SYSTEM AND METHODS FOR PROVIDING STATELESS SECURITY MANAGEMENT FOR WEB APPLICATIONS USING NON-HTTP COMMUNICATIONS PROTOCOLS

• US 20100306547A1
• Filed: 05/27/2010
• Published: 12/02/2010
• Est. Priority Date: 05/28/2009
• Status: Active Grant

• Current Assignee: Kaazing Corp.
• Original Assignee: Kaazing Corp.
• Inventors: Salim, Frank J., Fallows, John R.
• Granted Patent: US 8,527,774 B2
• Time in Patent Office: Days
• US Class Current: 713/178
• CPC Class Codes: G06F 21/305 by remotely controlling device operation
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/162 involving adaptations of sockets based mechanisms secure socket layer H04L63/168
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps

Abstract

A gateway server interoperates with client and remote server systems to provide stateless security management for a distributed Web application. A Web client application on the client system initiates a WebSocket connection directed to a remote Web service by performing an authentication challenge directed to a user of the Web-browser client where a secure token is not present in a local store instance corresponding to the client application. The authentication challenge obtains the user credentials and then exchanges the user credentials with the gateway server for a secure token. The secure token is then sent in a protocol specific connect message to the gateway server. The gateway server, in response to receipt of the connect message, initiates a WebSocket connection directed to the remote Web service by inspecting the connect message to recover the secure token, evaluating the secure token to obtain user credentials, injecting the secure token with the user credentials, and sending the connect message to the remote Web service.

Claims

1. A computer implemented method providing stateless security management for web applications using non-HTTP communications protocols, said method comprising the steps of:

a) first initiating, from a client application executed within a Web-browser client on a client system, a WebSocket connection directed to a remote Web service, wherein said connection is identified by a communications protocol identifier, said step of first initiating including the steps of;

i) performing an authentication challenge directed to a user of said Web-browser client where a secure token is not present in a local store instance corresponding to said client application, wherein said secure token corresponds to said communications protocol identifier, said authentication challenge obtaining first user credentials, sending said first user credentials to a gateway server, receiving said secure token from said gateway server, and storing said secure token in said local store instance;

ii) obtaining said secure token from said local store instance; and

iii) sending a first connect message to said gateway server, wherein said connect message is protocol specific to said communications protocol identifier and wherein said first connect message includes said secure token; and

b) second initiating, from said gateway server, a WebSocket connection directed to said remote Web service in response to receipt said first connect message, said step of second initiating including the steps of;

i) inspecting said first connect message to identify said secure token;

ii) evaluating said secure token to obtain second user credentials;

iii) injecting, in replacement of said secure token, said second user credentials into a second connect message corresponding to said first connect message; and

iv) sending said second connect message to said remote Web service.

2. The computer implemented method of claim 1 wherein said communications protocol identifier corresponds to a non-HTTP protocol hosted on said WebSocket connection.

3. The computer implemented method of claim 2 wherein said secure token includes an encrypted copy of said first user credentials.

4. The computer implemented method of claim 3 wherein said second user credentials are said first user credentials obtained by decryption of said secure token.

5. The computer implemented method of claim 2 wherein said secure token includes a timestamp, wherein said timestamp is determinative of whether said secure token is invalid, and wherein said step of performing determines said secure token to be not present in a local store instance where said secure token is invalid.

6. The computer implemented method of claim 5 wherein said step of determining includes the steps of:

i) monitoring said secure token, as stored in said local store instance, for an expiration of said timestamp; and

ii) sending said secure token to said gateway server for updating of said timestamp;

iii) storing said secure token, as updated by said gateway server, to said local store instance.

7. The computer implemented method of claim 6 further comprising the step of generating, by said gateway server, said secure token by private key encryption of said first user credentials to produce a sealed object and public key encryption of said sealed object and said timestamp.

8. The computer implemented method of claim 7 wherein said second user credentials are said first user credentials obtained by decryption of said secure token.

9. The computer implemented method of claim 8 wherein said secure token corresponds to a plurality of communications protocol identifiers.

10. A gateway server providing stateless secure authorization for distributed web applications executed cooperatively by client and remote server systems, said gateway server comprising:

a) a computer server system coupleable through a communications network with a client system and a remote server, wherein said client system is configured to execute a client application in a Web-browser client on a client system and wherein said remote server is configured to execute a Web service; and

b) a Web server, executed by said computer server system, said Web server including an authorization control processor, a packet inspection processor, and a credential injection processor,

wherein said authorization control processor is operative to generate a secure token upon receipt and validation of first user credentials provided by said client application, wherein said authorization control processor interoperates with said client application to store said secure token in a local store instance on said client system in a scope associated with said client application,

wherein said packet inspection processor, responsive to a connect message, embedding said secure token, provided by said client application, is operative to detect said connect message and provide said secure token to said authorization control processor,

wherein said authorization control processor is operative to recover second user credentials corresponding to said secure token,

wherein said credential injection processor, responsive to said authorization control processor, is operative to inject said second user credentials into said connect message, and

wherein said Web server is operative to transmit said connect message to said remote server.

11. The gateway server of claim 10 wherein said authorization control processor is operative to encrypt said first user credentials in generating said secure token and wherein said second user credentials are said first user credentials.

12. The gateway server of claim 10 wherein said authorization control processor is operative to encrypt said first user credentials in generating said secure token and wherein said second user credentials are recovered by said authorization control processor based on a predetermined correspondence with said first user credentials.

13. The gateway server of claim 10 wherein said authorization control processor is operative to encrypt said first user credentials to provide a session cookie in conjunction with generation of said secure token and wherein said authorization control processor is further operative to store said session cookie through said Web-browser client on said client system, said secure token including a session cookie identifier establishing a predetermined correspondence between said session cookie and said secure token, and wherein said second user credentials are recovered by said authorization control processor based on said predetermined correspondence.

14. The gateway server of claim 10 wherein said Web server is operative to return a connect acknowledgment message, provided from said Web service, to said client application, wherein said Web server further includes a token injection processor responsive to said authorization control processor, and wherein said authorization control processor is further operative to inject a copy of said secure token into said connect acknowledgment message prior to return to said client application, wherein said client application provides for the storage of said copy of said secure token in said local store instance on said client system in said scope associated with said client application.

15. The gateway server of claim 14 wherein said authorization control processor is further operative to include a timestamp, representing a limited period of validity, in said copy of said secure token and wherein said authorization control processor accepts said connect message conditionally based on said timestamp.

16. The gateway server of claim 15 wherein said authorization control processor is further operative to provide a first marker value in said secure token and a second marker value in said copy of said secure token, said first and second marker values identifying whether said secure token includes said timestamp, said copy o said secure token being provided by said client application in preference to said secure token in said connect message.