topology that demonstrates the method contained in the ARR computer program to deny requests originating from a computer outside the LAN.
  • FIG. 13 shows a flow chart detailing the components of the ARR computer program.
  • a method of connecting a plurality of heterogeneous computers, each capable of running an application program, to a public network using one physical connection this method consists of a LAN, capable of communicating via TCP/IP protocol, with one computer running the application request relay (ARR) computer program, and a physical connection from the computer running the ARR computer program to the public network.
  • the physical connection may be a dial up modem connecting over the public telephone network, a wireless connection, ISDN, or leased lines, but is not limited to these connections.
  • Applications needing network services on any computer on the LAN are configured to send requests for network services to the computer running the ARR software.
  • the ARR software communicates the request to the public network and returns the result to the requesting computer on the LAN.
  • the present invention provides a method for filtering content from the public network to computers of aforesaid LAN, by providing a filter to evaluate requests from computers on the LAN and allow or deny such requests as appropriate. Further, said filter evaluates content of requests returned from the public network to the ARR software and may allow or deny such content as appropriate.
  • the present invention provides a method for secure data transmission between computers of aforesaid LAN and computers external to the LAN, through the public network, by providing a security mechanism to evaluate the identification of computers sending requests to the ARR software.
  • the security mechanism evaluates requests returned from the public network to the ARR software and may allow or deny such requests as appropriate .
  • application request relay - a mechanism for evaluating and fulfilling requests (logical groups of data packets) from point to point using the Application layer of the Open Systems Interconnection (OSI) Model.
  • OSI Open Systems Interconnection
  • content - information contained in an internet resource such as a "web page " .
  • data packet - a small piece of digital information encapsulated with routing information to denote origin and destination.
  • firewall - a device (computer/router) that uses data packet filtering to determine if a particular data packet should be allowed to transit between two or more computer networks . This is the primary method used to provide security to LANs/WANs attached to public networks.
  • Java virtual machine the part of the Java runtime environment responsible for interpreting Java bytecodes
  • LAN local area network
  • network - a group of computers physically connected to one another using some established protocol (e.g. TCP/IP) to communicate amongst themselves.
  • some established protocol e.g. TCP/IP
  • node - a computer or device physically connected to a network.
  • OSI open systems interconnection
  • TCP/IP computer network communication protocols
  • public network a group of networks connected to one another that exist for public access to resources available in the connected networks. These networks share a common communication protocol (e.g. TCP/IP) and use routing to send data packets from point to point on the network.
  • TCP/IP Transmission Control Protocol/IP
  • the "Internet" is one example of a public network. requests - logical groups of data packets (this may be content or other information as may be requested by a computer connected to a LAN)
  • TCP/IP transmission control protocol/internet protocol
  • routing - a mechanism for evaluating data packets for delivery from one node to another on any computer network using the Network layer of the OSI Model.
  • SOHO small office/home office
  • WAN wide area network
  • nodes are physically located in a widely dispersed geographical area and are connected to the same physical network.
  • FIG. 3 shows a typical example of the application of this method is a small office with 5 computers sharing a single modem connection to gain Internet access.
  • Two or more computers configured as a LAN connected to one another by a persistent network connection running the TCP/IP protocol.
  • the computers may be of any manufacture, architecture, or origin with the proviso that a Java virtual machine is available for the one computer connected to the public network.
  • ARR computer program evaluates the -request.
  • ARR computer program communicates with a public network to fulfill requests on behalf of the nodes on the LAN. 9) ARR computer program communicates results from the requests to the computers on the LAN.
  • the key component in this method is the ARR computer program. It uses application request relay algorithms for passing service requests and answers from the LAN to a public network over the modem. It is important to note that the physical connection/service sharing is entirely software based and requires no special hardware interface and the same ARR computer program will run on virtually all computer systems without modification.
  • the ARR computer program "listens" for requests from the LAN connected computers and connects to the location where the request may be fulfilled.
  • the ARR computer program may work in conjunction with proxy servers or services on the public network.
  • the ARR computer program is not a member of a well-known protocol family. It is a new layer positioned between TCP/IP and any other protocol the request may require .
  • FIGS. 6 through 11 The manner of using the method for connecting multiple heterogeneous computers to a public network using a single physical connection is revealed in FIGS. 6 through 11.
  • the first five (5) steps of the method shown in FIG. 5. must be performed properly prior to actual operation.
  • Steps six (6) through nine (9) are repeated as often as necessary and form the basis of operation.
  • the following procedure clearly highlights the operation of this method using a typical situation in which a computer on the LAN requests a particular web page.
  • a request is made from the computer on the LAN to ARR in FIG. 6.
  • the request is evaluated and the corresponding resource is requested from a public network. During this step, rules or filters regarding the request may be consulted and acted upon by ARR. In FIG. 8. the ARR may fulfill or deny the request using this feature.
  • the results of the request are returned to the initiating computer on the LAN from ARR in FIG. 10.
  • rules or filters regarding the request may be consulted and acted upon by ARR.
  • the ARR may modify, fulfill, or deny the request using this feature.
  • FIG 12 shows that requests originating from a computer outside the LAN will not be fulfilled.
  • the method can be used to connect multiple heterogeneous computers to public networks using a single physical connection in a secure and user friendly manner, using standard hardware and software, while effectively using an entity's resources, providing this capability in a very economical manner.
  • the application request relay has additional advantages in that • it provides public network access without utilizing data packet routing;
  • the method can be used for implementing an intelligent network content filter, as a basis for electronic commerce, or as a strategy for linking many branch offices together.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Small-Scale Networks (AREA)

Abstract

L'invention porte sur un procédé de raccordement de plusieurs ordinateurs hétérogènes (24) à un réseau public (34) par une connexion physique unique (39). Les ordinateurs (24) du réseau utilisent un protocole TCP/IP et un relais de demande d'application fonctionnant sur un ordinateur passerelle (38). Le procédé de raccordement des ordinateurs au réseau public comprend: l'établissement d'une connexion au réseau public par cette passerelle (38); l'exécution d'un programme informatique de relais de demande d'application au niveau de cet ordinateur passerelle; des applications fonctionnant sur les ordinateurs du réseau qui sont configurées pour faire une demande de ressource localisée, du réseau public, par l'intermédiaire du relais de demande d'application; le relais de demande d'application effectuant la demande de ressource et, le cas échéant, en appliquant les règles, l'établissement de la demande pour le compte de l'ordinateur qui a lancé la demande. La demande sera approuvée ou refusée conformément aux règles. Le relais de demande d'application peut autoriser des demandes provenant d'ordinateurs connus ou refuser des demandes provenant d'ordinateurs inconnus.
PCT/US1998/001248 1997-01-16 1998-01-16 Procede de raccordement de plusieurs ordinateurs heterogenes a des reseaux publics par une connexion physique unique WO1998032077A1 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
AU62471/98A AU6247198A (en) 1997-01-16 1998-01-16 Method for connecting multiple heterogeneous computers to public networks using a single physical connection

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
US3563097P 1997-01-16 1997-01-16
US60/035,630 1997-01-16
US3675697P 1997-01-27 1997-01-27
US60/036,756 1997-01-27

Publications (1)

Publication Number Publication Date
WO1998032077A1 true WO1998032077A1 (fr) 1998-07-23

Family

ID=26712328

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US1998/001248 WO1998032077A1 (fr) 1997-01-16 1998-01-16 Procede de raccordement de plusieurs ordinateurs heterogenes a des reseaux publics par une connexion physique unique

Country Status (2)

Country Link
AU (1) AU6247198A (fr)
WO (1) WO1998032077A1 (fr)

Cited By (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
SG81299A1 (en) * 1998-09-02 2001-06-19 Ibm Virtual client to gateway connection over multiple physical connections
US6317837B1 (en) * 1998-09-01 2001-11-13 Applianceware, Llc Internal network node with dedicated firewall
US7844746B2 (en) 2008-02-01 2010-11-30 International Business Machines Corporation Accessing an effective address and determining whether the effective address is associated with remotely coupled I/O adapters
US7921261B2 (en) 2007-12-18 2011-04-05 International Business Machines Corporation Reserving a global address space
US7925842B2 (en) 2007-12-18 2011-04-12 International Business Machines Corporation Allocating a global shared memory
US8893126B2 (en) 2008-02-01 2014-11-18 International Business Machines Corporation Binding a process to a special purpose processing element having characteristics of a processor

Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5706434A (en) * 1995-07-06 1998-01-06 Electric Classifieds, Inc. Integrated request-response system and method generating responses to request objects formatted according to various communication protocols

Patent Citations (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5706434A (en) * 1995-07-06 1998-01-06 Electric Classifieds, Inc. Integrated request-response system and method generating responses to request objects formatted according to various communication protocols

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
"INSTALLING THE TIS PROXY SERVER", XP002913442, Retrieved from the Internet <URL:HTTP://WWW.THEOCHEM.UNI-DUESSELDORF...U/LINUX-HOWTO/FIREWALL-HOWTO-7.HTM> [retrieved on 19980413] *
WACK J: "INTRODUCTION TO FIREWALLS", XP002913443, Retrieved from the Internet <URL:HTTP://CSR.NCSL.NIST.GOV/NISTPUBS/800-10/NODE30.HTM> [retrieved on 19980413] *

Cited By (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6317837B1 (en) * 1998-09-01 2001-11-13 Applianceware, Llc Internal network node with dedicated firewall
US7739302B2 (en) 1998-09-01 2010-06-15 Stacy Kenworthy Network attached device with dedicated firewall security
US8306994B2 (en) 1998-09-01 2012-11-06 Robust Networks, Llc Network attached device with dedicated firewall security
US8892600B2 (en) 1998-09-01 2014-11-18 Robust Networks, Llc Network attached device with dedicated firewall security
SG81299A1 (en) * 1998-09-02 2001-06-19 Ibm Virtual client to gateway connection over multiple physical connections
US7921261B2 (en) 2007-12-18 2011-04-05 International Business Machines Corporation Reserving a global address space
US7925842B2 (en) 2007-12-18 2011-04-12 International Business Machines Corporation Allocating a global shared memory
US7844746B2 (en) 2008-02-01 2010-11-30 International Business Machines Corporation Accessing an effective address and determining whether the effective address is associated with remotely coupled I/O adapters
US8893126B2 (en) 2008-02-01 2014-11-18 International Business Machines Corporation Binding a process to a special purpose processing element having characteristics of a processor

Also Published As

Publication number Publication date
AU6247198A (en) 1998-08-07

Similar Documents

Publication Publication Date Title
EP0986229B1 (fr) Procédé et système pour surveillance et contrôle de l&#39;accès au réseau
US7296292B2 (en) Method and apparatus in an application framework system for providing a port and network hardware resource firewall for distributed applications
US7315903B1 (en) Self-configuring server and server network
JP4545925B2 (ja) コンピュータネットワークにおけるエージェントシステムによる接続仲介方法及びソフトウェアエージェントプログラムを格納した媒体
US6832321B1 (en) Public network access server having a user-configurable firewall
US5550984A (en) Security system for preventing unauthorized communications between networks by translating communications received in ip protocol to non-ip protocol to remove address and routing services information
US7739729B2 (en) Electronic security system and scheme for a communications network
US5987611A (en) System and methodology for managing internet access on a per application basis for client computers connected to the internet
CA2323766C (fr) Acces securise aux services de reseau
US6003084A (en) Secure network proxy for connecting entities
US7174378B2 (en) Co-location service system equipped with global load balancing (GLB) function among dispersed IDCS
US6233688B1 (en) Remote access firewall traversal URL
US20080123536A1 (en) Virtual network testing and deployment using network stack instances and containers
US20020078213A1 (en) Method and system for management of resource leases in an application framework system
US20060130133A1 (en) Automated generation of configuration elements of an information technology system
US20080130897A1 (en) Method and system for transmitting information across a firewall
EP1001571A2 (fr) Méthode et système pour communiquer avec un commutateur de télécommunication
US20030140151A1 (en) Method and a system for controlling the access and the connections to a network
US7269647B2 (en) Simplified network packet analyzer for distributed packet snooper
US6651174B1 (en) Firewall port switching
JP4873960B2 (ja) アプリケーションサーバ機能を促進するための方法およびアプリケーションサーバ機能を含むアクセスノード
US20050125511A1 (en) Intelligent local proxy for transparent network access from multiple physical locations
US6029201A (en) Internet application access server apparatus and method
EP1274011B1 (fr) Méthode et système pour guider et enregistrer une requête
WO1998032077A1 (fr) Procede de raccordement de plusieurs ordinateurs heterogenes a des reseaux publics par une connexion physique unique

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A1

Designated state(s): AL AM AT AU AZ BA BB BG BR BY CA CH CN CU CZ DE DK EE ES FI GB GE GH GM GW HU ID IL IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MD MG MK MN MW MX NO NZ PL PT RO RU SD SE SG SI SK SL TJ TM TR TT UA UG US UZ VN YU ZW

AL Designated countries for regional patents

Kind code of ref document: A1

Designated state(s): GH GM KE LS MW SD SZ UG ZW AM AZ BY KG KZ MD RU TJ TM AT BE CH DE DK ES FI FR GB GR IE IT LU MC NL PT SE BF BJ CF CG CI CM GA GN ML MR NE SN TD TG

DFPE Request for preliminary examination filed prior to expiration of 19th month from priority date (pct application filed before 20040101)
121 Ep: the epo has been informed by wipo that ep was designated in this application
REG Reference to national code

Ref country code: DE

Ref legal event code: 8642

NENP Non-entry into the national phase

Ref country code: JP

Ref document number: 1998534719

Format of ref document f/p: F

122 Ep: pct application non-entry in european phase