Method and arrangement for managing data transmission in a data network

• US 20020023222A1
• Filed: 07/23/2001
• Published: 02/21/2002
• Est. Priority Date: 07/21/2000
• Status: Abandoned Application

• Current Assignee: Suomen Posti OY
• Original Assignee: Suomen Posti OY
• Inventors: Gefwert, Boris
• Application Number:
  US09/909,883
• Publication Number:
  US 20020023222A1
• Time in Patent Office: Days
• US Class Current: 713/182
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

The invention relates to a method and arrangement for managing data transmission in a data network. In particular, the invention relates to the transmission of confidential information in a data network. One of the basic principles of the invention is that when the information meant for the user is recorded (413), the address of the storage location is transmitted to the user by intermediation of a reliable party (intermediator, 440). Thus, on the basis of a user verification owned out by the intermediator, the user can access the information/services of several different service producers,

Claims

1. A method for managing data transmission in a data network, characterized in that said method comprises the following steps, where

a determined piece of information is stored in a storage location according to a determined address (105, 110)

the address information that determines said address is transmitted to the intermediator (128),

information of at least one user who has the right to access said determined piece of information is transmitted to the intermediator (115),

said address information is stored in the user-specific directory of the intermediator, in which directory said at least one user has access (250), and

said determined piece of information is transmitted to the user on the basis of said address information (380).

2. A method according to claim 1, characterized in that said address information is encrypted by the user'"'"'s public key, in which case the address information encryption can be decoded by the user (120, 365).

3. A method according to claim 1, characterized in that said user information is encrypted by the intermediator'"'"'s public key (125), in which case the intermediator decodes the user information encryption and records the address information in a user-specific intermediary directory on the basis of said user information (235-250).

4. A method according to claim 1, characterized in that in between the user and the first intermediary directory, there is established a connection on the basis of user verification.

5. A method according to claim 4, characterized in that for one user, there are created two intermediary directories, in which case between the user and the first intermediary directory, there is established a connection on the basis of a first verification of the user, and in between the user and the second intermediary directory, there is created a connection on the basis of a second verification of the user, in which case the first and second verification are mutually different as regards the reliability (strength) typical of said verification procedure,

6. A method according to claim 1, characterized in that the intermediator transmits a given information to the user,

7. A method according to claim 6, characterized in that

the user sends the intermediator a request for receiving a given piece of information,

an encryption decoding key for decoding the encryption of said given piece of information is transmitted to the user,

the transmission of said encryption decoding key to the user is registered as an indication of the reception of said document.

8. An arrangement according to the invention for managing data transmission in a data network, characterized in that said arrangement comprises

means for storing a determined piece of information in a storage location according to a determined address (411, 413)

means for transmitting said address information to an intermediator, said address information defining said address (411, 430, 441),

means for transmitting to the intermediator information of at least one user who has right to access said determined piece of information (411, 412, 430, 44),

means for storing said address information in the user-specific directory of the intermediator, in which directory said at least one user has access (441, 48), and

means for transmitting said determined piece of information to the user on the basis of said address information (413, 411, 430, 420).

9. An arrangement according to claim 8, characterized in that said arrangement also comprises means for encrypting said address information by the user'"'"'s public key, so that the address information encryption can be decoded by the user (411, 412).

10. An arrangement according to claim 8, characterized in that said arrangement also comprises means for encrypting said user information by the intermediator'"'"'s public key prior to the transmission to the intermediator, means for decoding the encryption of the user information after transmission to the intermediator and means for recording the address information in a user-specific intermediary directory on the basis of said user information (411).

11. A arrangement according to claim 8, characterized in that said arrangement comprises means for verifying the user in order to establish a connection between the user and the intermediator (441, 446).

12. A method according to claim 11, characterized in that said arrangement comprises means for creating two intermediary directories for one user, means for establishing a connection between the user and the first intermediary directory on the basis of a first verification of the user, and means for establishing a connection between the user and the second intermediary directory on the basis of a second verification of the user, in which case the first and second verification are mutually different as regards the reliability (strength) typical of the verification procedure.