SECURE DATA EXCHANGE BETWEEN DATA PROCESSING SYSTEMS

• US 20110145590A1
• Filed: 02/18/2011
• Published: 06/16/2011
• Est. Priority Date: 06/01/1999
• Status: Active Grant

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: AOL Inc. (Apollo Global Management, Inc.)
• Inventors: HARADA, Larry T., Hendren, C. Hudson III, Purdum, Christopher S., Dolecki, Mark A.
• Granted Patent: US 8,713,690 B2
• Time in Patent Office: Days
• US Class Current: 713/185
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/561 Adding application-functional data or data for application control, e.g. adding metadata
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching

Abstract

A data transfer method performed at a proxy server includes intercepting a data request from a client computer that is directed to a target server, encrypting profile information, augmenting the data request by adding the encrypted profile information to the data request, and sending the augmented data request to the target server. A data transfer method that is performed at an information server includes receiving a data request from a proxy server, extracting profile information added to the data request by the proxy server, using the extracted profile information to generate a response, and sending the response to the proxy server.

Claims

1-32. -32. (canceled)

33. A method for communication, comprising:

retrieving an identifier based on an identity of a user of a client application;

including the retrieved identifier in a request from the client application to a server; and

sending the request to the server such that the server;

extracts the retrieved identifier from the request,

accesses a storage associated with the server in which user profile information for the user was stored prior to the server receiving the request,

retrieves the user profile information from the storage associated with the server based on the extracted identifier,

generates a response to the request based on the retrieved user profile information, and

sends the response to the client application.

34. The method of claim 33, wherein the request is a second request that is subsequent to a first request, and wherein the method further comprises:

encrypting the user profile information;

appending the encrypted profile information to the first request;

sending the first request to the server such that the server parses the first request to extract the encrypted user profile information, decrypts the encrypted user profile information extracted from the first request, stores the decrypted user profile information in the storage associated with the server, generates a response to the first request based on the decrypted user profile information, generates the identifier, and sends the response and the identifier to the client application.

35. The method of claim 34, wherein encrypting the user profile information comprises determining a session key and using the session key to encrypt the user profile information.

36. The method of claim 35, further comprising:

encrypting the session key; and

appending the encrypted session key to the first request.

37. The method of claim 36, wherein:

using the session key to encrypt the user profile information comprises using the session key and a symmetric encryption algorithm to encrypt the user profile information, and

encrypting the session key comprises encrypting the session key using a public key encryption algorithm and a public key associated with the server.

38. The method of claim 34 wherein determining the identity of the user comprises:

determining an IP address associated with a client computer of the user; and

querying a database to determine an identity associated with the IP address.

39. A communication method performed by a server, the method comprising:

receiving, from a client device, a request including an identifier associated with a user of the client device;

extracting the identifier from the request;

accessing a storage device associated with the server, wherein profile information for the user was stored in the storage device prior to the server receiving the request from the client device;

retrieving the user profile information from the storage device associated with the server based on the extracted identifier;

generating a response to the request based on the retrieved user profile information; and

sending, from the server, the response to the client device.

40. The method of claim 39, wherein the request is a second request that is subsequent to a first request, and wherein the method further comprises:

receiving, from the client device, the first request including encrypted user profile information;

extracting the encrypted user profile information from the first request;

decrypting the encrypted user profile information;

storing the decrypted user profile information in the storage device associated with the server;

generating the identifier; and

sending, to the client device, the identifier with a response to the first request.

41. The method of claim 40, wherein

the first request includes a session key, and

decrypting the encrypted user profile information comprises decrypting the encrypted user profile information using the session key.

42. The method of claim 41, further comprising decrypting the session key.

43. The method of claim 42, wherein:

decrypting the session key comprises decrypting the session key using a public key algorithm and a private key of the server, and

decrypting the encrypted user profile information using the session key comprises decrypting the encrypted user profile information using a symmetric decryption algorithm and the session key.

44. The method of claim 39, further comprising:

receiving a flush directive; and

in response to receiving the flush directive, discarding the user profile information stored in the storage device.

45. A computer-readable storage medium storing a computer program, the computer program comprising instructions, which when executed by at least one processor, perform a method comprising:

retrieving an identifier based on an identity of a user of a client;

including the retrieved identifier in a request from the client to a server; and

sending the request to the server such that the server extracts the retrieved identifier, accesses a storage device associated with the server in which user profile information for the user was stored prior to the server receiving the request, retrieves the user profile information from the storage device associated with the server based on the extracted identifier, generates a response to the request based on the retrieved user profile information, and sends the response to the client.

46. The computer-readable storage medium of claim 45, further comprising instructions for causing the at least one processor to:

encrypt the user profile information;

append the encrypted profile information to a first request;

send the first request to the server such that the server parses the first request to extract the encrypted user profile information, decrypts the encrypted user profile information extracted from the first request, stores the decrypted user profile information in the storage device associated with the server, generates the response to the first request based on the decrypted user profile information, generates the identifier, and sends the response and the identifier to the client.

47. The computer-readable storage medium of claim 46 wherein, to encrypt the user profile information, the instructions further comprise instructions for causing the at least one processor to determine a session key and use the session key to encrypt the user profile information.

48. The computer-readable storage medium of claim 47, further comprising instructions for causing the at least one processor to:

encrypt the session key; and

append the encrypted session key to the initial request to create the modified initial request.

49. The computer-readable storage medium of claim 48, wherein:

to use the session key to encrypt the profile information, the instructions further comprise instructions for causing the at least one processor to use the session key and a symmetric encryption algorithm to encrypt the user profile information, and

to encrypt the session key, the instructions further comprises instructions for causing the at least one processor to encrypt the session key using a public key encryption algorithm and a public key associated with the server.

50. The computer-readable storage medium of claim 45, further comprising instructions for causing the at least one processor to send a flush directive to the server such that the server discards the user profile information stored in the storage device associated with the server.