Secure network portal
View Patent ↗According to one embodiment, a secure network portal includes a number of application servers coupled to one or more clients through a portal server. The application servers serve a number of secure services that may be consumed by clients. The portal server creates a login session with a graphical user interface in which the login session is associated with a particular authorization level. The portal server then displays a service access point for each of the plurality of secure services and restricts access to each of the secure services according to the authorization level of the login session.
1. A secure portal system comprising:
a plurality of application servers each operable to provide a plurality of secure services over a network;
a plurality of client computers each operable to display a graphical user interface; and
a portal server communicatively connected between the plurality of application servers and the plurality of client computers, the portal server including a first firewall and a proxy server, the first firewall communicatively connected between the plurality of client computers and the proxy server, the proxy server communicatively connected between the first firewall and the plurality of application servers, the first firewall operable to restrict packet access to the at least one application server according to a set of rules, the proxy server operable to provide a level of indirection for the plurality of application servers from the graphical user interface, wherein the client computers communicate to the application server by communicating to the first firewall and then communicating with the proxy server;
an administrative server operable to store authorization level information associated with each of a plurality of users of the client computers;
a second firewall communicatively connected between the administrative server and the proxy server, the second firewall to restrict access to the authorization level information;
the portal server further operable to:
create a login session with the graphical user interface, the login session being associated with one or more authorization levels among a plurality of authorization levels, wherein at least one of the one or more authorization levels includes a confidentiality level and one or more sub-confidentiality levels, wherein the confidentiality level is one of a hierarchy of confidentiality levels and the one or more sub-confidentiality levels are each associated with an activity to be carried out by an organization associated with the plurality of client computers;
display, on the graphical user interface, a service access point for each of the plurality of secure services;
restrict access to each of the plurality of secure services according to the confidentiality level and the sub-confidentiality level of the login session; and
wherein one of the plurality of secure services comprises a storage device that stores a plurality of files, each of the plurality of files having a metadata tag indicating a file confidentiality level and sub-confidentiality level of its respective file, the portal server operable to restrict access to the storage device by comparing the authorization level of the login session with the file authorization level of each of the plurality of files.
2. The secure portal system of claim 1 , wherein the portal server is further operable to display textual content using a cross-dissolve display technique.
3. A secure portal access method comprising:
creating a login session with a graphical user interface, the login session being associated with one or more authorization levels among a plurality of authorization levels, the one or more authorization levels including a confidentiality level and a sub-confidentiality level, the confidentiality level indicating a level of a hierarchy of confidentiality levels for which the login session has clearance to access information regarding, the sub-confidentiality level indicating an activity to be carried out by an organization associated with the login session for which the login session has clearance to access information regarding;
displaying, on the graphical user interface, a service access point for each of a plurality of secure services, the plurality of secure services communicating with the graphical user interface through a network;
restricting access to each of the plurality of secure services according to the one or more authorization levels of the login session and according to a set of rules configured in a first firewall;
misdirecting a communication from the graphical user interface to the first firewall through a proxy server communicatively connected between the first firewall and the secure services, wherein the graphical user interface communicates to the service services by communicating to the first firewall and then communicating with the proxy server;
restricting access to an administrative server according to the one or more authorization levels of the login session and according to a set of rules configured in a second firewall communicatively connected between the proxy server and the administrative server, the administrative server including authorization level information associated with each of a plurality of users of the plurality of graphical user interfaces stored thereon; and
wherein displaying a service access point for each of a plurality of secure services comprises displaying a service access point for a storage device that stores a plurality of files, each of the plurality of files having a metadata tag that indicates a file confidentiality level and a sub-confidentiality level of its respective file, and restricting access to the storage device by comparing the confidentiality level and the sub-confidentiality level of the login session with the file confidentiality level and a sub-confidentiality level of each of the plurality of files.
4. The secure portal access method of claim 3 , further comprising displaying, on the graphical user interface, textual content using a cross-dissolve display technique.
5. A non-transitory computer-readable medium having code embodied thereon, the code operable, when executed by a machine, to cause the machine to perform at least the following:
create a login session with a graphical user interface, the login session being associated with one or more authorization levels among a plurality of authorization levels, the one or more authorization levels including a confidentiality level and a sub-confidentiality level, the confidentiality level indicating a level of a hierarchy of confidentiality levels for which the login session has clearance to access information regarding, the sub-confidentiality level indicating an activity to be carried out by an organization associated with the login session for which the login session has clearance to access information regarding;
display, on the graphical user interface, a service access point for each of a plurality of secure services, the plurality of secure services communicating with the graphical user interface through a network;
restrict access to each of the plurality of secure services according to the one or more authorization levels of the login session and according to a set of rules configured in a first firewall;
misdirect a communication from the graphical user interface to the firewall through a proxy server communicatively connected between the firewall and the secure services, wherein the graphical user interface communicates to the service services by communicating to the first firewall and then communicating with the proxy server;
restrict access to an administrative server according to the one or more authorization levels of the login session and according to a set of rules configured in a second firewall communicatively connected between the proxy server and the administrative server, the administrative server including authorization level information associated with each of a plurality of users of the plurality of graphical user interfaces stored thereon; and
wherein displaying a service access point for each of a plurality of secure services comprises displaying a service access point for a storage device that stores a plurality of files, each of the plurality of files having a metadata tag that indicates a file confidentiality level and a sub-confidentiality level of its respective file, and restricting access to the storage device by comparing the confidentiality level and the sub-confidentiality level of the login session with the file confidentiality level and a sub-confidentiality level of each of the plurality of files.
6. The non-transitory computer-readable medium of claim 5 , further comprising displaying, on the graphical user interface, textual content using a cross-dissolve display technique.
7. The secure portal system of claim 1 , wherein the graphical user interface comprises a web browser having a plurality of windows, the service access point for each of the plurality of secure services comprising one of the plurality of windows.
8. The secure portal access method of claim 3 , wherein creating a login session with a graphical user interface comprises creating a login session with a web browser having a plurality of windows, the service access point for each of the plurality of secure services comprising one of the plurality of windows.
9. The non-transitory computer-readable medium of claim 5 , wherein creating a login session with a graphical user interface comprises creating a login session with a web browser having a plurality of windows, the service access point for each of the plurality of secure services comprising one of the plurality of windows.
10. The secure portal system of claim 1 , wherein the set of rules that selectively allow or disallow the passage of packets between application servers and graphical user interface.
11. The secure portal access method of claim 3 , wherein the set of rules that selectively allow or disallow the passage of packets between the service access point and the graphical user interface.
12. The non-transitory computer-readable medium of claim 5 , wherein the set of rules that selectively allow or disallow the passage of packets between the service access point and the graphical user interface.
13. The secure portal system of claim 1 , wherein the plurality of files are stored in an encrypted format and wherein the portal server is operable to decrypt the plurality of files.
14. The secure portal system of claim 1 , wherein the graphical user interface of each of the client computers includes a file pane that displays only files that include an authorization level consistent with the authorization level of the login session.
15. The secure portal system of claim 1 , wherein the graphical user interface includes a plurality of service access points defined in an asynchronous javascript and extensible markup language technique, where each access point is associated with a different view on the graphical user interface as defined by the asynchronous javascript and extensible markup language technique.
16. The secure access method of claim 3 , further comprising storing the plurality of files in an encrypted format and decrypting, using the portal server, the plurality of files.
17. The secure access method of claim 3 , further comprising displaying, using the graphical user interface, a file pane that includes a display of only files that include an authorization level consistent with the authorization level of the login session.
18. The secure access method of claim 3 , wherein the service access points are defined using an asynchronous javascript and extensible markup language technique, where each service access point is associated with a different view on the graphical user interface as defined by the asynchronous javascript and extensible markup language technique.
19. The non-transitory computer readable medium of claim 5 , further comprising code embodied thereon, the code operable, when executed by a machine, to cause the machine to store the plurality of files in an encrypted format and decrypting, using the portal server, the plurality of files.
20. The non-transitory computer readable medium of claim 5 , further comprising code embodied thereon, the code operable, when executed by a machine, to cause the machine to display, using the graphical user interface, a file pane that includes a display of only files that include an authorization level consistent with the authorization level of the login session.