Scheme to allow two computers on a network to upgrade from a non-secured to a secured session

• US 5,822,434 A
• Filed: 06/18/1996
• Issued: 10/13/1998
• Est. Priority Date: 06/19/1996
• Status: Expired due to Term

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Caronni, Germano, Skrenta, Rich, Aziz, Ashar, Markson, Tom
• Primary Examiner(s): Tarcza, Thomas H.
• Assistant Examiner(s): Laufer, Pinchus M.
• Application Number:
  US08/665,410
• Time in Patent Office: 847 Days
• Field of Search: 380/49, 395/186, 395/187.01
• US Class Current: 713/156
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2211/007 Encryption, En-/decode, En-/decipher, En-/decypher, Scramble, (De-)compress
• CPC Class Codes: G06F 2211/009 Trust
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 69/18 Multiprotocol handlers, e.g. single devices capable of handling multiple protocols

Abstract

An apparatus for allowing communications to a target host on a network to be upgraded from a non-secured session to a secured session. The apparatus including a processor; a memory coupled to the processor and storing an access control list; and a network interface coupled to the processor, the network interface communicating with a target host; wherein the memory is configured to cause the processor to: (1) create an access control entry for the target host in the access control list; (2) exchange security information with the target host; (3) update the entry for the target host to include the security information; and, (4) communicate with said target host using said security information.

A method for allowing communications to a target host on a network to be upgraded from a non-secured session to a secured session having the steps of: (1) creating an access control entry for the target host in the access control list; (2) exchanging security information with the target host; (3) updating the entry for the target host to include the security information; and, (4) communicating with the target host using the security information.

Claims

1. In a computer system having a memory, a processor coupled to said memory, and a network interface coupled to said memory and said processor, said network interface communicating with a target host, a method comprising the steps of:

initializing an access control list;

creating an access control entry with a time-to-live value for said target host in said access control list, said time-to-live value being automatically renewed when communications are received from said target host;

exchanging security information with said target host;

updating said entry for said target host to include said security information;

communicating with said target host using said security information; and

,

maintaining non-secure, clear communication with said target host even in the absence of said security information subsequent to said step of exchanging security information.

2. The method of claim 1, wherein said creating step comprises the steps of:

creating said access control entry with a host name, said time-to-live value, and a security mode;

setting said host name to be a target host name;

setting said time-to-live value in said access control entry to be a default value; and

setting said security mode in said access control entry to be a default mode.

3. The method of claim 2, wherein:

said default value is five minutes.

4. The method of claim 2, wherein:

said default mode is non-secure.

5. The method of claim 1, wherein said exchanging step comprises the steps of:

sending a target host certificate request to said target host;

receiving a target host certificate from said target host; and

,

sending a host certificate to said target host.

6. The method of claim 1, wherein said exchanging step comprises the steps of:

receiving a host certificate request from said target host;

sending a host certificate to said target host; and

receiving a target host certificate from said target host.

7. The method of claim 1, wherein said security information comprises:

a public number; and

a target host public number of said target host.

8. The method of claim 1, further comprising the steps of:

checking said time-to-live value contained in said access control entry; and

removing said entry for said target host based on a comparison of said time-to-live value and a first value which represents a time of expiration of said entry.

9. The method of claim 8, wherein:

said first value is zero.

10. The method of claim 8, further comprising the step of:

resetting said time-to-live value to a default value if a packet is received from said target host.

11. The method of claim 10, wherein:

said default value is five minutes.

12. An apparatus comprising:

a processor;

a memory coupled to said processor;

a network interface coupled to said processor and said memory, said network interface communicating with a target host;

said memory configured to cause said processor to;

initialize an access control list;

create an access control entry with a time-to-live value for said target host in said access control list, said time-to-live value being automatically renewed when communications are received from said target host;

exchange security information with said target host;

update said entry for said target host to include said security information;

communicate with said target host using said security information; and

,

maintain non-secure clear communication with said target host even in the absence of said security information subsequent to said step of exchanging security information.

13. A computer program product for upgrading a non-secure communication session across a network into a secure communication session in a computer system having a memory, a processor coupled to said memory, and a network interface coupled to said memory and said processor, said network interface communicating with a target host, said computer program product comprising:

computer readable program code device configured to initialize an access control list;

computer readable program code device configured to create an access control entry with a time-to-live value for said target host in said access control list, said time-to-live value being renewed automatically when communications are received from said target host;

computer readable program code device configured to exchange security information with said target host;

computer readable program code device configured to update said entry for said target host to include said security information;

computer readable program code device configured to communicate with said target host using said security information; and

,

computer readable program code device configured to maintain non-secure clear communication with said target host even in the absence of said security information subsequent to said exchange of said security information.

14. The computer program product of claim 13 further comprising:

computer readable program code device configured to check said time-to-live value contained in said access control entry; and

computer readable program code device configured to remove said entry for said target host based on a comparison of said time-to-live value and a first value which represents a time of expiration of said entry.

15. The computer program product of claim 14, further comprising:

computer readable program code device configured to adjust said time-to-live value based on said comparison.

16. The computer program product of claim 14, further comprising:

computer readable program code device configured to adjust said first value based on said comparison.

17. The computer program product of claim 14, further comprising:

computer readable program code device configured to reset said time-to-live value to a default value if a packet is received from said target host.