Secure network protocol system and method

• US 5,680,461 A
• Filed: 10/26/1995
• Issued: 10/21/1997
• Est. Priority Date: 10/26/1995
• Status: Expired due to Term

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: McManis, Charles E.
• Primary Examiner(s): CANGIALOSI, SALVATORE A
• Application Number:
  US08/547,721
• Time in Patent Office: 726 Days
• Field of Search: 380/4, 380/25, 380/30, 380/49, 395/712, 395/615, 395/326, 395/806, 395/335, 395/200.12-200.19, 395/683
• US Class Current: 713/162
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A computer network having first and second network entities. The first network entity includes a packet object generator that generates a packet object including an executable source method, an executable destination method, and data associated with each of the methods. The first network entity also includes a communications interface to transmit the packet object. The second network entity includes a communications interface to receive the packet object and an incoming packet object handler to handle the received packet object. The incoming packet object handler includes a source and destination verifier to execute the source and destination methods with their associated data so as to verify the source and destination of the received object packet.

Claims

1. A computer network comprising:

a first network entity comprising;

a packet object generator to generate a packet object that has a source and a destination and includes an executable source method, an executable destination method, and data associated with the source and destination methods; and

a communications interface to transmit the generated packet object; and

a second network entity comprising;

a communications interface to receive the transmitted packet object; and

an incoming packet object handler to handle the received packet object, the incoming packet object handler including a source and destination verifier to execute the source and destination methods of the received packet object with their associated data so as to verify the source and destination of the received packet object.

2. The network of claim 1 wherein:

the packet object generator includes a signature generator to (A) generate one or more digital signatures that each include a message digest generated by performing a corresponding predetermined function on corresponding contents of the generated packet object, (B) encrypt each message digest with a corresponding private encryption key, and (C) embed each digital signature in the generated packet object;

the incoming packet object handler further includes a signature verifier to (A) decrypt each encrypted message digest in the received packet object with a public encryption key corresponding to the corresponding private encryption key, (B) for each encrypted message digest, generate a corresponding verifying message digest by performing the corresponding predetermined function on the corresponding contents of the received packet object, and (C) compare each decrypted message digest with the corresponding verifying message digest to verify the received packet object'"'"'s contents.

3. The network of claim 2 wherein:

the one or more digital signatures of the generated packet object include a signature for methods and a signature for data;

the contents of the generated packet object corresponding to the message digest of the signature for methods contain the source and destination methods;

the contents of the generated packet object corresponding to the message digest of the signature for data contain the data associated with the source and destination methods.

4. The network of claim 1 wherein:

the generated packet object is an instance of an associated object class and includes an object header that identifies the packet object'"'"'s class as a predefined "security" class;

the incoming packet object handler further includes a packet object class screener to determine the received packet object'"'"'s class and reject the received packet object when its class is not the "security" class.

5. The network of claim 1 wherein:

the second network entity further includes a virtual machine module to execute programs written in a predefined virtual machine language regardless of the second network entity'"'"'s computer platform and operating system;

the source and destination methods are written in the predefined virtual machine language and executed by the source and destination verifier with the virtual machine module.

6. The network of claim 1 wherein:

the generated packet object further includes an executable main method and data associated with the main method;

the incoming packet object handler further includes a main method executer to execute the main method of the received packet object with its associated data to implement a desired function when the source and destination verifier verifies that the source of the received packet object is the first network entity and the destination of the received packet object is the second network entity.

7. The network of claim 6 wherein:

the second network entity further includes a virtual machine module to execute programs written in a predefined virtual machine language regardless of its computer platform and operating system;

the source and destination methods are written in the predefined virtual machine language and executed by the source and destination verifier with the virtual machine module;

the main method is written in the predefined virtual machine language and executed by the main method executer with the virtual machine module.

8. The network of claim 1 further comprising:

a third network entity;

the generated packet object further including an executable main method and data associated with the main method;

the communications interface of the second network entity re-transmitting the received packet object to the third network entity when the source and destination verifier verifies that the source of the received packet object is the first network entity and the destination of the received packet object is the third network entity;

the third network entity comprising;

a communications interface to receive the re-transmitted packet object;

an incoming packet object handler including a main method executer to execute the main method of the received packet object with its associated data to implement a desired function.

9. The network of claim 8 wherein:

the second and third network entities further include virtual machine modules to execute programs written in a predefined virtual machine language regardless of their computer platforms and operating systems;

the source and destination methods are written in the predefined virtual machine language and executed by the source and destination verifier with the virtual machine module of the second network entity;

the main method is written in the predefined virtual machine language and executed by the main method executer with the virtual machine module of the third network entity.

10. A method of communicating between network entities comprising the steps of:

with a first network entity;

generating a packet object that has a source and a destination and includes an executable source method, an executable destination method, and data associated with the source and destination methods; and

transmitting the generated packet object; and

with a second network entity;

receiving the transmitted packet object; and

handling the received packet object including executing the source and destination methods of the received packet object with their associated data so as to verify the source and destination of the received packet object.

11. The method of claim 10 wherein:

the step of generating the packet object includes (A) generating one or more digital signatures that each include a message digest generated by performing a corresponding predetermined function on corresponding contents of the generated packet object, (B) encrypting each message digest with a corresponding private encryption key, and (C) embedding each digital signature in the generated packet object;

the step of handling the received packet object further includes (A) decrypting each encrypted message digest in the received packet object with a public encryption key corresponding to the corresponding private encryption key, (B) for each decrypted message digest, generating a corresponding verifying message digest by performing the corresponding predetermined function on the corresponding contents of the received packet object, and (C) comparing each decrypted message digest with the corresponding verifying message digest to verify the received packet object'"'"'s contents.

12. The method of claim 11 wherein:

the one or more digital signatures of the generated packet object include a signature for methods and a signature for data;

the contents of the generated packet object corresponding to the message digest of the signature for methods contain the source and destination methods;

the contents of the generated packet object corresponding to the message digest of the signature for data contain the data associated with the source and destination methods.

13. The method of claim 10 wherein:

the generated packet object is an instance of an associated object class and includes an object header that identifies the packet object'"'"'s class as a predefined "security" class;

the step of handling the received packet object further includes determining the received packet object'"'"'s class and rejecting the received packet object when its class is not the "security" class.

14. The method of claim 10 wherein:

the generated packet object further includes an executable main method and data associated with the main method;

the step of executing the source and destination methods includes verifying that the source of the received packet object is the first network entity and the destination of the received packet object is the second network entity;

the step of handling the received packet object further includes executing the main method of the received packet object with its associated data to implement a desired function when the source of the received packet object is the first network entity and the destination of the received packet object is the second network entity.

15. The method of claim 10 wherein:

the generated packet object further includes an executable main method and data associated with the main method;

the step of executing the source and destination methods includes verifying that the source of the received packet object is the first network entity and the destination of the received packet object is a third network entity;

the method further comprises the steps of;

with the second network entity, re-transmitting the received packet object to the third network entity when the source of the received packet object is the first network entity and the destination of the received packet object is the third network entity;

with the third network entity;

receiving the re-transmitted packet object;

handling the received packet object including executing the main method of the received packet object with its associated data to implement a desired function.

16. A memory to store data for access by programs being executed by a specific network entity, the memory comprising:

an incoming packet object handler, stored in said memory, configured to handle a packet object received by the specific network entity from a transmitting network entity, the received packet object having a source and a destination and including an executable source method, an executable destination method, and data associated with the source and destination methods, the incoming packet object handler including a source and destination verifier to execute the source and destination methods of the received packet object with their associated data so as to verify the source and destination of the received packet object.

17. The memory of claim 16 further comprising:

a packet object generator, stored in said memory, configured to generate a packet object to be transmitted by the specific network entity to a receiving network entity, the generated packet object having a source and a destination and including an executable source method, an executable destination method, and data associated with the source and destination methods, the source and destination methods of the generated packet object being capable of being executed with their associated data by the receiving network entity for verifying the source and destination of the generated packet object.

18. The memory of claim 17 wherein:

the packet object generator includes a signature generator to (A) generate one or more digital signatures that each include a message digest generated by performing a corresponding predetermined function on corresponding contents of the generated packet object, (B) encrypt each message digest with a corresponding private encryption key, and (C) embed each digital signature in the generated packet object,

for each encrypted message digest, a corresponding verifying message digest being capable of being generated by the receiving network entity by performing the corresponding predetermined function on the corresponding contents of the transmitted packet object, each encrypted message digest of the transmitted packet object being capable of being decrypted by the receiving network entity with a public encryption key corresponding to the corresponding private encryption key, each decrypted message digest being capable of being compared by the receiving network with the corresponding verifying message digest to verify the generated packet object'"'"'s contents.

19. The memory of claim 16 wherein

the received packet object includes one or more digital signatures that each include a message digest generated by performing a corresponding predetermined function on corresponding contents of the received packet object, each message digest being encrypted with a corresponding private encryption key;

the incoming packet object handler further includes a signature verifier to (A) decrypt each encrypted message digest in the received packet object with a public encryption key corresponding to the corresponding private encryption key, (B) for each decrypted message digest, generate a corresponding verifying message digest by performing the corresponding predetermined function on the corresponding contents of the received packet object, and (C) compare each decrypted message digest with the corresponding verifying message digest to verify that the generated packet object'"'"'s contents are the same as the received packet object'"'"'s contents.

20. The memory of claim 16 wherein:

the incoming packet object handler further includes a class screener to determine the received packet object'"'"'s class and reject the received packet object when its class is not a predefined "security" class.

21. The memory of claim 16 wherein:

the received packet object further includes an executable main method and data associated with the main method;

the incoming packet object handler further includes a main method executer to execute the main method of the received packet object with its associated data to implement a desired function when the source and destination verifier verifies that the source of the received packet object is the transmitting network entity and the destination of the received packet object is the specific network entity.