METHODS AND APPARATUSES FOR SECURE COMMUNICATION

• US 20130227291A1
• Filed: 02/26/2012
• Published: 08/29/2013
• Est. Priority Date: 02/26/2012
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Boyer, John Jules Alexander, Ahmed, Ali K., Montagna, Kenneth, Shephard, Timothy Michael
• Granted Patent: US 9,722,972 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

A method of establishing a secure communications path between a first local server on a local network and a device on a wide area network comprising: establishing a first secure communications connection between a second local server on the local network and the device; establishing a second secure communications connection between the second local server and the first local server, wherein the second local server impersonates the device for at least a portion of the connection request; and proxying data between the local server and the device

Claims

1. A method of establishing a secure communications path between a first local server on a local network and a device on a wide area network comprising:

establishing a first secure communications connection between a second local server on the local network and the device;

establishing a second secure communications connection between the second local server and the first local server, wherein the second local server impersonates the device for at least a portion of the connection request; and

proxying data between the first local server and the device.

2. The method of claim 1, wherein the device limits access to the first secure communications connection to select applications.

3. The method of claim 1, wherein the second local server limits access to the first secure communications connection to select applications.

4. The method of claim 1, wherein the second secure communications connection is established using a strong network authentication protocol.

5. The method of claim 4, wherein the strong network authentication protocol is Kerberos.

6. The method of claim 4, wherein the second local server impersonates the device by receiving a session key from the device over the first secure communications connection and uses the session key to authenticate on behalf of the device.

7. The method of claim 6, wherein the session key is decrypted by the device using a decryption key known only to the device.

8. The method of claim 6, wherein the session key is decrypted by the second local server using an intermediate key that is decrypted by the device using a decryption key known only to the device.

9. The method of claim 6, wherein the session key is established using a key exchange protocol.

10. The method of claim 6, wherein the session key is used to authenticate on behalf of the user by decrypting a Kerberos ticket.

11. The method of claim 1, wherein the first local server and the second local server are separated by a LAN firewall and the second local server is located in a DMZ zone of the local network.

12. The method of claim 1, wherein the first local server has limited or no access to communicate with the wide area network.

13. The method of claim 1, wherein the second local server impersonates the device to an authentication server on the local network during the establishing a second secure connection step.

14. The method of claim 1, wherein the first secure communications connection is established after the second local server intercepts a communications request from the device to the first local server.

15. The method of claim 14, wherein the second local server redirects the communications request back to the device with instructions to establish the first secure communications connection.

16. The method of claim 1, wherein the first secure communications connection is established when an authorized applications starts.

17. The method of claim 1, wherein the second local server intercepts a communications request from the device to the first local server and redirects the communications request back to the device with instructions to resubmit the communications request with additional security information.

18. The method of claim 17, wherein the additional security information includes a session key.

19. The method of claim 1, wherein the device is a cell phone or a tablet.

20. A method of establishing a secure communications path between a first local server on a local network and a device on a wide area network comprising:

establishing a first secure communications connection between a second local server on the local network and the device;

establishing a second secure communications connection using a strong network authentication protocol between the first local server and a second local server wherein the second local server establishes the second secure communications connection on behalf of the device by receiving a session key of the strong communications protocol from the device over the first secure communications connection and impersonates the device for at least a portion of the connection initiation; and

proxying data between the first local server and the device via the second local server.

21. The method of claim 20, wherein the device limits access to the first secure communications connection to select applications.

22. The method of claim 20, wherein the second local server limits access to the first secure communications connection to select applications.

23. The method of claim 20, wherein the strong network authentication protocol is Kerberos.

24. The method of claim 20, wherein the first local server and the second local server are separated by a LAN firewall and the second local server is located in a DMZ zone of the local network.

25. The method of claim 20, wherein the first local server has limited or no access to communicate with the wide area network.

26. The method of claim 20, wherein the second local server impersonates the device to an authentication server on the local network during the establishing a second secure communications connection step.

27. The method of claim 20, wherein the device is a cell phone or a tablet.

28. A system for establishing a secure communications path between a local server on a local network and a device on a wide area network comprising:

a firewall separating the local network from the wide area network;

a server located on the local network and in communication with both the wide area network and local network, wherein the server is configured to;

form a first secure communications connection with the device;

form a second secure communications connection with the local server by impersonating the device for at least a portion of the connection request; and

proxy data between the local server and the device.

29. The system of claim 28, further comprising an application running on the device that limits access to the first secure communications connection to select applications.

30. The system of claim 28, wherein the server impersonates the device by receiving a session key from the device over the first secure communications connection and uses the session key to establish the second secure communications connection.

31. The system of claim 28, further comprising a second firewall separating the server and the local server.

32. The system of claim 28, further comprising an authentication server on the local network, which authenticates connections to the local server.

33. The system of claim 28, wherein the second secure communications connection is established using a strong network authentication protocol.

34. The system of claim 33, wherein the strong network authentication protocol is Kerberos.

35. The system of claim 32, wherein the server impersonates the device to the authentication server by receiving a session key from the device over the first secure communications connection.

36. The system of claim 31, wherein the server is located in a DMZ zone of the local network.

37. The system of claim 32, wherein the local server and the authentication server have limited or no access to communicate with the wide area network.

38. The system of claim 32, wherein the server impersonates the device to the authentication server.

39. The system of claim 28, wherein the device is a cell phone or a tablet.

40. A method of establishing a secure communications path between a device on a wide area network and a server on a local network comprising the steps of:

establishing a communications connection between the device and the server, wherein the connection is established by an application running on the device that limits access to the secure communications connection to select applications.

41. The method of claim 40, wherein the connection is established after the server intercepts a request from the select application on the device to a local server on the local network.

42. The method of claim 40, wherein the connection is established after the application running on the device that limits access to the secure communications connection intercepts a communications request from the select application on the device to a local server on the local network.

43. The method of claim 40, wherein the connection is established when the application running on the device that limits access to the communications connection starts.

44. The method of claim 40, wherein the communications connection is established when one of the select applications starts.

45. The method of claim 40, wherein the server redirects communications requests from the select applications that occur outside the secure communications connection back to the application running on the device that limits access to the secure communications connection to select applications.

46. The method of claim 45, wherein the redirected communications requests are resubmitted inside the secure communications connection.

47. The method of claim 46, wherein the communications requests are resubmitted with additional security information.

48. The method of claim 47 wherein the additional security information includes a session key.

49. The method of claim 45, wherein the redirected communications requests are resubmitted outside the secure communications connection with additional security information.

50. The method of claim 49, wherein the additional security information includes a session key.