A SYSTEM AND METHOD OF EXPLOITING THE SECURITY OF A SECURE COMMUNICATION CHANNEL TO SECURE A NON-SECURE COMMUNICATION CHANNEL

• US 20050050317A1
• Filed: 05/28/2004
• Published: 03/03/2005
• Est. Priority Date: 11/03/2000
• Status: Abandoned Application

• Current Assignee: Andre Kramer, William Harwood
• Original Assignee: Andre Kramer, William Harwood
• Inventors: Harwood, William, Kramer, Andre
• Application Number:
  US10/709,806
• Publication Number:
  US 20050050317A1
• Time in Patent Office: Days
• US Class Current: 713/155
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06Q 20/0855 involving a third party
• CPC Class Codes: G06Q 20/367 involving electronic purses or money safes
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

The present invention features a system and method for establishing a secure communication channel between a client and an application server. In one embodiment, a ticket service generates a ticket having an identifier and a session key. A communications device obtains the ticket from the ticket service and transmits the ticket to a client over a secure communication channel. The client transmits the identifier of the ticket to an application server over an application communication channel. The application server then obtains a copy of the session key of the ticket from the ticket service. Communications exchanged between the client and the application server over the application communication channel are then encrypted using the session key to establish the application communication channel as a secure communication channel.

Claims

1. A method for establishing a secure communication channel between a client and an application server, the method comprising the steps of:

(a) obtaining, by a web server, a MIME type document and a ticket associated with a client, the MIME type document comprising a client application program, the ticket having an identifier and a session key;

(b) receiving, by a web browser, the MIME type document and the ticket from the web server;

(c) invoking, by the web browser, the received client application program;

(d) establishing an application communication channel between the client and the application server;

(e) transmitting, by the client application program, the identifier from the ticket to the application server over the application communication channel;

(f) obtaining, by the application server, a copy of the session key from the web server using the identifier; and

(g) encrypting communications between the client application program and the application server over the application communication channel using the session key.

2. The method of claim 1 wherein step (a) further consists of establishing a secure web communication channel between the web browser and the web server.

3. The method of claim 1 wherein step (c) further consists of transferring, by the web browser, the ticket to the client application program.

4. The method of claim 1 wherein step (g) further comprises decrypting communications between the client application program and the application server using the session key.

5. The method of claim 1 wherein step (a) further comprises receiving, at the web server, a request from the client to have an application program executed on the application server and to have output from the application program executing on the application server transmitted to the client application program.

6. The method of claim 5 wherein step (g) further comprises executing, by the application server, the application program identified in the request, and transmitting, by the application server, the output of the application program over the application communication channel via a remote display protocol.

7. The method of claim 1 wherein step (a) further comprises obtaining a MIME type document having a remote display client for the client application program.

8. The method of claim 1 wherein step (c) further comprises installing the client application program for a first time on the client.

9. The method of claim 1 wherein step (a) further comprises obtaining a ticket having an application server certificate for the identifier.

10. The method of claim 1 wherein step (a) further comprises obtaining a ticket having a session key substantially equivalent to a null value.

11. The method of claim 1 wherein step (a) further comprises obtaining a ticket granting access for a single use.

12. The method of claim 1 wherein step (a) further comprises obtaining a ticket granting access to a previously authorized resource.

13. The method of claim 1 wherein step (e) further comprises transmitting a password to the application server.

14. The method of claim 1 wherein step (a) further comprises obtaining the MIME type document from the application server.

15. The method of claim 6 wherein step (g) further comprises using the Independent Computing Architecture protocol for the remote display protocol.

16. The method of claim 6 wherein step (g) further comprises using the Remote Display Protocol for the remote display protocol.

17. A client system for establishing a secure communication channel with an application server, the client system comprising:

a web browser associated with a client;

a web server in communication with the web browser over a web communication channel, the web server obtaining a MIME type document and a ticket associated with the client, the MIME type document comprising a client application program, the ticket having an identifier and a session key;

the web browser receiving, from the web server, the ticket and the MIME type document,

the web browser invoking the received client application program;

an application server, in communication with the client over an application communication channel, receiving the identifier from the client application program, and the application server, in communication with the web server, obtaining a copy of the session key by using the identifier; and

the application server and the client application program encrypting communications over the application communication channel using the session key.

18. The system of claim 17 wherein the web communication channel is secure.

19. The system of claim 17 wherein the web browser transfers the ticket to the client application program.

20. The system of claim 17 wherein the application server and the client application program decrypt communications over the application communication channel using the session key.

21. The system of claim 17 wherein the web server receives a request from the client to have an application program executed on the application server and to have output from the application program executing on the application server transmitted to the client application program.

22. The system of claim 21 wherein the application server executes the application program identified in the request, and transmits the output of the application program to the client application program over the application communication channel via a remote display protocol.

23. The system of claim 17 wherein the client application program is a remote display client.

24. The system of claim 17 wherein the client application program is installed for a first time on the client.

25. The system of claim 17 wherein the identifier is an application server certificate.

26. The system of claim 17 wherein the session key is substantially equivalent to a null value.

27. The system of claim 17 wherein the ticket grants access for a single use.

28. The system of claim 17 wherein the ticket grants access to a previously authorized resource.

29. The system of claim 17 wherein the client transmits a password to the application server.

30. The system of claim 17 wherein the web server obtains the MIME type document from the application server.

31. The system of claim 22 wherein the remote display protocol is the Independent Computing Architecture protocol.

32. The system of claim 22 wherein the remote display protocol is the Remote Display Protocol.

33. A method for establishing a secure communication channel with an application server, the method comprising the steps of:

(a) receiving a MIME type document and a ticket from the web server, the ticket having an identifier and a session key, and the MIME type document comprising a client application program;

(b) invoking the received client application program;

(c) establishing an application communication channel with an application server;

(d) transmitting the identifier from the ticket to the application server over the application communication channel to provide the application server with information for obtaining a copy of the session key; and

(e) encrypting communications to the application server over the application communication channel using the session key.

34. The method of claim 33 wherein step (e) further comprises decrypting communications from the application server using the session key.

35. The method of claim 33 wherein step (a) further comprises establishing a secure web communication channel between a web browser and the web server.

36. The method of claim 35 wherein step (g) further comprises transferring the ticket from the web browser to the client application program.

37. The method of claim 33 wherein step (a) further comprises sending, to the web server, a request to have an application program executed on the application server and to receive output from the application program executing on the application server.

38. The method of claim 37 wherein step (e) further comprises executing, by the application server, the application program identified in the request, and transmitting, by the application server, the output of the application program over the application communication channel via a remote display protocol.

39. The method of claim 33 wherein step (e) further comprises obtaining a MIME type document having a remote display client for the client application program.

40. The method of claim 33 wherein step (a) further comprises installing the client application program for a first time.

41. The method of claim 33 wherein step (a) further comprises obtaining a ticket having an application server certificate for the identifier.

42. The method of claim 33 wherein step (a) further comprises obtaining a ticket having a session key substantially equivalent to a null value.

43. The method of claim 33 wherein step (a) further comprises obtaining a ticket granting access for a single use.

44. The method of claim 33 wherein step (a) further comprises obtaining a ticket granting access to a previously authorized resource.

45. The method of claim 33 wherein step (d) further comprises transmitting a password to the application server.

46. The method of claim 38 wherein step (e) further comprises using the Independent Computing Architecture protocol for the remote display protocol.

47. The method of claim 38 wherein step (e) further comprises using the Remote Display Protocol for the remote display protocol.

48. A client system for establishing a secure communication channel with a client, the client system comprising:

a web browser in communication with a web server over a web communication channel, the web browser receiving, from the web server, a MIME type document and a ticket, the MIME type document comprising a client application program, the ticket having an identifier and a session key;

a client application program invoked by the web browser; and

the client application program establishing an application communication channel with the application server, the client application program transmitting the identifier over the application communication channel, and the client application program encrypting communications to the application server over the application communication channel using the session key.

49. The system of claim 48 wherein the client application program decrypts communications from the application server over the application communication channel using the session key.

50. The system of claim 48 wherein the web browser transfers the ticket to the client application program.

51. The system of claim 48 wherein the web browser transmits a request to have an application program executed on the application server and to have output of the application program executing on the application server transmitted to the client application program.

52. The system of claim 51 wherein the application server executes the application program identified in the request, and transmits the output of the application program to the client application program over the application communication channel via a remote display protocol.

53. The system of claim 48 wherein the client application program is a remote display client.

54. The system of claim 48 wherein the client application program is installed for a first time on the client.

55. The system of claim 48 wherein the identifier is an application server certificate.

56. The system of claim 48 wherein the session key is substantially equivalent to a null value.

57. The system of claim 48 wherein the ticket grants access for a single use.

58. The system of claim 48 wherein the ticket grants access to a previously authorized resource.

59. The system of claim 52 wherein the remote display protocol is the Independent Computing Architecture protocol.

60. The system of claim 52 wherein the remote display protocol is the Remote Display Protocol.

61. A method for establishing a secure communication channel with a client, the method comprising the steps of:

(a) obtaining, by a web server, a MIME type document and a ticket associated with a client, the MIME type document comprising a client application program, the ticket having an identifier and a session key;

(b) transmitting, by the web server, the MIME type document and the ticket to a web browser over a web communication channel;

(c) invoking, by the web browser, the received client application program;

(d) establishing an application communication channel with the client;

(e) receiving, from the client application program, the identifier from the ticket over the application communication channel;

(f) obtaining a copy of the session key from the web server using the identifier; and

(g) encrypting communications to the client application program over the application communication channel using the session key.

62. The method of claim 61 wherein step (g) further comprises decrypting communications from the client application program using the session key.

63. The method of claim 61 wherein step (b) further comprises establishing a secure web communication channel between a web browser and the web server.

64. The method of claim 63 wherein step (b) further comprises transferring, by the web browser, the ticket to the client application program.

65. The method of claim 61 wherein step (a) further comprises receiving, at the web server, a request from the client to have an application program executed on the client'"'"'s behalf and to have output from the application program, as it is executing, transmitted to the client application program.

66. The method of claim 65 wherein step (g) further comprises executing the application program identified in the request, and transmitting the output of the application program over the application communication channel via a remote display protocol.

67. The method of claim 61 wherein step (g) further comprises using a remote display client for the client application program.

68. The method of claim 61 wherein step (e) further comprises installing the client application program for a first time on the client.

69. The method of claim 61 wherein step (a) further comprises obtaining a ticket having an application server certificate for an identifier.

70. The method of claim 61 wherein step (b) further comprises obtaining a ticket having a session key substantially equivalent to a null value.

71. The method of claim 61 wherein step (a) further comprises obtaining a ticket granting access for a single use.

72. The method of claim 61 wherein step (a) further comprises obtaining a ticket granting access to a previously authorized resource.

73. The method of claim 61 wherein step (e) further comprises receiving a password from the client.

74. The method of claim 61 wherein step (a) further comprises obtaining the MIME type document from an application server.

75. The method of claim 66 wherein step (g) further comprises using the Independent Computing Architecture protocol for the remote display protocol.

76. The method of claim 66 wherein step (g) further comprises using the Remote Display Protocol for the remote display protocol.

77. A server system for establishing a secure communication channel with a client, the server system comprising:

a ticket service generating a ticket associated with a client, the ticket having an identifier and a session key;

a web server in communication with the ticket service, the web server transmitting a MIME type document and the ticket to the client over a web communication channel, the MIME type document comprising a client application program; and

an application server receiving the identifier from the ticket from the client, obtaining a copy of the session key from the web server, establishing an application communication channel with the client, and encrypting communications to the client over the application communication channel using the session key.

78. The system of claim 77 wherein the application server decrypts communications from the client over the application communication channel using the session key.

79. The system of claim 77 wherein the web server receives a request from the client to have an application program executed on the client'"'"'s behalf and to have output from the application program, as it is executing, transmitted to the client.

80. The system of claim 77 wherein the application server executes the application program identified in the request, and transmits the output of the application program to the client application program over the application communication channel via a remote display protocol.

81. The system of claim 77 wherein the client application program is a remote display client.

82. The system of claim 77 wherein the client application program is installed for a first time on the client.

83. The system of claim 77 wherein the identifier is an application server certificate.

84. The system of claim 77 wherein the session key is substantially equivalent to a null value.

85. The system of claim 77 wherein the ticket grants access for a single use.

86. The system of claim 77 wherein the ticket grants access to a previously authorized resource.

87. The system of claim 77 wherein the application server receives a password from the client.

88. The system of claim 77 wherein the web server obtains the MIME type document from the application server.

89. The system of claim 80 wherein the remote display protocol is the Independent Computing Architecture protocol.

90. The system of claim 80 wherein the remote display protocol is the Remote Display Protocol.