METHOD AND SYSTEM FOR THE EXCHANGE OF DIGITALLY SIGNED OBJECTS OVER AN INSECURE NETWORK

• US 20040010684A1
• Filed: 06/10/1998
• Published: 01/15/2004
• Est. Priority Date: 06/10/1998
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: DOUGLAS, DANIEL GRAHAM
• Granted Patent: US 6,684,332 B1
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity

Abstract

Method and system aspects for authenticated communication of messages among computer systems in an insecure network are described. These aspects include building a first signed object message in a first computer system, the first signed object message including a first sequence number, a first object and a first signature. Further included is sending the first signed object message to a second computer system, verifying the first signed object message in the second computer system, and building a second signed object message in the second computer system for replying to the first computer system when the first signed object message is verified, the second signed object message including a second sequence number, a second object, and a second signature.

Claims

1. A method for authenticated communication of messages among computer systems in an insecure network, the method comprising:

building a first signed object message in a first computer system, the first signed object message including a first sequence number, a first object, and a first signature;

sending the first signed object message to a second computer system;

verifying the first signed object message in the second computer system;

building a second signed object message in the second computer system for replying to the first computer system when the first signed object message is verified, the second signed object message including a second sequence number, a second object, and a second signature.

2. The method of claim 1 wherein building the first signed object further comprises providing a first outgoing sequence number and a certificate for the first computer system in the first object.

3. The method of claim 2 wherein the first signature comprises a distinguished encoder routine sequence.

4. The method of claim 1 wherein building the second signed object further comprises providing the second sequence number as the first sequence number incremented.

5. The method of claim 2 wherein building the second signed object further comprises providing a second outgoing sequence number and a certificate for the second computer system in the second object.

6. The method of claim 5 wherein the second signature comprises a distinguished encoder routine sequence.

7. An authenticated system of communication across an insecure network of computer systems, the system comprising:

a first computer system acting as a sender, the sender sending a first signed object to initiate communication, the first signed object including a first sequence number, a first object, and a first signature; and

a second computer system acting as a recipient, the recipient receiving the first signed object, verifying the first signed object, and when verified, sending a second signed object in reply, the second signed object including a second sequence number, a second object, and a second signature.

8. The system of claim 7 wherein the first object comprises a first outgoing sequence number and a sender certificate.

9. The system of claim 8 wherein the first signature comprises a distinguished encoder rules sequence.

10. The system of claim 7 wherein the second sequence number comprises the first sequence number incremented.

11. The system of claim 8 wherein the second object comprises a second outgoing sequence number and a recipient certificate.

12. The system of claim 11 wherein the second signature comprises a distinguished encoder routine sequence.

13. The system of claim 7 wherein the first and second signed objects are formed through Java programming.

14. A method for achieving authenticated communication over an insecure network of computer systems, the method comprising:

providing a signed object socket;

building signed object messages for authenticated channel communication via the signed object socket; and

performing verification techniques on the signed object messages upon receipt of each signed object message within a computer system to ensure and maintain authenticated channel communication.

15. The method of claim 14 wherein performing verification techniques initiates with a handshake exchange of signed object messages.

16. The method of claim 14 further comprising terminating communication when a failure occurs during the verification.