Method and computer system for performing transactions between a client and a server

• US 8,825,554 B2
• Filed: 06/08/2007
• Issued: 09/02/2014
• Est. Priority Date: 06/13/2006
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Camenisch, Jan Leonhard, Shelat, Abhi A., Sommer, Dieter M., Zimmermann, Roger Daniel
• Primary Examiner(s): KIM, STEVEN S
• Application Number:
  US11/760,026
• Publication Number:
  US 20070288750A1
• Time in Patent Office: 2,643 Days
• Field of Search: 705/67, 705/74, 705/76, 705/27.1, 713/168
• US Class Current: 705/74
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06Q 20/36 using electronic wallets or electronic money safes
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/383 Anonymous user system
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A method and system for performing transactions between a client and a server. The client sends to the server a transaction request for performing a transaction, and receives from the server a transaction policy. The client displays a first representation of the transaction policy depicting transaction policy options for fulfilling the transaction policy. After the user selects a first transaction policy option, the client displays a second representation of the transaction policy, depicting at least one mechanism pertaining to the first transaction policy option for satisfying the requirements of the first transaction policy option. After the user selects a first mechanism, the client depicts evidence options for each requirement of the first transaction policy option. After the user selects an evidence option for each requirement of the first transaction policy option, the client sends to the server transaction enablement information that includes evidence dictated by the selected evidence options.

Claims

1. A method for performing transactions between a client computer and a server, said method comprising:

said client computer sending a transaction request to the server for performing a transaction;

said client computer receiving from the server, a response to the transaction request, said response comprising a transaction policy or an address at which the transaction policy may be retrieved by the client computer from storage at the address, said transaction policy specifying criteria for performing the transaction in accordance with the transaction request;

said client computer determining whether the response comprises the transaction policy or the address;

if the client computer determines that the response comprises the transaction policy, then said client computer retrieving the transaction policy from the response;

if the client computer determines that the response comprises the address, then said client computer retrieving the transaction policy from the storage at the address;

said client computer displaying, in a first window of a screen of the client computer, a first representation of the retrieved transaction policy, said first representation depicting a plurality of transaction policy options for fulfilling the transaction policy together with a respectively associated plurality of transaction management module activation elements that comprise a first transaction management module activation element that is activated, each transaction policy option comprising at least one requirement for fulfilling the transaction policy;

said client computer receiving a selection, made by a user at the client computer, of a first transaction policy option of the plurality of transaction policy options;

responsive to selection by the user of the first transaction policy option, said client computer displaying in a second window of the screen a second representation of the transaction policy such that the second representation in the second window is overlayed on the first representation in the first window and is displayed in the second window with a visual tie to the first transaction management module activation element displayed in the first representation in the first window, said first window comprising a visual indication that the first transaction management module activation element is activated to denote said selection by the user of the first transaction policy option, said second representation being displayed only while the first transaction management module activation element is activated, said second representation being associated with the first transaction policy option and simultaneously displaying an information menu and a mechanism menu in different non-overlapping portions of the screen, said information menu offering the user information about the transaction policy, said mechanism menu being specific to the selected first transaction policy option and depicting at least one mechanism pertaining to only the first transaction policy option for satisfying a first requirement of the at least one requirement of the first transaction policy option;

said client computer receiving a selection, made by the user, of a first mechanism of the depicted at least one mechanism pertinent to the first transaction policy option;

responsive to said selection by the user of the first mechanism, said client computer displaying in a third window of the screen at least one evidence option for proving that the first requirement is satisfied, said at least one evidence option for the first requirement being specific to the first mechanism, said third window overlaying a portion of the second window;

said client computer receiving a selection, made by the user, of an evidence option of the depicted at least one evidence option for each requirement of the first transaction policy option; and

following said selection by the user of the evidence option, said client computer sending transaction enablement information from the client computer to the server, said transaction enablement information comprising evidence dictated by each selected evidence option, said evidence enabling performance of the transaction by the server.

2. The method of claim 1, wherein a browser plugin is plugged into a browser comprised by the client computer and is coupled to a wallet comprised by the client computer, wherein the browser performs said sending the transaction request to the server, and wherein the method comprises:

prior to said sending the transaction request to the server, said wallet receiving, from an identity provider that is distinct from the server, private certificates comprising anonymous credentials of the user and said wallet storing the received privates certificates in the client computer, wherein none of said private certificates are sent to the server after said receiving the private certificates from the identity provider;

after said receiving the response, said browser sending a processing request to the browser plugin to process the response;

said browser plugin receiving the processing request sent by the browser;

in response to said receiving the processing request, said browser plugin parsing the response to determine where in the first representation to place the transaction management module activation elements during said displaying the first representation of the retrieved transaction policy.

3. The method of claim 2, wherein the selected evidence option is a certified assertion, and wherein said sending transaction enablement information from the client computer to the server comprises:

said wallet receiving from the browser plugin a request for an authentication protocol message, said request for the authentication protocol message including the selected first transaction policy option;

responsive to said receiving the request for the authentication protocol message, said wallet generating, from the private certificates stored in the client computer and based on a comparison between the selected first transaction policy option and the private certificates stored in the client computer, a certified assertion for the selected first transaction policy option;

said wallet generating the authentication protocol message that includes the certified assertion generated by the wallet;

said browser plugin receiving, from the wallet, the generated authentication protocol message that comprises the certified assertion;

after said receiving the authentication protocol message, said browser plugin sending the authentication protocol message to the server;

said browser plugin receiving from the server an access credential reflective of the server having checked the certified assertion in the authentication protocol message received by the server from the browser plugin;

after said receiving the access credential, said browser plugin sending, to the browser, the access credential together with a request to resend the transaction request to the server; and

said browser plugin resending the transaction request to the server such that the transaction request being resent further comprises the access credential, to enable the server to perform the transaction in response to the server verifying the access credential in the resent transaction request.

4. The method of claim 1, wherein the first mechanism is recited in the second representation as being a mechanism used at a previous session.

5. The method of claim 4, wherein the at least one evidence option comprises a plurality of evidence options, said evidence options denoting dates of respective previous sessions in which evidence pertaining to the first transaction policy option for satisfying the at least one requirement of the first transaction policy option was utilized.

6. The method of claim 1, wherein the at least one mechanism pertinent to the first transaction policy option consists of a plurality of mechanisms.

7. The method of claim 1, wherein the evidence comprises one or more statements about the identity of a user.

8. The method of claim 1, wherein the evidence comprises a certified assertion derived from a private certificate.

9. The method of claim 1, wherein the response comprises the transaction policy.

10. The method of claim 1, wherein the response comprises the address.

11. The method of claim 1, wherein the transaction request is a request to access a restricted area of a resource of the server.

12. A computer system comprising a client computer, said client computer comprising a processor and a computer readable memory unit coupled to the processor, said memory unit containing instructions that when executed by the processor performs a method for performing transactions between the client computer and a server, said method comprising:

said client computer sending a transaction request to the server for performing a transaction;

said client computer receiving from the server, a response to the transaction request, said response comprising a transaction policy or an address at which the transaction policy may be retrieved by the client computer from storage at the address, said transaction policy specifying criteria for performing the transaction in accordance with the transaction request;

said client computer determining whether the response comprises the transaction policy or the address;

if the client computer determines that the response comprises the transaction policy, then said client computer retrieving the transaction policy from the response;

if the client computer determines that the response comprises the address, then said client computer retrieving the transaction policy from the storage at the address;

said client computer displaying, in a first window of a screen of the client computer, a first representation of the retrieved transaction policy, said first representation depicting a plurality of transaction policy options for fulfilling the transaction policy together with a respectively associated plurality of transaction management module activation elements that comprise a first transaction management module activation element that is activated, each transaction policy option comprising at least one requirement for fulfilling the transaction policy;

said client computer receiving a selection, made by a user at the client computer, of a first transaction policy option of the plurality of transaction policy options;

responsive to selection by the user of the first transaction policy option, said client computer displaying in a second window of the screen a second representation of the transaction policy such that the second representation in the second window is overlayed on the first representation in the first window and is displayed in the second window with a visual tie to the first transaction management module activation element displayed in the first representation in the first window, said first window comprising a visual indication that the first transaction management module activation element is activated to denote said selection by the user of the first transaction policy option, said second representation being displayed only while the first transaction management module activation element is activated, said second representation being associated with the first transaction policy option and simultaneously displaying an information menu and a mechanism menu in different non-overlapping portions of the screen, said information menu offering the user information about the transaction policy, said mechanism menu being specific to the selected first transaction policy option and depicting at least one mechanism pertaining to only the first transaction policy option for satisfying a first requirement of the at least one requirement of the first transaction policy option;

said client computer receiving a selection, made by the user, of a first mechanism of the depicted at least one mechanism pertinent to the first transaction policy option;

responsive to said selection by the user of the first mechanism, said client computer displaying in a third window of the screen at least one evidence option for proving that the first requirement is satisfied, said at least one evidence option for the first requirement being specific to the first mechanism, said third window overlaying a portion of the second window;

said client computer receiving a selection, made by the user, of an evidence option of the depicted at least one evidence option for each requirement of the first transaction policy option; and

following said selection by the user of the evidence option, said client computer sending transaction enablement information from the client computer to the server, said transaction enablement information comprising evidence dictated by each selected evidence option, said evidence enabling performance of the transaction by the server.

13. The computer system of claim 12, wherein a browser plugin is plugged into a browser comprised by the client computer and is coupled to a wallet comprised by the client computer, wherein the browser performs said sending the transaction request to the server, and wherein the method comprises:

prior to said sending the transaction request to the server, said wallet receiving, from an identity provider that is distinct from the server, private certificates comprising anonymous credentials of the user and said wallet storing the received privates certificates in the client computer, wherein none of said private certificates are sent to the server after said receiving the private certificates from the identity provider;

after said receiving the response, said browser sending a processing request to the browser plugin to process the response;

said browser plugin receiving the processing request sent by the browser;

in response to said receiving the processing request, said browser plugin parsing the response to determine where in the first representation to place the transaction management module activation elements during said displaying the first representation of the retrieved transaction policy.

14. The computer system of claim 13, wherein the selected evidence option is a certified assertion, and wherein said sending transaction enablement information from the client computer to the server comprises:

said wallet receiving from the browser plugin a request for an authentication protocol message, said request for the authentication protocol message including the selected first transaction policy option;

responsive to said receiving the request for the authentication protocol message, said wallet generating, from the private certificates stored in the client computer and based on a comparison between the selected first transaction policy option and the private certificates stored in the client computer, a certified assertion for the selected first transaction policy option;

said wallet generating the authentication protocol message that includes the certified assertion generated by the wallet;

said browser plugin receiving, from the wallet, the generated authentication protocol message that comprises the certified assertion;

after said receiving the authentication protocol message, said browser plugin sending the authentication protocol message to the server;

said browser plugin receiving from the server an access credential reflective of the server having checked the certified assertion in the authentication protocol message received by the server from the browser plugin;

after said receiving the access credential, said browser plugin sending, to the browser, the access credential together with a request to resend the transaction request to the server; and

said browser plugin resending the transaction request to the server such that the transaction request being resent further comprises the access credential, to enable the server to perform the transaction in response to the server verifying the access credential in the resent transaction request.

15. A computer program product, comprising a computer readable storage hardware having a computer readable program code stored therein, said computer readable program code containing instructions that when executed by a processor of a client computer of a computer system performs a method for performing transactions between the client computer and a server, said method comprising:

said client computer sending a transaction request to the server for performing a transaction;

said client computer receiving from the server, a response to the transaction request, said response comprising a transaction policy or an address at which the transaction policy may be retrieved by the client computer from storage at the address, said transaction policy specifying criteria for performing the transaction in accordance with the transaction request;

said client computer determining whether the response comprises the transaction policy or the address;

if the client computer determines that the response comprises the transaction policy, then said client computer retrieving the transaction policy from the response;

if the client computer determines that the response comprises the address, then said client computer retrieving the transaction policy from the storage at the address;

said client computer displaying, in a first window of a screen of the client computer, a first representation of the retrieved transaction policy, said first representation depicting a plurality of transaction policy options for fulfilling the transaction policy together with a respectively associated plurality of transaction management module activation elements that comprise a first transaction management module activation element that is activated, each transaction policy option comprising at least one requirement for fulfilling the transaction policy;

said client computer receiving a selection, made by a user at the client computer, of a first transaction policy option of the plurality of transaction policy options;

responsive to selection by the user of the first transaction policy option, said client computer displaying in a second window of the screen a second representation of the transaction policy such that the second representation in the second window is overlayed on the first representation in the first window and is displayed in the second window with a visual tie to the first transaction management module activation element displayed in the first representation in the first window, said first window comprising a visual indication that the first transaction management module activation element is activated to denote said selection by the user of the first transaction policy option, said second representation being displayed only while the first transaction management module activation element is activated, said second representation being associated with the first transaction policy option and simultaneously displaying an information menu and a mechanism menu in different non-overlapping portions of the screen, said information menu offering the user information about the transaction policy, said mechanism menu being specific to the selected first transaction policy option and depicting at least one mechanism pertaining to only the first transaction policy option for satisfying a first requirement of the at least one requirement of the first transaction policy option;

said client computer receiving a selection, made by the user, of a first mechanism of the depicted at least one mechanism pertinent to the first transaction policy option;

responsive to said selection by the user of the first mechanism, said client computer displaying in a third window of the screen at least one evidence option for proving that the first requirement is satisfied, said at least one evidence option for the first requirement being specific to the first mechanism, said third window overlaying a portion of the second window;

said client computer receiving a selection, made by the user, of an evidence option of the depicted at least one evidence option for each requirement of the first transaction policy option; and

following said selection by the user of the evidence option, said client computer sending transaction enablement information from the client computer to the server, said transaction enablement information comprising evidence dictated by each selected evidence option, said evidence enabling performance of the transaction by the server.

16. The computer program product of claim 15, wherein a browser plugin is plugged into a browser comprised by the client computer and is coupled to a wallet comprised by the client computer, wherein the browser performs said sending the transaction request to the server, and wherein the method comprises:

prior to said sending the transaction request to the server, said wallet receiving, from an identity provider that is distinct from the server, private certificates comprising anonymous credentials of the user and said wallet storing the received privates certificates in the client computer, wherein none of said private certificates are sent to the server after said receiving the private certificates from the identity provider;

after said receiving the response, said browser sending a processing request to the browser plugin to process the response;

said browser plugin receiving the processing request sent by the browser;

in response to said receiving the processing request, said browser plugin parsing the response to determine where in the first representation to place the transaction management module activation elements during said displaying the first representation of the retrieved transaction policy.

17. The computer program product of claim 16, wherein the selected evidence option is a certified assertion, and wherein said sending transaction enablement information from the client computer to the server comprises:

said wallet receiving from the browser plugin a request for an authentication protocol message, said request for the authentication protocol message including the selected first transaction policy option;

responsive to said receiving the request for the authentication protocol message, said wallet generating, from the private certificates stored in the client computer and based on a comparison between the selected first transaction policy option and the private certificates stored in the client computer, a certified assertion for the selected first transaction policy option;

said wallet generating the authentication protocol message that includes the certified assertion generated by the wallet;

said browser plugin receiving, from the wallet, the generated authentication protocol message that comprises the certified assertion;

after said receiving the authentication protocol message, said browser plugin sending the authentication protocol message to the server;

said browser plugin receiving from the server an access credential reflective of the server having checked the certified assertion in the authentication protocol message received by the server from the browser plugin;

after said receiving the access credential, said browser plugin sending, to the browser, the access credential together with a request to resend the transaction request to the server; and

said browser plugin resending the transaction request to the server such that the transaction request being resent further comprises the access credential, to enable the server to perform the transaction in response to the server verifying the access credential in the resent transaction request.