Method and apparatus for establishing a secure communication connection between a java application and secure server

• US 6,874,084 B1
• Filed: 05/02/2000
• Issued: 03/29/2005
• Est. Priority Date: 05/02/2000
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Dobner, Edward Joseph, Nadalin, Anthony Joseph, Kuehr-McLaren, David Gerard, Zhang, Xiaoyan
• Primary Examiner(s): Vu, Kim
• Assistant Examiner(s): TRUONG, THANHNGA B
• Application Number:
  US09/562,196
• Time in Patent Office: 1,792 Days
• Field of Search: 713/156, 713/200, 713/155, 713/201, 709/223, 709/227, 709/228, 709/229
• US Class Current: 713/156
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

A method and apparatus for establishing a secure communication connection between a Java application or applet and a secure server is provided. An HTTPS handler is provided that may be used by Java applications or applets to establish secure communication connections with secure Web servers.

Claims

1. A method for creating a secure connection to a server, comprising:

within a platform independent applet, initializing a secure socket connection request via HyperText Transport Protocol (HTTP);

using a certificate database to authenticate the server; and

creating the secure connection between the platform independent applet and the server using HyperText Transport Protocol Secure (HTTPS) if the server is authenticated, wherein the secure connection between the platform independent applet and the server is created without intervention by a Web browser.

2. The method of claim 1, further comprising:

receiving a server public key from the server; and

sending a session key, encrypted with the server public key, to the server, wherein the secure connection makes use of the session key to encrypt data.

3. The method of claim 1, wherein the secure connection between the platform independent applet and the server is created using a secure connection handler, wherein the secure connection handler includes the following Java classes:

HTTPSClient, HTTPSURLConnection, new SSLsocket and SecureGlue.

4. The method of claim 1, wherein using the certificate database to authenticate the server includes:

receiving a certificate from the server;

determining if the certificate is a step-up certificate; and

if the certificate is a step-up certificate, using a strong cryptography to encrypt data being sent to the server.

5. A method of creating a secure connection between a platform independent application and a server using HTTPS, comprising:

sending an HTTPS secure connection request to the server from the platform independent application;

receiving a server identification;

authenticating the server based on the server identification; and

establishing the HTTPS secure connection between the platform independent application and the server if the server is authenticated, wherein the HTTPS secure connection between the platform independent application and the server is established without intervention by a Web browser.

6. The method of claim 5, further comprising:

receiving a server public key from the server; and

sending a session key, encrypted with the server public key, to the server, wherein the secure connection between the platform independent application and the server makes use of the session key to encrypt data.

7. The method of claim 5, wherein authenticating the server based on the server identification includes comparing the server identification to trusted server identifiers in an trusted server identifier database.

8. The method of claim 5, wherein the server identifier is a server certificate.

9. The method of claim 5, wherein the HTTPS secure connection is established using a secure connection handler, wherein the secure connection handler includes the following Java classes:

HTTPSClient, HTTPSURLConnection, new SSLsocket and SecureGlue.

10. The method of claim 5, wherein the platform independent application is one of a Java application and a Java applet.

11. The method of claim 5, further comprising:

downloading the platform independent application prior to establishing the HTTPS secure connection between the platform independent application and the server.

12. The method of claim 11, wherein the platform independent application is downloaded from the server.

13. The method of claim 11, wherein the platform independent application is downloaded from a server different from the server with which the HTTPS secure connection is established.

14. The method of claim 11, wherein the platform independent application is downloaded as a JAR file.

15. The method of claim 11, wherein the platform independent application is downloaded as a set of Java classes.

16. The method of claim 5, wherein the server is located behind a firewall, and wherein only message headers of messages sent via the secure connection are able to be examined by the firewall and message bodies of the messages sent via the secure connection remain encrypted.

17. The method of claim 5, wherein sending an HTTPS secure connection request to the server from the platform independent application is performed by an HTTPSURLConnection class of a secure connection handler.

18. The method of claim 5, wherein the HTTPS secure connection is initialized by a SecureGlue class of a secure connection handler and is established using an HTTPSClient class of the secure connection handler.

19. The method of claim 5, wherein authenticating the server is performed using a KeyRing class of a secure connection handler.

20. A computer program product in a computer readable medium for establishing an HTTPS secure connection between a platform independent application and a server, comprising:

first instructions for sending an HTTPS secure connection request to the server from the platform independent application;

second instructions for receiving a server identification;

third instructions for authenticating the server based on the server identification; and

fourth instructions for establishing the HTTPS secure connection between the platform independent application and the server if the server is authenticated, wherein the HTTP secure connection between the platform independent application and the server is established without intervention by a Web browser.

21. The computer program product of claim 20, further comprising:

fifth instructions for receiving a server public key from the server; and

sixth instructions for sending a session key, encrypted with the server public key, to the server, wherein the secure connection between the platform independent application and the server makes use of the session key to encrypt data.

22. The computer program product of claim 20, wherein the third instructions include instructions for comparing the server identification to trusted server identifiers in an trusted server identifier database.

23. The computer program product of claim 20, wherein the server identifier is a server certificate.

24. The computer program product of claim 20, wherein the first instructions include instructions for implementing an HTTPSURLConnection class, the third instructions include instructions for implementing a KeyRing class, and the fourth instructions include instructions for implementing an HTTPSClient class and a new SSLsocket class.

25. The computer program product of claim 20, wherein the platform independent application is one of a Java application and a Java applet.

26. The computer program product of claim 20, further comprising:

fifth instructions for downloading the platform independent application prior to establishing the HTTPS secure connection between the platform independent application and the server.

27. The computer program product of claim 26, wherein the platform independent application is downloaded from the server.

28. The computer program product of claim 26, wherein the platform independent application is downloaded from a server different from the server with which the HTTPS secure connection is established.

29. The computer program product of claim 26, wherein the platform independent application is downloaded as a JAR file.

30. The computer program product of claim 26, wherein the platform independent application is downloaded as a set of Java classes.

31. The computer program product of claim 20, wherein the first instructions include an HTTPSURLConnection class.

32. The computer program product of claim 20, wherein the fourth instructions include a SecureGlue class and an HTTPSClient class.

33. The computer program product of claim 20, wherein the third instructions include a KeyRing class.

34. The computer program product of claim 20, wherein the third instructions include:

determining if the server identification is a step-up certificate; and

if the server identification is a step-up certificate, using a strong cryptography to encrypt data being sent to the server.

35. A secure connection handler for creating an HTTPS secure connection between a platform independent application and a server, comprising:

means for sending an HTTPS secure connection request to the server from the platform independent application;

means for receiving a server identification;

means for authenticating the server based on the server identification; and

means for establishing the HTTPS secure connection between the platform independent application and the server if the server is authenticated, wherein the HTTPS secure connection between the platform independent application and the server is established without intervention by a Web browser.

36. The secure connection handler of claim 35, further comprising:

means for receiving a server public key from the server; and

means for sending a session key, encrypted with the server public key, to the server, wherein the secure connection between the platform independent application and the server makes use of the session key to encrypt data.

37. The secure connection handler of claim 35, wherein the means for authenticating the server based on the server identification includes means for comparing the server identification to trusted server identifiers in an trusted server identifier database.

38. The secure connection handler of claim 35, wherein the server identifier is a server certificate.

39. The secure connection handler of claim 35, wherein the HTTPS secure connection is established using a secure connection handler, wherein the secure connection handler includes the following Java classes:

HTTPSClient, HTTPSURLConnection, new SSLsocket and SecureGlue.

40. The secure connection handler of claim 35, wherein the platform independent application is one of a Java application and a Java applet.

41. The secure connection handler of claim 35, further comprising:

means for downloading the platform independent application prior to establishing the HTTPS secure connection between the platform independent application and the server.

42. The secure connection handler of claim 41, wherein the platform independent application is downloaded from the server.

43. The secure connection handler of claim 41, wherein the platform independent application is downloaded from a server different from the server with which the HTTPS secure connection is established.

44. The secure connection handler of claim 41, wherein the platform independent application is downloaded as a JAR file.

45. The secure connection handler of claim 41, wherein the platform independent application is downloaded as a set of Java classes.

46. The secure connection handler of claim 35, wherein the means for authenticating the server determines if the server identification is a step-up certificate and, if the server identification is a step-up certificate, the means for establishing the HTTPS secure connection uses a strong cryptography to encrypt data being sent to the server.