One pass security

• US 20030079143A1
• Filed: 03/12/2002
• Published: 04/24/2003
• Est. Priority Date: 10/22/2001
• Status: Active Grant

• Current Assignee: Extended Systems Inc. (SAP SE)
• Original Assignee: Extended Systems Inc. (SAP SE)
• Inventors: Wilkins, Mark, Mikel, Dean
• Granted Patent: US 7,281,128 B2
• Time in Patent Office: Days
• US Class Current: 713/200
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A system and method for secure network communication. In various embodiments of the present invention, data needed for authentication an encryption is included in each communication pass between network devices, so that when a network connection is broken, a secure connection can be reestablished with the next pass. A client authentication service on the client receives a server request and searches for a current client-side session key. If one is not present, the client authentication service generates and encrypts an initial session key, acquires credentials, adds the credentials to the server request, and encrypts the server request with the initial session key. The encrypted server request and the encrypted session key are sent to the server, where a server authentication service decrypts the initial session key, decrypts the server request with the initial session key, and authenticates the credentials before allowing the server request to be acted upon. Where a current client-side session key is detected, the client authentication service acquires the current client-side session key, generates a next step session key, adds the next step session key to the server request, and encrypts the server request with the current client-side session key. The encrypted server request is sent to the server where the server authentication service decrypts the server request with a current server-side session key allowing the server request to be acted upon.

Claims

1. A method for secure network communication at the start of a session, comprising the acts of:

receiving a server request;

generating and encrypting a session key;

acquiring and adding credentials to the server request;

encrypting the server request with the session key;

sending the encrypted server request and encrypted session key to a server;

decrypting the session key;

decrypting the server request with the session key;

authenticating the credentials; and

acting on the server request if the credentials are authentic.

2. The method of claim 1, further comprising the acts of:

generating a checksum;

adding the checksum to the server request before encrypting the server request; and

after decrypting, verifying the checksum prior to acting on the server request.

3. The method of claim 1, further comprising the acts of:

generating a session counter;

adding the session counter to the server request before encrypting the server request; and

after decrypting the server request, storing the session counter for use in future network communications.

4. The method of claim 1, wherein the act of acquiring credentials comprises acquiring a username and a password, adding the password to the server request, and wherein the act of sending also includes sending the username, and wherein the act of authenticating the credentials comprises authenticating the username and the password.

5. The method of claim 1, wherein the act of acting on the server request comprises:

generating a client response;

encrypting the client response with the session key; and

sending the response.

6. The method of claim 5, further comprising the acts of

generating a next step session key and adding the next step session key to the client response prior to encrypting;

storing the next step session key to be used as a current server-side session key to decrypt a subsequent server request;

decrypting the client response with the session key; and

storing the next step session key to be used as a current client-side session key used to encrypt the subsequent server request.

7. A method secure network communication during an existing session, comprising the acts of:

receiving a server request;

acquiring a current client-side session key;

generating and adding a next step session key to the server request;

encrypting the server request with the current client-side session key;

sending the server request;

acquiring a current server-side session key;

decrypting the server request with the current server-side session key; and

acting on the server request.

8. The method of claim 7, further comprising the acts of:

generating a checksum;

adding the checksum to the server request before encrypting the server request; and

after decrypting, verifying the checksum prior to acting on the server request.

9. The method of claim 7, further comprising the acts of:

updating a session counter;

adding the updated session counter to the server request before encrypting the server request;

after decrypting the server request, comparing the updated session counter with a last stored session counter; and

wherein the act of acting on the server request comprises acting on the server request only if the updated session counter exceeds the last stored session counter.

10. The method of claim 7, further comprising adding a device identifier to the server request before sending, and wherein the act of acquiring the current server-side session key comprises utilizing the device identifier to acquire the current server-side session key.

11. The method of claim 10, further comprising, after decrypting the server request, storing the next step session key such that it is accessible using the device identifier, the next step session key to act as a current server-side session key used to decrypt a subsequent server request.

12. The method of claim 7, wherein the act of acting on the server request comprises:

generating a client response;

generating a new next step session key and adding the new next step session key to the client response;

storing the new next step session key to be used as a current server-side session key to decrypt a subsequent server request;

encrypting the client response with the next step session key sent with the server request;

sending the client response;

decrypting the client response with the next step session key sent with the server request; and

storing the new next step session key to be used as a current client-side session key to encrypt the subsequent server request.

13. A method for secure network communication, comprising

receiving a server request;

detecting the presence of a current client-side session key;

if a current client-side session key is not detected, generating and encrypting an initial session key, acquiring credentials, adding the credentials to the server request, encrypting the server request with the initial session key, sending the encrypted server request and the encrypted session key to a server, decrypting the initial session key, decrypting the server request with the initial session key, and authenticating the credentials;

if a current client-side session key is detected, acquiring the current client-side session key, generating a next step session key, adding the next step session key to the server request, and encrypting the server request with the current client-side session key, sending the encrypted server request, and decrypting the server request with a current server-side session key; and

acting on the server request.

14. The method of claim 13, further comprising the acts of:

generating a checksum;

adding the checksum to the server request before encrypting the server request whether or not a current client-side session key is detected; and

verifying the checksum prior to acting on the server request.

15. The method of claim 13, further comprising the acts of:

if a current client-side session key is not detected, generating a session counter and adding the session counter to the server request before encrypting the server request, and, after decrypting the server request, storing the session counter for use in future network communications; and

if a current client-side session key is detected, updating the session counter, adding the updated session counter to the server request before encrypting the server request, after decrypting the server request, and comparing the updated session counter with a last stored session counter before acting on the server request.

16. The method of claim 13, wherein the act of acquiring credentials comprises acquiring a username and a password, and wherein the act of authenticating the credentials comprises authenticating the username and the password.

17. The method of claim 13, further comprising, where a current client-side session key is detected, adding a device identifier to the server request, and wherein the act of acquiring the current server-side session key comprises utilizing the device identifier to acquire the current server-side session key.

18. The method of claim 13, wherein the act of acting on the server request comprises:

generating a client response;

where a current client-side session key is detected, generating a next step session key, adding the next step session key to the response, and encrypting the client response with the initial session key;

where current a client-side session key is not detected, generating a new next step session key, adding the new next step session key to the client response, and encrypting the client response with the next step session key sent with the server request;

storing the generated next step session key, new or not, to be used as a current server-side session key to decrypt a subsequent server request; and

sending the encrypted client response.

19. The method of claim 18, further comprising the acts of

where a current client-side session key is not detected, decrypting the server response with the initial session key and storing the next step session key to be uses as a current client-side session key to encrypt a subsequent server request;

and

where a current client-side session key is detected, decrypting the server response with the next step session key sent with the session request and storing the new next step session key to be used as a current client-side session key to encrypt a subsequent server request.

20. A computer program product for secure network communication at the start of a session, the product comprising computer useable medium having computer readable instructions thereon for:

receiving a server request;

generating and encrypting a session key;

acquiring and adding credentials to the server request;

encrypting the server request with the session key;

sending the encrypted server request and encrypted session key to a server;

decrypting the session key;

decrypting the server request with the session key;

authenticating the credentials; and

acting on the server request if the credentials are authentic.

21. The product of claim 20, further comprising instructions for:

generating a checksum;

adding the checksum to the server request before encrypting the server request; and

after decrypting, verifying the checksum prior to acting on the server request.

22. The product of claim 20, further comprising instructions for:

generating a session counter;

adding the session counter to the server request before encrypting the server request; and

after decrypting the server request, storing the session counter for use in future network communications.

23. The product of claim 20, wherein the instructions for acquiring credentials comprise instructions for acquiring a username and a password and adding the password to the server request, and wherein the instructions for sending include instructions for sending the username, and wherein the instructions for authenticating the credentials includes authenticating the username and the password.

24. The product of claim 20, wherein the instructions for acting on the server request comprise instructions for:

generating a client response;

encrypting the client response with the session key; and

sending the response.

25. The product of claim 24, further comprising instructions for:

generating a next step session key and adding the next step session key to the client response prior to encrypting;

storing the next step session key to be used as a current server-side session key to decrypt a subsequent server request;

decrypting the client response with the session key; and

storing the next step session key to be used as a current client-side session key used to encrypt the subsequent server request.

26. A computer program product for secure network communication during an existing session, the product comprising computer useable medium having computer readable instructions thereon for:

receiving a server request;

acquiring a current client-side session key;

generating and adding a next step session key to the server request;

encrypting the server request with the current client-side session key;

sending the server request;

acquiring a current server-side session key;

decrypting the server request with the current server-side session key; and

acting on the server request.

27. The product of claim 26, further comprising instructions for:

generating a checksum;

adding the checksum to the server request before encrypting the server request; and

after decrypting, verifying the checksum prior to acting on the server request.

28. The product of claim 26, further comprising instructions for:

updating a session counter;

adding the updated session counter to the server request before encrypting the server request;

after decrypting the server request, comparing the updated session counter with a last stored session counter; and

wherein the act of acting on the server request comprises acting on the server request only if the updated session counter exceeds the last stored session counter.

29. The product of claim 26, further comprising instructions for adding a device identifier to the server request before sending, and wherein the act of acquiring the current server-side session key comprises utilizing the device identifier to acquire the current server-side session key.

30. The product of claim 29, further comprising instructions for, after decrypting the server request, storing the next step session key such that it is accessible using the device identifier, the next step session key to act as a current server-side session key used to decrypt a subsequent server request.

31. The product of claim 26, wherein the instructions for acting on the server request comprise instructions for:

generating a client response;

generating a new next step session key and adding the new next step session key to the client response;

storing the new next step session key to be used as a current server-side session key to decrypt a subsequent server request;

encrypting the client response with the next step session key sent with the server request;

sending the client response;

decrypting the client response with the next step session key sent with the server request; and

storing the new next step session key to be used as a current client-side session key to encrypt the subsequent server request.

32. A computer program product for secure network communication, the product comprising computer useable medium having computer readable instructions thereon for:

receiving a server request;

detecting the presence of a current client-side session key;

if current client-side session key is not detected, generating and encrypting an initial session key, acquiring credentials, adding the credentials to the server request, encrypting the server request with the initial session key, sending the encrypted server request and the encrypted session key to a server, decrypting the initial session key, decrypting the server request with the initial session key, and authenticating the credentials;

if a current client-side session key is detected, acquiring the current client-side session key, generating a next step session key, adding the next step session key to the server request, and encrypting the server request with the current client-side session key, sending the encrypted server request, and decrypting the server request with a current server-side session key; and

acting on the server request.

33. The product of claim 32, further comprising instructions for:

generating a checksum;

adding the checksum to the server request before encrypting the server request whether or not a current client-side session key is detected; and

verifying the checksum prior to acting on the server request.

34. The product of claim 32, further comprising instructions for:

if a current client-side session key is not detected, generating a session counter and adding the session counter to the server request before encrypting the server request, and, after decrypting the server request, storing the session counter for use in future network communications; and

if a current client-side session key is detected, updating the session counter, adding the updated session counter to the server request before encrypting the server request, after decrypting the server request, and comparing the updated session counter with a last stored session counter before acting on the server request.

35. The product of claim 32, wherein the instructions for acquiring credentials comprise instructions for acquiring a username and a password, and wherein the instructions for authenticating the credentials comprise instructions for authenticating the username and the password.

36. The product of claim 32, further comprising, where a current client-side session key is detected, instructions for adding a device identifier to the server request, and wherein the instructions for acquiring the current server-side session key comprise instructions for utilizing the device identifier to acquire the current server-side session key.

37. The product of claim 32, wherein the instructions for acting on the server request comprise instructions for:

generating a client response;

where a current client-side session key is detected, generating a next step session key, adding the next step session key to the response, and encrypting the client response with the initial session key;

where current a client-side session key is not detected, generating a new next step session key, adding the new next step session key to the client response, and encrypting the client response with the next step session key sent with the server request;

storing the generated next step session key, new or not, to be used as a current server-side session key to decrypt a subsequent server request; and

sending the encrypted client response.

38. The product of claim 37, further comprising instructions for:

where a current client-side session key is not detected, decrypting the server response with the initial session key and storing the next step session key to be uses as a current client-side session key to encrypt a subsequent server request; and

where a current client-side session key is detected, decrypting the server response with the next step session key sent with the server request and storing the new next step session key to be used as a current client-side session key to encrypt a subsequent server request.

39. A system for secure network communication, comprising:

a request builder operable to act on a server request;

a client encryption module operable to generate session keys, encrypt the server request with a generated or an acquired session key, and to decrypt a client response with a generated or an acquired session key;

a response builder operable to act on the client response generated in response to the server request; and

a server encryption module operable to generate session keys, encrypt the client response with a generated or an acquired session key, and to decrypt the server request with an acquired session key.

40. The system of claim 39, wherein:

the request builder is further operable add credentials to the server request and to add a next step session key to the server request;

the client encryption module is further operable to detect whether a current client-side session key is available;

if a current client-side session key is not available, to generate an initial session key, to encrypt the server request, including the credentials, with the initial session key, and to encrypt the initial session key with a server public key;

If a current client-side session key is available, to generate a next step session key and to encrypt the server request, including the next step session key, with the current client side session key and to store the next step session key in the client database as a current client-side session key to be used to decrypt a subsequent client response;

the server encryption module being further operable to;

decrypt the initial session key with a server private key;

decrypt the server request with the initial session key or a current server-side session key; and

encrypt the client response with the next step session key.

41. The system of claim 40, wherein the client authentications service further includes a client integrity module operable to create a checksum for the server request, the request builder being further operable to add the checksum to the server request, and wherein the server authentication service further comprises a server integrity module operable to validate the integrity of the server request using the checksum.

42. The system of claim 40, wherein the client authentication service further includes a client sequence module operable to create and update a session counter, the request builder being further operable to add the session counter to the server request, and wherein the server authentication service further comprises a server sequence module operable to validate the session counter.

43. The system of claim 40, wherein the server encryption module is further operable to:

generate and store a new next step session key to be used as a current server-side session key to decrypt a subsequent server request; and

to

encrypt a client response using the next step session key or the initial session key provided with the server request;

wherein the response builder is further operable to add the new next step session key to the client response.

44. The system of claim 43, wherein the server authentication service further includes a server integrity module operable to create a checksum for the client response, the response builder being further operable to add the checksum to the client response, and wherein the client authentication service further comprises a client integrity module operable to validate the integrity of the client response using the checksum.

45. A system for secure network communication, comprising:

a means for adding a session key and a session counter to a server request;

a means adding a session key to a client response adding a session key;

a means for generating session keys;

a means for encrypting a session key with a server public key;

a means for encrypting the server request with a generated or an acquired session key, and decrypting the client response with a generated or an acquired session key;

a means for encrypting the client response with a generated or an acquired session key and to decrypting the server request with an acquired session key;

a means for passing encrypted server requests, encrypted client responses, and encrypted session keys between a client and a server; and

a means for validating the session counter.