METHOD AND APPARATUS FOR MAINTAINING SECURITY IN A PUSH SERVER

• US 20040068665A1
• Filed: 01/28/2002
• Published: 04/08/2004
• Est. Priority Date: 04/30/1998
• Status: Active Grant

• Current Assignee: Unwired Planet LLC (JP Morgan Chase & Co)
• Original Assignee: Openwave Systems Incorporated (JP Morgan Chase & Co)
• Inventors: Fox, Mark A., King, Peter F., Ramasubramani, Seetharaman
• Granted Patent: US 6,742,127 B2
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 12/1859 adapted to provide push services, e.g. data channels
• CPC Class Codes: H04L 12/189 in combination with wireless systems selective distribution or broadcast in wireless communication networks H04W4/06
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 67/55 Push-based network services
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 12/106 Packet or message integrity
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices

Abstract

A secure push server is disclosed. The push server is used for sending notifications to different wireless clients on different wireless networks. The push server allows information service providers to send notifications to the wireless clients. The information service providers initiate a request to the push server that includes updated information. The request also includes a certificate from the information service provider. The push server authenticates the request from the information service provider by verifying the certificate. The push server also determines if the certificate was issued from an acceptable certificate authority by examining an acceptable certificate authority list. Finally, the push server checks the content of the notification to be sure it does not interfere with other information service providers. After performing the security checks, the push server processes the notification request.

Claims

1. A method of delivering notifications from an information server to a push server, said method comprising:

initiating a request from said information server computer having updated information to said push server, said request including a certificate from said information server;

authenticating said information server by verifying said certificate;

determining if said certificate was issued from an acceptable certificate authority by examining an acceptable certificate authority list; and

processing said request if said certificate was issued by an acceptable certificate authority and said certificate was verified.

2. The method as claimed in claim 1 further comprising:

verifying that said request refers to information that originates from a server within a domain closely associated with said information server.

3. The method as claimed in claim 1 wherein processing said request comprises:

examining a default security policy; and

allowing said request if said default policy is to allow access else denying said request if said default policy is to deny access.

4. The method as claimed in claim 3 wherein processing said request comprises:

examining an access control list; and

allowing said request if said default policy is to deny access and said information server is listed in said access control exception list.

5. The method as claimed in claim 1 wherein processing said request comprises:

examining an access control list; and

allowing or denying said request depending on if said information server is in said access control list.

6. The method as claimed in claim 1 wherein processing said request comprises sending a notification across a wireless network to a wireless computing device.

7. The method as claimed in claim 1 wherein initiating a request from said information server comprises initiating an SSL connection from said information server to said push server.

8. The method as claimed in claim 1 wherein said certificate comprises an X.509 digital certificate.

9. The method as claimed in claim 1 further comprising:

examining if said request refers to an earlier request; and

verifying that said request comes from a same entity that sent said earlier request if said request refers to said earlier request.

10. The method as claimed in claim 1 further comprising:

examining said request; and

rejecting said request if said request contains a URL that refers to a domain not closely associated with a domain name in said certificate.

11. The method as claimed in claim 10 wherein rejecting said request if said request contains a URL that refers to a reference domain name not closely associated with said domain name in said certificate comprises requiring a net_loc of said URL to be said domain name or an immediate superdomain of said domain name.

12. The method as claimed in claim 1 further comprising:

examining said request to determine if said request contains a URL; and

rejecting said request if said URL is not absolute or does not contain a net_loc.

13. An apparatus for delivering notifications to a set of wireless client devices on a wireless network, said apparatus comprising:

a computer network;

an information server, said information server coupled to said computer network, said information server having a site certificate;

a push server, said push server coupled to said wireless network, said push server coupled to said computer network, said push server accepting requests that include said site certificate from said information server, said push server verifying said site certificate and processing said requests after verifying said site certificates.

14. The apparatus as claimed in claim 13 wherein said push server further verifies that said site certificate was issued by an acceptable certificate authority.

15. The apparatus as claimed in claim 13 wherein said computer network comprises the global Internet.

16. The apparatus as claimed in claim 13 wherein said certificate comprises an X.509 digital certificate delivered with an SSL connection.

17. The apparatus as claimed in claim 13 wherein said push server examines said request to determine if said request refers to an earlier request and verifies that said request comes from a same entity that sent said earlier request if said request refers to said earlier request.

18. The apparatus as claimed in claim 13 wherein said push server further verifies that said request does not refer to a reference domain name not closely related to a domain name identified in said site certificate.

19. The apparatus as claimed in claim 18 wherein said push server rejects said request if said request contains a URL that does not match said domain name identified in said site certificate or an immediate superdomain of said domain name identified in said site certificate.

20. A method of delivering notifications from an information server to a push server, said method comprising:

initiating a request from said information server having updated information to said push server;

authenticating said information server; and

verifying that a content of said request is acceptable.

21. The method as claimed in claim 20 wherein authenticating said information server comprises verifying a certificate.

22. The method as claimed in claim 21 wherein said certificate comprises an X.509 digital certificate.

23. The method as claimed in claim 21 wherein authenticating said information server further comprises verifying that said certificate was issued by an acceptable certificate authority.

24. The method as claimed in claim 20 wherein initiating a request comprises making an SSL connection from said information server to said push server.

25. The apparatus as claimed in claim 20 wherein verifying that a content of said request is acceptable comprises:

examining said request to see if said request contains a URL; and

rejecting said request when said URL refers to a domain name not closely associated with an authenticated domain name in a certificate.

26. The apparatus as claimed in claim 25 wherein rejecting said request when said URL refers to a domain name not closely associated with said authenticated domain name in a certificate comprises requiring said URL to be said authenticated domain name or an immediate superdomain of said authenticated domain name.

27. The apparatus as claimed in claim 20 further comprising:

examining if said request refers to an earlier request; and

verifying that said request comes from a same entity that sent said earlier request if said request refers to said earlier request.

28. The apparatus as claimed in claim 20 further comprising:

examining an access control list; and

processing or denying said request depending on if a domain name associated with said information server is in said access control list.