CRYPTOGRAPHIC WEB SERVICE

• US 20080178010A1
• Filed: 01/15/2008
• Published: 07/24/2008
• Est. Priority Date: 01/18/2007
• Status: Abandoned Application

• Current Assignee: entIT Software LLC (Open Text Corporation)
• Original Assignee: entIT Software LLC (Open Text Corporation)
• Inventors: Appenzeller, Guido, Pauker, Matthew J., Vaterlaus, Robert K.
• Application Number:
  US12/014,681
• Publication Number:
  US 20080178010A1
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0485 Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services

Abstract

A system that supports cryptographic web services is provided. A program running on program computing equipment may call a local cryptographic function. A web services interface such as a simple object access protocol interface on the program computing equipment makes a corresponding remote cryptographic function call to a web services interface such as a simple object access protocol interface at a cryptographic web service over a communications network such as the internet. At the cryptographic web service, a cryptographic engine implements cryptographic operations such as encryption and decryption operations. After successful authentication of the calling program, the cryptographic engine produces results for the remotely cryptographic function and returns the results to the program over the communications network.

Claims

1. A method in which a program uses a cryptographic web service remotely over a communications network, comprising:

at program computing equipment on which the program is implemented, calling a local cryptographic function from the program; and

in response to calling the local cryptographic function, calling a remote cryptographic function at the cryptographic web service that corresponds to the called local cryptographic function by sending information from a web services interface at the program computing equipment to a web services interface at the cryptographic web service over the communications network;

at the cryptographic web service, requesting a key from a key server over the communications network;

at the cryptographic web service, receiving the requested key from the key server over the communications network; and

at the cryptographic web service, producing results for the called remote cryptographic function using a cryptographic engine, wherein the results are produced by the cryptographic engine using the key from the key server.

2. The method defined in claim 1 further comprising:

providing parameters for the local cryptographic function from the program.

3. The method defined in claim 1 wherein the web services interface at the program computing equipment comprises a simple object access protocol interface, the method further comprising:

providing parameters for the local cryptographic function from the program; and

encoding the parameters with the simple object access protocol interface on the program computing equipment.

4. The method defined in claim 1 wherein the web services interface at the program computing equipment comprises a simple object access protocol interface and wherein the web services interface at the cryptographic web service comprises a simple object access protocol interface, the method further comprising:

providing parameters for the local cryptographic function from the program;

encoding the parameters with the simple object access protocol interface on the program computing equipment;

receiving the encoded parameters with the simple object access protocol interface at the cryptographic web service; and

decoding the encoded parameters with the simple object access protocol interface at the cryptographic web service.

5. The method defined in claim 1 wherein the web services interface at the program computing equipment comprises a simple object access protocol interface and wherein the web services interface at the cryptographic web service comprises a simple object access protocol interface, the method further comprising:

providing parameters for the local cryptographic function from the program;

encoding the parameters with the simple object access protocol interface on the program computing equipment;

receiving the encoded parameters with the simple object access protocol interface at the cryptographic web service;

decoding the encoded parameters with the simple object access protocol interface at the cryptographic web service; and

at the cryptographic web service calling the remote cryptographic function with the decoded parameters.

6. The method defined in claim 1 wherein the web services interface at the program computing equipment comprises a simple object access protocol interface and wherein the web services interface at the cryptographic web service comprises a simple object access protocol interface, the method further comprising:

providing parameters for the local cryptographic function from the program;

encoding the parameters with the simple object access protocol interface on the program computing equipment;

receiving the encoded parameters with the simple object access protocol interface at the cryptographic web service;

decoding the encoded parameters with the simple object access protocol interface at the cryptographic web service;

at the cryptographic web service calling the remote cryptographic function with the decoded parameters; and

in response to calling the remote cryptographic function with the decoded parameters at the cryptographic web service, performing cryptographic operations with a cryptographic engine at the cryptographic web service using the decoded parameters.

7. The method defined in claim 1 wherein the web services interface at the program computing equipment comprises a simple object access protocol interface and wherein the web services interface at the cryptographic web service comprises a simple object access protocol interface, the method further comprising:

providing parameters for the local cryptographic function from the program;

encoding the parameters with the simple object access protocol interface on the program computing equipment;

transmitting the encoded parameters to the simple object access protocol interface at the cryptographic web service from the simple object access protocol interface at the program computing equipment over the communications network in accordance with an address of the cryptographic web service and a function definition for the remote cryptographic function that are supplied in a web services description language file;

receiving the encoded parameters with the simple object access protocol interface at the cryptographic web service;

decoding the encoded parameters with the simple object access protocol interface at the cryptographic web service;

at the cryptographic web service calling the remote cryptographic function with the decoded parameters; and

in response to calling the remote cryptographic function with the decoded parameters at the cryptographic web service, performing cryptographic operations with a cryptographic engine at the cryptographic web service using the decoded parameters, wherein the decoded parameters include input data for the cryptographic engine and a cryptographic key.

8. The method defined in claim 1 further comprising:

from authorization level information at the cryptographic web service, determining, for the program, a maximum allowed level of cryptographic functionality to be performed by the remote cryptographic function; and

at the cryptographic web service, performing the called remote cryptographic function from the determined maximum allowed level of cryptographic functionality.

9. The method defined in claim 1 further comprising:

from the program, requesting a desired level of cryptographic functionality to be performed by the remote cryptographic function; and

from authorization level information at the cryptographic web service, determining whether the program is authorized to have the cryptographic web service perform the remote cryptographic function with the desired level of cryptographic functionality; and

if it is determined from the authorization level information at the cryptographic web service that the program is authorized to have the cryptographic web service perform the remote cryptographic function with the desired level of cryptographic functionality, performing the remote cryptographic function with the desired level of cryptographic functionality.

10. A method in which a program uses a cryptographic web service remotely over a communications network, comprising:

at program computing equipment on which the program is implemented, calling a local cryptographic function from the program; and

calling a remote cryptographic function at the cryptographic web service by calling a local cryptographic function at the program computing equipment, wherein calling the remote cryptographic function comprises providing parameters for the local cryptographic function from the program including at least one identifier, encoding the parameters with a web services interface at the program computing equipment, receiving the encoded parameters with a web services interface at the cryptographic web service, decoding the encoded parameters with the web services interface at the cryptographic web service;

at the cryptographic web service, requesting a key from a key server over the communications network using the identifier;

at the cryptographic web service, receiving the requested key from the key server over the communications network; and

at the cryptographic web service, producing results for the called remote cryptographic function using a cryptographic engine, wherein the results are produced by the cryptographic engine using the key from the key server.

11. The method defined in claim 10 wherein the web services interface at the program computing equipment comprises a simple object access protocol interface, wherein the web services interface at the cryptographic web service comprises a simple object access protocol interface, and wherein the remote cryptographic function comprises a decryption function, the method further comprising:

at the cryptographic web service, decrypting one of the parameters from the program computing equipment using the decryption function and the key; and

conveying results from the decryption function to the program over the communications network using the simple object access protocol interfaces at the cryptographic web service and the program computing equipment.

12. The method defined in claim 10 wherein the web services interface at the program computing equipment comprises a simple object access protocol interface, wherein the web services interface at the cryptographic web service comprises a simple object access protocol interface, and wherein the remote cryptographic function comprises an identity-based-encryption decryption function, the method further comprising:

at the cryptographic web service, decrypting one of the parameters from the program computing equipment using the identity-based-encryption decryption function and the key; and

conveying results from the identity-based-encryption decryption function to the program over the communications network using the simple object access protocol interfaces at the cryptographic web service and the program computing equipment.

13. The method defined in claim 10 wherein the web services interface at the program computing equipment comprises a simple object access protocol interface, wherein the web services interface at the cryptographic web service comprises a simple object access protocol interface, and wherein the remote cryptographic function comprises a public-key-cryptography decryption function, the method further comprising:

at the cryptographic web service, decrypting one of the parameters from the program computing equipment using the public-key-cryptography decryption function and the key; and

conveying results from the public-key-cryptography decryption function to the program over the communications network using the simple object access protocol interfaces at the cryptographic web service and the program computing equipment.

14. The method defined in claim 10 wherein the web services interface at the program computing equipment comprises a simple object access protocol interface, wherein the web services interface at the cryptographic web service comprises a simple object access protocol interface, and wherein the remote cryptographic function comprises a symmetric-key cryptographic decryption function, the method further comprising:

at the cryptographic web service, decrypting one of the parameters from the program computing equipment using the symmetric-key cryptographic decryption function and the key; and

conveying results from the symmetric-key cryptographic decryption function to the program over the communications network using the simple object access protocol interfaces at the cryptographic web service and the program computing equipment.

15. The method defined in claim 10 wherein the web services interface at the program computing equipment comprises a simple object access protocol interface and wherein the web services interface at the cryptographic web service comprises a simple object access protocol interface, the method further comprising:

communicating over the communications network between the simple object access protocol interface at the program computing equipment and the simple object access protocol interface at the cryptographic web service using a transport protocol in which authentication credentials are included; and

checking the authentication credentials with the simple object access protocol interface at the cryptographic web service.

16. The method defined in claim 10 further comprising:

at the cryptographic web service, determining whether authentication external to the cryptographic web service is required for the program based on configuration information stored at the cryptographic web service.

17. The method defined in claim 10 further comprising:

at the cryptographic web service, determining whether the key has been cached before requesting the key.

18. A method in which a program uses a cryptographic web service remotely over a communications network, comprising:

calling a remote cryptographic function at the cryptographic web service by calling a local cryptographic function at the program computing equipment, wherein calling the remote cryptographic function comprises providing parameters for the local cryptographic function from the program including at least one data parameter, encoding the parameters with a web services interface at the program computing equipment, receiving the encoded parameters with a web services interface at the cryptographic web service, decoding the encoded parameters with the web services interface at the cryptographic web service;

at the cryptographic web service, analyzing the data parameter to produce analysis results; and

at the cryptographic web service, producing function results for the called remote cryptographic function based at least partly on the analysis results.

19. The method defined in claim 18 wherein producing the function results comprises using the analysis results at the cryptographic web service in determining how to perform cryptographic functions with a cryptographic engine.

20. The method defined in claim 18 wherein the producing the function results comprises selecting which encryption algorithm to use at the cryptographic web service based on whether the analysis results indicate that the data parameter included a credit card number.

21. The method defined in claim 18 further comprising:

requesting a key from a key server over the communications network from the cryptographic web service; and

at the cryptographic web service, receiving the requested key from the key server over the communications network, wherein producing the function results comprises performing a cryptographic function using the requested key.

22. The method defined in claim 18 further comprising:

requesting a key from a key server over the communications network from the cryptographic web service; and

at the cryptographic web service, receiving the requested key from the key server over the communications network, wherein producing the function results comprises performing a cryptographic function using the requested key and wherein the producing the function results comprises selecting which encryption algorithm to use at the cryptographic web service based on whether the analysis results indicate that the data parameter included a credit card number.