Method and a system for securing processing of an order by a mobile agent within a network system

• US 20070286424A1
• Filed: 05/18/2007
• Published: 12/13/2007
• Est. Priority Date: 05/26/2006
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP AG (SAP SE)
• Inventors: Rits, Maarten E.
• Granted Patent: US 7,778,931 B2
• Time in Patent Office: Days
• US Class Current: 380/270
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: H04L 2209/84 Vehicles
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

The present description refers to a method for securing processing of an order by a mobile agent from a first server (S₀) within a network system with a plurality of servers (S₀, S₁, . . . ,S_n), at least a number of which the mobile agent has to pass according to an appropriate succession, wherein each of the plurality of servers has a pair of a public key (KS₀, . . . ,KS_i, . . . , KS_n) and a private key (PKS₀, . . . ,PKS_i, . . . , PKS_n) associated therewith, respectively, the method comprising, starting from any one of the number of servers the mobile agent has to pass, called herein the i'"'"'th server at least the steps of receiving the mobile agent which has been prepared by the first server by choosing a unique number (r0) and assigning it to the mobile agent, encoding the chosen unique number (r0) with the private key (PKS₀) of the first server (S₀), thus forming an agent specific initialisation number (C₀) as basis for a sequence of checksums (C₀, . . . ,C_i, . . . ,C_n) to be computed successively by the number of servers (S₀, S₁, . . .,S_n), sending the mobile agent together with its initialisation number (C₀) on its route through the network system for processing the order passing thereby the number of servers (S₀, S₁, . . . ,S_n) successively, and initiating each server (S₁, . . . ,S_n) from which the mobile agent intends to take data with it when passing that server to encode the initialisation number (C₀) together with the data with the respective server'"'"'s private key (PKS₁, . . . ,PKS_i, . . . , PKS_n) and to compute therewith a new server specific checksum (C₁, . . . ,C_i, . . . ,C_n) using the public key (KS₀) of the first server (S₀) and the checksum (C₀, . . . ,C_i, . . . ,C_n−1) computed by the server (S₀, . . . ,S_n−1) right before in the succession.

Claims

1. A method for securing processing of an order by a mobile agent from a first server (S₀) within a network system with a plurality of servers (S₀, S_i, . . . ,S_n), at least a number of which the mobile agent has to pass according to an appropriate succession, wherein each of the plurality of servers has a pair of a public key (KS₀, . . . ,KS_i, . . . , KS_n) and a private key (PKS₀, . . . ,PKS_i, . . . , PKS_n) associated therewith, respectively, the method comprising, starting from any one of the number of servers the mobile agent has to pass, called herein the i'"'"'th server, at least the following steps:

receiving the mobile agent which has been prepared by the first server (S₀) by choosing a unique number (r0) and assigning it to the mobile agent, encoding the chosen unique number (r0) with the private key (PKS₀) of the first server (S₀), thus forming an agent specific initialisation number (C₀) as basis for a sequence of checksums (C_O, . . . ,C_i, . . . ,C_n) to be computed successively by the number of servers (S₀, S₁, . . . ,S_n), and sending the mobile agent together with its initialisation number (C₀) on its route through the network system for processing the order passing thereby the number of servers (S₀, S₁, . . . ,S_n) successively,

encoding in case that the mobile agent intends to take data (X_i) with it when passing the i'"'"'th server the initialisation number (C₀) together with the data (X_i) with the i'"'"'th server'"'"'s private key (PKS_i) and computing therewith a new server specific checksum (C_i) using the public key (KS₀) of the first server (S₀) and the checksum (C<sub>i−

1</sub>) computed by the server (S<sub>i−

1</sub>) right before in the succession, and

sending the mobile agent further to the next server (S_i+1) within the succession.

2. The method according to claim 1, wherein the data the mobile agent takes with it from the i'"'"'th server is encoded by the public key (KS₀) of the first server (S₀).

3. The method according to claim 1, wherein the data the mobile agent gathers on its route through the network when processing the order are collected within a data container.

4. The method according to claim 1, wherein the sequence of checksums is defined by the following functional rule:

C_i={C<sub>i−

1</sub>,[X_i,[r0]PKS₀]PKS_i,S_i}KS₀

wherein C_i is the i'"'"'th checksum, X_i is the data from the i'"'"'th server, r0 is the unique number, PKS₀ is the private key of the first server, KS₀ is the public key of the first server, PKS_i is the private key of the i'"'"'th server, S_i is a code number of the i'"'"'th server, i is a positive integer value.

5. The method according to claim 1, wherein the unique number (r0) is a process identification number.

6. The method according to claim 1, wherein each checksum (C_i) is used to be deflated by the first server for verifying successively the respective keys on the data thus checking the unaffected processing of the order when the mobile agent returns back to the first server (S₀).

9. A computer program product with a computer-readable medium and a computer program stored on the computer-readable medium with a program code which is suitable for carrying out a method according to claim 1 when the computer program is run on a computer.

10. A computer program with a program code which is suitable for carrying out a method according to claim 1 when the computer program is run on a computer.

11. A computer-readable medium with a computer program stored thereon, the computer program comprising a program code which is suitable for carrying out a method according to claim 1 when the computer program is run on a computer.

7. A network system for providing a secure processing of an order by a mobile agent from a first server, the first server (S₀) having a pair of a private key (PKS₀) and a public key (KS₀), and, for processing the order, the mobile agent being associated with a unique number (r0) encoded by said private key (PKS₀), the network system further comprises a plurality of servers (S₀, S₁, . . . ,S_n), at least a number of which the mobile agent has to pass according to an appropriate succession for processing the order, wherein each of the plurality of servers (S₀, S₁, . . . ,S_n) has a pair of a public key (KS₀, . . . ,KS_i, . . . , KS_n) and a private key (PKS₀, . . . ,PKS_i, . . . , PKS_n) associated therewith, respectively, and is configured to encode the encoded unique number together with data the mobile agent intends to take with it when passing that server with the respective server'"'"'s private key and to compute therewith a new server specific checksum using the public key of the first server and the checksum computed by the server right before in the succession.

8. A mobile agent from a first server (S₀) providing a secure processing of an order within a network system with a plurality of servers (S₀, . . . ,S_i, . . . ,S_n), at least a number of which the mobile agent has to pass according to an appropriate succession, wherein each of the plurality of servers (S₀, . . . ,S_i, . . . ,S_n) has a pair of a public key (KS₀, . . . ,KS_i, . . . ,KS_n) and a private key (PKS₀, . . . ,PKS_i, . . . ,PKS_n) associated therewith, respectively, and wherein the mobile agent gets, when starting processing the order, associated with a unique number (r0), which is encoded with the private key (PKS₀) of the first server (S₀) thus forming an agent specific initialisation number (C₀) as basis for a sequence of checksums (C₀, . . . ,C_i, . . . ,C_n) to be computed successively by the number of servers when being passed by the mobile agent on its route through the network system for processing the order, each checksum being further encoded by the public key (KS₀) of the first server (S₀).