APPARATUS AND SYSTEM FOR ASYMMETRIC SECURITY

• US 20080285752A1
• Filed: 07/02/2008
• Published: 11/20/2008
• Est. Priority Date: 09/23/2004
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Zhang, Kai Mike, Khangaonkar, Manoj, Ahuja, Pratima
• Granted Patent: US 8,392,700 B2
• Time in Patent Office: Days
• US Class Current: 380/255
• CPC Class Codes: G06Q 20/027 involving a payment switch or gateway
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

An apparatus and system are disclosed for asymmetric security in data communications between two or more nodes. Asymmetric security within data communications refers to sending and receiving messages at different security levels. The apparatus includes a receiving module, a transmission module, and a communication module. The receiving module receives a first message at a first security level from a first node. A security level may be defined by implementation of one or more security features, including encryption, digital signatures, and/or other security features. The transmission module transmits a second message at a second security level to the first node in response to receiving the first message. The first and second messages may be communicated during a single communication session. The communication module communicates the second security level to the first node. The communication may be directly between two nodes or may occur via a broker or other intermediate node.

Claims

1. An apparatus to facilitate asymmetric security, the apparatus comprising:

a receiving module configured to receive a first message at a first security level from a first node;

a transmission module configured to transmit a second message at a second security level to the first node in response to receiving the first message; and

a communication module configured to communicate the second security level to the first node.

2. The apparatus of claim 1, wherein the communication module is further configured to communicate the second security level to the first node by a security level indicator coupled to the second message.

3. The apparatus of claim 1, wherein the communication module is further configured to communicate the second security level to the first node during a handshaking operation between the first node and a second node.

4. The apparatus of claim 1, further comprising a detection module configured to detect the first security level of the first message.

5. The apparatus of claim 1, further comprising a processing module configured to process the first message.

6. The apparatus of claim 1, further comprising a security module configured to apply a security feature to the second message according to the second security level.

7. The apparatus of claim 6, further comprising an encryption module to encrypt the second message.

8. The apparatus of claim 6, further comprising a signature module configured to digitally sign the second message.

9. The apparatus of claim 1, further comprising a definition module configured to define a security level definition descriptive of the first security level and the second security level.

10. The apparatus of claim 9, wherein the definition module is further configured to dynamically update the security level definition during a current communication session.

11. A system to facilitate asymmetric security, the system comprising:

a first node configured to transmit a first message at a first security level, the first security level descriptive of a first encryption level and a first digital signature level; and

a second node configured to receive the first message from the first node and to transmit a second message at a second security level to the first node in response to receiving the first message, the second security level descriptive of a second encryption level and a second digital signature level.

12. The system of claim 11, further comprising an intermediate node coupled between the first node and the second node, the intermediate node configured to receive the first message from the first node and transmit the first message to the second node, the intermediate node further configured to receive the second message from the second node and transmit the second message to the first node.

13. A signal bearing medium tangibly embodying a program of machine-readable instructions executable by a digital processing apparatus to perform operations to facilitate asymmetric security, the operations comprising:

receiving a first message at a first security level from a first node;

transmitting a second message at a second security level to the first node in response to receiving the first message; and

communicating the second security level to the first node.

14. The signal bearing medium of claim 13, wherein the instructions further comprise an operation to couple a security level indicator to the second message and communicate the security level indicator to the first node.

15. The signal bearing medium of claim 13, wherein the instructions further comprise an operation to communicate the second security level to the first node during a handshaking operation between the first node and a second node.

16. The signal bearing medium of claim 13, wherein the instructions further comprise an operation to detect the first security level of the first message.

17. The signal bearing medium of claim 13, wherein the instructions further comprise an operation to dynamically update the security level definition during a current communication session.

18. The signal bearing medium of claim 17, wherein the instructions further comprise an operation to communicate the updated security level definition to the first node during the current communication session.

19. The signal bearing medium of claim 13, wherein the instructions further comprise an operation to communicate the second message in a synchronous communication environment.

20. The signal bearing medium of claim 13, wherein the instructions further comprise an operation to communicate the second message in an asynchronous communication environment.