Modular Secure Data Transfer

• US 20110072258A1
• Filed: 09/24/2009
• Published: 03/24/2011
• Est. Priority Date: 09/24/2009
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP AG (SAP SE)
• Inventors: Heidasch, Robert
• Granted Patent: US 8,997,207 B2
• Time in Patent Office: Days
• US Class Current: 713/150
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061

Abstract

A method and system that modularizes a message by separating the message definition data from the message data. The message definition data and message data are transmitted over a secure channel to a target computing device. The message definition data and message data are recombined to form the original message at the target computer using a process corresponding to the modularization process. A key is used to track the associated definitions and message data and determine the corresponding combination process. Separate transmission of the data definitions and message data provides an added level of security. If message data is intercepted and decrypted by a third party, then the data is not easily utilized, because the definition data is absent. Similarly, interception of the message definition is not useful without the message data.

Claims

1. A method comprising:

receiving a message;

separating definition data and non-definition data within the message;

encrypting the definition data and non-definition data separately; and

transmitting the definition data and non-definition data to a target computing device separately.

2. The method of claim 1, further comprising:

transmitting a message key with the non-definition data to identify the definition data.

3. The method of claim 1, further comprising:

establishing a secure communication channel between a transmitting computing device and a target computing device using any one of symmetric encryption, asymmetric encryption or hybrid encryption.

4. The method of claim 2, wherein the message key is unique to a message definition and valid for a communication session.

5. A method comprising:

receiving a message definition and message data and a key over a secure communication channel;

decrypting the message definition, message data and key at the target computing device; and

combining the message definition and message data to recreate a message.

6. The method of claim 5, further comprising:

identifying a match between the message definition and message data using the key.

7. The method of claim 5, wherein the key is unique to a message definition and a session.

8. The method of claim 5, further comprising:

storing the message definition in a message definition store on the target computing device.

9. The method of claim 8, further comprising:

receiving a second message data with the key; and

combining the second message data with the message definition.

10. An apparatus comprising:

a first modular transfer module to process a message to generate a first message definition and first message data;

a message key component coupled to the first module transfer module; and

a communication module to securely transmit the first message definition and first message data separately.

11. The apparatus of claim 10, further comprising:

an encryption module to encrypt the first message definition and the first message data.

12. The apparatus of claim 10, further comprising:

a second modular transfer module to process a second message to generate a second message definition and second message data, the first and second message definition corresponding to separate formats.

13. An apparatus comprising:

a message creator to combine a first message definition with a first message data to generate a first massage;

a communication module to receive the first message definition and the first message data over a secure communication channel; and

a decryption module to decrypt the first message definition and the first message data.

14. The apparatus of claim 13, further comprising:

a message definition store to store the first message definition and to match a message key with the first message definition.

15. The apparatus of claim 13, further comprising:

a message key matching component to match the first message definition and the first message data using a message key.

16. A computer-readable medium having instructions stored herein, which when executed cause a computer to perform a set instructions comprising:

receiving a first message;

separating a first message definition and a first message data for the first message;

encrypting the first message definition and the first message data by a transmitting computing device; and

transmitting the first message definition and the first message data to a target computing device separately.

17. The computer-readable medium of claim 16, having further instructions stored therein, which when executed cause a computer to perform a further set of instructions comprising:

generating a key to identify the first message definition.

18. The computer-readable medium of claim 16, having further instructions stored herein, which when executed cause a computer to perform a further set of instructions:

establishing a secure communication channel between the transmitting computer and the target computer using any one of symmetric encryption, asymmetric encryption or hybrid encryption.

19. A computer-readable medium having instructions stored therein, which when executed cause a computer to perform a set of instructions comprising:

receiving a first message definition and a first message data over a secure communication channel;

identifying a match between the first message data and the first message definition;

combining the first message data and the first message definition to form a message.

20. The computer-readable medium of claim 19, having further instructions stored therein, which when executed cause a computer to perform a further set of instructions comprising:

searching a message definition store for a matching message definition for the first message data.

21. The computer-readable medium of claim 20, wherein the searching is a look up using a key received with the first message data.

22. The computer-readable medium of claim 19, having further instructions stored therein, which when executed cause a computer to perform a further set of instructions comprising:

storing the first message definition in a message definition store to be combined with a second message data that is subsequently received.