System and method for enabling secure access to services in a computer network

• US 7,287,271 B1
• Filed: 04/08/1997
• Issued: 10/23/2007
• Est. Priority Date: 04/08/1997
• Status: Expired due to Fees

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Good Technology Corporation (Blackberry Limited)
• Inventors: Riggins, Mark D.
• Primary Examiner(s): TRUONG, THANHNGA B
• Application Number:
  US08/841,950
• Time in Patent Office: 3,850 Days
• Field of Search: 380 23- 25, 380/49, 380/255, 713/200, 713/201, 713/202, 713/161, 713/166, 709/203, 709/229, 709/201, 709/223, 709/225, 726 3- 4, 726/11, 705/50, 705/64, 705/67, 705/78
• US Class Current: 726/3
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

A global server includes a communications engine for establishing a communications link with a client; security means coupled to the communications engine for determining client privileges; a servlet host engine coupled to the security means for providing to the client, based on the client privileges, an applet which enables I/O with a secured service; and a keysafe for storing a key which enables access to the secured service. The global server may be coupled to multiple sites, wherein each site provides multiple services. Each site may be protected by a firewall. Accordingly, the global server stores the keys for enabling communication via the firewalls with the services.

Claims

1. A system on a server computer system, comprising:

a communications engine configured to establish a communications link with a client;

a security services engine coupled to the communications engine configured to present to the client a plurality of user authentication protocol options, each user authentication protocol option having a particular level of authentication associated with it to authenticate a user according to at least one user authentication protocol and to determine user privileges based on the identity of the user and the level of authentication;

a web server engine configured to present a set of available services based on the user privileges, at least one of the available services requiring additional authentication information to be provided before access to the service is granted to enable the client to select a particular service from the set of available services;

a host engine coupled to the security services engine and to the web server configured to provide to the client executable service communication code that enables communication with the particular service; and

a keysafe configured to store keys, each key for enabling communication between the client and service selected from the set of available services and including all additional authentication information required by the selected service for authenticating the user to the selected service, the executable service communication code functioning to retrieve a key corresponding to the particular service from the keysafe upon execution of the code.

2. The system of claim 1, wherein the communications engine uses SSL to create a secure communications link with the client.

3. The system of claim 1, wherein the communications engine negotiates an encryption protocol for transferring messages to and from the client.

4. The system of claim 1, wherein the communications engine uses public key certificates for transferring messages to and from the client.

5. The system of claim 1, wherein the security services use public key certificates to authenticate a user of the client to determine the user privileges.

6. The system of claim 1, wherein the security services use a digital signature to authenticate the user to determine the user privileges.

7. The system of claim 1, wherein the host engine forwards to the client security code for enabling the client to perform a security protocol recognized by the security services.

8. The system of claim 1, wherein one of the available services is secured by a firewall and one of the keys includes the additional authentication information to enable communication through the firewall.

9. The system of claim 1, further comprising a firewall for protecting the system.

10. The system of claim 1, wherein one of the keys includes an address identifying the location of the selected service.

11. The system of claim 1, wherein the code uses a key to provide to the client a direct connection with the selected service.

12. The system of claim 1, further comprising a proxy for communicating with the selected service, and wherein the code enables the client to communicate with the proxy and one of the keys enables the proxy to locate the selected service.

13. A method comprising:

establishing a communications link with a client;

presenting to the client a plurality of user authentication protocol options, each user authentication protocol option having a particular level of authentication associated with it;

authenticating the user according to at least one user authentication protocol option;

determining user privileges based on the identity of a user and the level of authentication;

presenting a set of available services based on the user privileges, at least one of the available services requiring additional authentication information to be provided before access to the service is granted;

enabling the client to select a particular service from a set of available services;

providing to the client executable service communication code that enables communication with the particular service; and

retrieving a key from a set of keys, each key corresponding to a respective service from the set of available services, the retrieved key for enabling communication between the client and the particular service selected and including all additional authentication information required by the selected service for authenticating the user to the selected service, the executable service communication code functioning to retrieve a key corresponding to the particular service fromthe keysaft upon execution of the code.

14. The method of claim 13, wherein establishing a communications link includes the step of using SSL to create a secure communications link with the client.

15. The method of claim 13, wherein establishing a communications link includes the step of negotiating an encryption protocol for transferring messages to and from the client.

16. The method of claim 13, wherein establishing a communications link includes the step of using public key certificates for transferring messages to and from the client.

17. The method of claim 13, wherein determining user privileges includes the step of using public key certificates to authenticate a user of the client.

18. The method of claim 13, wherein determining user privileges includes using a digital signature to authenticate the user.

19. The method of claim 13, wherein establishing a communications link includes forwarding to the client security code for enabling the client to perform a recognized security protocol.

20. The method of claim 13, further comprising:

using one of the keys to communicate through a firewall to the selected service.

21. The method of claim 13, wherein the method is performed by a server employing a firewall to protect the server.

22. The method of claim 13, wherein one of the keys includes an address identifying the location of the selected service.

23. The method of claim 13, wherein providing includes the step of providing to the client a direct connection with the service.

24. The method of claim 13, further comprising using a proxy to communicate with the service, and wherein providing includes enabling the client to communicate with the proxy.

25. A system on a server computer system, comprising:

means for establishing a communications link with a client;

means for presenting the client a plurality of user authentication protocol options, each user authentication protocol option having a particular level of authentication;

means for authenticating a user according to at least one user authentication protocol;

means for determining user privileges based on the identity of the user and the level of authentication;

means for presenting a set of available services based on the user privileges, at least one of the available services requiring additional authentication information to be provided before granting access to the service;

means for enabling the client to select a particular service from a set of available services;

means for providing to the client executable service communicaiton code that enables communication with the particular service; and

means for retrieving a key from a set of keys, each key corresponding to a respective service from the set of available services, the retrieved key for enabling communication between the client and the particular service selected and including all additional authentication information required by the selected service for authenticating the user to the selected service, the executable service communication code functioning to retrieve a key corresponding to the particular service selected from the keysafe upon execution of the code.