Reverse access method for securing front-end applications and others

Abstract

A system that provides a secured connection between servers on the lan and clients on the WAN comprises the lan (which includes lan server and lan controller) and the dmz (which includes dmz server and dmz Stack Pool Service). Wherein the client request reaches the dmz server it stores it in the dmz Stack Pool Service and the lan controller establishes outbound TCP based connection to the dmz Stack Pool Service that passes the client connection Information to the lan server via the lan controller. Then the lan server then generates a connection between the Service and dmz server.

Description

5For the sake of clarity and for simplifying the explanation of the System, the following terms are used: WAN: Wide Area Network (10); DMZ: De-5 Militarized Zone (20); LAN: Local Area Network (30); LAN Server: Server running in the LAN (31); DMZ Server: Server running in the DMZ (21); DMZ Stack Pool Service: Stores and handles Client's Requests (22) in the DMZ; Client Request: HTTP/HTTPS (Web browser)/

SSH/SFTP/FTP/FTPS/RDP/SMTP/TLS, and any other TCP/IP based protocols; 10 Client Connection Information: IP-address/Port number of the relevant destination service inside the LAN; LAN Controller: a controller running in the LAN that manages the Client Connection Information (32); Connection Binder: Handshake between two TCP/IP sockets; Service: HTTP/HTTPS (Web Server)/SSH/SFTP/FTP/FTPS/RDP/SMTP/TLS, and any other TCP/IP 15 based services.

For the sake of clarity and for simplifying the explanation of the System, the following terms are used: WAN: Wide Area Network (10); DMZ: De-Militarized Zone (20); LAN: Local Area Network (30); LAN Server: Server running in the LAN (31); DMZ Server: Server running in the DMZ (21); DMZ Stack Pool Service: Stores and handles Client's Requests (22) in the DMZ; Client Request: HTTP/HTTPS (Web browser)/SSH/SFTP/FTP/FTPS/RDP/SMTP/TLS, and any other TCP/IP based protocols; Client Connection Information: IP-address/Port number of the relevant destination service inside the LAN; LAN Controller: a controller running in the LAN that manages the Client Connection Information (32); Connection Binder: Handshake between two TCP/IP sockets; Service: HTTP/HTTPS (Web Server)/SSH/SFTP/FTP/FTPS/RDP/SMTP/TLS, and any other TCP/IP based services.

The objective of this invention is to provide a secured connection between servers in the LAN and the clients in the WAN.

FIG. 1 describes the main components of the System. The LAN (30) includes the Service (33), the LAN Server (31) and the LAN Controller (32); The DMZ (20) includes the DMZ Server (21), the DMZ Stack Pool Service (22); and the WAN (10) that by its nature includes the clients and the ‘outside’ world. In addition, FIG. 1 describes the connections between the System components.

The connections between the System components will be described while 10 describing the System flow. The connection flow of the System is as follow follows:

First step: The Client Request (of the client (11)) reaches the DMZ Server (21). Second step: The DMZ Server (21) stores the Client Request in the DMZ Stack Pool Service (22). Third step: The LAN Controller (32) establishes outbound 15 TCP based connection (41) to the DMZ Stack Pool Service (22). One of the innovative aspects of the System is that the LAN Controller (32) constantly, and/or on a predefined set of time basis, checks for Client Requests stored in the DMZ Stack Pool Service (22). Fourth step: The DMZ Stack Pool Service (22) then passes the Client Connection Information, to the LAN Server (31) via 20 the LAN Controller (32).

The Fifth step: The LAN Server (31) then generates two TCP/IP connections: One connection is to the Service (33), which is the destination service, based on 5 the Client Connection Information. The second connection is an outbound connection (42) to the DMZ Server (21). In addition the LAN Server (31) creates a Connection Binder in the LAN Server between the Service (33) and the outbound connection (42). The Sixth step: The DMZ Server (21) then creates a Connection Binder in the DMZ Server between the incoming Client 10 Request (that is stored in the DMZ Stack Pool Service (22)) and the outbound connection (42) arriving from the LAN Server (31), and by that completes the route of the Client Request.

Once the Connection Binder, in the DMZ Server, binds the Client Request and 15 the outbound connection (42) arriving from the LAN Server, the Client Request is then streamed through the DMZ Server and the LAN Server over the System, and then the client request data (50) streams from the Service (33) to the Client (11). In other words, client request data (50) is able to stream from the Service (33) to the Client (11) as a result of the net effect of the establishment of the two TCP/IP connections by the LAN server and the two connection binders.

In accordance with this invention as described above, no administrative management is required in the LAN Server (31) to establish or maintain 5 communications after it is initially installed and configured on the LAN (30) and on the DMZ (20). The LAN Controller (32) permanently or periodically queries the DMZ Stack Pool Service (22) for incoming Client Requests. The DMZ Server (20) will accept all Client Requests and route them to the LAN-Server (31), without changing the data that the Client Requests contains. For 10 example, if a Client Request uses the HTTPS connection protocol, then the HTTPS connection protocol will be transmitted over the System, as with any other common protocols such as SSH/SFTP/FTP/FTPS/RDP/SMTP/TLS/ or any other TCP/IP based protocols.

Claims

1. A system for reverse access, said system comprising:

a De-Militarized Zone (dmz) Stack Pool Service executing on a device so that the dmz Stack Pool Service is located in a De-Militarized Zone dmz, the dmz Stack Pool Service being arranged configured to store requests received from a client, wherein said requests are stored at the a TCP/IP level using a TCP/IP protocol;

a local area network (lan) controller located in a lan, the lan controller being configured to check for existence of the requests in said dmz Stack Pool Service of said requests, wherein said checking is performed at the TCP/IP level and said lan controller is located in a lan; and

a dmz server configured to receive said requests from a lan server of said lan, and, responsive to the requests, to route said requests stream client request data, to said client, wherein the receiving and routing streaming by said dmz server occurs at the TCP/IP level using the TCP/IP protocol;

wherein said dmz Stack Pool Service, said lan controller, and said dmz server do does not change the data of said requests and the system requires no administrative management after initial installation and configuration.

2. The system of claim 1, wherein computer programs and sensitive data of said lan server reside only in the lan.

3. A method for reverse access, said method comprising:

storing requests received from a client, wherein said requests are stored in a De-Militarized zone Zone (dmz) Stack Pool Service at the a TCP/IP level using a TCP/IP protocol, wherein said dmz Stack Pool Service is located executing on a device in a De-Militarized Zone dmz;

checking, at the TCP/IP level, said dmz Stack Pool Service for existence of said requests, wherein said checking is performed by a local area network (lan) controller located in a lan; and

receiving said requests establishing an outbound connection from a lan server of said lan and routing said requests client request data, responsive to said requests, by a dmz server to said client;

wherein said storing and routing occurs at the TCP/IP level using the TCP/IP protocol and said storing and routing dmz server does not change data of said requests; and

wherein said method requires no administrative management of the lan server after initial installation and configuration.

4. The method of claim 3, wherein computer programs and sensitive data of said lan server, reside only in the lan.

5. The method of claim 3, wherein the client request data is routed over the outbound connection.

6. The method of claim 3, further comprising:

establishing a connection from the lan server to a destination service in the lan that supplies the client request data, wherein the client request data is initially transmitted from a destination service in the lan that supplies the client request data and is thereafter routed over the outbound connection.

7. The method of claim 3, further comprising:

establishing a connection from the lan server to a destination service in the lan that supplies the client request data; and

binding the connection from the lan server to the destination service in the lan that supplies the client request data to the outbound connection.

8. The method of claim 7, wherein the connection from the lan server to the destination service in the lan is established at a TCP/IP level to use a TCP/IP protocol.

9. The method of claim 3, wherein the outbound connection is established to a dmz server.

10. The method of claim 9, wherein the outbound connection is further established at a TCP/IP level to use a TCP/IP protocol.

11. The method of claim 9, wherein the outbound connection is bound by the dmz server to one of the requests stored in the dmz Stack Pool Service.

12. The system of claim 1, wherein using the TCP/IP protocol comprises using information associated with the TCP/IP protocol.

13. A method for reverse access, said method comprising:

storing requests received from a client in a De-Militarized Zone (dmz) Stack Pool Service at a TCP/IP level using a TCP/IP level-based protocol, wherein said dmz Stack Pool Service is executing on a device in a dmz;

checking, at the TCP/IP level, said dmz Stack Pool Service for existence of said requests, wherein said checking is performed by a local area network (lan) controller located in a lan;

establishing an outbound connection from a lan server of said lan and routing by a dmz server, client request data, responsive to said requests, to said client;

wherein said storing and routing occurs at the TCP/IP level using a TCP/IP level-based protocol and said dmz server does not change data of said requests; and

wherein said method requires no administrative management of the lan server after initial installation and configuration.

14. A system for reverse access, said system comprising:

a De-Militarized Zone (dmz) Stack Pool Service executing on a device so that the dmz Stack Pool Service is located in a dmz, the dmz Stack Pool Service being configured to store requests received from a client, wherein said requests are stored at a TCP/IP level;

a local area network (lan) controller located in a lan, the lan controller being configured to check for existence of the requests in said dmz Stack Pool Service, wherein said checking is performed at the TCP/IP level; and

a dmz server configured to receive said requests from a lan server of said lan, and, responsive to the requests, to stream client request data, to said client, wherein the receiving and streaming by said dmz server occurs at the TCP/IP level;

wherein said dmz server does not change the data of said requests and the system requires no administrative management after initial installation and configuration.