US20150082413A1 - Network resource control system - Google Patents

Abstract

A secure network resource access system facilitates network access by network terminals to network resources located behind an enterprise firewall, and comprises a proxy server and a polling server. The proxy server is located logically outside the enterprise firewall for receiving application data from the network terminals. The polling server is located logically behind the enterprise firewall, and is configured to poll the proxy server to initiate transmission of the received application data from the proxy server to the polling server, to receive application data and associated network resource data from the proxy server in response to the poll, and to direct the application data to one of the network resources in accordance with the associated network resource data.

Description

CROSS REFERENCE TO RELATED APPLICATIONS
• This application is a continuation of application Ser. No. 13/546,395 filed Jul. 11, 2012 which is a further continuation of application Ser. No. 12/891,536 filed Sep. 27, 2010, which is a continuation of nonprovisional application Ser. No. 09/926,436 filed Jan. 18, 2002, now U.S. Pat. No. 7,827,293, issued Nov. 2, 2010, which in turn is a National Entry of International Application No. PCT/CA01/00235 filed Mar. 1, 2001, which claims priority to Canadian Application No. 2,299,824 filed Mar. 1, 2000. The disclosure of which is hereby incorporated by reference in its entirety.
FIELD OF THE INVENTION
• The present invention relates to a method and system for network management system. In particular, the present invention relates to a method and system for providing secure access to network resources.
BACKGROUND OF THE INVENTION
• Local area networks are widely used as a mechanism for making available computer resources, such as file servers, scanners, and printers, to a multitude of computer users. It is often desirable with such networks to restrict user access to the computer resources in order to manage data traffic over the network and to prevent unauthorized use of the resources. Typically, resource access is restricted by defining access control lists for each network resource. However, as the control lists can only be defined by the network administrator, it is often difficult to manage data traffic at the resource level.
• Wide area networks, such as the Internet, have evolved as a mechanism for providing distributed computer resources without regard to physical geography. Recently, the Internet Print Protocol (“IPP”) has emerged as a mechanism to control access to printing resources over the Internet. However, IPP is replete with deficiencies.
• First, as IPP-compliant printing devices are relatively rare, Internet printing is not readily available.
• Second, although IPP allows user identification information to be transmitted to a target resource, access to IPP-compliant resources can only be changed on a per-resource basis. This limitation can be particularly troublesome if the administrator is required to change permissions for a large number of resources.
• Third, users must have the correct resource driver and know the IPP address of the target resource before communicating with the resource. Therefore, if the device type or the IPP address of the target resource changes, users must update the resource driver and/or the IPP address of the resource. Also, if a user wishes to communicate with a number of different resources, the user must install and update the resource driver and IPP address far each resource as the properties of each resource changes.
• Fourth, access to IPP printers cannot be obtained without the resource administrator locating the resource outside the enterprise firewall, or without opening an access port through the enterprise firewall. Whereas the latter solution provides the resource administrator with the limited ability to restrict resource access, the necessity of opening an access port in the enterprise firewall exposes the enterprise network to the possibility of security breaches.
• Consequently, there remains a need for a network resource access solution which allows resource owners to easily and quickly control resource access, which is not hindered by changes in device type and resource network address, which facilitates simultaneous communication with a number of target resources, and which does not expose the enterprise network to a significant possibility of security breaches.
SUMMARY OF THE INVENTION
• According to the invention, there is provided a secure network resource access system and a method of secure network resource access which addresses at least one deficiency of the prior art network resource access systems.
• The secure network resource access system, according to the present invention facilitates network access by network terminals to network resources located behind an enterprise firewall, and comprises a proxy server and a polling server. The proxy server is located logically outside the enterprise firewall for receiving application data from the network terminals. The polling server is located logically behind the enterprise firewall, and is configured to poll the proxy server to initiate transmission of the received application data from the proxy server to the polling server.
• The secure network resource access method, according to the present invention, facilitates network access by network terminals to network resources located behind an enterprise firewall, and comprises the steps of (1) polling a proxy server located logically outside the enterprise firewall for requests for communication with the network resources; (2) receiving application data and associated network resource data from the proxy server in response to the polling step; and (3) directing the application data to one of the network resources in accordance with the associated network resource data.
BRIEF DESCRIPTION OF THE DRAWINGS
• The preferred embodiment of the invention will now be described, by way of example only, with reference to the drawings, in which:
• FIG. 1 is a schematic view of the network resource access system, according to the present invention, showing the network terminals, the network resources, the resource registry, the authorization server, the administration server, the proxy server, and the polling server;
• FIG. 2 is a schematic view one of the network terminals depicted inFIG. 1, showing the driver application for use with the present invention;
• FIG. 3 is a schematic view of the format of the resource records comprising the resource database of the resource registry depicted inFIG. 1, showing the network address field, the resource type field, the user access level field, the resource information field, the pseudo-name field, the username/password field, and the driver identification field; and
• FIG. 4A andFIG. 4B are flow charts depicting the method of operation of the network resource access system.
DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT
• Turning toFIG. 1, a network resource access system, denoted generally as100, is shown comprising anetwork terminal200, anetwork resource104, aresource registry106, anadministration server108, and anauthorization server110. Typically, the networkresource access system100 comprises a plurality ofnetwork terminal200, and a plurality ofnetwork resources104, however for enhanced clarity of discussion,FIG. 1 only shows asingle network terminal200 and asingle network resource104.
• The networkresource access system100 also includes acommunications network112 facilitating communication between thenetwork terminals200, thenetwork resources104, theadministration server108, and theauthorization server110. Preferably, thecommunications network112 comprises a wide area network such as the Internet, however thenetwork112 may also comprise a local area network. Further, thenetwork112 need not be a land-based network, but instead may comprise a wireless network and/or a hybrid of a land-based network and a wireless network for enhanced communications flexibility.
• Eachnetwork terminal200 typically comprises a land-based network-enabled personal computer. However, the invention is not limited for use with personal computers. For instance. one or more of thenetwork terminals200 may comprise a wireless communications device, such as a wireless-enabled personal data assistant, or e-mail-enabled wireless telephone if thenetwork112 is configured to facilitate wireless data communication. In addition, the invention is not limited to only facilitating transmission of text data, but instead may be used to transmit image data, audio data or multimedia data, if desired.
• As shown inFIG. 2, thenetwork terminal200 comprises anetwork interface202, auser interface204, and adata processing system206 in communication with thenetwork interface202 and theuser interface204. Typically, thenetwork interface202 comprises an Ethernet network circuit card, however thenetwork interface202 may also comprise an RF antenna for wireless communication over thecommunications network112. Preferably, theuser interface204 comprises a data entry device208 (such as keyboard, microphone or writing tablet), and a display device210 (such as a CRT or LCD display).
• Thedata processing system206 includes a central processing unit (CPU)208, and a non-volatile memory storage device (DISC)210 (such as a magnetic disc memory or electronic memory) and a read/write memory (RAM)212 both in communication with theCPU208. TheDISC210 includes data which, when loaded into theRAM212, comprise processor instructions for theCPU208 which define memory objects for allowing thenetwork terminal200 to communicate with thenetwork resources104 and theauthorization server110 over thecommunications network112. Thenetwork terminal200, and the processor instructions for theCPU208 will be discussed in greater detail below.
• Typically, eachnetwork resource104 comprises a printing device, and in particular, an IPP-compliant printer. However, the invention is not limited for use with networked printers (IPP-compliant or otherwise), but instead can be used to provide access to any of a variety of data communication devices, including facsimile machines, image servers and file servers. Further, the invention is not limited for use with land-based data communications devices, but instead can be used to provide access to wireless communications devices. For instance, the networkresource access system100 can be configured to facilitate data communication with e-mail pagers or e-mail enabled wireless telephones.
• It is expected that some of thenetwork resources104 may be located behind an enterprise firewall. Accordingly, to facilitate communication betweennetwork terminals200 and firewall-protectednetwork resources104, the networkresource access system100 may also include aproxy server114 located logically outside the enterprise firewall, and apolling server116 located logically within the firewall, as shown inFIG. 1. Preferably, theproxy server114 is located on-site at the enterprise responsible for administering thenetwork resource104, is provided with a network address corresponding to the enterprise, and includes a queue for receiving application data. However, theproxy server114 may also be located off-site, and may be integrated with theauthorization server110 if desired. This latter option is advantageous since it allows system administrators to provide access tonetwork resources104, but without having to incur the expense of the domain name registration and server infrastructure.
• In addition to theproxy server114 and thepolling server116, preferably the enterprise includes an enterprise server118 (eg. a print server) to facilitate communication with thenetwork resources104 located behind the firewall. Thepolling server116 is in communication with theenterprise server118, and is configured to periodically poll theproxy server114 through the firewall to determine whether application data from anetwork terminal200 is waiting in the queue of theproxy server114. Theproxy server114 is configured to transmit any queued application data to thepolling server116 in response to the poll signal from thepolling server116. Upon receipt of the queued application data from theproxy server114, thepolling server116 transmits the application to theenterprise server118 for distribution to theappropriate network resource104. As will be apparent, this mechanism allows application data to be transmitted tonetwork resources104 located behind a firewall, but without exposing the enterprise to the significant possibility of security breaches associated with firewall access ports.
• Theresource registry106 comprises aresource database120, adriver database122, and auser registration database124. Theresource database120 includesresource records300 identifying parameters associated with thenetwork resources104. As shown inFIG. 3, eachresource record300 comprises anetwork address field302, aresource type field304, and a useraccess level field306 for the associatednetwork resource104. Thenetwork address field302 identifies the network address of thenetwork resource104. As discussed above, typically eachnetwork resource104 comprises an IPP-compliant printer, in which case thenetwork address field302 identifies comprises the network resource IPP address. However, in the case where thenetwork resource104 comprises a non-IPP-compliant device and thecommunications network112 comprises the Internet, preferably thenetwork resource104 is linked to thecommunications network112 via a suitable server, and thenetwork address field302 for thenetwork resource104 identifies the Internet Protocol (“IP”) address of the server.
• Theresource type field304 identifies the type of data communication device of thenetwork resource104. For instance, theresource type field304 may specify that thenetwork resource104 is a printer, an image server, a file server, an e-mail pager, or an e-mail enabled wireless telephone. Further, theresource type field304 may include a resource type sub-field specifying a sub-class of the network resource type. For example, the resource type sub-field may specify that thenetwork resource104 is an IPP-capable printer, or a non-IPP-capable printer.
• The useraccess level field306 identifies the type of communications access which thenetwork terminals200 are allowed to have in regards to the associatednetwork resource104. In the embodiment, as presently envisaged, the useraccess level field306 establishes that thenetwork resource104 allows one of:
• • (a) “public access” in which anynetwork terminal200 of the networkresource access system100 can communicate with thenetwork resource104;
  • (b) “private access” in which only members (eg. employees) of the enterprise associated with thenetwork resource104 can communicate with thenetwork resource104; and
  • (c) “authorized access” in which onlyparticular network terminals200 can communicate with thenetwork resource104.
• If the useraccess level field306 specifies “authorized access” for anetwork resource104, preferably the useraccess level field306 includes a sub-field which lists the names of thenetwork terminals200 authorized to access thenetwork resource104, and a sub-field which includes an authorization password which the identifiednetwork terminals200 must provide in order to access thenetwork resource104. If the useraccess level field306 specifies “private access” for anetwork resource104, preferably the useraccess level field306 includes a sub-field which lists the network address of thenetwork terminals200 which are deemed to members of the enterprise.
• It should be understood, however, that the useraccess level field306 is not limited to identifying only the foregoing predefined user access levels, but may instead identify more than one of the predefined user access levels, or other user access levels altogether. For instance, the useraccess level field306 may identify that the associatednetwork resource104 allows both private access to all employees of the enterprise running thenetwork resource104, and authorized access to otherpre-identified network terminals200. Further, the useraccess level field306 may also include one or more sub-fields (not shown) which provide additional restrictions/permissions on the type of communications access which thenetwork terminals200 are allowed to have in regards to the associatednetwork resource104. For instance, the user access level sub-fields may limit the hours of operation of thenetwork resource104, or may place restrictions on the type of access limitations on a per-user basis, or per-group basis. Other variations on the type of access will be readily apparent, and are intended to be encompassed by the scope of the present invention.
• Preferably, eachresource record300 includes aninformation field308 which provides information on thenetwork resource104, such as data handling capabilities, resource pricing and geographical co-ordinates. This latter parameter is particularly advantageous for use withmobile network terminals200, such as a wireless-enabled personal data assistant or an e-mail-enabled wireless telephone, since it allows thenetwork terminal200 to identify the nearest one of a plurality ofavailable network resources104. This aspect of the invention will be explained in greater detail below.
• Eachresource record300 also includes apseudo-name field310, a username/password field312 and a networkdriver identifier field314. Thepseudo-name field310 contains a resource pseudo-name which identifies thenetwork resource104 to thenetwork terminals200. Preferably, the pseudo-name is a network alias that identifies the physical location and properties of thenetwork resource104, but does not identify the network address of theresource104. Further, preferably each pseudo-name uniquely identifies one of thenetwork resources104, however a group of thenetwork resources104 may be defined with a common pseudo-name to allow communication with a group ofnetwork resources104. This latter feature is particularly advantageous since it allows the administrator of an enterprise associated with the group of network resources to dynamically allocate eachnetwork resource104 of the group as the demands for thenetwork resources104 or maintenance schedules require.
• In addition, preferably theresource record300 includes a plurality of thepseudo-name fields310 to allow the administrator of the associatednetwork resource104 to update the name assigned to thenetwork resource104, while also retaining one or more previous pseudo-names assigned to thenetwork resource104. As will be explained, this feature is advantageous since it allows the administrator to update a resource name without the risk thatnetwork terminals200 using a prior pseudo-name will be unable to locate or communicate with thenetwork resource104.
• The username/password field312 contains a unique username and password combination which allows the administrator of the associatednetwork resource104 to prevent authorized access and alteration to the data contained in theresource record300. Preferably, eachresource record300 also includes an e-mail address field (not shown) which the networkresource access system100 uses to provide the administrator of the associatednetwork resource104 with a notification e-mail message when a message is successfully transmitted to thenetwork resource104.
• Thedriver identifier field314 contains a resource driver identifier which is used in conjunction with thedriver database122 to provide thenetwork terminals200 with the appropriate resource driver for communication with thenetwork resource104. Thedriver database122 includes resource drivers which allow software applications installed on thenetwork terminals200 to communicate with thenetwork resources104. As will be explained below, in order for anetwork terminal200 to communicate with a selectednetwork resource104, thenetwork terminal200 first downloads a driver application data from theadministration server108 over thecommunications network112. Thenetwork terminal200 may also download the appropriate resource driver from the driver database122 (via theauthorization server110 over the communications network112), and then allow theauthorization server110 to configure the downloaded resource driver in accordance with theaccess level field306 of theresource record300 associated with the selectednetwork resource104. Preferably, each resource driver includes a resource driver identifier which allows theauthorization server110 to identify the resource driver which thenetwork terminal200 has downloaded.
• The driver application will now be discussed in association withFIG. 2. As discussed above, theDISC210 of thenetwork terminal200 includes data which, when loaded into theRAM212 of thenetwork terminal200, comprise processor instructions for theCPU208. As shown, the downloaded driver application data defines in the RAM212 a memory object comprising adriver application400. Thedriver application400 includes ageneric resource driver402 and a wrap-aroundresource driver layer404. Thegeneric resource driver402 allows thenetwork terminal200 to communicate with a variety ofdifferent network resources104, however thegeneric resource driver402 typically will not provide thenetwork terminal200 with access to all the features and capabilities of anyparticular network resource104. If thenetwork terminal200 requires additional features not implemented with thegeneric resource driver402, the appropriate resource driver may be downloaded from thedriver database116, as mentioned above.
• The wrap-arounddriver layer404 includes anapplication communication layer406, adriver administrator layer408, and adata transmitter layer410. Theapplication communication layer406 is in communication with the resource driver402 (generic or network resource specific) and the application software installed on thenetwork terminal200, and is configured to transmit user application data between the application software and theresource driver402. Thedriver administrator layer408 communicates with theresource registry106 over thecommunications network112 to ensure that thedriver application400 is properly configured for communication with the selectednetwork resource104. Thedata transmitter layer410 is in communication with theresource driver402 and is configured to transmit the data output from theresource driver402 over thecommunications network112 to the selectednetwork resource104, via thenetwork interface202. Although thedriver application400 and its constituent component layers are preferably implemented as memory objects or a memory module in theRAM212, it will be apparent that thedriver application400 may instead be implemented in electronic hardware, if desired.
• Returning toFIG. 1, theregistration database124 of theresource registry106 includes user records each uniquely associated with a user of arespective network terminal200 upon registration with the networkresource access system100. Each user record identifies the name the registered user's name, post office address and e-mail address. In addition, each user record specifies a unique password which the registered user must specify in order to update the user's user record, and to obtain access tonetwork resources104 configured for “authorized access”. The user record may also include additional information specifying default options for the networkresource access system100. For instance, the user may specify that the networkresource access system100 should provide the user with an acknowledgement e-mail message when a message is successfully transmitted to a selectednetwork resource104. The user may also specify an archive period for which the networkresource access system100 should archive the message transmitted to the selectednetwork resource104. This latter option is advantageous since it allows the user to easily transmit the same message tomultiple network resources104 at different times, and to periodically review transmission dates and times for each archive message.
• Theadministration server108 is in communication with theresource database120 and theregistration database124. Theadministration server108 provides administrators of thenetwork resources104 with access to the records of theresource database120 to allow the administrators to update thenetwork address field302, theresource type field304, the useraccess level field306, theresource information field308, thepseudo-name field310, the username/password field312 and/or thedriver identifier field314 of theresource record300 for the associatednetwork resource104. As will become apparent, this mechanism allows network administrators to change, for example, the network address and/or the restrictions/permissions of thenetwork resources104 under their control, or even thenetwork resource104 itself, without having to notify eachnetwork terminal200 of the change. Theadministration server108 also provides controlled access to theregistration database124 so that only the user of thenetwork terminal200 which established the user record can update the user record.
• Where the username/password field312 has been completed, theadministration server108 is configured to block access to theresource record300 until the administrator provides theadministration server108 with the correct username/password key. This feature allows the resource administrator to make adjustments, for example, to pricing and page limit, in response to demand for thenetwork resources104, and to make adjustments to the restrictions/permissions set out in the useraccess level field306 and theresource information field308 and thereby thwart unauthorized access to thenetwork resources104.
• Theauthorization server110 is in communication with theresource database120 and thedriver database122 for providing thenetwork terminals200 with theresource drivers402 appropriate for the selectednetwork resources104. Preferably, theauthorization server110 is also configured to configure thedriver application400 for communication with the selectednetwork resource104, by transmitting the network address of the selectednetwork resource110 to thedata transmitter layer410 over a communications channel secure from the user of thenetwork terminal200 so that the network address of thenetwork resource104 is concealed from the user of thenetwork terminal200. In the case where thecommunications network112 comprises the Internet, preferably the secure communications channel is established using the Secure Sockets Layer (“SSL”) protocol.
• In addition to thenetwork terminal200, thenetwork resource104, theresource registry106, theadministration server108, theauthorization server110, and thecommunications network112, preferably the networkresource access system100 also includes atransaction server126 and anarchive server128. Thetransaction server126 is in communication with theauthorization server110 for keeping track of each data transfer between anetwork terminal200 and anetwork resource104. For each transmission, preferably thetransaction server126 maintains a transmission record identifying thenetwork terminal200 which originated the transmission, thenetwork resource104 which received the transmission, and the date, time and byte size of the transmission.
• Thearchive server128 is configured to retain copies of the data transmitted, for a specified period. As discussed above, the user of anetwork terminal200 specifies the requisite archive period (if any) for the data transmission, upon registration with the networkresource access system100. Preferably, theadministration server108 provides controlled access to thetransaction server126 and thearchive server128 so that only the user of thenetwork terminal200 which originated transmission of the data is allowed access to the transmission record associated with the transmission.
• The process by which a user of anetwork terminal200 can communicate with anetwork resource104 will now described with reference toFIG. 4. The following discussion presupposes that the user of thenetwork terminal200 has downloaded thedriver application400 from theadministration server108 over thecommunications network112. Atstep500, the user of anetwork terminal200 decides whether to log in to the networkresource access system100. As discussed above, if the user registers with the networkresource access system100 and subsequently logs in to the network resource access system100 (by providing theauthorization server106 with the user's assigned password), the user will have access to anynetwork resources104 which have “authorized access” as the user access level and which have identified the registered user as a user authorized to access thenetwork resource104. If the user does not register or fails to log in to the networkresource access system100, the user will only have access tonetwork resources104 which have established “public access” as the user access level.
• Atstep502, the user selects anetwork resource104 by querying theadministration server108 for a list ofavailable network resources104. Alternately, the user may postpone selection of anetwork resource104 until initiation of the transmission command. The network user query may be based upon any desired criteria, including print turn-around time and page size (where thetarget network resource104 is a printer), price, and geography. In addition, the user may provide theadministration server108 with the geographical coordinates of the user to determine the user's nearest network resources. The user may provide its geographical coordinates through any suitable mechanism known to those skilled in the art, including latitude/longitude co-ordinates, GPS, and wireless triangulation.
• If the user requested a list ofavailable network resources104, the user is provided with a list of pseudo-names associated with eachnetwork resource104 satisfying the designated search criteria. As discussed above, if the user logged in to the networkresource access system100, the pseudo-name list will include both “public access”network resources104 and “authorized access”network resources104 with which the user has been authorized to communicate. Also, if the user is member of an enterprise havingnetwork resources104 registered with the networkresource access system100, the pseudo-name list will also identifynetwork resources104 which have been registered by the enterprise for “private access”. Otherwise, the pseudo-name list will only identifynetwork resources104 registered for public access. Upon receipt of the resource list, the user selects anetwork resource104 from the list.
• Atstep504, theadministration server108 queries the network user'snetwork terminal200 for the resource driver identifier of theresource driver402 configured on thenetwork terminal200, and then compares the retrieved resource driver identifier against the resource driver identifier specified in the networkdriver identifier field314 of theresource record300 associated with the selectednetwork resource104 to determine whether thedriver application400 has been configured with theappropriate resource driver402 for communication with thenetwork resource104. If thenetwork terminal200 has not been configured with theappropriate resource driver402, theadministration server108 prompts the user'snetwork terminal200 to download thenecessary resource driver402. As will be apparent, the downloadedresource driver402 becomes part of thedriver application400.
• When the user of thenetwork terminal200 is ready to communicate with the selectednetwork resource104, the user of thenetwork terminal200 transmits a transmission request via its application software to thedriver application400, atstep506. If the user did not select anetwork resource104 atstep502, theapplication communication layer406 of thedriver application400 contacts theadministration server108 over thecommunications network112 and prompts the user to select anetwork resource104, as described above. Once anetwork resource104 is selected, and theappropriate resource driver402 is installed, theapplication communication layer406 notifies thedriver administrator layer408 of the transmission request.
• Atstep508, thedriver administrator layer408 provides theauthorization server110 with the transmission request and identifies the selectednetwork resource104, by transmitting to theauthorization server110 the pseudo-name assigned to the selectednetwork resource104. If the user of thenetwork terminal200 has registered and logged in to the networkresource access system100, thedriver administrator layer408 also provides theauthorization server110 with the registered user's name.
• Theauthorization server110 then queries theresource database120 with the received pseudo-name for theresource record300 associated with the pseudo-name, atstep510. Theauthorization server110 then extracts the user access level from the useraccess level field306 of the retrievedresource record300, and determines whether thenetwork terminal200 is authorized to communicate with the selectednetwork resource104, atstep512. As will be apparent from the foregoing discussion, if the useraccess level field306 specifies “public access” for thenetwork resource104, thenetwork terminal200 will be automatically authorized to communicate with thenetwork resource104.
• However, if the useraccess level field306 specifies “private access” for thenetwork resource104, theauthorization server110 determines the network address of thenetwork terminal200 from the transmission request transmitted by thenetwork terminal200, and then queries the user access level sub-field with the terminal's network address to determine whether thenetwork terminal200 is authorized to communicate with thenetwork resource104. In the case where thecommunications network112 comprises the Internet, theauthorization server110 can determine the network terminal's network address from the IP packets received from thenetwork terminal200. On the other hand, if the useraccess level field306 specifies “authorized access” for thenetwork resource104, theauthorization server110 queries the user access level sub-field with the user's name to determine whether thenetwork terminal200 is authorized to communicate with thenetwork resource104.
• If the query atstep512 reveals that thenetwork terminal200 is not authorized to communicate with thenetwork resource104, atstep514 theauthorization server110 provides thenetwork terminal200 with a notification that thenetwork terminal200 is not authorized for communication with the selectedresource104. However, if the query atstep512 reveals that thenetwork terminal200 is authorized to communicate with thenetwork resource104, theauthorization server110 queries thenetwork address field302 of theresource record300 associated with thenetwork resource104 for the network address of thenetwork resource104. Theauthorization server110 then establishes a secure communications channel with thedriver administrator layer408, and then transmits the network address to thedriver administrator layer408 over the secure communications channel, atstep516.
• Also, if the useraccess level field306 specifies “authorized access” for thenetwork resource104, and thenetwork terminal200 is authorized to communicate with thenetwork resource104, theauthorization server110 queries the user access level sub-field for the authorization password assigned to thenetwork resource104, and then transmits the authorization password to thedriver administrator layer408 over the secure communications channel, together with the network address. In the case where thecommunications network112 comprises the Internet, preferably theauthorization server110 establishes the secure communications channel using a Secure Sockets Layer (“SSL”) protocol. Since the network address and the authorization password are transmitted over a secure communications channel, this information is concealed from the user of thenetwork terminal200.
• Preferably, theauthorization server110 also extracts the resource driver identifier from theresource identifier field314 of theresource record300, and determines whether thenetwork terminal200 is still properly configured for communication with the network resource14. If thenetwork terminal200 no longer has thecorrect resource driver402, theauthorization server110 queries thedriver database122 for thecorrect resource driver402, and prompts the user of thenetwork terminal200 to download thecorrect resource driver402. This driver configuration verification step may be performed concurrently or consecutively with the network address providing step described in the preceding paragraph.
• In addition, theadministration server108 queries theregistration database124 to determine whether the user of thenetwork terminal200 registered with the networkresource access system100. If the user registered with the networkresource access system100 and specified that thearchive server128 should maintain archival copies of data transmissions, theadministration server108 transmits the network address of thearchive server128 to thedriver administrator layer408. As a result, when the user of thenetwork terminal200 issues a data transmission command, thedriver application400 will transmit the user application data to the selectednetwork resource104 and to thearchive server128.
• Atstep518, theapplication communication layer406 passes the application data received from the application software to theresource driver402 for translation into a format suitable for processing by the selectednetwork resource104. Meanwhile, thedriver administrator layer408 interrogates thenetwork resource104, using the received network address, to determine whether thenetwork resource104 still resides at the specified network address, is operational and is on-line.
• If the interrogatednetwork resource104 resides at the specified network address, is operational and is on-line. online, theresource driver202 passes the translated application data to thedata transmitter layer410 of thedriver application400. Preferably, thedata transmitter layer410 compresses and encrypts the translated application data upon receipt. Thedata transmitter layer410 also receives the network address of thenetwork resource104 from thedriver administrator layer408, adds the network address data to the compressed, encrypted data, and then transmits the resulting data over thecommunications network112 to thenetwork resource104 at the specified network address, atstep520.
• Preferably, thedata transmitter layer410 also transmits details of the transmission to thetransaction server126, such as the selectednetwork resource104 and the byte size of the transmission. Upon receipt of the transmission details, preferably theadministration server108 queries theresource database120 and theuser registration database124 for the e-mail address of the resource administrator and the e-mail address of the user of thenetwork terminal200, if provided, and then transmits an e-mail message indicating completion of the transmission.
• If the useraccess level field306 specifies “authorized access” for thenetwork resource104, thedata transmitter layer410 also receives the authorization password for thenetwork resource104 from thedriver administrator layer408, and transmits the authorization password (as part of the compressed, encrypted data) to thenetwork resource104.
• If the useraccess level field306 specifies “public access” for thenetwork resource104, preferably thenetwork resource104 is accessible through a local server which serves to queue, decrypt and decompress the application data, and extract the network address data, and then transmit the decompressed application data to theappropriate network resource104. Alternately, thenetwork resource104 itself may be configured for direct communication over thecommunications network112, such as an IPP-capable printer, so that thenetwork resource104 is able to process the application data directly.
• If the useraccess level field306 specifies “authorized access” for thenetwork resource104, preferably thenetwork resource104 is accessible through a local server which serves to queue, decrypt and decompress the application data, and extract the network address data and authorization password, and then transmit the application data to theappropriate network resource104 if the received authorization password is valid.
• If the useraccess level field306 specifies “private access” for thenetwork resource104, typically thenetwork resource104 will be located behind a firewall. Accordingly, theproxy server114 associated with thenetwork resource104 will receive the application data, and transfer the application data to the proxy server queue. Thepolling server116 associated with thenetwork resource104 will poll theproxy server114 to determine the status of the queue. Upon receipt of a polling signal from thepolling server116, theproxy server114 transmits any queued application data from the proxy server queue, through the firewall, to thepolling server116. Thepolling server116 then extracts the network address from the received application data, and transmits the application data to theappropriate server118 ornetwork resource104 for processing.
• As will be apparent from the foregoing discussion, regardless of the user class defined for anetwork resource104, if a resource administrator relocates anetwork resource104 to another network address, and/or changes the device type and/or restrictions/permissions associated with thenetwork resource104, the resource administrator need only update theresource record300 associated with thenetwork resource104 to continue communication with thenetwork resource104. Subsequently, when a user attempts communication with thenetwork resource104 using the original pseudo-name, theauthorization server110 will provide theadministrator layer408 with the updated network address of thenetwork resource104, or prompt the user to download theappropriate resource driver402, assuming that thenetwork terminal200 is still authorized to communicate with thenetwork resource104.
• Further, if the useraccess level field306 specifies “authorized access” for thenetwork resource104 and the resource administrator desires to change the pseudo-name and authorization password associated with thenetwork resource104, the resource administrator need only update the pseudo-name and authorization password provided on theresource record300. Subsequently, when a user of anetwork terminal200 initiates communication with thenetwork resource104 using the original pseudo-name, theauthorization server110 scans theresource records300 for occurrences of the original pseudo-name. After locating theappropriate resource record300, theauthorization server110 provides thedriver administrator layer408 with the updated pseudo-name and authorization password of thenetwork resource104, provided that thenetwork terminal200 is still authorized to communicate with thenetwork resource104. Anetwork terminal200 which is not authorized to communicate with thenetwork resource104 will not receive the updated pseudo-name and authorization password from theauthorization server110 and, consequently, will not be able to communicate with thenetwork resource104, even if the user of thenetwork terminal200 knew the network address for thenetwork resource104.
• The foregoing description is intended to be illustrative of the preferred embodiment of the present invention. Those of ordinary skill may envisage certain additions, deletions and/or modifications to the described embodiment which, although not explicitly described herein, are encompassed by the spirit or scope of the invention, as defined by the claims appended hereto.

Claims (4)

We claim:

1. A secure network resource access system for facilitating network access by network terminals to network resources located behind an enterprise firewall, the secure network resource access system comprising:

a proxy server located logically outside the enterprise firewall for receiving application data from the network terminals; and

a polling server located logically behind the enterprise firewall, the polling server being configured for polling the proxy server to initiate transmission of the received application data from the proxy server to the polling server.

2. The secure network resource access system according toclaim 1, wherein each said network resource includes an alias name, and the application data includes the alias name of one of the network resources, and the polling server is configured to direct the application data to the one network resource in accordance with alias name.

3. A method for facilitating secure network access by network terminals to network resources located behind an enterprise firewall, the method comprising the steps of:

polling a proxy server located logically outside the enterprise firewall for requests for communication with the network resources;

receiving application data and associated network resource data from the proxy server in response to the polling step; and

directing the application data to one of the network resources in accordance with the associated network resource data.

4. The method according toclaim 3, wherein each said network resource includes an alias name, and the network resource data includes the alias name of the one network resource.

Images