Method for creating and managing secure service communities

• US 7,627,532 B2
• Filed: 02/16/2006
• Issued: 12/01/2009
• Est. Priority Date: 10/25/2002
• Status: Active Grant

• Current Assignee: Randall E. Orkis, William M. Randle
• Original Assignee: Randall E. Orkis, William M. Randle
• Inventors: Orkis, Randall E., Randle, William M.
• Primary Examiner(s): Elisca; Pierre E
• Application Number:
  US11/355,861
• Publication Number:
  US 20060248330A1
• Time in Patent Office: 1,384 Days
• Field of Search: 705/65, 705/50, 705/51
• US Class Current: 705/65
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/166 at the transport layer

Abstract

A virtual secure service oriented network and process model for the creation and management of secure service communities including a private secure digital courier means for the secure and auditable movement of digital information over any network connection wherein end to end security is provided.

Claims

1. A method for managing a virtual secure service network comprising:

(a) providing a plurality of network connectible digital devices;

(b) creating private secure service communities by extending a private invitation from an existing participant in the network to another potential participant, wherein the invitation correlates to network enrollment through one or more unique artifacts associated with one or more of the invitation and the relationship between the parties to the invitation;

(c) mutually authenticating network service activity between participants;

(d) providing a virtual connection to a service for network participants;

(e) associating each network participant with a network connectible device;

(f) controlling authorization specific to a service and service relationship to a participant by the provider of the service;

(g) using an authenticated secure sockets layer to provide transport encryption for the participant to the network where the participant to the network connection is authenticated prior to the delivery of the service;

(h) using a unique service identification for each activity that links authentication, authorization, usage, and encryption for the participant to the network specific to the instance of a network activity;

(i) providing end to end reporting of each instance of network activity;

(j) providing privacy to each instance of network activity on the service to the participant;

(k) digitally encrypting the payload or service content specific to the recipient of the service invocation by a network participant;

(l) providing the secure service network and an administration layer as a virtual network overlay to network connections above a pre-existing physical network configuration; and

(m) administering the applications layer by the secure service network layer in accordance with predetermined criteria limiting access by a network participant only to applications allowed to the participant by the secure service network layer.

2. A method of claim 1 wherein a digital signature for payload or service content independent of the transport encryption and specific to the recipient or parties to an instance of use of a service is applied to the network participant requesting a service invocation.

4. A method of claim 1 wherein transitive security is established through combined elements of security provided by elements of the virtual service connection.

5. A method of claim 1 wherein a digital certificate associated with a participant is applied to permit portable indicia of a participant'"'"'s identity on a secure service network, and a token, a biometric characteristic or secret employed in combination with a network library of authentication indicia is accessed over the network by a participant requesting access to a network activity.

6. A method of claim 1 including out of band notification of service activity over a network that is not the secure service network utilized by a participant.

7. A method of claim 1 including in band notification of service activity over the secure service network.

8. A method of claim 1 including XML digital certificate authentication between or among network participants as a component of a service associated with an instance of a service invocation.

9. A method of claim 1 wherein authentication is based on Security Access Markup Language (SAML) and access to one or more identity servers managed by participants on the service network is via a service on the secure service network.

10. A method of claim 1 wherein a software node on the secure service network is self provisioned and the node is registered on the secure service network.

11. A method of claim 1 wherein more than one set of digital certificates are associated with network participants;

one or more certificate authorities is associated with each set of digital certificates; and

a service on the network validates each certificate with the respective issuer and or signer of the certificate.

12. A method of claim 11 wherein one or more certificate authorities is associated with each set of digital certificates associated with a participant to the network and a service on the network validates each certificate with the respective issuer and/or signer of the certificate.

13. A method of claim 11 wherein the use of more than one set of digital certificates provides multiple levels of encryption and one or more certificate authorities is associated with each set of digital certificates and a service on the secure service network is used to validate each certificate with the respective issuer and/or signer of the certificate.

14. A method of claim 1 wherein the Web Services Security standard is used as a requirement of the security mechanism within the network to effect components of security for the authentication, authorization, and/or encryption of web services over the secure service network.

15. A method of claim 14 wherein a service on the network validates a digital certificate or security artifact in the service wrapper or payload transmitted by a participant prior to passing the service onto another participant on the secure service network.

16. A method of claim 1 wherein data is compressed and the payload and/or transport is encrypted and then decrypted by the participant.

17. A method in accordance with claim 16 where a Public Key Infrastructure (PKI) based container is created around the payload and a method compatible with PKI encryption is installed in the network connectible digital device to encrypt one of (a) the complete payload comprising one or more application and the service content associated with the one or more application, (b) one or more application separately as (i) a single application or (ii) a set of applications and (c) service content specific to a downloaded application and a permitted network participant.

18. A method of providing a secure service network in accordance with claim 1 wherein a service is provided as one of a networked web service, a networked function within an application, or a networked application.

19. A method for the management of a secure service network in accordance with claim 1 wherein (a) the network connectible digital device includes one of a network gateway, a router, a PC, wireless smart phone, a PDA, a laptop PC, a specialized appliance, a desktop PC;

and (b) a network client application is installed on the digital device.

20. A method in accordance with claim 19 wherein the network connectible digital device includes a client application downloaded from the secure service network issued to a participant following acceptance of an invitation by the participant and the downloaded client application administers services provided by the secure service network.

21. A method of claim 1 wherein a participant'"'"'s enrollment in the secure service network is determined by a participant'"'"'s access to a network connectible hardware appliance that includes a client application for administering participant activity permitted by the secure service network.

22. A method in accordance with claim 1 wherein the managed secure service network includes a hosted global service controller offering services over the network for managing the provisioning of services, managing PKI certificates, governing enrollment, billing for activity over the secure service network, reporting activity over the secure service network, logging activity over the secure service network, and maintaining a database of accounts for the secure service network.

23. A method in accordance with claim 1 wherein the secure service network includes a hosted global service controller as a node on the secure service network layer offering services over the network for managing the provisioning of services, managing security certificates, governing enrollment, billing for activity over the secure service network, reporting activity over the secure service network, logging activity over the secure service network, and maintaining a database of accounts for the secure service network.

3. A method of 1 claim wherein the payload encryption protects the payload while at rest within any fixed or mobile storage device such that only a predesignated network participant to a service invocation can decrypt the contents.