IMX session control and authentication

• US 7,581,244 B2
• Filed: 01/25/2006
• Issued: 08/25/2009
• Est. Priority Date: 01/25/2006
• Status: Expired due to Fees

• Current Assignee: Seiko Epson Corporation (Seiko Group)
• Original Assignee: Seiko Epson Corporation (Seiko Group)
• Inventors: Nelson, Steve, Ivashin, Victor, Li, Chia-Hsin
• Primary Examiner(s): Chai; Longbit
• Application Number:
  US11/340,062
• Publication Number:
  US 20070180503A1
• Time in Patent Office: 1,308 Days
• Field of Search: 726/5
• US Class Current: 726/5
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A secured network connection requires three authentication routines. A system access authentication routine requires a client network device to submit user authentication information to a network server. Upon successful user authentication, the network server creates a Client Service Access Pass, embeds this pass into a dynamic web page transmitted to the client device. A client application access authentication routine requires that the dynamic web page pass the Client Service Access Pass to an instantiated client application, which in turn submits it back to a service server on the network server for authentication. Upon success authentication, the network server destroys the Client Service Access Pass, creates a Media File Access Pass, and sends this pass to the client application. A media file access authentication routine requires the client application to submit the Media File Access Pass along with any file access requests to the network server.

Claims

1. A network communication system comprising:

a network server for selectively providing network access to soliciting network clients; and

a client device for contacting said network server and soliciting network access;

wherein;

said network server is configured to respond to said client device soliciting network access by requesting authentication information from said client device, and responding to receipt of verified authentication information from said client device by generating a first access key code transmitted as a first issued key code embedded within an executable software code to said client device;

said executable software code being effective for launching a client application on said client device and passing said first issued key code to said launched client application;

said client application being effective for transmitting to said network server said first issue key code as a first returned key code along with a request for establishment of a communication session;

said network server, upon receipt of a document submission or document request from said client device, responding to said first returned key code matching said first issued key code by destroying said first access key code, accepting the submitted document or document request, establishing a communication session with said client application, generating a second access key code unrelated to said first access key code, and transmitting said second access key code as a second issued key code to said client application.

2. The network communication system of claim 1, wherein said network server and said client device communicate over the Internet, and said executable software code is embodied within a dynamic web page.

3. The network communication system of claim 1, wherein said network server and said client device communicate over the Internet, and said client application is independent of an any Internet browser application on said client device.

4. The network communication system of claim 1, wherein said first access key code is unrelated to said client device.

5. The network communication system of claim 1, wherein:

every document submission and document request from said client device requires said client device to submit, as a current return key code, the issued key code most recently received from said network server;

upon receipt of each document submission and document request from said client device to said network server, if said current return access key code submitted by the client device matches the most recent issued key code issued by said network server to said client device, then said network server accepts the submitted document or document request, generates a new access key code, and transmits the newly generated access key code as a current issued key code to said client application.

6. The network communication system of claim 1, wherein said client application automatically terminates itself if launched by any other means than said executable software code.

7. The network communication system of claim 6, wherein:

said network server assigns said executable software code an identifying ID code;

said client application maintains a predefined launching identification code;

said software executable code passes its identifying ID code to said client application; and

said client application terminates itself is said identifying ID code is not authenticated by said predefined launching identification code.

8. The network communication system of claim 1, wherein:

said client application maintains a predefined client application identification code;

said executable software code passes said first issued key code to said launched client application only if said client application identification code is authenticated by said executable software code.

9. The network communication system of claim 8, wherein:

said network server maintains a store of application ID codes for identifying client applications;

said network application embeds a specific application ID code corresponding to the expected client application within said client device;

and said executable software code uses the embedded specific application ID code to authenticate said client application identification code.

10. The network communication system of claim 8, wherein:

said network server maintains a store of application ID codes for identifying client applications; and

said executable software code transfers said client application identification code to said network server for authentication.

11. The network communication system of claim 1, wherein:

said client device has at least one predefined archive memory space directly accessible by an external memory query to said client device; and

each issued key code received by said client application is maintained as an active parameter within volatile memory of said client device, is not located in any predefined archive memory space, and is destroyed upon termination of said client application.

12. The network communication system of claim 1, wherein each issued key code received by said client application is maintained as a temporary register entry within a central controller part of said client device, and is not transferable to any nonvolatile memory of said client device.

13. The network communication system of claim 1, wherein transmissions between said network server and said client device are in the form of transmission packets, and network transmission packets from said client device to said network server include a header section having textual transmission parameter information, and a body section having data provided by said client application, and the returned access key code provided by said client application to said network server is excluded from said header section.

14. A method of establishing a secure communication link over a computer network between a network server and a client device, said method comprising:

establishing a communication session between said network server and said client device; and

having said client device submit a document to said network server or submit a document request to said network server;

wherein said establishing of said communication session between said network server and said client device includes;

having said client device transmit an access request to said network server;

having said network server respond to said access request by requesting user authentication information from said client device, and responding to receipt of valid user authentication information from said client device by generating a first access key code and transmitting said first access key code as a first issued key code embedded within an executable software code to said client device;

having said client device execute the received executable software code, and having said executable software code launch a client application on said client device, wherein said executable software code passes said first access key code to said client application;

having said client application submit to said network server a new request for a communication session and submit said first access key code as a first returned key code;

having said network server, upon receipt of the document submission or document request from said client device, respond to said first returned key code matching said first access key code by destroying said first access key code, accepting the submitted document or document request, establishing a communication session with said client application, generating a second access key code, and transmitting said second access key code as a second issued key code to said client application.

15. The method of claim 14, wherein said executable software code is embodied within a dynamic web page.

16. The method of claim 14, wherein said first access key code is unrelated to said client device.

17. The method of claim 14, wherein said second access key code is unrelated to said first access key code.

18. The method of claim 14, wherein:

submission of a document from said client device to said network server requires said client device to submit said second issued key code as a second returned access key code along with a request for document submission, and

said network server responds to said request for document submission by accepting said document submission if said second returned access key code matches said second access key code, destroying said second access key code, generating a third access key code unrelated to said second access key code, and transmitting said third access key code as a third issued key code to said client application.

19. The method of claim 14, wherein:

submission of a document request from said client device to said network server requires said client device to submit said second issued key code as a second returned access key code along with said document request, and

said network server responds to said document request by transmitting the requested document if said second returned access key code matches said second access key code, destroying said second access key code, generating a third access key code, and transmitting said third access key code as a third issued key code to said client application.

20. The method of claim 14, wherein:

every document submission and document request from said client device requires said client device to submit, as a current return key code, the issued key code most recently received from said network server;

upon receipt of each document submission and document request from said client device to said network server, if said current return access key code submitted by the client device matches the most recent issued key code issued by said network server to said client device, then said network server accepts the submitted document or submitted document request, generates a new access key code, and transmits the newly generated access key code as a current issued key code to said client application.

21. The method of claim 14, wherein:

said client device has at least one predefined archive memory space directly accessible by an external memory query to said client device; and

each issued key code received by said client application is maintained as an active parameter within volatile memory of said client device, is not located in any predefined archive memory space, and is destroyed upon termination of said client application.

22. The method of claim 21, wherein each issued key code received by said client application is maintained as a temporary register entry within a central controller of said client device, and is not transferred to any nonvolatile memory of said client device.

23. The method of claim 14, wherein said access key code transmitted from said network server to said client device is encoded.

24. The method of claim 14, wherein transmissions between said network server and said client device are in the form of transmission packets, and network transmission packets from said client device to said network server include a header section having textual transmission parameter information, and a body section having data provided by said client application, and the returned access key code provided by said client application to said network server is excluded from said header section.