Seamless integration of application programs with security key infrastructure

• US 6,490,679 B1
• Filed: 01/18/1999
• Issued: 12/03/2002
• Est. Priority Date: 01/18/1999
• Status: Expired due to Term

• Current Assignee: EMC Corporation (Dell Technologies Inc.)
• Original Assignee: SHYM Technology, Inc. (Dell Technologies Inc.)
• Inventors: Tumblin, Henry R., Geary, James M., Artick, Steve R., Rothman, Michael S., Pinkett, Fred J.
• Primary Examiner(s): BARRON JR, GILBERTO
• Application Number:
  US09/232,977
• Time in Patent Office: 1,415 Days
• Field of Search: 713/200, 713/201, 713/155, 713/156, 713/229, 709/223, 709/225
• US Class Current: 713/155
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 2211/008 Public Key, Asymmetric Key, Asymmetric Encryption
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

The invention is a method and system for integrating a security key infrastructure with applications programs on a computer system. A security key infrastructure service request is transmitted from a first application program to a security integration module. In the security integration module, a first policy is requested from a policy server and a first security key infrastructure is selected to service the security key infrastructure service request, according to the first policy. The security key infrastructure service request is transmitted from the security integration module to the selected first security key infrastructure.

Claims

1. A method for integrating a security key infrastructure with an application program on a computer system comprising:

transmitting a security key infrastructure service request to a security integration module that is characterized by having multiple security interfaces matched respectively to different security key infrastructures;

in the security integration module, retrieving a policy suitable for the application from a policy database;

in the security integration module, selecting a security key infrastructure to service the security key infrastructure service request according to the retrieved policy; and

transmitting the security key infrastructure service request from the security integration module to the selected security key infrastructure,

wherein the security key infrastructure service request is generated in a first network security interface module, linked to the application program, and

wherein prior to practice of the method, the application program is linked to a network access module, and the method further comprising;

initially replacing the network access module with the network security integration module.

2. A method for securing a distributed data processing system having a client application program on a client, and a server application program on a server connected to the client by a network, comprising:

in the client;

intercepting, in a first network security interface module that is characterized by having multiple security interfaces matched respectively to different security key infrastructures, a request by the client application program to open a network connection to the server application program;

determining the current user of the client application program;

determining from a policy database whether the user is authorized to open the connection by reference to a policy in the database associated with the user and the client application program;

sending a message from the first network in module to the server requesting a secure network connection between the client application program and the server application program, only if the user is authorized by the policy to establish the connection; and

in the server;

in a second network security interface module, receiving the request from the first network security interface module to open a secure connection between the client application program and the server application program;

determining whether the user is authorized to open a connection between the client application program and the server application program according to a user policy from a policy database;

providing information to the first network security interface module necessary to establish a secure connection between the client application program and the server application program, only if the user is authorized by the user policy accessed by the server to open a connection between the client application program and the server application program;

wherein, prior to practice of the method, the client application program is linked to a network access module, and further comprising;

initially replacing the network access module with the first network security interface module.

3. A method for securing a distributed data processing system having a client application program on a client, and a server application program on a server connected to the client by a network, comprising:

in the client;

intercepting, in a first network security interface module that is characterized by having multiple security interfaces matched respectively to different security key infrastructures, a request by the client application program to open a network connection to the server application program;

determining the current user of the client application program;

determining from a policy database whether the user is authorized to open the connection by reference to a policy in the database associated with the user and the client application program;

sending a message from the first network security interface module to the server requesting a secure network connection between the client application program and the server application program, only if the user is authorized by the policy to establish the connection; and

in the server;

in a second network security interface module, receiving the request from the first network security interface module to open a secure connection between the client application program and the server application program;

determining whether the user is authorized to open a connection between the client application program and the server application program according to a user policy from a policy database;

providing information to the first network security interface module necessary to establish a secure connection between the client application program and the server application program, only if the user is authorized by the user policy accessed by the server to open a connection between the client application program and the server application program;

wherein the server application program is initially linked to a second network access module, and further comprising;

initially replacing the network access module with the second network security interface module.

4. A computer program product, residing on a computer readable medium, for integrating a security key infrastructure with an application program on a computer system, the computer program product comprising instructions for causing a computer to perform the steps of transmitting a security key service request to a security integration module that is characterized by having multiple security interfaces matched respectively to different security key infrastructures;

in the security integration module, retrieving a policy suitable for the application from a policy database;

in the security integration module, selecting a security key infrastructure to service the security key service request according to the retrieved policy; and

transmitting the security key service request from the security integration module to the selected security key infrastructure;

for causing the computer to generate the security key service request in a first network security interface module, linked to the application program; and

to initially replace the network access module with the first network security integration module.