Security mechanisms in a web server

• US 6,363,478 B1
• Filed: 09/17/1998
• Issued: 03/26/2002
• Est. Priority Date: 05/16/1998
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Wright, Steven, Lambert, Howard Shelton
• Primary Examiner(s): Swann, Tod
• Assistant Examiner(s): Darrow, Justin T.
• Application Number:
  US09/154,645
• Time in Patent Office: 1,286 Days
• Field of Search: 713/151, 713/153, 713/155, 380/262, 380/269, 705/56, 705/64, 709/203, 709/206, 709/227, 709/228, 709/230, 709/246, 709/247
• US Class Current: 713/151
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A session processing module for a server is adapted to communicate across the Internet with a plurality of clients. The processing module runs within a servlet and allocates a session identifier in response to a first input stream of a session between a client and the server; negotiates communication characteristics for the session; and instantiates, according to the communication characteristics, routines for processing subsequent session input streams containing request data and routines for generating session output streams containing response data. A variable depth of penetration to be applied to a dynamically specified quality of service for a session is enabled. Thus, in one embodiment the module relays encrypted request data for a session to a back-end server, and receives from the back-end server encrypted response data for the session for the client. Alternatively, the module itself decrypts input streams containing request data and processes the data to generate output streams containing encrypted response data for the client.

Claims

1. A session processing module for a server adapted to communicate across a packet switched network with a plurality of clients, wherein the server includes means for running simultaneous communication sessions with a plurality of the clients via a single network connection to the server, said processing module comprising:

means for allocating a session identifier in response to a first input stream of a session between a client and said server;

means for negotiating communication characteristics specifically for said client-server session; and

means for instantiating, according to said negotiated communication characteristics for said session, routines for processing subsequent session input streams containing request data and routines for generating session output streams containing response data.

2. A session processing module as claimed in claim 1 wherein said negotiation means includes means for authenticating the identity of client to said server and the identity of said server to said client.

3. A session processing module as claimed in claim 1 wherein said negotiation means includes means for determining routines by which said request data and said response data for a session are compressed and decompressed by said client or said server.

4. A session processing module as claimed in claim 1 wherein said negotiation means includes means for determining routines by which said request data and said response data for a session are encrypted and decrypted by said client or said server.

5. A session processing module as claimed in claim 4 including processing means adapted to relay request data for a session, encrypted by a client as determined by said negotiation means, to a back-end server, and to receive response data for said session, encrypted by said back-end server as determined by said negotiation means, for said client.

6. A session processing module as claimed in claim 4 including processing means adapted to decrypt input streams containing request data, encrypted by a client as determined by said negotiation means, and to process said data to generate output streams containing response data, encrypted as determined by said negotiation means, for said client.

7. A session processing module as claimed in claim 4 wherein said negotiation means is adapted to determine that no encryption is necessary.

8. A servlet comprising initialisation means for instantiating a session processing module according to claim 3, said servlet including one or more compression/decompression means adapted to be selectively instantiated, according to the communications characteristics for a session, by said processing module to compress response data and to decompress request data or by said client to compress request data and to decompress response data.

9. A servlet comprising initialisation means for instantiating a session processing module according to claim 4, said servlet including one or more encryption/decryption means adapted to be selectively instantiated, according to the communications characteristics for a session, by said client to encrypt request data and to decrypt response data or by said processing module to encrypt response data and to decrypt request data.

10. A server including one or more servlets according to claim 8, said server including means for receiving said input streams including a servlet identifier from a client, means for relaying said input streams to a servlet identified by said servlet identifier and means for relaying output streams from the servlet to said client.

11. A computer program product stored on a computer readable storage medium for, when executed on a computer, session processing in a virtual machine for managing a plurality of simultaneous communication sessions via a single network connection to the server, the virtual machine being for operating with a computer processing system, the product comprising:

means for allocating a session identifier in response to a first input stream of a session between a client and said server;

means for negotiating communication characteristics specifically for said client-server session; and

means for instantiating, according to said negotiated communication characteristics for said session, routines for processing subsequent session input streams containing request data and routines for generating session output streams containing response data.

12. A method for processing communication sessions between a server and a plurality of clients in a data communications system, wherein the server has means for running simultaneous communication sessions with a plurality of said clients via a single network connection to the server, comprising the steps of:

allocating a session identifier in response to a first input stream of a session between a client and said server;

negotiating communication characteristics specifically for said client-server session; and

instantiating, according to said negotiated communication characteristics for said session, routines for processing subsequent session input streams containing request data and routines for generating session output streams containing response data.