SECURE AUTHENTICATION FOR AUTHORIZATION FOR TRANSACTION PROCESSING

• US 20090138722A1
• Filed: 01/29/2009
• Published: 05/28/2009
• Est. Priority Date: 06/30/2000
• Status: Active Grant

• Current Assignee: Palmsource Incorporated (Access Company Limited)
• Original Assignee: Palmsource Incorporated (Access Company Limited)
• Inventors: Lennie, Robert, Dalbec, Gabe, Chen, Carl
• Granted Patent: US 8,095,965 B2
• Time in Patent Office: Days
• US Class Current: 713/181
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: Y10S 707/99931 Database or file accessing

Abstract

A method and apparatus for authenticating and authorizing online transactions. An authentication cookie is transmitted to a client system. The authentication cookie includes a user encryption key and an encrypted buffer that contains user identification data and a profile code. Subsequent requests for the particular service use the authentication cookie to generate a query that includes the encrypted buffer and user identification data entered by the user. Portions of the query are encrypted using the user encryption key. Queries received at each authentication and authorization server are authenticated by reconstructing the user encryption key using information transmitted in the clear and decrypting the query using both the reconstructed user encryption key and the secret key. The user identification data entered by the user is then compared with the user identification data in the encrypted buffer for further authentication. The profile code is analyzed for determining authorization. If the query is authenticated and authorized, the authentication and authorization server forwards the request to a server that provides the desired service.

Claims

1. A method of processing a query sent from a client system comprising the steps of:

accessing said query comprising user identification data, said query further comprising an unencrypted portion comprising unencrypted data and an encrypted portion comprising an encrypted buffer encrypted using a first encryption key, said encrypted buffer also encrypted using a second encryption key;

obtaining said second encryption key;

decrypting at least a portion of said encrypted portion using said second encryption key;

decrypting said encrypted buffer using said first encryption key;

determining authentication by comparing said user identification data to user identification data contained within said encrypted buffer;

determining authorization to use a service requested in said query based on information indicating services accessible by said user contained within said encrypted buffer if said user identification data matches user identification data contained within said encrypted buffer; and

generating and transmitting to said client system an error message if said user identification data does not match said user identification data contained within said encrypted buffer.

2. The method according to claim 1, wherein said obtaining said second encryption key step comprises determining said second encryption key using at least a portion of said unencrypted data of said query.

3. The method according claim 1, wherein said query further comprises:

a request buffer encrypted using said second encryption key and wherein said request buffer is decrypted during decrypting at least a portion of said encrypted portion step; and

further comprising transmitting said unencrypted request buffer to a site providing service related to said query provided said query is determined to be authentic and authorized.

4. The method according to claim 3, further comprising the steps of:

receiving a response from said site; and

forwarding said response.

5. The method according to claim 4, wherein said forwarding step further comprises the steps of:

encrypting said response; and

forwarding said response.

6. The method according to claim 2, wherein said second encryption key is determined using a hash of at least three elements.

7. The method according to claim 6, wherein said second encryption key is determined by a MD-5 hash of said user identification data, a randomly generated number and a third encryption key.

8. The method according to claim 6, wherein said second encryption key is determined by a MD-5 hash of said user identification data, a randomly generated number and said first encryption key.

9. A method of processing transactions in a single transmission between a client system and a transactional service comprising the steps of:

transmitting a request for a service by a client system;

receiving said request by a first server, wherein said first server analyzes whether the request is authorized and authentic;

generating a response comprising said authorized and authentic requests;

forwarding said response to a transactional service wherein a requested service is generated;

transmitting said requested service to client system.

10. The method according to claim 9, further comprising the step of:

registering a user for access to said transactional service and storing registration data related to said user in a database.

11. The method according to claim 10, wherein said registering step comprises:

updating said database with new access to said transactional service if said registration data exists in said database.

12. The method according to claim 10, wherein said registering step is performed by a second server, wherein second server resides on hardware different from said first server.

13. The method according to claim 9, wherein said transactional service resides on the same hardware as said server.

14. The method according to claim 9, wherein said analyzing request further comprises the steps of:

determining authentication by comparing a user identification data to a user identification data contained within an encrypted buffer; and

determining authorization to use said service requested based on an information indicating services accessible by said user contained within said encrypted buffer if said user identification data matches user identification data contained within said encrypted buffer.

15. The method according to claim 9, wherein said transmitting requested service step comprises the steps of:

sending said requested service to said first server by said transactional service; and

forwarding said requested service to said client system by said first server.