System and method for secure communication

• US 7,752,434 B2
• Filed: 09/23/2002
• Issued: 07/06/2010
• Est. Priority Date: 09/21/2001
• Status: Active Grant

• Current Assignee: Corel Corporation (Corel Holdings LP)
• Original Assignee: Corel Corporation (Corel Holdings LP)
• Inventors: Chiu, Joseph, Mereu, Stephen, Schnarr, Matt
• Primary Examiner(s): Moise; Emmanuel L
• Assistant Examiner(s): Abyaneh; Ali S
• Application Number:
  US10/252,872
• Publication Number:
  US 20030061517A1
• Time in Patent Office: 2,843 Days
• Field of Search: 713/161, 713/172, 726/5, 380/277
• US Class Current: 713/161
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising
• CPC Class Codes: G06Q 30/04 Billing or invoicing
• CPC Class Codes: H04L 63/0838 using one-time-passwords

Abstract

A secure communication module is provided for securing communication between a client application and a network service. The secure communication module comprises an authentication identifier provider for providing the client application a pool of authentication identifiers for use in subsequent communication with the network service, and an authentication identifier validator for checking the validity of an authentication identifiers from the pool of authentication identifiers sent with the subsequent communication.

Claims

1. A secure communication hardware module implemented in a computer coupled to a network, the computer comprising a processor for executing instructions stored in a computer readable memory, the secure communication hardware module for securing authentication between a client application and a web service, the secure communication hardware module comprising:

an authentication identifier provider for providing to the client application a plurality of authentication identifiers over a secure communication channel established over the network, individual authentication identifiers of the plurality of authentication identifiers for use in validating subsequent client application requests to access functionality provided by a first web service; and

an authentication identifier validator for validating the client application'"'"'s authorization to access the requested functionality of the first web service using an authentication identifier from the plurality of authentication identifiers received with a client application request to access functionality provided by the first web service; and

a communication module for receiving, over an unsecure communication channel established over the network, the client application request and the associated authentication identifier and sending the request to access functionality to the web service when the client application'"'"'s authorization to access the web service is validated by the authentication identifier validator.

2. The secure communication module as claimed in claim 1, wherein each authentication identifier is invalidated after being validated by the authentication validator, whereby each authentication identifier can only be used once.

3. The secure communication module as claimed in claim 1, further comprising an authentication module for authenticating the client application prior to providing the client application the plurality of authentication identifiers.

4. The secure communication module as claimed in claim 1, further comprising an authorization module for checking if the client application has authorization to access the functionality of the first web service.

5. The secure communication module as claimed in claim 1, further comprising a repository for storing information relating to the plurality of authentication identifiers.

6. The secure communication module as claimed in claim 5, wherein the repository further stores information relating to the client application, and the first web service.

7. The secure communication module as claimed in claim 1, further comprising a billing module to bill for the plurality of authentication identifiers.

8. The secure communication module as claimed in claim 7, further comprising a metering module for tracking usage of the plurality of authentication identifiers.

9. The system as claimed in claim 1, wherein the communication module is further for receiving a response from the first web service and sending the response to the client application in response to the client application request.

10. The system as claimed in claim 1, wherein the plurality of authentication identifiers further comprise one or more authentication identifiers for use in validating subsequent client application requests to access functionality provided by a second web service, and

wherein the communication module further for receiving a client application request for accessing functionality of the second web service and an authentication identifier for use in validating the client application'"'"'s access to the second web service, and sending the request to access the functionality of the second web service when the client application'"'"'s authorization to access the second web service is validated by the authentication identifier.

11. A method for securing authentication between a client application and a web service, the method comprising steps of:

establishing a secure communication channel to the client application;

providing the client application a plurality of authentication identifiers over the established secure communication channel, each of the plurality of authentication identifiers of the plurality of authentication identifiers for use in validating subsequent client application requests to access functionality provided by a first web service;

receiving from the client application over an unsecured communication channel a client application request to access functionality provided by the first web service and an associated authentication identifier from the plurality of authentication identifiers; and

validating the client application'"'"'s authorization to access the requested functionality of the first web service using the received authentication identifier; and

sending the client application'"'"'s request to the first web service.

12. The method as claimed in claim 11, further comprising the step of invalidating the received authentication identifier after it has been validated, whereby each authentication identifier can only be used once.

13. The method as claimed in claim 11, further comprising the step of authenticating the client application prior to providing the client application the plurality of authentication identifiers.

14. The method as claimed in claim 13, further comprising the step of checking if the client application has authorization to access the particular web service.

15. The method as claimed in claim 11, further comprising the step of storing information relating to the plurality of authentication identifiers in a repository.

16. The method as claimed in claim 15, further comprising the step of storing information relating to the client application and the first web service in the repository.

17. The method as claimed in claim 11, wherein the first web service is a web service.

18. The method as claimed in claim 11, further comprising the step of billing for the plurality of authentication identifiers sent to the client application.

19. The method as claimed in claim 18, further comprising the step of metering the usage of the plurality of authentication identifiers sent to the web service-client application.

20. The method as claimed in claim 18, wherein the step of billing comprises the step of billing the client application based upon the amount of authentication identifiers in the plurality of authentication identifiers.

21. The method as claimed in claim 11, further comprising the step of billing for each of the validated authentication identifiers received from the plurality of authentication identifiers.

22. The method of claim 11, further comprising:

receiving a response from the first web service; and

sending the response to the client application in response to the client application request.

23. The method of claim 11, wherein the plurality of authentication identifiers further comprise one or more authentication identifiers for use in validating subsequent client application requests to access functionality provided by a second web service and further comprising:

receiving from the client application a client application request to access functionality provided by the second web service and an associated authentication identifier from the plurality of authentication identifiers;

validating the client application'"'"'s authorization to access the requested functionality of the second web service using the received authentication identifier; and

sending the client application'"'"'s request to the second web service.

24. Computer readable memory storing the instructions for use in the execution in a computer of a method for securing authentication between a client application and a particular web service, the method comprising steps of:

establishing a secure communication channel to the client application;

providing the client application a plurality of authentication identifiers over the established secure communication channel, each of the plurality of authentication identifiers of the plurality of authentication identifiers for use in validating subsequent client application requests to access functionality provided by a first web service;

receiving from the client application over an unsecured communication channel a client application request to access functionality provided by the first web service and an associated authentication identifier from the plurality of authentication identifiers; and

validating the client application'"'"'s authorization to access the requested functionality of the first web service using the received authentication identifier; and

sending the client application'"'"'s request to the first web service.