External access to internal network resources

Abstract

Provide smooth external access to resources inside the network from outside the network. Inside the network, the internal user simply provides the internal identifier, and the external user accesses not the internal identifier but the external uniform resource identifier (URL), and the external user can simply select the URL to access the internal resources of the network. This is achieved by converting the internal identifier into an external URL with the proxy server as its domain name. When the external URL selects the URL, a request with the external URL is sent to the proxy server, which translates the external URL back to the internal identifier and coordinates with the network to obtain the resource for the external user.

Description

Background Art

[0001] A uniform resource locator is an identifier used to locate a resource on a network. For this reason, a uniform resource locator is also called a "web address," although a uniform resource locator can be used to access resources from networks other than the World Wide Web. For example, an internal uniform resource locator is sometimes used to access resources from within a local or corporate network. Such a uniform resource locator can be shared with other people within the network so that those people within the network can use the internal uniform resource locator to access internal resources of the network.

[0002] Sometimes, in order to share resources with people outside the network, authorized users within the network may provide internal uniform resource locators to people outside the network. However, when the outsider selects the internal uniform resource locator (e.g., by selecting an associated link), the outsider will receive a failure message. This is because the global domain name server cannot resolve the internal uniform resource locator into a network address (e.g., an Internet Protocol (IP) address).

[0003] There are many ways to solve this problem. For example, an outsider can establish a virtual private network (VPN) connection, effectively gaining access to the network. Alternatively, the outside user can contact the network administrator to allow access to resources. It is also possible to have a portal that the outside user can log in to gain access to internal resources. All of these methods require human intervention.

[0004] The subject matter claimed herein is not limited to embodiments that solve any disadvantages or that operate only in the above-described environment. Rather, this background is merely provided to illustrate one exemplary technology area in which some embodiments described herein may be implemented. Summary of the invention

[0005] At least some embodiments described herein relate to providing external access to resources within a network. From within the network, the internal user simply provides an internal identifier (such as an internal uniform resource locator), and the external user accesses not an Internet identifier, but an external uniform resource identifier that the external user can simply select to obtain access to the network's internal resources.

[0006] According to the principles described herein, a translation component accesses an internal identifier (e.g., an internal uniform resource locator) that can be resolved to an internal network address of a resource within the network using an internal domain name server within the network. The internal uniform resource locator is not resolvable by an external global domain name server, but may only be resolvable by a domain name server specific to the network. The translation component automatically determines that an external uniform resource locator will be generated using the internal uniform resource locator (e.g., by performing pattern matching on the accessed internal uniform resource locator).

[0007] In response to the determination, an external uniform resource locator is generated that is configured to be resolved by an external global domain name server to a server computing system (e.g., a proxy server of the network). This generation can be rule-based, for example, by inserting a domain name of the server computing system within the external uniform resource locator and inserting an internal identifier within a path and / or parameters of the external uniform resource locator.

[0008] Thus, when an external user selects an external uniform resource locator, a request is automatically made to the server computing system. The server then obtains the internal identifier from the external uniform resource locator and uses the internal domain name server inside the network to obtain access to the resource on behalf of the external user. Thus, the automatic mechanism provides smooth access to internal resources from outside the network. This process is smooth because the user does not need to make any special efforts beyond what is normally done with a shared uniform resource locator.

[0009] This summary is provided to introduce some concepts in a simplified form that are further described in the detailed description below. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to describe the manner in which the above and other advantages and features can be obtained, various embodiments will be described in more detail with reference to the accompanying drawings. It should be understood that these drawings only show example embodiments and are not to be considered as limiting the scope of the invention, and these embodiments will be described and explained with additional specificity and detail through the use of the accompanying drawings, in which:

[0011] Figure 1 shows a network with internal resources accessible externally according to the principles described herein;

[0012] Figure 2 An environment in which the principles described herein may be employed is shown, including Figure 1 The network, in the larger context, includes proxy servers, translation components, and client computing systems that have access to external Figure 1 Users of the network's internal resources;

[0013] Figure 3 Shown with Figure 2 The same environment as shown, except that communications represented by arrows are additionally shown;

[0014] Figure 4 A flowchart showing a method of providing access to resources within a network from the outside, which can be performed by Figure 3 The translation component is executed to generate an external uniform resource locator based on the internal identifier;

[0015] Figure 5 A flow chart showing a method for providing access to resources within a network from the outside, which may be performed by Figure 3 The proxy server is executed to generate or extract the internal identifier based on the external uniform resource locator;

[0016] Figure 6 shows a flow chart associated with performing rule-based generation of an external uniform resource locator from an internal resource;

[0017] Figure 7 shows a flow chart associated with performing rule-based generation or extraction of internal resources based on external resource locators; and

[0018] Figure 8 An example computer system is shown that may implement the principles described herein. DETAILED DESCRIPTION

[0019] At least some embodiments described herein relate to providing access to resources within a network from the outside. From within the network, the internal user simply provides an internal identifier (such as an internal uniform resource locator), and the external user accesses not an Internet identifier, but an external uniform resource identifier that the external user can simply select to gain access to the network's internal resources.

[0020] According to the principles described herein, a translation component accesses an internal identifier (e.g., an internal uniform resource locator) that can be resolved to an internal network address of a resource within the network using an internal domain name server within the network. The internal uniform resource locator is not resolvable by an external global domain name server, but may only be resolvable by a domain name server specific to the network. The translation component automatically determines that an external uniform resource locator will be generated using the internal uniform resource locator (e.g., by performing pattern matching on the accessed internal uniform resource locator).

[0021] In response to the determination, an external uniform resource locator is generated to be configured to be resolved by an external global domain name server to the server computing system (e.g., a proxy server of the network). Such generation can be rule-based, such as by inserting the domain name of the server computing system within the external uniform resource locator and inserting the internal identifier within the path and / or parameters of the external uniform resource locator.

[0022] Thus, when an external user selects an external uniform resource locator, a request is automatically made to the server computing system. The server then obtains the internal identifier from the external uniform resource locator and uses the internal domain name server inside the network to obtain access to the resource on behalf of the external user. Thus, the automatic mechanism provides smooth access to internal resources from outside the network. This process is smooth because the user does not need to make special efforts beyond what is normally done with a shared uniform resource locator.

[0023] This detailed description will be organized as follows. First, reference will be made to Figure 1-Figure 3 Describes a network environment in which the principles described herein can be implemented. Then, reference will be made to Figure 4-Figure 7 The process performed by the various components of the environment to allow external access to the internal resources of the network is described. Finally, since the principles described herein operate in the context of a computer system, reference will be made to Figure 8 Describe the computer system.

[0024] Figure 1 A network 100 is shown that is externally accessible according to the principles described herein. Network 100 includes a plurality of internal resources 101. Network 100 is represented as a circle to represent that network 100 is a protected network having confidential resources contained therein. For example, network 100 may be a corporate network to which employees of the company may connect in order to access internal resources of network 100.

[0025] Internal Resources 101 (in Figure 1 ) can be any identifiable thing that can be retrieved from the network using a network address (e.g., an Internet Protocol (IP) address). For example, internal resource 101 can be a document, file, data, web page, file, credential, database, device, computing system, session (such as collaborative editing, conference, etc.), class, attribute, or any other identifiable thing that can be retrieved through the network. Figure 1 In the example of , internal resources 101 are shown as including two internal resources 101A and 101B. As shown by ellipsis 101C, network 100 may include any number of internal resources, which are typically far more than two. However, for simplicity, two internal resources 101A and 101B are shown.

[0026] Each internal resource 101 has a network address 111 (such as an Internet Protocol (IP) address) that can be used to address and ultimately access the relevant internal resource. For example, internal resource 101A has an associated network address 111A, and internal resource 101B has an associated network address 111B. The network address can be used by a network protocol layer (e.g., an IP layer) of a network communication stack to route requests for internal resources and retrieve internal resources.

[0027] Internal identifiers (often referred to as uniform resource identifiers or uniform resource locators) are often used to identify resources because they are easier for humans to read and intuitive than network addresses. Therefore, each internal resource 101 also potentially has an internal identifier 121, which can be resolved by the local domain name server 110 to the network address 111 of the internal resource 101. The identifier is called "internal" because it cannot be resolved to a network address using a global domain name server external to the network 101.

[0028] For example, internal identifier 121A is assigned to internal resource 101A, and internal identifier 121B is assigned to internal resource 101B. Thus, when an internal user wants to access internal resource 101A, the user provides internal identifier 121A to local domain name server 110, and local domain name server 110 resolves internal identifier 121A to network address 111A, which can then be used to access internal resource 101A. Similarly, when an internal user wants to access internal resource 101B, the user provides internal identifier 121B to local domain name server 110, and local domain name server 110 resolves internal identifier 121B to network address 111B, which can then be used to access internal resource 101B. Thus, local domain name server 110 is used to facilitate access to internal network resources within network 100.

[0029] Figure 2 An environment 200 is shown in which the principles described herein may be employed. The environment 200 includes the Figure 1 The network 100 described herein is shown in Figure 2. However, the environment 200 also includes a proxy server computing system 201 (also referred to herein as a "proxy" or "proxy server"). The proxy server 201 has a network address 211 (such as an IP address) that can be used to access the proxy server 201 via the Internet. The proxy server 201 can be a computing system having computer executable instructions thereon that are configured to, when executed by one or more processors of the computing system, cause the computing system to perform as described herein. For example, the proxy server 201 can be configured as follows for Figure 8 Alternatively, the proxy server 201 may be constructed as described below for the executable component 806 of the computing system 800.

[0030] The environment 200 also includes a translation component 202 between the network 100 and a client computing system 210 (and its users 212) external to the network 100. The translation component 210 operates to convert internal identifiers into external uniform resource locators, which facilitates external users 212 to access internal resources 101 of the network 100. The translation component 202 can be a computing system having computer executable instructions thereon, which are structured so that when executed by one or more processors of the computing system, the computing system is caused to perform as described herein. For example, the translation component 202 can be as follows for Figure 8 Alternatively, the translation component 202 can be constructed as described below for the executable component 806 of the computing system 800.

[0031] The environment also includes a global domain name server 220. The global domain name server 220 is also referred to herein as an "external" domain name server because it can resolve uniform resource locators to network addresses as long as these uniform resource locators are public. The external domain name server 220 cannot resolve uniform resource locators to network addresses of resources 101 within the network 100.

[0032] Figure 3 An environment 300 is shown, which is Figure 2 The environment 200 is the same as that of FIG. 2 , except that communications are additionally shown (represented by arrows 301 - 306 ). Figure 4 A flowchart of a method 400 for providing access to internal resources of a network from the outside is shown. The method may be performed by Figure 3 The translation component 202 executes to translate the internal identifier into an external uniform resource locator. Figure 5 A flowchart of a method 500 for providing access to internal resources of a network from the outside is shown. The method may be performed by Figure 3 The proxy server 201 executes to generate or extract the internal identifier according to the external uniform resource locator. Figure 3 The present invention is performed in the context of environment 300 and will now be described with frequent cross-references. Figure 3-Figure 5 We will first describe Figure 4 Method 400, and is often referenced Figure 3 environment 300.

[0033] Method 400 includes accessing an internal identifier (act 401). Figure 3In the example environment 300, the translation component 202 accesses the internal identifier 311 (represented by a triangle pointing to the right) from the network 100 (as shown by arrow 301). The internal identifier 311 can be resolved to an internal network address of an internal resource within the network using an internal domain name server within the network. In other words, the internal resource cannot be resolved to the internal identifier using an external domain name server.

[0034] exist Figure 3 In the example environment 300 of FIG. 3 , the local domain name server 110 can resolve the internal identifier 311 to the corresponding internal network address 111 within the network 100. For example, if the internal identifier 311 is the internal identifier 121A, the local domain name server 110 resolves the internal identifier 121A to the network address 111A, thereby allowing the network resource 101A to be properly addressed and retrieved. Similarly, if the internal identifier 311 is the internal identifier 121B, the local domain name server 110 resolves the internal identifier 121B to the network address 111B, thereby allowing the network resource 101B to be properly addressed and retrieved. However, the global domain name server 220 cannot resolve the internal identifier 311 to the network address 111 of the network 100.

[0035] After accessing the internal identifier, the translation component automatically determines that an external uniform resource locator will be generated using the identifier (action 402). For example, this automatic determination can be performed by pattern matching the internal identifier. For example, the pattern can be similar to "sharable\*", wherein if the internal identifier begins with the text "sharable\", then the internal identifier will match no matter what follows the text. Therefore, internal identifiers such as "sharable\codebase" and "sharable\financials" will match each other, so the translation component will determine (for these internal identifiers) that corresponding external uniform resource locators should be generated.

[0036] In response to this determination (act 402), the translation component generates an external uniform resource locator (act 403). Figure 3 In the example environment 300 of , the translation component 202 can, for example, generate an external uniform resource locator 312 (represented by a triangle pointing to the left). The external uniform resource locator 312 is configured to resolve to the network address 211 of the proxy server 201. In one embodiment, the external uniform resource locator 312 can also include a network identifier that identifies the network 100 derived from the internal identifier.

[0037] Therefore, an internal identifier, internal URI, or internal URI is used in Figure 3, which is represented as a right-pointing triangle pointing toward network 100, to indicate that the internal identifier can be resolved by local domain name server 110 of network 100, but cannot be resolved by global domain name server 220. Similarly, external uniform resource locators are represented in Figure 3 , which is represented as a triangle pointing to the left away from the network 100 , to indicate that the external uniform resource locator cannot be resolved by the global domain name server 220 to an internal identifier, but can only be resolved to the network address of the proxy server serving the network 100 .

[0038] The generation of the external uniform resource locator may be performed using rules (action 403). These rules may specify a predetermined domain name (matching the domain name of proxy server 201) to be used in the domain name portion of the uniform resource locator. These rules may further specify that the internal identifier will actually be used (either directly or after some transformation) for the path and / or parameter portion of the generated uniform resource locator.

[0039] For example, Figure 6 A generation process 600 is shown in which a rule 610 is applied using an input internal identifier 601 to generate an output external uniform resource locator 602. For example, the rule causes a predetermined domain name 611 to be populated into a predetermined portion 621 (e.g., a domain name portion and possibly some path and / or parameter portions) of the external uniform resource locator. In addition, the input identifier 601 (and potentially also a network identifier identifying the network 100) is then populated directly (or through a transformation 612) with a second predetermined portion 622 (e.g., part or all of the path and / or parameter portions) of the external uniform resource locator 602.

[0040] The translation component then provides the external uniform resource locator to the client computing system (act 404). Figure 3 In the example environment 300 of , the translation component 202 provides (as indicated by arrow 302) an external uniform resource locator 312 to the client computing system 210. Then, the user 212 of the client computing system 210 can select the uniform resource locator by interacting with the control 215 corresponding to the uniform resource locator 312.

[0041] For example, a user within the network 100 may send a message (such as an email, chat input, text) to an external user 212. The message may be intercepted by a translation component, which forwards the message after replacing the internal identifier with an external uniform resource locator. In an alternative example, there may be no message at all. An internal user may simply publish a centralized control (accessible to both internal users and external users 212) and associate the control with an internal identifier. The translation component may change the control viewed from outside the network so that the internal identifier is replaced with an external uniform resource locator. Therefore, if the internal user selects the control, the internal identifier 311 is resolved through the local domain name server 110.

[0042] If the external user interacts with control 305 in a particular manner, external uniform resource locator 312 is resolved by global domain name server 220. Specifically, as indicated by dashed arrow 303, client computing system 210 communicates external uniform resource locator 303 (or at least its domain name) to global domain name server 220. As indicated by dashed arrow 304, global domain name server 220 responds by providing network address 211 of proxy server 201. This causes the request with external uniform resource locator 312 to be dispatched (as indicated by arrow 305) to proxy server 201. Proxy server 201 may then execute Figure 5 Method 500.

[0043] according to Figure 5 , the proxy server accesses a request with an external uniform resource locator from a requester computing system (action 501). Figure 3 In this case, the requestor computing system is the client computing system 210. The request and the requested access are determined by Figure 3 The arrow 305 in FIG. 304 indicates that the external uniform resource locator is the external uniform resource locator 312 previously generated by the translation component 202 .

[0044] The proxy server determines that an internal identifier will be generated from an external uniform resource locator based on the request (action 502). This determination can be performed by pattern matching on the external uniform resource locator. If the external uniform resource locator matches the pattern, the internal identifier is generated. Therefore, when the external uniform resource locator 312 is first generated, the translation component 202 ensures that the external uniform resource locator 312 matches the pattern.

[0045] In response to determining that an internal identifier is to be generated (act 502), the proxy server generates an internal identifier (act 503). The internal identifier may be the same as the internal identifier initially accessed by the translation component. Figure 3, the proxy server 201 can regenerate the internal identifier 311. Recall that this is the internal identifier 311 that is recognized and resolvable by the local domain name server 110 of the network 100.

[0046] Rules may be used to perform the generation of the internal identifier (action 503). These rules may include extracting the identifier from a predetermined portion of the external uniform resource locator. For example, Figure 7 The process 700 of generating an internal identifier 601 from an external uniform resource locator 602 using rules 700 is shown. Figure 6 In , rule 610 causes internal identifier 601 to be placed (after potential translation) into a predetermined portion 622 of an external uniform resource locator 602. Depending on the identity of the network to which the underlying internal identifier refers, the rules may differ.

[0047] exist Figure 7 In the reverse process of , rule 710 extracts the internal identifier from the predetermined portion 622 of the external uniform resource locator 602 (as indicated by arrow 631). In addition, the process outputs (as indicated by arrow 632) the internal identifier 601 after performing a potential transformation 712. The transformation 712 is the reverse of the transformation 612 used when inserting the internal identifier into the external uniform resource locator. If there is no transformation 612 during the generation of the external uniform resource locator, then there is no need for the reverse transformation 712 during the generation of the internal identifier.

[0048] return Figure 5 , the process then estimates or determines an internal identifier that identifies a resource within the network (action 504). In one embodiment, proxy server 201 only serves network 201. Therefore, it can be immediately estimated that any generated internal identifier is associated with network 100. On the other hand, proxy server 201 can potentially serve multiple networks. In this case, proxy server 201 can check the internal identifier against a list to estimate which network the internal identifier belongs to. Alternatively, proxy server 201 can extract a network identifier included in an external uniform resource locator to identify the network. For security, preferably, translation component 202 only serves one network 100, and proxy server 201 also only serves the same network 100. In addition, the proxy server can perform access control on internal resources identified by internal identifiers.

[0049] The proxy server then attempts to resolve the internal identifier to the network address of the internal resource within the network using an internal domain name server within the network (action 505). Figure 3 , the proxy server 201 provides (as indicated by arrow 306 ) the internal identifier 311 to the local domain name server 110 .

[0050] If the attempt is successful (yes in decision block 510), network 100 returns the internal resource to proxy server 201, and proxy server 201 then provides the internal resource to the client computing system (action 511). For example, proxy server 201 may obtain a network address associated with the internal identifier and then use the network address to obtain the internal resource itself. The proxy server may then provide the network resource to client computing system 210.

[0051] If the attempt is unsuccessful (no in decision block 510), the proxy server may redirect the requester computing system to the internal identifier itself (action 512). This is the same result as if methods 400 and 500 had never been performed. Thus, in the case of success, the external user can seamlessly access the internal resources. Even in the case of failure, the external user can still attempt to access the internal resources using the internal identifier (e.g., by contacting a network administrator, logging into a VPN, and using the internal identifier), etc. Thus, the principles described herein enhance the ability to appropriately share network internal resources with authorized users outside the network. Methods 400 and 500 may be performed multiple times for different users and networks.

[0052] Finally, since the principles described herein operate in the context of computer systems, reference will be made to Figure 8 Describe a computer system. Computing systems now increasingly take a variety of forms. For example, a computing system may be a handheld device, an appliance, a laptop computer, a desktop computer, a mainframe, a distributed computing system, a data center, or even a device that is not traditionally considered a computing system, such as a wearable device (e.g., glasses, a watch, a hoop, etc.). In this specification and claims, the term "computing system" is broadly defined to include any device or system (or combination thereof) having at least one physical and tangible processor and physical and tangible memory capable of having computer executable instructions that can be executed by the processor. The memory may take any form and may depend on the nature and form of the computing system. The computing system may be distributed over a network environment and may include multiple constituent computing systems.

[0053] like Figure 8 As shown, in its most basic configuration, computing system 800 generally includes at least one hardware processing unit 802 and memory 804. Memory 804 can be physical system memory, which can be volatile, non-volatile, or some combination of the two. The term "memory" can also be used herein to refer to non-volatile mass storage, such as physical storage media. If the computing system is distributed, then the processing, memory, and / or storage capabilities can also be distributed.

[0054] The computing system 800 has a number of structures, often referred to as "executable components". For example, the memory 804 of the computing system 800 is shown as including an executable component 806. The term "executable component" is a name for a structure that is understood by those skilled in the computing arts to be a structure that can be software, hardware, or a combination thereof. For example, when implemented in software, those skilled in the art will understand that the structure of the executable component can include software objects, routines, methods that can be executed on the computing system, regardless of whether such executable components are present in the stack of the computing system, or whether the executable components are present on a computer-readable storage medium.

[0055] In this case, it will be understood by those skilled in the art that the structure of the executable component exists on a computer-readable medium so that when interpreted by one or more processors of the computing system (e.g., by a processor thread), the computing system will perform the function. This structure can be read directly on the computer by the processor (if the executable component is binary, this is the case). Alternatively, the structure can be constructed to be interpretable and / or compiled (whether in a single stage or in multiple stages) to generate a binary that can be directly interpreted by the processor. When the term "executable component" is used, this understanding of the example structure of the executable component is fully within the scope of understanding of those skilled in the computing field.

[0056] The term "executable component" is well understood by those skilled in the art to include structures that are implemented specifically or nearly specifically in hardware, such as in a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), or any other special circuit. Therefore, the term "executable component" refers to a term for a structure that is well understood by those skilled in the computing field, whether implemented in software, hardware, or a combination. In this specification, the term "component" may also be used. As used in this specification and examples, this term (whether or not the term is modified with one or more modifiers) is also intended to be synonymous with the term "executable component", or a specific type of such an "executable component", so the structure is also well understood by those skilled in the computing field.

[0057] In the following description, embodiments are described with reference to actions performed by one or more computing systems. If such actions are implemented in software, one or more processors (of the associated computing system performing the actions) direct the operation of the computing system in response to having executed the computer-readable instructions that constitute the executable components. For example, such computer-executable instructions may be embodied on one or more computer-readable media forming a computer program product. Examples of such operations involve manipulation of data.

[0058] Computer-executable instructions (and processed data) may be stored in memory 804 of computing system 800. Computing system 800 may also include communication channels 808 that allow computing system 800 to communicate with other computing systems over network 810, for example.

[0059] Although not all computing systems require a user interface, in some embodiments, the computing system 800 includes a user interface 812 for interacting with a user. The user interface 812 may include an output mechanism 812A and an input mechanism 812B. The principles described herein are not limited to the precise output mechanism 812A or input mechanism 812B, and therefore will depend on the nature of the device. However, for example, the output mechanism 812A may include a speaker, a display, a tactile output, a hologram, virtual reality, etc. For example, examples of the input mechanism 812B may include a microphone, a touch screen, a hologram, virtual reality, a camera, a keyboard, a mouse or other pointer input, any type of sensor, etc.

[0060] As discussed in more detail below, the embodiments described herein may include or utilize a dedicated or general-purpose computing system, which includes computer hardware, such as one or more processors and system memory. The embodiments described herein also include physical and other computer-readable media for carrying or storing computer-executable instructions and / or data structures. Such computer-readable media can be any available media that can be accessed by a general-purpose or dedicated computing system. The computer-readable medium that stores computer-executable instructions is a physical storage medium. The computer-readable medium that carries computer-executable instructions is a transmission medium. Therefore, by way of example and not limitation, an embodiment may include at least two distinct computer-readable media: a storage medium and a transmission medium.

[0061] Computer-readable storage media include RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other physical and tangible storage media that can be used to store desired program code in the form of computer-executable instructions or data structures and can be accessed by a general or special purpose computing system.

[0062] A "network" is defined as one or more data links that enable the transmission of electronic data between computing systems and / or components and / or other electronic devices. When information is transmitted or provided to a computing system via a network or another communications connection (hardwired, wireless, or a combination of hardwired or wireless), the computing system properly views the connection as a transmission medium. Transmission media may include networks and / or data links that may be used to carry desired program code means in the form of computer-executable instructions or data structures and may be accessed by general or special computing systems. Combinations of the above should also be included within the scope of computer-readable media.

[0063] Furthermore, program code in the form of computer-executable instructions or data structures may be automatically transferred from transmission media to storage media (or vice versa) upon reaching various computing system components. For example, computer-executable instructions or data structures received over a network or data link may be buffered in RAM within a network interface component (e.g., a "NIC") and then ultimately transferred to computing system RAM and / or to less volatile storage media within the computing system. Thus, it should be understood that readable media may be included in computing system components that also (or even primarily) utilize transmission media.

[0064] For example, computer executable instructions include instructions and data that, when executed in a processor, cause a general-purpose computing system, a special-purpose computing system, or a special-purpose processing device to perform a specific function or group of functions. Alternatively or additionally, the computer executable instructions may configure a computing system to perform a specific function or group of functions. For example, computer executable instructions may be binary, or even instructions that have undergone some translation (such as compilation) before being directly executed by the processor, such as intermediate format instructions, such as assembly language, or even source code.

[0065] Those skilled in the art will appreciate that the present invention can be implemented in a network computing environment with various types of computing system configurations, including personal computers, desktop computers, laptop computers, message processors, handheld devices, multiprocessor systems, microprocessor-based or programmable consumer electronics, network PCs, microcomputers, mainframe computers, mobile phones, PDAs, pagers, routers, switches, data centers, wearable devices (such as glasses or watches), etc. The present invention can also be implemented in a distributed system environment, where local and remote computing systems linked by a network (by hardwired data links, wireless data links, or by a combination of hardwired and wireless data links) all perform tasks. In a distributed system environment, programming components can be located in local and remote memory storage devices.

[0066] Those skilled in the art will also appreciate that the present invention may be implemented in a cloud computing environment supported by one or more data centers or portions thereof. The cloud computing environment may be distributed, although this is not required. If distributed, the cloud computing environment may be distributed internationally within an organization and / or have components across multiple organizations.

[0067] In this specification and the following claims, "cloud computing" is defined as a model that enables on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services). The definition of "cloud computing" is not limited to any of the many other advantages that can be derived from such a model when properly deployed.

[0068] For example, cloud computing is currently used in the market to provide ubiquitous and convenient on-demand access to a shared pool of configurable computing resources. In addition, the shared pool of configurable computing resources can be quickly provisioned via virtualization and released with low management effort or service provider interaction, and then expanded accordingly.

[0069] The cloud computing model can consist of various features, such as on-demand, self-service, broad network access, resource pools, rapid elasticity, measurable services, etc. The cloud computing model can also appear in the form of various application service models, such as software as a service ("SaaS"), platform as a service ("PaaS"), and infrastructure as a service ("IaaS"). The cloud computing model can also be deployed using different deployment models, such as private cloud, community cloud, public cloud, hybrid cloud, etc. In this specification and claims, a "cloud computing environment" is an environment where cloud computing is used. The present invention may be embodied in other specific forms without departing from its spirit or essential characteristics. The described embodiments will be considered in all respects only as illustrative and not restrictive. Therefore, the scope of the present invention is indicated by the appended claims rather than the foregoing description. All changes within the equivalent meaning and scope of the claims should be made within their scope.

Claims

1. A computing system, comprising: one or more processors; as well as One or more computer-readable media having computer-executable instructions stored thereon, the computer-executable instructions being configured to, when executed by the one or more processors, cause the computing system to at least perform: receiving an identifier from a client computing system via a second network, wherein the identifier is resolvable to an internal network address of a resource within a first network using an internal domain name server within the first network, but the identifier is not resolvable to the resource using an external domain name server; automatically determining that an external uniform resource locator is to be generated using the identifier; responsive to the determination, generating an external uniform resource locator structured to be resolved by the external domain name server to a server computing system, the server computing system configured to regenerate the identifier for the internal network address of the resource based on the external uniform resource locator; sending the external uniform resource locator to the client computing system via the second network external to the first network, causing the client computing system to associate the external uniform resource locator with the resource internal to the first network so that the external uniform resource locator is accessed to obtain access to the resource internal to the first network from the second network external to the first network, The computing system is in the second network external to the first network.

2. The computing system of claim 1, further configured to access the external uniform resource locator.

3. The computing system of claim 1, wherein the automatic determination that the external uniform resource locator is to be generated is performed by pattern matching the accessed identifier.

4. The computing system of claim 1, wherein generating the external uniform resource locator based on the identifier is performed using a rule.

5. The computing system of claim 4, the rule comprising using a predetermined domain name that matches the server computing system.

6. The computing system of claim 5, the rule comprising using the identifier in a path of the external uniform resource locator.

7. The computing system of claim 5, the rule comprising using the identifier as a parameter of the external uniform resource locator.

8. The computing system of claim 4, the rule comprising using the identifier in a path of the external uniform resource locator or as a parameter of the external uniform resource locator.

9. The computing system of claim 1, wherein the identifier is an internal uniform resource identifier identified within the first network by a local domain name server, and the generated external uniform resource locator includes a network identifier identifying the second network.

10. A method implemented at a computing system for providing access to resources within a network from the outside, the method comprising: receiving an identifier from a client computing system via a second network, wherein the identifier is resolvable to an internal network address of a resource within a first network using an internal domain name server within the first network, but the identifier is not resolvable to the resource using an external domain name server; automatically determining that an external uniform resource locator is to be generated using the identifier; responsive to the determination, generating an external uniform resource locator structured to be resolved by the external domain name server to a server computing system, the server computing system configured to regenerate the identifier for the internal network address of the resource based on the external uniform resource locator; providing the external uniform resource locator to the client computing system via the second network external to the first network, causing the client computing system to associate the external uniform resource locator with the resource internal to the first network, so that the external uniform resource locator is accessed to obtain access to the resource internal to the first network from the second network external to the first network, The computing system is in the second network external to the first network.

11. The method according to claim 10, wherein the identifier is a first identifier, the internal network address is a first internal network address, the resource is a first resource, and the external uniform resource locator is a first uniform resource locator, and the method further comprises: accessing a second identifier that is resolvable to a second internal network address of a second resource within the first network using the internal domain name server, but that is not resolvable externally to the second resource using an external domain name server; automatically determining that an external uniform resource locator is to be generated using the second identifier; generating a second external uniform resource locator structured to be resolved externally to the server computing system in response to the determination that an external uniform resource locator is to be generated using the second identifier, the server computing system being configured to: determining the second identifier based on the second external uniform resource locator; attempting to resolve the second identifier to the second internal network address of the second resource using the internal domain name server, and If the attempt is successful, providing the second resource to the entity causing the second external uniform resource locator to be accessed; and The second external uniform resource locator is provided so that the second external uniform resource locator will be accessed to obtain access to the second resource within the internal network from outside the internal network.

12. The method according to claim 10, wherein the internal network is a first network, the internal domain name server is a first internal domain name server, the identifier is a first identifier, the internal network address is a first internal network address, the resource is a first resource, and the external uniform resource locator is a first uniform resource locator, and the method further comprises: accessing a second identifier that is resolvable to a second internal network address of a second resource within the second network using a second internal domain name server within the second network, but that is not resolvable externally to the second resource using an external domain name server; automatically determining that an external uniform resource locator is to be generated using the second identifier; generating a second external uniform resource locator structured to be resolved externally to the server computing system in response to the determination that an external uniform resource locator is to be generated using the second identifier, the server computing system being configured to: determining the second identifier based on the second external uniform resource locator; attempting to resolve the second identifier to the second internal network address of the second resource using the second internal domain name server, and If the attempt is successful, providing the second resource to the entity causing the second external uniform resource locator to be accessed; as well as The second external uniform resource locator is provided so that the second external uniform resource locator will be accessed to obtain access to the second resource inside the second network from outside the second network.

13. The method according to claim 10, The automatic determination that the external uniform resource locator is to be generated is performed by pattern matching the accessed identifier.

14. The method of claim 10, wherein generating the external uniform resource locator based on the identifier is performed using a rule.

15. The method of claim 14, wherein the rule comprises using a predetermined domain name that matches the server computing system.

16. The method of claim 15, wherein the rule comprises using the identifier in a path of the external uniform resource locator.

17. The method of claim 15, wherein the rule comprises using the identifier as a parameter of the external uniform resource locator, the generated external uniform resource locator comprising a network identifier identifying the second network.

18. A computer program product comprising: One or more hardware storage devices having computer-executable instructions stored thereon, the computer-executable instructions being structured such that when the computer-executable instructions are executed by one or more processors of a computing system, the computer-executable instructions cause the computing system to at least perform: receiving an internal uniform resource locator from a client computing system via a second network, wherein the internal uniform resource locator is resolvable to an internal network address of a resource within the first network using an internal domain name server within the first network, but the internal uniform resource locator is not resolvable to the resource using an external domain name server; automatically determining that an external uniform resource locator is to be generated using the internal uniform resource locator; In response to the determination, generating an external uniform resource locator, the external uniform resource locator being structured to be resolved by the external domain name server to a server computing system, the server computing system being configured to regenerate the internal uniform resource locator based on the external uniform resource locator; as well as sending the external uniform resource locator to the client computing system via the second network external to the first network, causing the client computing system to associate the external uniform resource locator with the internal uniform resource locator so that the external uniform resource locator is accessed to obtain access to the resource from the second network external to the first network, the resource being addressed by the internal uniform resource locator in the first network, The computing system is in the second network external to the first network.

Images