Network security and integration method and system

• US 6,134,591 A
• Filed: 06/18/1997
• Issued: 10/17/2000
• Est. Priority Date: 06/18/1997
• Status: Expired due to Fees

• Current Assignee: Securitech LLC
• Original Assignee: Client/Server Technologies Incorporated
• Inventors: Nickles, Alfred E.
• Primary Examiner(s): Geckil, Mehmet B.
• Application Number:
  US08/878,279
• Time in Patent Office: 1,217 Days
• Field of Search: 395/200.47, 395/200.49, 395/200.56, 395/200.59, 395/187.01, 395/186, 709/203, 709/204, 709/205, 709/217, 709/219, 709/225, 709/229, 709/230, 709/246, 709/206, 380/21-25, 380/29, 380/30, 713/200, 713/202
• US Class Current: 709/229
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/067 using one-time keys cryptographic mechanisms or cryptographic arrangements for generation of one-time passwords H04L9/0863
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A method of the present invention includes a network security system that has a single point of access control to a source computer system. The network security system provides various mechanisms for securing access to a source computer systems that includes generating single-use encryption keys, generating random port assignments for communication between devices, an asynchronous message protocol used in the security system and utilizing various levels of transaction tables to help secure and manage security parameters of the system. More particularly, the present invention provides a method for securing access to a plurality of computers connected via a network. An indication is received that a first user of a first computer program module desires to communicate with a destination computer system. When this indication is received, a message is directed to a security computer system. The security computer system determines whether the first user is authorized to access the destination computer program module of the destination computer system. If the security computer system determines that the first user is authorized to access the destination computer system, the security computer system sets up a communication protocol between the first computer program module and the second computer program module.

Claims

1. A method for providing a first computer with secure access to a destination computer, comprising the steps of:

receiving a first message from the first computer at a gateway requesting a function to be executed by the destination computer;

directing the first message from the gateway to a security server;

determining whether the requested function is permitted;

if the requested function is permitted, transmitting a second message from the security server to the destination computer authorizing execution of the function;

initiating execution of the function at the destination computer; and

while the function executes, asynchronously transmitting a third message from the destination computer to the security server confirming initiation of the execution of the function.

2. The method of claim 1 further comprising the step of:

transmitting a fourth message from the security server to the gateway while the function executes.

3. The method of claim 2 further comprising the steps of:

randomly selecting a communications port from a plurality of unused communications ports available at the gateway;

including a value representing the selected communications port in the second message transmitted from the security server to the destination computer;

including the value representing the selected communications port in the fourth message transmitted from the security server to the gateway;

preparing the gateway to receive communications from the destination computer on the selected communications port; and

after the function has finished executing, transmitting a fifth message from the destination computer to the selected communications port of the gateway, the fifth message including a response associated with the executed function.

4. The method of claim 2 further comprising the steps of:

allotting a predetermined function execution time;

including a value representing the predetermined function execution time in the second message transmitted from the security server to the destination computer; and

terminating execution of the function if the time to execute the function exceeds the predetermined function execution time.

5. The method of claim 4 further comprising the step of logging the termination of the execution of the function in a log maintained at the security server.

6. The method of claim 4 further comprising the step of including the value representing the predetermined function execution time in the fourth message transmitted from the security server to the gateway.

7. The method of claim 2 further comprising the steps of:

dynamically creating a single-use encryption key;

transmitting the single-use encryption key in the second message transmitted from the security server to the destination computer;

transmitting the single-use encryption key in the fourth message transmitted from the security server to the gateway;

encrypting a fifth message with the single-use encryption key at the destination computer, the fifth message including a response associated with the executed function; and

decrypting the fifth message at the gateway using the single-use encryption key.

8. The method of claim 1, wherein the step of determining whether the requested function is permitted comprises one or more of the steps selected from the group including:

accessing a first table to determine whether the user has input identification information contained in the first table;

accessing a second table to determine whether the user is authorized access to an indicated program module of the destination computer;

accessing a third table to determine whether the user has access privileges for the requested function;

accessing a fourth table to obtain a physical address associated with the destination computer; and

determining whether the requested function has been requested during a time when the destination computer is available for performing the requested function.

9. The method of claim 1, wherein the first message is encrypted and contains a digital signature to authenticate the first message was received from an authorized first computer, further comprising the steps of:

decrypting the first message;

receiving the digital signature in the first message; and

authenticating the first message by calculating a digital signature associated with the first message and comparing the calculated digital signature to the received digital signature.

10. The method of claim 1, wherein the step of executing the function comprises executing an object or completing a transaction.

11. An apparatus configured to perform the method of claim 1.

12. A computer storage medium, or a group of computer storage media, comprising computer-executable instructions for performing the method of claim 1.

13. A method for providing a first computer with secure access to a destination computer, comprising the steps of:

receiving a first message from the first computer at a gateway requesting a function to be executed by the destination computer;

directing the first message from the gateway to a security server;

determining whether the requested function is permitted;

if the requested function is permitted, transmitting a second message from the security server to the destination computer authorizing execution of the function;

initiating execution of the function at the destination computer;

allotting a predetermined function execution time;

including a value representing the predetermined function execution time in the second message transmitted from the security server to the destination computer;

terminating execution of the function if the time to execute the function exceeds the predetermined function with execution of time while the function executes, asynchronously transmitting a third message from the destination computer to the security server confirming initiation of the execution of the function.

14. The method of claim 13 further comprising the steps of:

while the function executes, asynchronously transmitting a fourth message from the security server to the gateway;

dynamically creating a single-use encryption key;

transmitting the single-use encryption key in the second message transmitted from the security server to the destination computer;

transmitting the single-use encryption key in the fourth message transmitted from the security server to the gateway;

encrypting a fifth message with the single-use encryption key at the destination computer, the fifth message including a response associated with the executed function;

after the function has finished executing, transmitting the fifth message from the destination computer to the selected communications port of the gateway, the fifth message including a response associated with the executed function; and

decrypting the fifth message at the gateway using the single-use encryption key.

15. The method of claim 14, wherein the step of determining whether the requested function is permitted comprises one or more of the steps selected from the group including:

accessing a first table to determine whether the user has input identification information contained in the first table;

accessing a second table to determine whether the user is authorized access to an indicated program module of the destination computer;

accessing a third table to determine whether the user has access privileges for the requested function;

accessing a fourth table to obtain a physical address associated with the destination computer; and

determining whether the requested function has been requested during a time when the destination computer is available for performing the requested function.

16. An apparatus configured to perform the method of claim 14.

17. A computer storage medium, or a group of computer storage media, comprising computer-executable instructions for performing the method of claim 14.

18. A method for providing a first computer with secure access to a destination computer, comprising the steps of:

receiving a first message from the first computer at a gateway requesting a function to be executed by the destination computer;

directing the first message from the gateway to a security server;

determining whether the requested function is permitted;

if the requested function is permitted;

dynamically creating a single-use encryption key,

transmitting a second message from the security server to the destination computer authorizing execution of the function, and

including the single-use encryption key in the second message;

initiating execution of the function at the destination computer;

while the function executes;

asynchronously transmitting a third message from the destination computer to the security server confirming initiation of the execution of the function,

asynchronously transmitting a fourth message from the security server to the gateway, and

including the single-use encryption key in the fourth message; and

after the function has finished executing;

encrypting a fifth message with the single-use encryption key at the destination computer, the fifth message including a response associated with the executed function,

transmitting the fifth message from the destination computer to the selected communications port of the gateway, the fifth message including a response associated with the executed function, and

decrypting the fifth message at the gateway using the single-use encryption key.

19. An apparatus configured to perform the method of claim 18.

20. A computer storage medium, or a group of computer storage media, comprising computer-executable instructions for performing the method of claim 18.