Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Particular communication authentication technique
Reexamination Certificate
1999-06-30
2003-06-24
Peeso, Thomas R. (Department: 2132)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Particular communication authentication technique
C713S182000, C713S152000, C713S152000
Reexamination Certificate
active
06584567
ABSTRACT:
BACKGROUND OF THE INVENTION
1. Technical Field
The present invention relates generally to network security protocols and, in particular, to a method of extending to an intermediary (e.g., a transcoding proxy) the privacy of a secure session between a client and one or more origin servers.
2. Description of the Related Art
Network security protocols, such as Netscape's Secure Sockets Layer protocol (SSL) and the Internet Engineering Task Force (IETF) Transport Layer Security protocol (TLS), provide privacy and data integrity between communicating applications. These protocols, for example, are commonly used to secure electronic commerce transactions over the Internet.
Recently, the computer industry has sought to add computer processing and communications capabilities to devices other than what would normally be considered a traditional computer. Such devices are quite varied and include, for example, personal digital assistants (PDAs), business organizers (e.g., IBM® WorkPad® and the 3Com® PalmPilot®,), smartphones, cellular phones, other handheld devices, and the like. For convenience, these devices, as a class, are sometimes referred to as “pervasive computing” clients as they are devices that are designed to be connected to servers in a computer network and used for computing purposes regardless of their location.
Pervasive computing clients, however, typically do not support the full function set of an HTML Windows-based client. As a result, transcoding services typically are required to translate information to be rendered on the pervasive client from one source markup language (e.g., HTML) to another (e.g., HDML or handheld device markup language). The provision of transcoding services over a secure network connection, however, is problematic. In particular, there is a fundamental conflict between the security and transcoding services because traditional security protocols such as SSL and TLS are designed precisely to prevent a third party from intervening in the communication between the client and the server.
Restricting third party intervention in a secure session is also problematic in other applications. For example, if a client is located behind a firewall, SSL/TLS communications to servers in the outside network cannot be readily audited or otherwise monitored. Thus, data records or other sensitive information can be transmitted from the client, possibly without administrative authorization. As another example, a client that communicates with a server over a secure connection cannot take advantage of third party caching or pre-fetch mechanisms that would otherwise be useful in reducing network resource demands and enhancing communications between the devices.
It would be desirable to provide a mechanism by which a client could delegate enough security information to a proxy to enable the proxy to perform a given function (e.g., transcoding, auditing, monitoring, caching, pre-fetching, encryption/decryption on behalf of the client, etc.) without diluting the security of the network protocol. Further, it would also be desirable to enable such a proxy to secure data from another origin server during the process of servicing a request on behalf of the client.
The present invention solves these important problems.
BRIEF SUMMARY OF THE INVENTION
A client that is using a network security protocol (e.g., SSL or TLS) to communicate with an origin server allows a proxy to participate in the session without changing the security attributes of the session. In accordance with the invention, a protocol is provided to enable the client to take a session master secret negotiated with an origin server, and to securely deliver that secret to the proxy. The proxy uses that master secret to encrypt/decrypt data passing between the client and the server. If the proxy requires additional secure data from a second origin server while servicing a given client request, the proxy asks the client to repeat the protocol to obtain another session master secret (negotiated with the second origin server), which secret is then delivered to the proxy for use in obtaining data from the second origin server.
It is thus an object of the present invention to enable a given third party intermediary or proxy to participate in a secure session between a client and one or more origin servers. Preferably, the third party participates without the express knowledge of a given origin server. As a consequence, the method does not require changes to the origin server or changes to the handshake protocol used in negotiating the session secret.
It is another object of the invention to enable security and other services (e.g., transcoding, caching, monitoring, encryption/decryption on the client's behalf, and the like) to coexist while communications are passed according to a network security protocol.
It is a more specific object of the invention to enable a proxy to provide transcoding services while a pervasive computing client communicates with one or more origin servers over a secure link.
Yet another specific object of the invention is to enable a proxy to perform caching or other administrative services on behalf of a client that communicates with one or more servers using a network security protocol.
A still further object is to enable a proxy to perform encryption/decryption on behalf of a client that communicates with one or more origin servers using a network server protocol.
In a preferred embodiment, a proxy participates in a secure communication between a client and a first server. The method begins by establishing a first secure session between the client and the proxy. Upon verifying the first secure session, the method continues by establishing a second secure session between the client and the proxy. In the second secure session, the client requests the proxy to act as a conduit to the first server. Thereafter, the client and the first server negotiate a first session master secret. Using the first secure session, this first session master secret is then provided by the client to the proxy to enable the proxy to participate in secure communications between the client and the first server. After receiving the first session master secret, the proxy generates cryptographic information that enables it to provide a given service (e.g., transcoding, monitoring, encryption/decryption, caching, or the like) on the client's behalf and without the server's knowledge or participation. The first secure session is maintained between the client and the proxy during such communications.
According to a feature of the present invention, if the proxy requires data from a second server to process a given client request, the above-mentioned protocol is repeated. In particular, the proxy issues a request to the client to establish a separate connection with the second server by again tunneling through the proxy. As described above, this protocol enables the client to establish a second session master secret with the second server, and that secret is shared with the proxy in the manner previously described. The proxy then continues its service operation (e.g., transcoding) by using this second secret to obtain secure data from the second server.
Thus, once the basic tunneling protocol is established between the client and a given origin server, the protocol is repeated as needed by the client to enable the proxy to obtain secure data from up to “n” additional origin servers while servicing a given client request to the given origin server.
REFERENCES:
patent: 5623601 (1997-04-01), Vu
patent: 5706434 (1998-01-01), Kremen et al.
patent: 5764750 (1998-06-01), Chau et al.
patent: 5781550 (1998-07-01), Templin et al.
patent: WO 98/43177 (1998-10-01), None
patent: WO 01/03398 (2001-01-01), None
Norifusa, “Internet security: difficulties and solutions”,International Journal of Medical Informatics, v. 49, n. 1, pp. 69-74, Mar. 1998.
Han et al., “Dynamic Adaptation in an Image Transcoding Proxy for Mobile Web Browsing”,IEEE Personal Communications, v. 5, n. 6, pp. 8-17, Dec. 1998.
Fox et al., “Adapting
Bellwood Thomas Alexander
Lita Christian
Rutkowski Matthew Francis
Burwell Joseph R.
Judson David H.
LaBaw Jeffrey S.
Peeso Thomas R.
LandOfFree
Dynamic connection to multiple origin servers in a... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Dynamic connection to multiple origin servers in a..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Dynamic connection to multiple origin servers in a... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3150047