Infrastructure architecture for secure network management with peer to peer functionality

• US 8,327,436 B2
• Filed: 06/27/2006
• Issued: 12/04/2012
• Est. Priority Date: 10/25/2002
• Status: Active Grant

• Current Assignee: Randall E. Orkis, William M. Randle
• Original Assignee: Randall E. Orkis, William M. Randle
• Inventors: Orkis, Randall E., Randle, William M.
• Primary Examiner(s): Flynn, Nathan
• Assistant Examiner(s): Lakhia, Viral
• Application Number:
  US11/426,806
• Publication Number:
  US 20070112578A1
• Time in Patent Office: 2,352 Days
• Field of Search: 709223-226, 726 2- 10, 726/15, 705/1
• US Class Current: 726/15
• CPC Class Codes: H04L 63/0272 Virtual private networks

Abstract

Architecture defining a secure virtual network of communities of two or more participants where security and business management reporting is a result of a network architecture and where participants can maintain absolute security and control over their services independent of any other participant according to implemented selection rules of the network architecture administration.

Claims

1. A secure virtual network wherein a service is provided to a given requestor through a virtual service connection created between the service and the given requestor upon successful mutual authentication and authorization of the given requestor for the service, comprising:

a pre-existing network comprising multiple participants, each connected to the pre-existing network by an appliance, the participants including uniquely identifiable service providers and uniquely identifiable requestors, each service provider offering at least one service through an openable and closeable gateway behind a firewall connected to the pre-existing network, the service listed in a service definition in a repository and specific to a given requestor;

an infrastructure architecture implemented via a distributed governance model wherein each provider is responsible for authenticating and authorizing each requestor,

wherein successful mutual authentication comprises;

a) the given requestor providing the service definition to a gateway connecting the given requestor to the pre-existing network, the given requestor gateway comparing the service definition to a record for that service, the record comprising a response code, a response reason, a request size, a response size, an identity of the given requestor and the service provider, a service URL, a unique origination identifier, a unique given requestor identifier, a unique correlation identifier, a local infrastructure identifier, a remote infrastructure identifier, an originator host, a destination host, a destination port, and instructions for fulfilling the request, and, upon a match of the service definition to the record, the given requestor gateway opens and allows the given requestor to request the service; and

b) the exchange of digital certificates between the service gateway and the given requestor gateway, the certificates each comprising a serial number, a host name, an organization ID, and a status, and, upon mutual validation, opening a secure socket layer encrypted tunnel between the service gateway and the given requestor gateway, the tunnel specific to the service and the request;

wherein successful authorization comprises, upon opening of the tunnel, confirmation that the given requestor is listed on an access control list (ACL), the ACL listing certain services accessible by the given requestor, the ACL maintained by the service provider and

wherein the provisioning of the service is mapped end to end for reporting, administration, and security tracking, and wherein the virtual service connection is created independent of, and unknown to any other providers and requestors on the network and disposed of when the service has been provided to the given requestor; and

a data base to provide audit and report management of each provisioning of service activity on the network, the data comprising records identified by a unique request identifier for each request.

2. The network of claim 1 wherein the service provided to the given requestor is provided to another participant at a different fee than the fee charged the given requestor.

3. The network of claim 1 wherein the service provider controls access to each of the service provider'"'"'s services via the service definition, the service definition comprising a service ID, a service description, a service type, and creation date.

4. The network of claim 1 wherein the provider is a bank and the service is one of Bank to Bank, Bank to Corp Customer, Bank to Retail Customer, Bank To Small Business and Bank to Government.

5. The network of claim 1 wherein the appliance is selected from the group consisting of a PC, a laptop and a wireless device.

6. The network of claim 1 wherein the virtual service connection is isolated, private, secure, and tracked independently of other virtual service connection on the pre-existing network.

7. The network of claim 1 wherein the service definition provides for the creation and addition of a new service.

8. The network of claim 1 wherein the provider interacts with a second provider to provide the service.

9. The network of claim 1 wherein multiple virtual secure connections are created among participants having a common community of interest.

10. The network of claim 1 wherein virtual secure connections between a bank, a customer, and a gaming site facilitate real time settlement and clearing of gaming activity.

11. The network of claim 1 wherein the service is a collection of services aggregated from other service providers.