Method and system for controlled distribution of application code and content data within a computer network

• US 7,650,491 B2
• Filed: 11/29/2008
• Issued: 01/19/2010
• Est. Priority Date: 04/12/2001
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Dubey, Pradeep K., Craft, David John, Hofstee, Harm Peter, Kahle, James Allan
• Primary Examiner(s): Pich; Ponnoreay
• Application Number:
  US12/325,192
• Publication Number:
  US 20090083542A1
• Time in Patent Office: 416 Days
• Field of Search: None
• US Class Current: 713/150
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A secure communication methodology is presented. The client device is configured to download application code and/or content data from a server operated by a service provider. Embedded within the client is a client private key, a client serial number, and a copy of a server public key. The client forms a request, which includes the client serial number, encrypts the request with the server public key, and sends the download request to the server. The server decrypts the request with the server'"'"'s private key and authenticates the client. The received client serial number is used to search for a client public key that corresponds to the embedded client private key. The server encrypts its response, which includes the requested information, with the client public key of the requesting client, and only the private key in the requesting client can be used to decrypt the information downloaded from the server.

Claims

1. A method for secure communication between a client and a server in a data processing system, the method comprising:

the client requesting information from the server;

generating a first server message at the server, the first server message including application code encrypted with a server private key and authenticable with a server public key, wherein the application code includes a program that performs a download using symmetric keys;

retrieving the information that was requested by the client;

storing the retrieved information in a second server message encrypted with the symmetric keys;

sending the first server message to the client;

authenticating the first server message at the client using the server public key; and

executing the program at the client to download the second server message from the server.

2. The method of claim 1, further comprising

retrieving server authentication data;

retrieving the server private key;

encrypting the server authentication data with the server private key; and

storing the encrypted server authentication data in the first server message.

3. A method for secure communication between a client and a server in a data processing system, the method comprising:

receiving a first server message from the server at the client, the first server message including first application code encrypted with a server private key, wherein the first application code includes a program that performs a download using symmetric keys, wherein the first server message is received in response to a request for a second application code by the client;

authenticating the first application code with a server public key; and

executing the program at the client to download a second server message from the server, the second server message including the second application code requested by the client, wherein the first application code is small relative to the second application code.