System and Method for Secure Remote Access

• US 20080016354A1
• Filed: 09/26/2007
• Published: 01/17/2008
• Est. Priority Date: 08/26/2003
• Status: Active Grant

• Current Assignee: Hulu LLC (The Walt Disney Company)
• Original Assignee: International Business Machines Corporation
• Inventors: Wilding, Mark, Horman, Randall
• Granted Patent: US 8,904,178 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

A method and apparatus for directing a client to establish a secure connection with a server across a public network. The server and the client exchange a Server Authentication Public Key, a Client Authentication Public Key, and a Remote Service Unique Identifier (RSUID) during a registration process. In one embodiment, the method includes the client transmitting to the server a client information package having the RSUID and a client challenge information package encrypted with the Server Authentication Public Key, the client receiving from the server a server information package having the RSUID and a server challenge information package and a portion of the received client challenge information encrypted with the Client Authentication Public Key, the client decrypting and verifying the server challenge information package with the Client Authentication Private Key, and, the client transmitting to the server an encrypted portion of the received client challenge information.

Claims

1. A method of directing a client to establish a secure connection with a server providing remote customer services across a network, the server and the client having exchanged a server authentication public key, a client authentication public key, and a remote service unique identifier during a registration process, the method comprising:

(a) transmitting from the client to the server a client information package including the unique identifier and a client challenge information package encrypted with the server authentication public key, wherein the unique identifier uniquely identifies a remote service customer;

(b) receiving at the client from the server a server information package having the unique identifier and a server challenge information package encrypted with the client authentication public key;

(c) decrypting and verifying the server challenge information package with the client authentication private key; and

(d) transmitting from the client to the server an encrypted portion of the received server challenge information to facilitate access by the client to the remote customer services.

2. The method of claim 1, wherein step (a) further includes:

(a.1) encrypting the client information package with a temporary public key assigned by the server.

3. The method of claim 1, wherein step (b) further includes:

(b.1) decrypting the server information package with a client session private key.

4. The method of claim 1, wherein step (a) further includes:

(a.1) transmitting the client challenge information package including a client session public key.

5. The method of claim 1, wherein step (a) further includes:

(a.1) transmitting the client challenge information package including a previous session ID to enable the server to select a client session public key associated with the previous session ID.

6. A program product apparatus having a computer readable medium with computer program logic recorded thereon for directing a client to establish a secure connection with a server providing remote customer services across a network, the server and the client having exchanged a server authentication public key, a client authentication public key, and a remote service unique identifier during a registration process, said program product apparatus comprising:

an initiation module to transmit from the client to the server a client information package including the unique identifier and a client challenge information package encrypted with the server authentication public key, wherein the unique identifier uniquely identifies a remote service customer;

a reception module to receive at the client from the server a server information package having the unique identifier and a server challenge information package encrypted with the client authentication public key;

a decryption module to decrypt and verify the server challenge information package with the client authentication private key; and

a response module to transmit from the client to the server an encrypted portion of the received server challenge information to facilitate access by the client to the remote customer services.

7. The program product of claim 6, wherein the initiation module includes:

an information package encryption module to encrypt the client information package with a temporary public key assigned by the server.

8. The program product of claim 6, wherein the reception module includes:

a client session key decryption module to decrypt the server information package with a client session private key.

9. The program product of claim 6, wherein the initiation module includes:

a session key module to place a client session public key within the client challenge information package.

10. The program product of claim 6, wherein the initiation module includes:

a session tracking module to place a previous session ID within the client challenge information package to enable the server to select a client session public key associated with the previous session ID.

11. A method for directing a server providing remote customer services to establish a secure connection with a client across a network, the server and the client having exchanged a server authentication public key, a client authentication public key, and a remote service unique identifier during a registration process, the method comprising:

(a) receiving at the server from the client a client information package having the unique identifier and a client challenge information package encrypted with the server authentication public key, wherein the unique identifier uniquely identifies a remote service customer;

(b) retrieving an associated server authentication private key utilizing the received unique identifier as an index;

(c) decrypting and verifying the client challenge information package with the server authentication private key;

(d) transmitting from the server to the client a server information package including the unique identifier and a server challenge information package encrypted with the client authentication public key; and

(e) enabling access by the client to the remote customer services in accordance with an appropriate response from the client.

12. The method of claim 11, wherein step (a) further includes:

(a.1) decrypting the client information package at the server using a temporary private key.

13. The method of claim 11, wherein step (d) further includes:

(d.1) encrypting the server information package using a client session public key.

14. The method of claim 11, wherein step (d) further includes:

(d.1) transmitting the server challenge information package including a server session public key.

15. The method of claim 11, wherein step (d) further includes:

(d.1) transmitting the server challenge information package including a previous session ID that enables the client to select a server session public key associated with the previous session ID.

16. A program product apparatus having a computer readable medium with computer program logic recorded thereon for directing a server providing remote customer services to establish a secure connection with a client across a network, the server and the client having exchanged a server authentication public key, a client authentication public key, and a remote service unique identifier during a registration process, said program product apparatus comprising:

a reception module at the server to receive from the client a client information package having the unique identifier and a client challenge information package encrypted with the server authentication public key, wherein the unique identifier uniquely identifies a remote service customer;

an index module at the server to retrieve an associated server authentication private key utilizing the received unique identifier as an index;

a validation module at the server to decrypt and verify the client challenge information package with the server authentication private key;

a transmission module at the server to transmit to the client a server information package including the unique identifier and a server challenge information package encrypted with the client authentication public key; and

an access module at the server to enable access by the client to the remote customer services in accordance with an appropriate response from the client.

17. The program product of claim 16, wherein the reception module includes:

a decryption module to decrypt the client information package at the server using a temporary private key.

18. The program product of claim 16, wherein the transmission module includes:

an encryption module to encrypt the server information package using a client session public key.

19. The program product of claim 16, wherein the transmission module includes:

a session module to place a server session public key within the server challenge information package.

20. The program product of claim 16, wherein the transmission module includes:

a session tracking module to place a previous session ID within the server challenge information package that enables the client to select a server session public key associated with the previous session ID.

21. A system to establish a secure connection between a server computer system providing remote customer services and a client across a network, the server computer system and the client having exchanged a server authentication public key, a client authentication public key, and a remote service unique identifier during a registration process, the system comprising:

a server computer system in communication with a client via a network;

a reception module at the server computer system to receive from the client a client information package having the unique identifier and a client challenge information package encrypted with the server authentication public key, wherein the unique identifier uniquely identifies a remote service customer;

an index module at the server computer system to retrieve an associated server authentication private key utilizing the received unique identifier as an index;

a validation module at the server computer system to decrypt and verify the client challenge information package with the server authentication private key; and

a transmission module at the server computer system to transmit to the client a server information package including the unique identifier and a server challenge information package encrypted with the client authentication public key; and

an access module at the server computer system to enable access by the client to the remote customer services in accordance with an appropriate response from the client.

22. The system of claim 21, further including:

an initiation module at said client to transmit to the server computer system the client information package including the unique identifier and the client challenge information package encrypted with the server authentication public key;

a reception module at the client to receive from the server computer system the server information package having the unique identifier and the server challenge information package encrypted with the client authentication public key;

a decryption module at the client to decrypt and verify the server challenge information package with the client authentication private key; and

a response module at the client to transmit to the server computer system an encrypted portion of the received server challenge information to facilitate access by the client to the remote customer services.