Secure socket layer application program apparatus and method

• US 5,825,890 A
• Filed: 07/01/1997
• Issued: 10/20/1998
• Est. Priority Date: 08/25/1995
• Status: Expired due to Term

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: Netscape Communications Corporation (Apollo Global Management, Inc.)
• Inventors: Hickman, Kipp E.B., Elgamal, Taher
• Primary Examiner(s): CAIN, DAVID C
• Application Number:
  US08/889,879
• Time in Patent Office: 476 Days
• Field of Search: 380/49, 380/23, 380/24, 380/25, 380/4, 395/682, 370/60, 370/94.1
• US Class Current: 713/151
• CPC Class Codes: G06F 2211/008 Public Key, Asymmetric Key, Asymmetric Encryption
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 69/326 in the transport layer [OSI layer 4] H04L69/16 takes precedence
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A computer program product comprising: a computer useable medium having computer readable program code means embodied therein for encrypting and decrypting information transferred over a network between a client application program running in a client computer and a server application program running in a server computer, the computer readable program code means in the computer program product comprising: computer readable program code means for providing a socket application program interface to an application layer program; computer readable program code means for providing encrypted information to transport protocol layer services; computer readable program code means for encrypting information received from an application layer program; and computer readable program code means for decrypting information received from transport protocol layer services.

Claims

1. A socket application interface computer program product that interfaces application program code executing in an application layer to transport protocol layer services code, comprising:

application program interface code that encrypts information received from the application program code; and

means for providing the encrypted information to the transport protocol layer services code.

2. A socket application interface computer program product that interfaces application program code executing in an application layer to transport protocol layer services code, comprising:

means for decrypting encrypted information received from the transport protocol layer services code;

application program interface code that provides the decrypted information to the application layer program.

3. A client security software application for use by a client application executing on a client computer, for setting up a secure socket connection for secure data transfer between the client computer and a server computer:

means for causing the client computer to transmit to the server computer a client-hello message including challenge data and client cipher-specs data, the client cipher-specs data indicating an indication of at least one bulk cipher supported by the client computer;

means for causing the client computer to receive from the server computer a server-hello message including connection_-- identification data, server_-- certificate data and server cipher-specs data, wherein the server cipher-specs data includes an indication of a bulk cipher to be used during the secure data transfer.

4. A client security software application as in claim 3, and further comprising:

means for providing a master key to the server computer.

5. A client security software application as in claim 4, wherein the master key provided to the server computer is encrypted using a key exchange encryption algorithm.

6. A client security software application as in claim 5, wherein the key exchange encryption algorithm is an RSA public key exchange encryption algorithm.

7. A client security software application as in claim 4, wherein the master key providing means includes means for generating the master key by randomly generating a number.

8. A client security software application as in claim 4, and further comprising:

means for generating a session key.

9. A client security software application as in claim 8, wherein the session key generating means includes means for applying a hash function to the master key.

10. A client security software application as in claim 8, and further comprising:

means for providing to the server computer a client-finished message indicating that the client security software application is satisfied with the server.

11. A client security software application as in claim 10, wherein the client-finished message includes an encoding of selected cases of handshake protocol messages previously sent to the client computer by the server during since the client computer sent the client-hello message.

12. A client security software application as in claim 11, wherein the encoding included in the client-finished message is a hash encoding.

13. A client security software as in claim 11, wherein the encoding included in the client-finished message is as application of the bulk cipher received from the server computer.

14. A client security software application as in claim 11, and further including:

means for receiving from the server computer a server verification message indicating a verification from the server computer of the integrity of the secure socket connection.

15. A client security software application as in claim 10, and further comprising:

means for receiving from the server computer a server-finished message indicating that the server computer is satisfied with the client and is ready to begin communication via the secure socket connection.

16. A client security software application as in claim 15, wherein:

the server-finished message receiving means includes means for receiving from the server computer a new_-- session_-- identifier of the server-finished message.

17. A client security software application as in claim 16, and further comprising:

means, responsive to the received server-finished message, for storing the received new-session-identifier in a memory along with corresponding security parameters including the encryption algorithm selection, for use in a future secure socket connection between the client computer and the server computer.

18. A client security software application as in claim 15, wherein the server-finished message includes an encryption of selected ones of handshake protocol messages sent by the server computer to the client computer since the server computer sent the server-hello message to the client computer.

19. A client security software application as in claim 18, wherein the encryption included in the server-finished message is a hash encryption.

20. A client security software application as in claim 19, wherein the hash encryption included in the server-finished message is performed using the agreed-upon bulk cipher and the session key generated by the server computer.

21. A client security software application as in claim 20, wherein the server-finished message includes challenge data sent in the client-hello message, encrypted by the selected bulk cipher using the server write key.

22. A client security software application as in claim 21, and further comprising:

means for decrypting the encrypted challenge data received from the server computer and for comparing the decrypted challenge data to the challenge data sent to the server computer in the client-hello message.

23. A client security software application as in claim 17, further including:

interval timer means to measure whether a length of time that the new-session-identifiers and corresponding security parameters have been stored exceeds a predetermined interval; and

means for deleting the stored new session_-- identifier from the memory if the predetermined interval is exceeded.

24. A client security software application as in claim 23, and further including:

means for resetting the interval timer means in response to a subsequent request by the client for a secure socket connection to the server computer session-identifier matching a new-session-identifier stored in the memory.

25. A client security software application as in claim 23, and further including:

means for receiving a server-hello message from the server that includes a session_-- identification_-- hit indication;

means responsive to the session_-- identification_-- hit indication, for using the security parameters that were previously stored in the cache and that correspond the session-identification sent by the client computer to the server computer in the client-hello message.

26. A client security software application as in claim 3, wherein the client-hello message and the server-hello message are sent in the clear.

27. A socket application interface computer program product as in claim 7, and further comprises:

means for receiving a request, from a Winsock program, for a socket connection to a server computer;

means responsive to the request receiving means, for establishing the socket connection via an operating system protocol stack;

means for receiving an indication that socket connection has been successfully established and for so notifying the Winsock program.