IP Library › Granted Patent US 10,097,523

Granted Patent B2

US 10,097,523 · App. 14/375,504 · Granted Oct 9, 2018

Method and system for providing secure remote external client access to device or service on a remote network

Inventors: Bill Kuker (Dover, NH); Ryan Tenney (Saxtons River, VT); Clement Tse (Vancouver, CA)

Assignee: Martello Technologies Corporation

H04L63/0478 H04L12/4641 H04L63/0471 H04L63/164 H04L63/166 H04L63/0272

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 10,097,523
App. No.: 14/375,504
Granted: Oct 9, 2018
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

In order to provide secure user access to a device or service on a remote network, upon receipt of a request to access the device or service on a portal on a central server, a request is sent to a probe application installed on the remote network to establish a secure link to the central server. A message is then sent to the user directing the user to initiate a specific session request to the central server. The session request is cross connected to the probe application installed on the remote network over the secure link to establish a secure tunnel to the probe application. A secure user session is set up through the secure tunnel to the device or service via the probe application.

Claims (109)

1. A method of providing secure user access to a device or service on a remote network, comprising:

receiving a request to access the device or service on a portal on a central server which authenticates users and maintains a database mapping particular probe applications to accessible devices on a remote network;

creating a device proxy on the central server which the user communicates with and which will communicate with the device or service on the remote network over a secure tunnel to a probe application;

sending a request to the probe application installed on the remote network to establish a secure link to the central server;

sending a message to the user directing the user to initiate a specific session request to the central server;

cross connecting the session request to the probe application installed on the remote network over the secure link to establish the secure tunnel to the probe application;

forwarding a secure user session through the secure tunnel to the device or service via the probe application; and

the user is connected to the device using port forwarding which is established by a first process or a second process; wherein

the first process establishes the port forwarding as follows:

an SSH tunnel over a TCP Connection is established in between an SSH server on the central server and an SSH client session on the probe application;

when the user generates a request to access the device a request message is sent from a user web page to the central server;

the central server validates the user's authorization and retrieves the particular probe application corresponding to the requested device;

the central server sends a request to the SSH Server to create a new session to handle the request and to open the port forward to the requested device;

the SSH Server then forwards this request over the SSH tunnel to the SSH client session on the correct probe application;

the SSH Client Session checks a database associated with the probe application to make sure the device is accessible;

the SSH client session then sends a request for a port forward to the SSH Server;

the SSH Server creates the device Proxy and notifies the web Server that the open port forward is complete and sends the open port forward and the address of the device proxy;

the central server passes the device proxy address to an application associated with the user;

the application associated with the user then establishes a connection to the remote device by sending a connect-over-TCP/IP request to the device proxy; and

the device proxy then sends the connect request over the SSH tunnel to the SSH client session; and

the SSH client session sends the connect request to the device to permit data to flow back and forth between the application associated with the user and the requested device; and

the second process establishes the port forwarding as follows:

an SSH tunnel over a TCP Connection is established in between an SSH server on the central server and an SSH client session on the probe application;

when the user generates a request to access the device a request message is sent from a user web page to the central server;

the central server validates the user's authorization and retrieves the particular probe application corresponding to the requested device;

the central server sends a request to the SSH Server to create a new session to handle the request and to open the port forward to the requested device;

the SSH Server then forwards this request over the SSH tunnel to the SSH client session on the correct probe application;

the SSH Client Session checks a database associated with the probe application to make sure the device is accessible;

the SSH client session then sends a request for a port forward to the SSH Server the SSH Server creates the device proxy and notifies the central Server that the open port forward is complete and sends the open port forward and the address of the device proxy;

the central server passes the device proxy address to the web browser on the user computer;

the web browser initiates the local agent with the device proxy address;

the SSH client session connects to the device proxy address and initializes an encrypted connection;

the local agent connects to the device proxy address and initializes an encrypted connection;

the device proxy authenticates the local agent and the SSH client session and facilitates the initialization of an encrypted connection between the local agent and the SSH client session;

the application associated with the user then establishes a connection to the remote device by sending a connect-over-TCP/IP request to the local agent;

the local agent then sends the connect request over the SSH tunnel; through the device proxy, to the SSH client session; and

the SSH client session sends the connect request to the device to permit data to flow back and forth between the application associated with the user and the requested device.

2. The method according to claim 1 , wherein the tunnel is established using a Secure Shell (SSH) protocol.

3. The method according to claim 1 , wherein the portal is in the form of a web page accessible by the user.

4. The method according to claim 2 , wherein at least one of:

the message sent to the user includes a click-to-connect link; and

the secure user session is a specific IP protocol connection.

5. The method according to claim 1 , wherein a local agent is created on the local computer, the user communicates with the local agent, and the local agent communicates with the central server over the secure tunnel.

6. The method according to claim 1 , wherein the device proxy encrypts and decrypts messages passing between it and the probe application.

7. The method according to claim 1 , wherein

the web page contains gadgets that create proxy objects that represent objects created from a set of classes associated with a client session in the probe application to permit the user to perform a remote procedure call (RPC) setup on the device on the remote network; and

in order to create a proxy object the user clicks on a gadget embedded in the page, the gadget sends an RPC Request for the particular gadget to the web server, which passes via to the SSH server the SSH client session, the SSH client session creates the particular Gadget X Object from classes it has stored, and a message is sent back to the user application, which creates a proxy object that has all the functions that the class provides, and are now available to the user through the web page.

8. A system for providing secure user access to a device or service on a remote network, comprising:

a central server comprising a database mapping particular probe applications to accessible devices on the remote network and providing a portal to receive a request to access the device or service and configured to:

create a device proxy, whereby the user communicates with the device proxy, and the device proxy communicates with the device on the remote network over the secure tunnel to the probe application;

send a request to a probe application installed on the remote network to establish a secure link to the central server;

send a message to the user directing the user to initiate a specific session to the central server;

cross connect the session request to the probe application installed on the remote network over the secure link to establish a secure tunnel to the probe application,

forward a secure user session through the secure tunnel to the device or service via the probe application; and

user is connected to the device using port forwarding which is established by a first process or a second process; wherein

the first process establishes the port forwarding as follows:

the SSH server establishes the SSH tunnel to an SSH Client Session on the probe application;

when the user generates a request to access the device the central server receives a request message from a user web page;

the central server validates the user's authorization and retrieves the particular probe application corresponding to the requested device;

the central server sends a request to the SSH Server to create a new session to handle the request and to open the port forward to the requested device;

the SSH Server then forwards this request over the SSH Tunnel to the SSH client session on the correct probe application;

the SSH Client Session checks a database associated with the probe application to make sure the device is accessible;

the SSH client session then sends a request for a Port Forward to the SSH Server;

the SSH Server creates the device proxy and notifies the central server that the open port forward is complete and sends the open port forward and the address of the device proxy;

the central server passes the device proxy address to an application associated with the user;

the application associated with the user then establishes a connection to the remote device by sending a connect-over-TCP/IP request to the device proxy;