Mobile work platform for remote data centers

Patent metadata

Field	Value
Publication number	US-10033719-B1
Application number	US-201213721998-A
Country	US
Kind code	B1
Filing date	Dec 20, 2012
Priority date	Dec 20, 2012
Publication date	Jul 24, 2018
Grant date	Jul 24, 2018

Abstract

Access to an information technology resource may be provided to a user involved in a data center construction project. The information technology resource may be located on a secure network, but be made accessible to the user through one or more unsecure networks. Access to the information technology resource aids the user in performing tasks related to data center construction, such as tracking the receipt and installation of equipment.

First claim

What is claimed is:

1. A system for allowing a user to access, through one or more unsecure networks, information technology resources accessible through a secure network, the system comprising:
a memory having stored thereon instructions that, when executed by a computing device, cause the system to at least:
download a certificate from the secure network to a mobile device, while the device is disconnected from the unsecure network;
receive a request to begin a login process from the mobile device originating the request, the request comprising the certificate issued to the mobile device and a second device identifier that is separate from the certificate and corresponds to the mobile device, the certificate comprising a first device identifier that is inalterable by the user and associates the certificate with the mobile device;
send the mobile device a login page to receive user credentials from the user in response to validating the certificate by comparing the first device identifier of the certificate to the second device identifier;
validate user credentials received by the processing of the login page on the mobile device, and send a cookie to the mobile device, the cookie comprising an encrypted payload containing an identifier of the certificate; receive a second request, the second request for access to an information technology resource, the information technology resource accessible through the secure network, the request for access comprising the cookie and an indication of an interface call directed to the information technology resource;
validate the second request by decrypting the encrypted payload, wherein the decrypting comprises a first stage of the validation, and checking the indication of an interface call against a list of interface calls authorized for use by the user; and forward the interface call to the information technology resource and to return results for the interface call to the device.

2. A method for accessing, by one or more unsecure networks at a data center construction site, information technology resources on a secure network, the method comprising:
downloading a certificate to a mobile device only when the mobile device is connected to the secure network,
receiving a request, via the one or more unsecured networks, from the mobile device to initiate a login process, the request comprising the certificate and a device identifier corresponding to the mobile device that is separate from the certificate, the certificate issued to the mobile device and comprising encoded information identifying the mobile device that is inalterable by a user;
in response to the request to initiate a login process, validating the certificate by comparing the encoded information identifying the mobile device to the device identifier, validating credentials sent by the mobile device, and sending a cookie to the device, the cookie comprising an encrypted payload containing an identifier of the certificate;
receiving from the mobile device a request for access to an information technology resource, the information technology resource connected to a trusted network, the request for access comprising the cookie and a description of an interface call; and
validating the request for access by decrypting the encrypted payload, comparing the identifier of the certificate from the encrypted payload to a second identifier of the certificate, and verifying that a user corresponding to the credentials is authorized to access the information technology resource.

3. A method for remote access, via an unsecured network, to a secure network, the method comprising:
creating a certificate comprising an identifier of a mobile device and storing an association between a user of the mobile device and the certificate;
sending the certificate to the mobile device while the mobile device is directly connected to the secure network and disconnected from the unsecured network, the certificate issued to the mobile device and inalterable by the user upon creation;
receiving a login request comprising the certificate and credentials corresponding to the user, wherein the login request was sent from the device to a proxy over the unsecured network;
validating the request by verifying the validity of the certificate, verifying the credentials corresponding to the user, and verifying the association between the user and the certificate;
sending a cookie to the device over the unsecured network, the cookie comprising an encrypted payload;
receiving a request to access an information technology resource on the secured network, the request comprising the cookie and a description of an interface call; and
validating the request to access an information technology resource by decrypting the encrypted payload and comparing the identifier of the certificate from the encrypted payload to a second identifier of the certificate.

4. The method of claim 3 , comprising further validating the request to access an information technology resource by associating a certificate identifier, device identifier, or user login name contained in the encrypted payload with corresponding information received by the proxy from a source on the secure network.

5. The method of claim 3 , comprising disconnecting the mobile device from the secure network and transporting the device to a work location.

6. The method of claim 3 , comprising receiving, by the proxy, equipment tracking information from the device, the equipment tracking information indicative of equipment installed at a work location.

Assignees

• Amazon Tech Inc

Inventors

• Baranowski Matthew Paul
• Guduru Srinivas
• Ward Patrick James

Classifications

• H04L9/3263

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title

• H04L63/0823 Primary

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/123

  received data contents, e.g. message integrity · CPC title

• H04L9/32

  including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials} · CPC title

• H04L63/0876

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title