Method and apparatus for providing secure communication with a relay in a network

• US 6,643,701 B1
• Filed: 11/17/1999
• Issued: 11/04/2003
• Est. Priority Date: 11/17/1999
• Status: Expired due to Term

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Aziz, Ashar, Gupta, Vipul, Caronni, Germano, Gupta, Amit, Scott, Glenn C., Baehr, Geoffrey
• Primary Examiner(s): Barot, Bharat
• Application Number:
  US09/441,451
• Time in Patent Office: 1,448 Days
• Field of Search: 709/200-203, 709/217-219, 709/227-229, 713/150-151, 713/155-156, 713/200-202, 705/64-67
• US Class Current: 709/227
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066

Abstract

Methods and systems of the present invention include providing a connection between a first computer and a second computer by receiving, at a third computer, information regarding one of the first and second computers to facilitate establishment of a secure connection between the first computer and the second computer, creating a first end-to-end security link between the first computer and third computer, and creating a second end-to-end security link between the second computer and the third computer to establish the secure connection. The first and second computers could be a client and a server on the Internet, and these methods and systems can, for example, increase the possible number of new secure connections to the server. The third computer also permits processing of information transmitted between the client and server in the third computer. For example, the information could be reformatted or used in testing a process of one of the first and second computers.

Claims

1. A method of providing a connection between a first computer and a second computer, comprising:

receiving, at a third computer, information regarding one of the first and second computers to facilitate establishment of a secure connection between the first computer and the second computer;

creating a first end-to-end security link between the first computer and third computer; and

creating a second end-to-end security link between the second computer and the third computer to establish the secure connection.

2. The method according to claim 1, wherein the information regarding one of the first and second computers includes a certificate of the one of the computers and the creating the first end-to-end security link step uses the certificate to pass off the third computer as the one of the computers.

3. The method according to claim 1, wherein the end-to-end security links are one of Secure Socket Layer links and Transport Layer Security links.

4. The method according to claim 1, further comprising:

processing information transmitted between the first and second computers in the third computer.

5. The method according to claim 4, wherein the processing includes reformatting information received at the third computer from one of the first and second computers.

6. The method according to claim 4, wherein the processing includes testing a process of one of the first and second computers.

7. A method of processing data transmitted between a client and a server, comprising:

providing an authentication token of the client to a trusted relay computer;

receiving a request from the user for a connection between the client and the server;

transmitting the request to the trusted relay computer;

creating a first end-to-end security link between the client and the trusted relay computer;

providing the authentication token to the server;

authenticating the client in the server;

creating a second end-to-end security link between the server and the trusted relay computer;

initiating transfer of information between the client and the server through the trusted relay computer; and

during the transfer, processing, in the trusted relay computer, the information transferred between the client and the server.

8. The method according to claim 7, wherein the end-to-end security links are one of Secure Socket Layer links and Transport Layer Security links.

9. The method according to claim 7, wherein the processing includes reformatting information received at the trusted relay computer from one of the client and the server.

10. The method according to claim 7, wherein the processing includes testing a process of one of the client and server.

11. A method of connecting a plurality of clients to a server, comprising:

providing a plurality of trusted relays between the plurality of clients and the server;

providing each of the trusted relays with a certificate of the server and a private key of the server;

for each of the trusted relays, creating first end-to-end security links between a number of the plurality of clients and a respective trusted relay using the certificate and public key of the server; and

creating second end-to-end security links between the server and each of the respective trusted relays.

12. The method according to claim 11, wherein the creating the second end-to-end security link includes a resumption handshaking session where a key pair from an initial handshaking session is used.

13. The method according to claim 12, wherein the server is capable of processing N initial handshaking sessions and N′

resumption handshaking sessions, N′

being greater than N, and wherein the step of providing the plurality of trusted relays includes providing N′

trusted relays.

14. The method according to claim 11, wherein the end-to-end security links are one of Secure Socket Layer links and Transport Layer Security links.

15. A data processing system for providing a connection between a first computer and a second computer, comprising:

a third computer that receives information regarding one of the first and second computers to facilitate establishment of a secure connection between the first computer and the second computer;

a first end-to-end security link between the first computer and third computer; and

a second end-to-end security link between the second computer and the third computer to establish the secure connection.

16. The data processing system according to claim 15, wherein the information regarding one of the first and second computers includes a certificate of the one of the computers and the first end-to-end security link is created using the certificate so as pass off the third computer as the one of the computers.

17. The data processing system according to claim 15, wherein the end-to-end security links are one of Secure Socket Layer links and Transport Layer Security links.

18. The data processing system according to claim 15, wherein the third computer processes information transmitted between the first and second computers in the third computer.

19. The data processing system according to claim 18, wherein the third computer reformats information received at the third computer from one of the first and second computers.

20. The data processing system according to claim 18, wherein the third computer is used in testing a process of one of the first and second computers.

21. A system including a client that receives a request from a user for a connection between the client and a server, which authenticates the client based on an authentication token, the system comprising:

a trusted relay including a storage device that stores the authentication token of the client and a device that processes information transmitted between the client and the server;

a first end-to-end security link between the client and the relay; and

a second end-to-end security link between the server and the relay.

22. The system according to claim 21, wherein the end-to-end security links are one of Secure Socket Layer links and Transport Layer Security links.

23. The system according to claim 21, wherein the relay reformats information received at the relay from one of the client and server.

24. The system according to claim 21, wherein the relay is used in testing a process of one of the client and server.

25. A system of connecting a plurality of clients to a server, comprising:

a plurality of trusted relays between the plurality of clients and the server, each including a storage device that stores a certificate of the server and a private key of the server;

first end-to-end security links between each of the plurality of clients and any one of the relays, the first end-to-end security links created using the certificate and public key of the server; and

second end-to-end security links between the server and each of the relays.

26. A computer-readable medium containing instructions for controlling a computer network to perform a method for providing a connection between a first computer and a second computer, the method comprising:

receiving, at a third computer, information regarding one of the first and second computers to facilitate establishment of a secure connection between the first computer and the second computer;

creating a first end-to-end security link between the first computer and third computer; and

creating a second end-to-end security link between the second computer and the third computer to establish the secure connection.