Method and apparatus for encrypted communications to a secure server

• US 20040230820A1
• Filed: 02/22/2001
• Published: 11/18/2004
• Est. Priority Date: 05/26/2000
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: Symantec Corporation (NortonLifeLock Inc.)
• Inventors: Hormuzdiar, James Noshir, Hui Hsu, Stephen Dao
• Granted Patent: US 7,673,329 B2
• Time in Patent Office: Days
• US Class Current: 713/200
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 67/01 Protocols

Abstract

An embodiment of the invention includes a secure server. A user at a terminal, communicatively coupled to the secure server by a secure link, can obtain web pages from web sites in a network, in encrypted form, via the secure link. Addresses associated with the web pages are altered to make it appear as if the web pages come from the secure server rather than from the web sites. Spoofing units may be used as alternative access points to the secure server, with the secure server sending the requested web pages directly to the terminal. In general, address rewriting and other manipulation can be performed on the requested web pages, such that the true sources of the web pages are disguised and such that subsequent communications from the terminal are directed to the secure server and/or spoofing unit, rather than to the true source of the web pages. Components of the user'"'"'s privacy may be sold, or advertisements may be provided, in exchange for protection of the user'"'"'s identity.

Claims

1. A method, comprising:

responsive to a request, retrieving a web page designated in the request;

modifying an address associated with the retrieved web page to indicate an address associated with a secure server that retrieved the web page; and

encrypting data associated with the retrieved web page and sending, via a secure link, the encrypted data to a terminal that sent the request.

2. The method of claim 1, further comprising modifying computer code associated with the retrieved web page to cause subsequent requests related to the retrieved web page to be sent to the secure server instead of to a source web site that originated the web page.

3. The method of claim 2 wherein the computer code is associated with a Turing complete language.

4. The method of claim 2 wherein the computer code comprises a dynamic hypertext markup language (DHTML) code.

5. The method of claim 2 wherein modifying computer code associated with the retrieved web page includes:

obtaining the code to be modified;

identifying an original function in the code to access a resource address different from an address associated with the secure server; and

replacing the original function in the code with a new function to access the address associated with the secure server.

6. The method of claim 5 wherein replacing the original function in the code with the new function includes:

defining the new function by appending a prefix, having the address associated with the secure server, to the resource address; and

calling the original function.

7. The method of claim 5 wherein replacing the original function in the code with the new function comprises altering the original function to include the address associated with the secure server in addition to the resource address.

8. The method of claim 1, further comprising using a proxy technique to indicate the address associated with the secure server as a source of an electronic file that is sent from a web site to the terminal for storage.

9. The method of claim 8 wherein the proxy technique includes:

replacing an original address associated with the web site that is present in the electronic file with the address associated with the secure server;

appending the address associated with the web site to an original pathname;

obtaining a new variable name by appending the appended address and original pathname to an original variable name;

forwarding the electronic file having the new variable name from the secure server to the terminal; and

if the stored electronic file is subsequently requested by the web site, retrieving the stored electronic file from the terminal via the secure server and extracting the address associated with the web site and the original path name from the new variable name in the retrieved electronic file.

10. The method of claim 9, further comprising replacing the original pathname with a new pathname.

11. The method of claim 9, further comprising encrypting at least the new variable name in the electronic file.

12. The method of claim 9, further comprising rewriting computer code to process the electronic files having the new variable names.

13. The method of claim 1, further comprising:

providing an intermediate unit to receive the request from the terminal;

at the secure server, receiving the request, forwarded from the intermediate unit;

retrieving the web page designated in the request from a source;

modifying address information in the retrieved web page to indicate a source address corresponding to an address of the intermediate unit rather than to an address of the source that provided the web page; and

directly sending an encrypted version of the retrieved web page from the secure sever to the terminal, via the secure link.

14. The method of claim 13 wherein a connection between the secure server and the terminal via the secure link comprises a stateful connection, and wherein a connection between the terminal and the intermediate unit comprises a non-stateful connection.

15. The method of claim 13 wherein a connection between the secure server and the terminal via the secure link comprises a non-stateful connection, and wherein a connection between the terminal and the intermediate unit comprises a stateful connection.

16. The method of claim 14 wherein the stateful connection comprises a Transmission Control Protocol/Internet Protocol (TCP/IP) connection.

17. The method of claim 14, further comprising stripping at least some data from the request prior to forwarding the request to the secure server from the intermediate unit via the stateful connection.

18. A method, comprising:

providing an intermediate unit to receive a request for a web page from a terminal;

at a secure server, receiving the request, forwarded from the intermediate unit;

retrieving the web page designated in the request from a source;

modifying address information in the retrieved web page to indicate a source address corresponding to an address associated with the intermediate unit rather than to an address associated with a source that provided the web page; and

directly sending an encrypted version of the retrieved web page from the secure server to the terminal, via a secure link.

19. The method of claim 18 wherein a connection between the secure server and the terminal via the secure link comprises a stateful connection.

20. The method of claim 19 wherein the stateful connection comprises a Transmission Control Protocol/Internet Protocol (TCP/IP) connection.

21. The method of claim 19 wherein a connection between the terminal and the intermediate unit comprises a non-stateful connection.

22. The method of claim 21 further comprising stripping at least some data from the request prior to forwarding the request to the secure server from the intermediate unit via the stateful connection.

23. The method of claim 19 wherein a connection between the terminal and the intermediate unit comprises a stateful connection.

24. The method of claim 23 wherein a connection between the terminal and the secure server comprises a non-stateful connection.

25. The method of claim 23 wherein the stateful connection between the terminal and the intermediate unit comprises a secure connection.

26. The method of claim 23 wherein the intermediate unit decrypts at least a portion of the request that is received from the terminal via the secure connection and that is to be forwarded to the secure server.

27. An article of manufacture, comprising

a machine-readable medium having stored thereon instructions to:

receive a request for a web page from a terminal; and

forward the request from the terminal to a secure server to allow the secure server to retrieve the web page designated in the request from a source and to allow the secure server to directly send an encrypted version of the retrieved web page from the secure server to the terminal, via a secure link.

28. The article of manufacture of claim 27 wherein the machine-readable medium further includes instructions stored thereon to establish a stateful connection with the terminal.

29. The article of manufacture of claim 27 wherein the machine-readable medium further includes instructions stored thereon to strip at least some of the information in the request that is received from the terminal and that is to be forwarded to the secure server.

30. The article of manufacture of claim 27 wherein a connection between the secure server and the terminal comprises a stateful connection.

31. An apparatus, comprising:

a server communicatively coupleable to a network and to a terminal, the server being capable of sending data from the network to the terminal in an encrypted form via a secure link, in response to a request received from the terminal, wherein the data sent to the terminal indicates the server as a source of the data.

32. The apparatus of claim 31 wherein the server is capable to use a cookie proxy technique to indicate the address associated with the server as a source of a cookie that is sent from the network to the terminal for storage.

33. A system, comprising:

a server communicatively coupleable to a network and to a terminal, the server being capable of sending data from the network to the terminal in an encrypted form via a secure link, in response to a request received from the s terminal, wherein the data sent to the terminal indicates the server as a source of the data; and

an intermediate unit communicatively coupleable to the server, the server being capable of receiving the request from the terminal via the intermediate unit and sending the data responsive to the request directly to the terminal via the secure link.

34. The system of claim 33 wherein the intermediate unit is capable of receiving subsequent requests from the terminal and sending the request to the server, the server being capable of receiving the requests from the intermediate unit and sending data responsive to the request directly to the terminal, the data sent to the terminal indicating a source address corresponding to the intermediate unit rather than an address corresponding to the server.

35. The system of claim 34 wherein a connection between the terminal and the intermediate unit comprises a non-stateful connection, and wherein a connection between the terminal and the secure server comprises a stateful connection.

36. The system of claim 34 wherein a connection between the terminal and the intermediate unit comprises a stateful connection, and wherein a connection between the terminal and the secure server comprises a non-stateful connection.

37. The system of claim 35 wherein the stateful connection between the terminal and the secure server comprises a Transmission Control Protocol/Internet Protocol (TCP/IP) connection.