METHOD AND COMPUTER SYSTEM FOR PERFORMING TRANSACTIONS BETWEEN A CLIENT AND A SERVER

• US 20070288750A1
• Filed: 06/08/2007
• Published: 12/13/2007
• Est. Priority Date: 06/13/2006
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Shelat, Abhi, Camenisch, Jan, Zimmermann, Roger, Sommer, Dieter
• Granted Patent: US 8,825,554 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06Q 20/36 using electronic wallets or electronic money safes
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/383 Anonymous user system
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A method and system for performing transactions between a client and a server. The client sends to the server a transaction request for performing a transaction, and receives from the server a transaction policy. The client displays a first representation of the transaction policy depicting transaction policy options for fulfilling the transaction policy. After the user selects a first transaction policy option, the client displays a second representation of the transaction policy, depicting at least one mechanism pertaining to the first transaction policy option for satisfying the requirements of the first transaction policy option. After the user selects a first mechanism, the client depicts evidence options for each requirement of the first transaction policy option. After the user selects an evidence option for each requirement of the first transaction policy option, the client sends to the server transaction enablement information that includes evidence dictated by the selected evidence options.

Claims

1. A method for performing transactions between a client and a server, said method comprising:

sending, by the client to the server, a transaction request for performing a transaction;

receiving, by the client, a response from the server comprising a transaction policy or an address at which the transaction policy may retrieved by the client, said transaction policy specifying criteria for performing the transaction in accordance with the transaction request;

if the response comprises the address, then retrieving the transaction policy from the address, said retrieving being performed by the client;

displaying, by the client in a first window of a screen of a client device at the client, a first representation of the transaction policy, said first representation depicting a plurality of transaction policy options for fulfilling the transaction policy, each transaction policy option comprising at least one requirement for fulfilling the transaction policy;

responsive to selection by a user of a first transaction policy option of the plurality of transaction policy options, displaying by the client in a second window of the screen a second representation of the transaction policy, said second representation being specific to the first transaction policy option and depicting at least one mechanism pertaining to the first transaction policy option for satisfying the at least one requirement of the first transaction policy option;

responsive to selection by the user of a first mechanism of the at least one mechanism pertinent to the first transaction policy option, depicting by the client in the screen at least one evidence option for each requirement of the first transaction policy option for proving that each requirement of the first transaction policy option is satisfied, said at least one evidence option for each requirement of the first transaction policy option being specific to the first mechanism; and

following selection by the user of an evidence option of the at least one evidence option for each requirement of the first transaction policy option, sending transaction enablement information from the client to the server, said transaction enablement information comprising evidence dictated by each selected evidence option, said evidence enabling performance of the transaction by the server.

2. The method of claim 1, wherein the at least one mechanism pertinent to the first transaction policy option consists of a plurality of mechanisms.

3. The method of claim 1, wherein the least one evidence option for a requirement of the first transaction policy option consists of a plurality of evidence options.

4. The method of claim 1, wherein the evidence comprises one or more statements about the identity of a user.

5. The method of claim 1, wherein the evidence comprises a certified assertion derived from a private certificate.

6. The method of claim 1, wherein the response comprises the transaction policy.

7. The method of claim 1, wherein the response comprises the address.

8. The method of claim 7, wherein the address is an address at the server.

9. The method of claim 7, wherein the address is an address at another server.

10. The method of claim 1, wherein the first mechanism is recited in the second representation as being a mechanism used at a previous session.

11. The method of claim 10, wherein the at least one evidence option comprises a plurality of evidence options, said evidence options denoting dates of respective previous sessions in which evidence pertaining to the first transaction policy option for satisfying the at least one requirement of the first transaction policy option was utilized.

12. The method of claim 1, wherein the transaction request is a request to access a restricted area of a resource of the server.

13. The method of claim 1, wherein a browser plugin is plugged into a browser comprised by the client, wherein the browser plugin is connected to a wallet, wherein the browser performs said sending the transaction request to the server, and wherein the method comprises:

sending a request by the browser to the browser plugin to process the response;

parsing, by the browser plugin, the response to determine where in the first representation to place transaction management module activation elements that are each allocated to a corresponding transaction policy option for selecting the corresponding transaction policy option upon being activated by the user;

after said parsing, displaying by the browser the transaction management module activation elements in the first representation;

if the response comprises the address, then performing by the browser plugin said retrieving the transaction policy from the address;

sending a request by the browser plugin to the wallet to process the transaction policy;

receiving, by the browser plug-in from the wallet, transaction menu descriptions of the plurality of transaction policy options, after said sending the request to process the transaction policy;

pre-computing, by the browser plug-in, a visual representation of a transaction menu that comprises the transaction menu descriptions;

sending, by the browser plugin to the browser, the pre-computed visual representation of the transaction menu; and

displaying, by the browser in the first representation of the transaction policy, the pre-computed visual representation of the transaction menu.

14. The method of claim 13, wherein the user selected the first transaction policy option by activating a first transaction management module activation element, and wherein the second representation is displayed with a visual tie to the first transaction management module activation element.

15. The method of claim 14, wherein the first transaction management module activation element is optically highlighted after being activated.

16. The method of claim 13, wherein the user has selected a certified assertion as an evidence option of the at least one evidence option, and wherein said sending transaction enablement information from the client to the server comprises:

sending, by the browser plugin to the wallet, a request for an authentication protocol message, wherein the request for the generation of an authentication protocol message includes the first transaction policy option;

receiving, by the browser plugin from the wallet, the authentication protocol message such that the authentication protocol message comprises the certified assertion, after said sending the request to generate the authentication protocol message;

sending, by the browser plugin to the server, the authentication protocol message;

receiving, by the browser plugin from the server, an access credential, after said sending the authentication protocol message;

sending, by the browser plugin to the browser, the access credential together with a request to resend the transaction request to the server; and

sending, by the browser to the server, the transaction request such that the transaction request further comprises the access credential, to enable the server to perform the transaction in response to the server verifying the access credential in the transaction request.

17. The method of claim 16, wherein prior to said sending the request for the authentication protocol message, the method further comprises:

receiving, by the wallet from an identity provider, the certified assertion; and

storing, by the wallet, the received certified assertion.

18. The method of claim 17, wherein the identity provider is a bank.

19. A computer system comprising a processor and a computer readable memory unit coupled to the processor, said memory unit containing instructions that when executed by the processor performs the method of claim 1, wherein the computer system comprises the client.

20. A computer program product, comprising a computer usable storage medium having a computer readable program code embodied therein, said computer readable program code containing instructions that when executed by a processor of a computer system performs the method of claim 1, wherein the computer system comprises the client.