System and method for implementing an enhanced transport layer security protocol

• US 8,516,242 B2
• Filed: 02/22/2012
• Issued: 08/20/2013
• Est. Priority Date: 08/25/2000
• Status: Expired due to Fees

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Brown, Michael Stephen, Little, Herbert Anthony, Yach, David Paul
• Primary Examiner(s): Gee, Jason
• Application Number:
  US13/402,039
• Publication Number:
  US 20120159150A1
• Time in Patent Office: 545 Days
• Field of Search: 713/151
• US Class Current: 713/151
• CPC Class Codes: G07B 17/00193 Constructional details of apparatus in a franking system
• CPC Class Codes: G07B 2017/00491 Mail/envelope/insert handling system
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/61 Time-dependent

Abstract

A system and method for implementing an enhanced transport layer security (ETLS) protocol is provided. The system includes a primary server, an ETLS servlet and an ETLS software module. The primary server operates on a computer network and is configured to communicate over the computer network using a non-proprietary security protocol. The ETLS servlet also operates on the computer network and is securely coupled to the primary server. The ETLS servlet is configured to communicate over the computer network using an ETLS security protocol. The ETLS software module operates on a mobile device, and is configured to communicate over the computer network using either the non-proprietary security protocol or the ETLS security protocol. Operationally, the ETLS software module initially contacts the server over the computer network using the non-proprietary security protocol, and subsequently contacts the server through the ETLS servlet using the ETLS security protocol.

Claims

1. A method at a mobile device for securely communicating with a server operating on a computer network, comprising:

establishing a wireless connection with a computer network;

establishing a secure connection with the server using a non-proprietary security protocol;

sending a first encrypted service request to the server via the non-proprietary security protocol;

receiving a first encrypted response from the server that includes a unique location of a security servlet operating on the computer network and communicating with the server via a secure link;

sending a second encrypted service request to the security servlet using the unique location of the security servlet, the second service request for decryption by the security servlet and transfer to the server.

2. The method of claim 1, wherein the second encrypted service request is encrypted using a proprietary security protocol.

3. The method of claim 1, wherein the non-proprietary security protocol is one of the Transport Layer Security (TLS) protocol and the Secure Socket Layer (SSL) protocol.

4. The method of claim 1, wherein the first encrypted response includes a custom HTTP response header that identifies the unique location of the security servlet on the computer network.

5. The method of claim 1, wherein the decrypted service request is transferred from the security servlet to the server using a hypertext transfer protocol (HTTP) connection.

6. The method of claim 1, further comprising sending a plurality of additional encrypted service requests to the security servlet, for decryption by the security servlet and transfer to the server.

7. The method of claim 1, further comprising sending an encrypted current time-stamp with the second encrypted service request, for verification of the originality of the second encrypted service request at the security servlet.

8. The method of claim 1, wherein the first encrypted response includes a public key, and wherein the security servlet has a private key configured to decrypt data that has been encrypted using the public key;

the method further comprising encrypting the second encrypted service request using the public key.

9. The method of claim 8, wherein sending the second encrypted service request to the security servlet comprises:

generating a session key;

encrypting a service request with the session key;

encrypting the session key with the public key;

encapsulating the encrypted service request and the encrypted session key according to a transfer mechanism to form the second encrypted service request; and

transmitting the second encrypted service request to the security servlet, for decryption of the session key at the security servlet using the private key and for decryption of the second service request at the security servlet using the session key.

10. The method of claim 9, further comprising:

receiving a response to the second encrypted service request from the security servlet, the response encrypted using the session key.

11. A method at a server for securely communicating with a mobile device via a computer network, comprising:

establishing a secure connection with the mobile device using a non-proprietary security protocol;

receiving a first encrypted service request from the mobile device via the non-proprietary security protocol;

sending a first encrypted response to the mobile device that includes the unique location of a security servlet operating on the computer network and communicating with the server via a secure link;

receiving a second encrypted service request from the mobile device via the security servlet, the second service request having been received and decrypted by the security servlet and transferred to the server.

12. The method of claim 11, wherein the second encrypted service request is encrypted using a proprietary security protocol.

13. The method of claim 11, wherein the non-proprietary security protocol is one of the Transport Layer Security (TLS) protocol and the Secure Socket Layer (SSL) protocol.

14. The method of claim 11, wherein the first encrypted response includes a custom HTTP response header that identifies the unique location of the security servlet on the computer network.

15. The method of claim 11, wherein the decrypted second service request is received via the security servlet using a hypertext transfer protocol (HTTP) connection.

16. The method of claim 11, further comprising receiving a plurality of additional encrypted service requests from the mobile device via the security servlet, each additional encrypted service request having been received and decrypted by the security servlet and transferred to the server.

17. The method of claim 11, wherein an encrypted current time-stamp is received at the security servlet from the mobile device with the second encrypted service request, and wherein the security servlet is configured to verify the originality of the second encrypted service request by decrypting the encrypted current time-stamp and comparing it with a connection log maintained by the security servlet.

18. The method of claim 11, wherein:

the first encrypted response includes a public key;

the security servlet has a private key configured to decrypt data that has been encrypted using the public key; and

the second encrypted service request is encrypted by the mobile device using the public key.

19. The method of claim 18, wherein the second encrypted service request is encapsulated with a session key encrypted with the public key, and wherein the security servlet is configured to decrypt the session key using the private key, and to decrypt the second encrypted service request using the session key.

20. The method of claim 19, further comprising:

generating a response to the service request at the server;

transferring the response from the server to the security servlet, for encryption of the response using the session key and transmission of the encrypted response from the security servlet to the mobile device.