Object-based security system

• US 6,829,712 B1
• Filed: 05/29/2003
• Issued: 12/07/2004
• Est. Priority Date: 10/27/1998
• Status: Expired due to Term

• Current Assignee: Sprint Communications Company LP (Deutsche Telekom AG)
• Original Assignee: Sprint Communications Company LP (Deutsche Telekom AG)
• Inventors: Madoukh, Ashraf T.
• Primary Examiner(s): Vu, Kim
• Assistant Examiner(s): Ha, Leynna
• Application Number:
  US10/447,550
• Time in Patent Office: 558 Days
• Field of Search: 713/200-201, 713/155-56, 713/156, 713/170-71, 713/171, 713/150, 709/200, 709/202-3, 709/217-19, 709/223, 709/225-227, 709/316-16, 709/229, 380/268, 380/28-30, 380/282-85
• US Class Current: 726/2
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32

Abstract

The invention authenticates processes and inter-process messaging. In some examples of the invention, security is performed in three layers—the application layer, the middleware layer, and the transport layer. Some examples of the invention include software products. One software product comprises security software and middleware software stored on a software storage medium. The security software directs a processor to receive a log-in request for a process, generate a request to authenticate the process, transfer the request to authenticate the process, receive a security association for the process, and transfer the security association. The middleware software directs the processor to receive the security association from the security software, receive a message from the process, insert the security association into the message, and transfer the message. Another software product comprises security software stored on a software storage medium. The security software directs a processor to receive a request to authenticate a process, authenticate the process, generate a security association for the process, store the security association, transfer the security association, receive the security association extracted from a message, and check the security association extracted from the message with the stored security association to authenticate the message.

Claims

1. A communication method comprising:

in a fist system having a first process, transferring information for the first process to a security system where the security system is located in a second system;

in the security system, processing the information to authenticate the first process, and if the first process is authenticated, transferring a security association to the first system;

in the first system, receiving a message from the first process, inserting the security association into the message, and transferring the message with the security association to a third system;

in the third system, extracting the security association from the message and transferring the security association to the security system; and

in the security system, comparing the security association transferred to the first system with the security association received from the third system for a match to authenticate the message.

2. The method of claim 1 further comprising:

generating a random number;

processing the random number with a mathematical function to generate a first result;

encrypting the first result with a private key for the first process; and

wherein transferring the information for the first process to the security system comprises transferring the random number and the encrypted first result to the security system.

3. The method of claim 2 wherein, in the security system, processing the information to authenticate the first process comprises:

processing the random number with the mathematical function to generate a second result;

decrypting the encrypted first result with a public key for the first process; and

comparing the decrypted first result with the second result to authenticate the first process if the decrypted first result matches the second result.

4. The method of claim 1 further comprising:

generating the security association if the first process is authenticated;

encrypting the security association with a public key for the first process; and

wherein the transferring the security association to the first system comprises transferring the encrypted security association to the first system.

5. The method of claim 4 further comprising, in the first system, receiving the encrypted security association and decrypting the encrypted security association with a private key for the first process.

6. The method of claim 1 further comprising, in the security system, generating a security alarm if the security association transferred to the first system does not match the security association received from the third system.

7. The method of claim 1 further comprising, in the security system, generating a public key and a private key for the first system.

8. The method of claim 1 further comprising, in the first system:

receiving a password for the first process;

encrypting a private key for the first process with the password;

subsequently receiving the password from the first process;

decrypting the private key for the first process with the password received from the first process.

9. The method of claim 1 wherein the message comprises a TCP/IP message and wherein inserting the security association into the message and extracting the security association from the message comprises inserting the security association into a TCP/IP envelope for the message and extracting the security association from the TCP/IP envelope for the message.

10. The method of claim 1 wherein the first system comprises a user system and the third system comprises a service node in a communication system.

11. A communication system comprising:

a first system having a first process;

a second system; and

a security system in a third system;

wherein the first system is configured to transfer information for the first process to the security system;

wherein the security system is configured to process the information to authenticate the first process, and if the first process is authenticated, to transfer a security association to the first system;

wherein the first system is configured to receive a message from the first process, insert the security association into the message, and transfer the message with the security association to the second system;

wherein the second system is configured to extract the security association from the message and transfer the security association to the security system; and

wherein the security system is configured to compare the security association transferred to the first system with the security association received from the second system for a match to authenticate the message.

12. The communication system of claim 11 wherein the first system is configured to generating a random number, process the random number with a mathematical function to generate a first result, encrypt the first result with a private key for the first process, and transfer the random number and the encrypted first result to the security system.

13. The communication system of claim 12 wherein the security system is configured to process the random number with the mathematical function to generate a second result, decrypting the encrypted first result with a public key for the first process, compare the decrypted first result with the second result to authenticate the first process if the decrypted first result matches the second result.

14. The communication system of claim 11 wherein the security system is configured to generate the security association if the first process is authenticated, encrypt the security association with a public key for the first process, and transfer the encrypted security association to the first system.

15. The communication system of claim 14 wherein the first system is configured to receive the encrypted security association and decrypt the encrypted security association with a private key for the first process.

16. The communication system of claim 11 wherein the security system is configured to generate a security alarm if the security association transferred to the first system does not match the security association received from the third system.

17. The communication system of claim 11 wherein the security system is configured to generate a public key and a private key for the first process.

18. The communication system of claim 11 wherein the first system is configured to receive a password for the first process, encrypt a private key for the first process with the password, subsequently receive the password from the first process, and decrypt the private key for the first process with the password received from the first process.

19. The communication system of claim 11 wherein the message comprises a TCP/IP message and wherein the first system is configured to insert the security association into a TCP/IP envelope for the message and the third system is configured to extract the security association from the TCP/IP envelope for the message.

20. The communication system of claim 11 wherein the first system comprises a user system and the third system comprises a service node in a communication system.