IP Library › Granted Patent US 9,185,077
Granted Patent B2
US 9,185,077 · App. 14/089,347 · Granted Nov 10, 2015

Isolation proxy server system

Inventors: Terence A. Robb (Colorado Springs, CO); William M. Lacey (Colorado Springs, CO); William J. Wofford, IV (Colorado Springs, CO); James R. Lehmpuhl (Colorado Springs, CO)
Assignee: Verizon Patent and Licensing Inc.
H04L63/0281H04L67/28
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 9,185,077
App. No.
14/089,347
Granted
Nov 10, 2015
Kind
B2
Abstract

An isolation proxy server system separates a typical proxy server or reverse proxy server into two physical computing platforms. A first physical platform, a front end proxy server, receives requests from clients on an external network, but is unable to relay requests by originating corresponding requests on an internal network. A second physical platform, a back end proxy client, originates distinct work requests to the front end proxy server. The front end proxy server forwards client requests to the back end proxy client in responses to the distinct work requests it receives from the back proxy client. The back end proxy client relays the client requests to a target server. Thus, the front end proxy server may not originate new requests to the server(s) in the protected zone, and the back end proxy client may not receive new requests from clients or from the front end proxy server.

Claims (95)

1. A computer, comprising:

a processor configured to control operations of the computer;

a memory; and

a front end proxy server program in the memory comprising:

an internal server program object;

an external server program object; and

a connection swapper program object,

wherein:

execution of the front end proxy server internal server program object by the processor of the computer configures the computer to implement functions, including functions to:

(I) establish first threads of execution, wherein:

each first thread of execution is in response to a respective request for work from a back end proxy client internal client program object executing on a computer platform configured as a back end proxy client; and

each first thread of execution sleeps while waiting to receive a request for a service provided by a target server from a user client to the front end proxy server external server program object;

(II) receive, by one of the first threads of execution and from the front end proxy server connection swapper program object, the request for the service received from the user client;

(III) forward, by the one of the first threads of execution and contained in a response to the respective request for work from the back end proxy client internal client program object, the request for the service received from the user client; and

(IV) send, by another one of the first threads of execution and to the front end proxy server connection swapper program object, a response from the target server to the request for the service received from the user client upon receipt of the response from the target server to the request for the service received from the user client contained in another request for work from the back end proxy client internal client program object;

execution of the front end proxy server external server program object by the processor of the computer configures the computer to implement functions, including functions to:

(A) establish a second thread of execution in response to receipt of the request for the service from the user client;

(B) send, by the second thread of execution, the request for the service received from the user client to the front end proxy server connection swapper program object;

(C) receive, by the second thread of execution, the response from the target server to the request for the service received from the user client from the front end proxy server connection swapper program object; and

(D) forward, by the second thread of execution and to the user client, the response from the target server to the request for the service received from the user client; and

execution of the front end proxy server connection swapper program object by the processor of the computer configures the computer to implement functions, including functions to:

(i) associate the second thread of execution established by the front end proxy server external server program object with the one of the first threads of execution in receipt of the request for the service received from the user client and the other one of the first threads of execution sending the response from the target server to the request for the service received from the user client;

(ii) receive, from the second thread of execution established by the front end proxy server external server program object, the request for the service received from the user client;

(iii) send, to the one of the first threads of execution, the request for the service received from the user client;

(iv) receive, from the other one of the first threads of execution, the response from the target server to the request for the service received from the user client; and

(v) send, to the second thread of execution, the response from the target server to the request for the service received from the user client.

2. The computer of claim 1 , wherein the implemented function of the front end proxy server external server program object to send the request for the service received from the user client to the front end proxy server connection swapper program object further includes functions to:

compose a work packet comprising a unique ID, a work packet version number, a mode indicating the contents of the work packet, properties of the request for the service received from the user client, and the body of the request for the service received from the user client,

wherein the composed work packet encapsulates the request for the service received from the user client.

3. The computer of claim 1 , wherein the implemented function of the front end proxy server external server program object to receive the response from the target server to the request for the service received from the user client from the front end proxy server connection swapper program object further includes functions to:

decompose a work packet comprising a unique ID, a work packet version number, a mode indicating the contents of the work packet, properties of the response from the target server to the request for the service received from the user client, and the body of the response from the target server to the request for the service received from the user client,

wherein the work packet encapsulates the response from the target server to the request for the service received from the user client.

4. The computer of claim 1 , wherein the implemented function of the front end proxy server internal server program object to establish the first threads of execution further includes functions to:

establish, in compliance with a configuration file, each first thread of execution in response to the respective request for work from the back end proxy client internal client program object, wherein the configuration file comprises:

a rule to allow or deny the front end proxy server internal server program object to receive the respective request for work from the back end proxy client.

5. The computer of claim 1 , wherein the one of the first threads of execution and the other one of the first threads of execution are a same thread of execution.

6. The computer of claim 1 , wherein the one of first threads of execution and the other one of the first threads of execution are different threads of execution.

7. A non-transitory storage medium storing instructions executable by a device, wherein the instructions comprise instructions to:

execute a front end proxy server internal server program object to:

(I) establish first threads of execution, wherein each first thread of execution is in response to a respective request for work from a back end proxy client internal client program object executing on a computer platform configured as a back end proxy client;

(II) receive, by one of the first threads of execution and from a front end proxy server connection swapper program object, a request for a service received from a user client;

(III) forward, by the one of the first threads of execution and contained in a response to the respective request for work from the back end proxy client internal client program object, the request for the service received from the user client; and

(IV) send, by another one of the first threads of execution and to the front end proxy server connection swapper program object, a response from the target server to the request for the service received from the user client upon receipt of the response from the target server to the request for the service received from the user client contained in another request for work from the back end proxy client internal client program object;

execute the front end proxy server external server program object to:

(A) establish a second thread of execution in response to receipt of the request for the service from the user client;

(B) send, by the second thread of execution, the request for the service received from the user client to the front end proxy server connection swapper program object;

(C) receive, by the second thread of execution, the response from the target server to the request for the service received from the user client from the front end proxy server connection swapper program object; and

(D) forward, by the second thread of execution and to the user client, the response from the target server to the request for the service received from the user client; and

execute the front end proxy server connection swapper program object to:

(i) associate the second thread of execution with the one of the first threads of execution in receipt of the request for the service received from the user client and the other one of the first threads of execution sending the response from the target server to the request for the service received from the user client;

(ii) receive, from the second thread of execution, the request for the service received from the user client;

(iii) send, to the one of the first threads of execution, the request for the service received from the user client;

(iv) receive, from the other one of the first threads of execution, the response from the target server to the request for the service received from the user client; and

(v) send, to the second thread of execution, the response from the target server to the request for the service received from the user client.

8. The non-transitory storage medium of claim 7 , wherein the instructions to send the request for the service received from the user client to the front end proxy server connection swapper program object further comprise instructions to:

compose a work packet comprising a unique ID, a work packet version number, a mode indicating the contents of the work packet, properties of the request for the service received from the user client, and the body of the request for the service received from the user client,

wherein the composed work packet encapsulates the request for the service received from the user client.

9. The non-transitory storage medium of claim 7 , wherein the instructions to receive the response from the target server to the request for the service received from the user client from the front end proxy server connection swapper program object further comprise instructions to:

decompose a work packet comprising a unique ID, a work packet version number, a mode indicating the contents of the work packet, properties of the response from the target server to the request for the service received from the user client, and the body of the response from the target server to the request for the service received from the user client,

wherein the work packet encapsulates the response from the target server to the request for the service received from the user client.

10. The non-transitory storage medium of claim 7 , wherein the instructions to establish the first threads of execution further comprise instructions to:

establish, in compliance with a configuration file, each first thread of execution in response to the respective request for work from the back end proxy client internal client program object, wherein the configuration file comprises:

a rule to allow or deny the front end proxy server internal server program object to receive the respective request for work from the back end proxy client.

11. The non-transitory storage medium of claim 7 , wherein the one of the first threads of execution and the other one of the first threads of execution are a same thread of execution.

12. The non-transitory storage medium of claim 7 , wherein the one of the first threads of execution and the other one of the first threads of execution are different threads of execution.

13. The non-transitory storage medium of claim 7 , wherein to establish the first threads of execution, each first thread of execution sleeps while waiting to receive the request for the service provided by a target server from the user client to a front end proxy server external server program object.

14. A method performed by a device, the method comprising:

executing a front end proxy server internal server program object to:

(I) establish first threads of execution, wherein each first thread of execution is in response to a respective request for work from a back end proxy client internal client program object executing on a computer platform configured as a back end proxy client;

(II) receive, by one of the first threads of execution and from a front end proxy server connection swapper program object, a request for a service received from a user client;

(III) forward, by the one of the first threads of execution and contained in a response to the respective request for work from the back end proxy client internal client program object, the request for the service received from the user client; and

(IV) send, by another one of the first threads of execution and to the front end proxy server connection swapper program object, a response from the target server to the request for the service received from the user client upon receipt of the response from the target server to the request for the service received from the user client contained in another request for work from the back end proxy client internal client program object;

executing the front end proxy server external server program object to:

(A) establish a second thread of execution in response to receipt of the request for the service from the user client;

(B) send, by the second thread of execution, the request for the service received from the user client to the front end proxy server connection swapper program object;

(C) receive, by the second thread of execution, the response from the target server to the request for the service received from the user client from the front end proxy server connection swapper program object; and

(D) forward, by the second thread of execution and to the user client, the response from the target server to the request for the service received from the user client; and

executing the front end proxy server connection swapper program object to:

(i) associate the second thread of execution with the one of the first threads of execution in receipt of the request for the service received from the user client and the other one of the first threads of execution sending the response from the target server to the request for the service received from the user client;

(ii) receive, from the second thread of execution, the request for the service received from the user client;

(iii) send, to the one of the first threads of execution, the request for the service received from the user client;

(iv) receive, from the other one of the first threads of execution, the response from the target server to the request for the service received from the user client; and

(v) send, to the second thread of execution, the response from the target server to the request for the service received from the user client.

15. The method of claim 14 , wherein to send the request for the service received from the user client to the front end proxy server connection swapper program object, the instructions further to:

compose a work packet comprising a unique ID, a work packet version number, a mode indicating the contents of the work packet, properties of the request for the service received from the user client, and the body of the request for the service received from the user client,

wherein the composed work packet encapsulates the request for the service received from the user client.

16. The method of claim 14 , wherein to receive the response from the target server to the request for the service received from the user client from the front end proxy server connection swapper program object the method further comprising:

decomposing a work packet comprising a unique ID, a work packet version number, a mode indicating the contents of the work packet, properties of the response from the target server to the request for the service received from the user client, and the body of the response from the target server to the request for the service received from the user client,

wherein the work packet encapsulates the response from the target server to the request for the service received from the user client.

17. The method of claim 14 , wherein to establish the first threads of execution, the method further comprising:

establishing, in compliance with a configuration file, each first thread of execution in response to the respective request for work from the back end proxy client internal client program object, wherein the configuration file comprises:

a rule to allow or deny the front end proxy server internal server program object to receive the respective request for work from the back end proxy client.

18. The method of claim 14 , wherein the one of the first threads of execution and the other one of the first threads of execution are a same thread of execution.

19. The method of claim 14 , wherein the one of the first threads of execution and the other one of the first threads of execution are different threads of execution.

20. The method of claim 14 , wherein to establish the first threads of execution, each first thread of execution sleeps while waiting to receive the request for the service provided by a target server from the user client to a front end proxy server external server program object.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Nov 26, 2013
From: ROBB, TERENCE A.; LACEY, WILLIAM M.; WOFFORD, WILLIAM J., IV; LEHMPUHL, JAMES R.
To: VERIZON PATENT AND LICENSING INC.
Reel/Frame 031679/0068 →
Continuity (1)
Related Publication 20150150113A1 · May 28, 2015