Security services system and method

• US 20020199119A1
• Filed: 03/28/2002
• Published: 12/26/2002
• Est. Priority Date: 04/02/2001
• Status: Abandoned Application

• Current Assignee: Numeme Limited
• Original Assignee: Numeme Limited
• Inventors: Dunnion, Dermot, Dunnion, Brian
• Application Number:
  US10/107,136
• Publication Number:
  US 20020199119A1
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/166 at the transport layer

Abstract

A server downloads a program to a client for secure services such as secure email messaging. A one-time session key is generated by both the server and the client. There are a number of options for the client to obtain private keys, and where it is generated by the client it may be sent to the server for an escrow service. Time-varying authentication is achieved by the server transmitting a random value to the client and the client uses this value to transmit a password to the server. The server establishes a pre-registered state for the client to allow a message to be sent to a non-registered recipient. The server also downloads a library of components which are subsequently used by applications to generate user displays.

Claims

1. A method for managing secure communication services in a client/server environment, the method comprising the steps of:

the server downloading a program to the client and the client using said program to communicate with the server to avail of secure services.

2. A method as claimed in claim 1, wherein the program is a Java applet, and the server operations are according to Java servlets.

3. A method as claimed in claim 1, wherein a session key is generated for encryption of sensitive data communicated between the client and the server.

4. A method as claimed in claim 3, wherein both the client and the server generate and send a one-time session key.

5. A method as claimed in claim 4, wherein the session key is generated according to the Diffie-Hellman algorithm.

6. A method as claimed in claim 1, wherein the client allows the user to select one of a plurality of options for obtaining a private key.

7. A method as claimed in claim 6, wherein the options are:

(a) the client generating and encrypting a private key and sending to the server for storage;

(b) the client generating a private key, transmitting it to the server, and the server storing it; and

(c) the client generating, encrypting, and storing a private key.

8. A method as claimed in claim 7, wherein option (c) comprises the further step of the client transmitting the encrypted private key to the server for an escrow service.

9. A method as claimed in claim 1, wherein the client allows the user to select one of a plurality of options for obtaining a public key.

10. A method as claimed in claim 1, wherein the options are:

(c) the server sending the public key in a plain format, and

(d) the server sending the public key as a key certificate and wherein the key data is signed.

11. A method as claimed in claim 1, wherein the server transmits a random value to the client during login or other sensitive operation, and the client uses said value to transmit a password to the server to provide time-varying authentication.

12. A method as claimed in claim 1, wherein the secure service is an email messaging service.

13. A method as claimed in claim 1, wherein the server maps a user'"'"'s existing email address to a new address.

14. A method as claimed in claim 13, wherein the server allows a message to be sent to a non-registered recipient by registering after the sender sends the message.

15. A method as claimed in claim 14, wherein the server establishes a pre-registered state for the recipient.

16. A method as claimed in claim 15, wherein the server stores pending messages for the pre-registered state in encrypted form.

17. A method as claimed in claim 14, wherein the server notifies the recipient of pending messages using a separate link.

18. A method as claimed in claim 1, wherein the client is a handheld device such as a personal digital assistant (PDA) or mobile phone.

19. A method as claimed in claim 1, wherein the secure service is a secure data storage service.

20. A method as claimed in claim 1, wherein the downloaded program is used by the client to generate a user interface of a type similar to that of a substantial located application such as an email messaging application, and wherein the program comprises a toolkit of user interface primitives such as windows, frames, buttons, multi-column lists, button bars, and dialog boxes, and a client application calls these primitives.

21. A method as claimed in claim 1, wherein the program is a secure communications program which makes secure communication functions available to applications.

22. A method as claimed in claim 21, in which an application sends data to a client communication manager, which in turn communicates securely with a sever communications manager, which in turn processes the application data itself or passes it to another server module.

24. A method as claimed in claim 23 wherein the applications launched are determined by user registration details.

25. A method as claimed in claim 23, wherein functions available to an application are determined by user registration details.

27. A method as claimed in claim 26, wherein:

the client downloads a library containing some or all of cryptographic primitive functions, user-interface components, protocol primitive functions, session-management functions and cryptographic key-management functions, and

the client also downloads one or more applications which call said library functions and use them to provide cryptography-based services

28. A method as claimed in claim 27, wherein the library functions are embedded in an application.

29. A server comprising means for performing server operations in a method as claimed in claim 1.

30. A computer program product comprising software code for performing the steps of claim 1 when executing on a digital computer.

23. A method of operating in a client/server environment comprising the steps of using an applet downloaded to a client web-browser for launching one or more windowed applications.

26. A method of operating a client system in a client/server environment, the method comprising the steps of:

the client system downloading a library containing user-interface components, and

the client also downloading one or more applications which call said components and use them to generate user displays.