Secure digital courier and desktop architecture for secure service oriented networking

• US 20060248330A1
• Filed: 02/16/2006
• Published: 11/02/2006
• Est. Priority Date: 10/25/2002
• Status: Active Grant

• Current Assignee: Randall E. Orkis, William M. Randle
• Original Assignee: Randall E. Orkis, William M. Randle
• Inventors: Orkis, Randall E., Randle, William M.
• Granted Patent: US 7,627,532 B2
• Time in Patent Office: Days
• US Class Current: 713/155
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/166 at the transport layer

Abstract

A virtual secure service oriented network and process model for the creation and management of secure service communities including a private secure digital courier means for the secure and auditable movement of digital information over any network connection wherein end to end security is provided.

Claims

1. A Virtual Secure Service Oriented Network (SON) for the creation and management of secure service communities including (a) a private Secure Digital Courier (SDC) Service means for the secure and auditable movement of digital information over any network connection, (b) means for providing end to end security, (c) means for reporting activity within the SDC, (d) a controlled enrollment means, and (e) strong authentication means whereby the creation of a secure service community and the provisioning of additional users and/or services to new or existing service communities is effected.

2. The SON of claim 1 including a Virtual Service Connection (VSC) means providing security for all network activity and network participants comprising:

(a) Mutual authentication for all service activity and VSC creation for all parties to a service use;

(b) Authorization specific to a service and service relationship to a participants is controlled by the provider of the service;

(c) Transport encryption using mutually authenticated Secure Sockets Layer (SSL) or equivalent approach where all parties to the network connection are authentication prior to the delivery of a service;

(d) End to end reporting using a unique service ID for each activity that links authentication, authorization, usage, and encryption for all parties specific to the instance of the activity;

(f) Participant privacy on a service to participant relationship basis;

(g) Digital encryption of the payload or service content independent of the transport and specific to the recipient or parties of a service invocation and independent of the transport encryption.

3. A network of claim 2 including means for digital signing of payload or service content independent of the transport encryption and specific to the recipient or parties to an instance of use of a service.

4. A network of claim 2 that includes digital encryption of the payload or service content independent of the transport encryption and specific to the recipient or parties to an instance of use of a service.

5. A network of claim 2 that includes digital signing and digital encryption of the payload or service content independent of the transport encryption and specific to the recipient or parties to an instance of use of a service.

6. A network of claim 2 wherein payload encryption means allow for the protection of the payload while at rest within any fixed or mobile storage device such that only a predesignated participant to a transaction can decrypt the contents.

7. A network of claim 2 including means for establishing transitive security is through combined elements of security provided elements of the VSC.

8. A network of claim 1 wherein specific control of a participant is effected by means of local ACL control by a service provider such that the provider maintains absolute control over services independent of any other participant on a public or private implementation of the service network or service community.

9. A network of claim 2 including means for permitting a portable indicia of a participant'"'"'s identity on a service network via a digital certificate, a token, a biometric characteristic, or secret employed in combination with a Common Authentication Service and Authentication Library accessed over the network.

10. A network of claim 2 including means for controlling the enrollment of participants in the network to effect strong participant authentication by service, service community, or participant grouping.

11. A network of claim 10 including means for participant and/or service enrollment comprising means for effecting strong authentication by invitation only.

12. A network of claim 10 wherein participants or service providers create private secure service communities through means of a private invitation process that is correlated to network enrollment through one or more unique artifacts associated with the invitation and/or the relationship between the parties to the invitation.

13. A network of claim 11 including means for participants or service providers to create private secure service communities as an element of the invitation and enrollment process.

14. A network of claim 1 including means for out of band notification of service activity over the network.

15. A network of claim 1 including means for in band notification of service activity over the network.

16. A network claim 1 including means for strong authentication wherein a Common Authentication Service is a service on the network.

19. A network of claim 1 including XML digital certificate authentication means as a function of a service over an instance of a service network.

20. A network of claim 1 that includes an authentication service based on Security Access Markup Language (SAML) accessing one or more identity servers managed by participants on the service network wherein access to the identity servers is via a service on the network.

21. A network of claim 12 including means for the self provisioning of a software node on the network wherein the node is registered on the network.

22. A network of claim 2 wherein strong authentication is effected through the use of more than one set of digital certificates where one or more certificate authorities is associated with each set of digital certificates and a service on the network is used to validate each certificate with the respective issuer and/or signer of the certificate.

23. A network of claim 2 where strong authorization is effected through the use of more than one set of digital certificates where one or more certificate authorities is associated with each set of digital certificates wherein a service on the network is used to validate each certificate with the respective issuer and/or signer of the certificate.

24. A network of claim 2 wherein multiple levels of encryption are effected through the use of more than one set of digital certificates wherein one or more certificate authorities is associated with each set of digital certificates and a service on the network is used to validate each certificate with the respective issuer and/or signer of the certificate.

25. A method of claim 22 or claim 23 or claim 24 wherein transitive security is provided for all services and participants on a service oriented network.

26. A network of claim 2 wherein Web Services Security (WS-S standard) is used to effect components of security for the authentication, authorization, and/or encryption of web services over a service oriented network.

27. A network of claim 26 wherein a service on the network validates a digital certificate or equivalent artifact in the service wrapper or payload transmitted by a participant prior to passing the service onto another participant on the network.

28. A network of claim 2 wherein data compression is effected in cooperation with payload and/or transport encryption.

29. A method of encryption over a SON where a Public Key Infrastructure (PKI) based container is created around the payload that includes one or more of the functions in accordance with claim 3 or claim 4 or claim 5 wherein the payload is actually encrypted via a CPU method allowing for increased performance for large payloads over that available using a convention PKI approach for the entire payload.

30. A method of encryption and compression over a service oriented network where a PKI based container is created around the payload that includes one or more of the functions in accordance with claim 3 or claim 4 or claim 5, wherein the payload is compressed and protected inside the PKI based container allowing for increased performance with the same level of security for large payloads over that available by using a convention PKI approach for the entire payload.

31. A SON of claim 2 wherein a service is one of a networked web service, a networked function within an application, or a networked application.

32. A SON of claim 31 where end to end security is implemented and enforced independent of the service where all services inherit a base but comprehensive security model with no programmatic changes required to the service.

33. A SON of claim 31 wherein end to end security is implemented and enforced independent of the service provided and all services inherit a base but comprehensive security model with no programmatic changes required to the service allowing the service to implement additional security to effect service and participant specific security.

34. The SON of claim 1 including network topology architecture wherein an SSN virtual service connection and administration layer is an overlay configured intermediate a predetermined network configuration and an applications layer administered by the SSN layer in accordance with predetermined criteria limiting access by a network participant only to applications allowed by the SSN layer.

17. An SDC service for the transmission of payment information.

18. An SDC service of claim 17 wherein the payment information includes one or more of digital checks, micro payments, ACH, wire transfers, account credits, and account debits.