Methods systems and computer program products for providing secure client profile completion by network intermediaries

• US 6,978,373 B1
• Filed: 03/22/2000
• Issued: 12/20/2005
• Est. Priority Date: 03/22/2000
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Singhal, Sandeep Kishan, Hild, Stefan Georg
• Primary Examiner(s): Barrón, Gilberto
• Assistant Examiner(s): STULBERGER, CAS P
• Application Number:
  US09/533,644
• Time in Patent Office: 2,099 Days
• Field of Search: 713/172, 713/185, 713/201, 713/179, 713/193, 380/30
• US Class Current: 713/182
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/303 Terminal profiles
• CPC Class Codes: H04L 67/306 User profiles
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Methods, systems and computer program products are provided which provide profile information associated with a client to a server by generating, at the client, a profile document containing profile information associated with the client and incorporating in the profile document a designator which indicates that profile information identified by the designator is not provided by the client and is provided by a network intermediary in a path between the client and the server. The designator in the profile document is encrypted utilizing a key associated with the client and the profile document with the encrypted designator transmitted from the client to the server utilizing the path. Method, systems and computer program products corresponding to the network intermediaries are also provided.

Claims

1. A method of providing profile information associated with a client to a server, the method comprising the steps of:

generating, at the client, a profile document containing profile information associated with the client;

incorporating in the profile document a designator which indicates that profile information identified by the designator is not provided by the client and is provided by a network intermediary in a path between the client and the server; and

transmitting the profile document with the designator from the client to the server utilizing the path so as to provide to the server a modified profile document containing information incorporated in the profile document at the client and information incorporated in the profile document by the network intermediary.

2. A method according to claim 1, wherein the designator incorporated into the profile document comprises a profile information identifier which identifies a type of profile information in the profile document and a wildcard designator associated with the profile information identifier which indicates that the type of profile information associated with the profile information identifier is provided by a network intermediary in the path between the client and the server.

3. A method according to claim 1, further comprising the step of encrypting the designator in the profile document utilizing a key associated with the client.

4. A method according to claim 3, wherein the step of encrypting the designator comprises the step of encrypting the wildcard designator utilizing a private key associated with the client to provide the encrypted designator.

5. A method according to claim 4, wherein the wildcard designator comprises a client identification associated with the client, a token and an encrypted value and wherein the step of encrypting the wildcard designator comprises the step of encrypting the token so as to provide the encrypted value.

6. A method according to claim 5, wherein the step of encrypting the token further comprises the step of encrypting the token and a predefined character string.

7. A method according to claim 5, wherein the token is a randomly generated value.

8. A method according to claim 3, wherein the step of encrypting the designator comprises the step of encrypting the wildcard designator and the profile information identifier utilizing a private key associated with the client to provide the encrypted designator.

9. A method according to claim 8, wherein the wildcard designator comprises a client identification associated with the client, a token and an encrypted value and wherein the step of encrypting the wildcard designator and the profile information identifier comprises the step of encrypting the token and the profile information identifier so as to provide the encrypted value.

10. A method according to claim 8, wherein the step of encrypting the token and the profile information identifier further comprises the step of encrypting the token, the profile information identifier and a predefined character string.

11. A method according to claim 10, wherein the token is a randomly generated value.

12. A method according to claim 1, further comprising the step of encrypting the designator utilizing a public key of the network intermediary.

13. A method according to claim 3, further comprising the steps of:

receiving the profile document transmitted by the client at the network intermediary; and

wherein the network intermediary carries out the steps of;

decrypting the designator incorporated in the profile document if the designator incorporated in the profile document is encrypted;

incorporating the profile information identified by the designator into the profile document to provide a modified profile document if the network intermediary has available the profile information indentified by the designator;

transmitting the modified profile document to the server.

14. A method of providing client profile information to a server, the method comprising the steps of:

receiving, at a network intermediary, a profile document from a client for forwarding to the server;

determining if a portion of the profile document is encrypted;

decrypting the encrypted portion of the profile document;

parsing the decrypted portion of the profile document to determine if a designator is provided in the decrypted portion of the profile document which indicates that profile information identified by the designator is to be incorporated into the profile document by the network intermediary;

incorporating the identified profile information in the profile document so as to provide a modified profile document; and

transmitting the modified profile document to the server.

15. A method according to claim 14, wherein the designator incorporated into the profile document comprises a profile information identifier which identifies a type of profile information in the profile document and a wildcard designator associated with the profile information identifier which indicates that the type of profile information associated with the profile information identifier is provided by the network intermediary.

16. A method according to claim 15, wherein the step of decrypting the designator comprises the step of decrypting the encrypted portion of the document profile utilizing a private key associated with the client to provide the designator.

17. A method according to claim 16, wherein the wildcard designator comprises a client identification associated with the client, a token and an encrypted value and wherein the step of decrypting the encrypted portion of the document profile comprises the step of decrypting the encrypted value.

18. A method according to claim 16, wherein the token is a randomly generated value.

19. A method according to claim 15, wherein the step of decrypting the encrypted portion of the document profile comprises the steps of:

decrypting the encrypted portion of the profile document to provide a wildcard designator; and

decrypting the profile information identifier utilizing a private key associated with the client to provide the decrypted designator.

20. A method according to claim 14, further comprising the step of decrypting the encrypted portion of the document profile utilizing a private key of the network intermediary.

21. A system for providing profile information associated with a client to a server, comprising:

means for generating, at the client, a profile document containing profile information associated with the client;

means for incorporating in the profile document a designator which indicates that profile information identified by the designator is not provided by the client and is provided by a network intermediary in a path between the client and the server; and

means for transmitting the profile document with the designator from the client to the server utilizing the path so as to provide to the server a modified profile document containing information incorporated in the profile document at the client and information incorporated in the profile document by the network intermediary.

22. A system according to claim 21, wherein the designator incorporated into the profile document comprises a profile information identifier which identifies a type of profile information in the profile document and a wildcard designator associated with the profile information identifier which indicates that the type of profile information associated with the profile information identifier is provided by a network intermediary in the path between the client and the server.

23. A system according to claim 21, further comprising means for encrypting the designator in the profile document utilizing a key associated with the client.

24. A system according to claim 23, wherein the means for encrypting the designator comprises means for encrypting the wildcard designator utilizing a private key associated with the client to provide the encrypted designator.

25. A system according to claim 24, wherein the wildcard designator comprises a client identification associated with the client, a token and an encrypted value and wherein the means for encrypting the wildcard designator comprises means for encrypting the token so as to provide the encrypted value.

26. A system according to claim 25, wherein the means for encrypting the token further comprises means for encrypting the token and a predefined character string.

27. A system according to claim 25, wherein the token is a randomly generated value.

28. A system according to claim 23, wherein the means for encrypting the designator comprises means for encrypting the wildcard designator and the profile information identifier utilizing a private key associated with the client to provide the encrypted designator.

29. A system according to claim 28, wherein the wildcard designator comprises a client identification associated with the client, a token and an encrypted value and wherein the means for encrypting the wildcard designator and the profile information identifier comprises means for encrypting the token and the profile information identifier so as to provide the encrypted value.

30. A system according to claim 28, wherein the means for encrypting the token and the profile information identifier further comprises means for encrypting the token, the profile information identifier and a predefined character string.

31. A system according to claim 30, wherein the token is a randomly generated value.

32. A system according to claim 21, further comprising means for encrypting the designator utilizing a public key of the network intermediary.

33. A system according to claim 21, further comprising:

means for receiving the profile document transmitted by the client at the network intermediary;

means for decrypting the designator incorporated in the profile document if the designator is encrypted;

means for incorporating the profile information identified by the designator into the profile document to provide a modified profile document;

means for transmitting the modified profile document to the server.

34. A system for providing client profile information to a server, comprising:

means for receiving, at a network intermediary, a profile document from a client for forwarding to the server;

means for determining if a portion of the profile document is encrypted;

means for decrypting the encrypted portion of the profile document;

means for parsing the decrypted portion of the profile document to determine if a designator is provided in the decrypted portion of the profile document which indicates that profile information identified by the designator is to be incorporated into the profile document by the network intermediary;

means for incorporating the identified profile information in the profile document so as to provide a modified profile document; and

means for transmitting the modified profile document to the server.

35. A system according to claim 34, wherein the designator incorporated into the profile document comprises a profile information identifier which identifies a type of profile information in the profile document and a wildcard designator associated with the profile information identifier which indicates that the type of profile information associated with the profile information identifier is provided by the network intermediary.

36. A system according to claim 35, wherein the means for decrypting the designator comprises means for decrypting the encrypted portion of the document profile utilizing a private key associated with the client to provide the designator.

37. A system according to claim 36, wherein the wildcard designator comprises a client identification associated with the client, a token and an encrypted value and wherein the means for decrypting the encrypted portion of the document profile comprises means for decrypting the encrypted value.

38. A system according to claim 36, wherein the token is a randomly generated value.

39. A system according to claim 35, wherein the means for decrypting the encrypted portion of the document profile comprises:

means for decrypting the encrypted portion of the profile document to provide a wildcard designator; and

means for decrypting the profile information identifier utilizing a private key associated with the client to provide the decrypted designator.

40. A system according to claim 34, further comprising means for decrypting the encrypted portion of the document profile utilizing a private key of the network intermediary.

41. A computer program product for providing profile information associated with a client to a server, comprising:

a computer-readable storage medium having computer-readable program code embodied in said medium, said computer-readable program code comprising;

computer readable program code which generates, at the client, a profile document containing profile information associated with the client;

computer readable program code which incorporates in the profile document a designator which indicates that profile information identified by the designator is not provided by the client and is provided by a network intermediary in a path between the client and the server; and

computer readable program code which transmits the profile document with the designator from the client to the server utilizing the path so as to provide to the server a modified profile document containing information incorporated in the profile document at the client and information incorporated in the profile document by the network intermediary.

42. A computer program product according to claim 41, wherein the designator incorporated into the profile document comprises a profile information identifier which identifies a type of profile information in the profile document and a wildcard designator associated with the profile information identifier which indicates that the type of profile information associated with the profile information identifier is provided by a network intermediary in the path between the client and the server.

43. A computer program product according to claim 41, further comprising computer readable program code which encrypts the designator in the profile document utilizing a key associated with the client.

44. A computer program product according to claim 43, wherein the computer readable program code which encrypts the designator comprises computer readable program code which encrypts the wildcard designator utilizing a private key associated with the client to provide the encrypted designator.

45. A computer program product according to claim 44, wherein the wildcard designator comprises a client identification associated with the client, a token and an encrypted value and wherein the computer readable program code which encrypts the wildcard designator comprises computer readable program code which encrypts the token so as to provide the encrypted value.

46. A computer program product according to claim 45, wherein the computer readable program code which encrypts the token further comprises computer readable program code which encrypts the token and a predefined character string.

47. A computer program product according to claim 45, wherein the token is a randomly generated value.

48. A computer program product according to claim 43, wherein the computer readable program code which encrypts the designator comprises computer readable program code which encrypts the wildcard designator and the profile information identifier utilizing a private key associated with the client to provide the encrypted designator.

49. A computer program product according to claim 48, wherein the wildcard designator comprises a client identification associated with the client, a token and an encrypted value and wherein the computer readable program code which encrypts the wildcard designator and the profile information identifier comprises computer readable program code which encrypts the token and the profile information identifier so as to provide the encrypted value.

50. A computer program product according to claim 48, wherein the computer readable program code which encrypts the token and the profile information identifier further comprises computer readable program code which encrypts the token, the profile information identifier and a predefined character string.

51. A computer program product according to claim 49, wherein the token is a randomly generated value.

52. A computer program product according to claim 41, further comprising computer readable program code which encrypts the designator utilizing a public key of the network intermediary.

53. A computer program product according to claim 41, further comprising:

computer readable program code which receives the profile document transmitted by the client at the network intermediary;

computer readable program code which decrypts the designator incorporated in the profile document if the designator is encrypted;

computer readable program code which incorporates the profile information identified by the designator into the profile document to provide a modified profile document;

computer readable program code which transmits the modified profile document to the server.

54. A computer program product for providing client profile information to a server, comprising:

a computer-readable storage medium having computer-readable program code embodied in said medium, said computer-readable program code comprising;

computer readable program code which receives, at a network intermediary, a profile document from a client for forwarding to the server;

computer readable program code which determines if a portion of the profile document is encrypted;

computer readable program code which decrypts the encrypted portion of the profile document;

computer readable program code which parses the decrypted portion of the profile document to determine if a designator is provided in the decrypted portion of the profile document which indicates that profile information identified by the designator is to be incorporated into the profile document by the network intermediary;

computer readable program code which incorporates the identified profile information in the profile document so as to provide a modified profile document; and

computer readable program code which transmits the modified profile document to the server.

55. A computer program product according to claim 54, wherein the designator incorporated into the profile document comprises a profile information identifier which identifies a type of profile information in the profile document and a wildcard designator associated with the profile information identifier which indicates that the type of profile information associated with the profile information identifier is provided by the network intermediary.

56. A computer program product according to claim 55, wherein computer readable program code which decrypts the designator comprises computer readable program code which decrypts the encrypted portion of the document profile utilizing a private key associated with the client to provide the designator.

57. A computer program product according to claim 56, wherein the wildcard designator comprises a client identification associated with the client, a token and an encrypted value and wherein computer readable program code which decrypts the encrypted portion of the document profile comprises computer readable program code which decrypts the encrypted value.

58. A computer program product according to claim 56, wherein the token is a randomly generated value.

59. A computer program product according to claim 55, wherein the computer readable program code which decrypts the encrypted portion of the document profile comprises:

computer readable program code which decrypts the encrypted portion of the profile document to provide a wildcard designator; and

computer readable program code which decrypts the profile information identifier utilizing a private key associated with the client to provide the decrypted designator.

60. A computer program product according to claim 54, further comprising computer readable program code which decrypts the encrypted portion of the document profile utilizing a private key of the network intermediary.