Method and system for controlled distribution of application code and content data within a computer network

• US 7,603,703 B2
• Filed: 04/12/2001
• Issued: 10/13/2009
• Est. Priority Date: 04/12/2001
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Hofstee, Harm Peter, Kahle, James Allan, Dubey, Pradeep K., Craft, David John
• Primary Examiner(s): Pich; Ponnoreay
• Application Number:
  US09/833,342
• Publication Number:
  US 20020150243A1
• Time in Patent Office: 3,106 Days
• Field of Search: 380201-203, 380/258, 380268-273, 380277-286, 380 44- 47, 380/30, 709201-206, 709208-211, 709217-219, 711/4, 711100-103, 711154-164, 711/216, 712/32, 712/34, 712 36- 38, 713150-152, 713155-156, 713159-162, 713168-176, 713180-194, 713200-201, 717171-178
• US Class Current: 726/22
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce data processing systems or methods, specially adapted for e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A secure communication methodology is presented. The client device is configured to download application code and/or content data from a server operated by a service provider. Embedded within the client is a client private key, a client serial number, and a copy of a server public key. The client forms a request, which includes the client serial number, encrypts the request with the server public key, and sends the download request to the server. The server decrypts the request with the server'"'"'s private key and authenticates the client. The received client serial number is used to search for a client public key that corresponds to the embedded client private key. The server encrypts its response, which includes the requested information, with the client public key of the requesting client, and only the private key in the requesting client can be used to decrypt the information downloaded from the server.

Claims

1. A method for secure communication between a client and a server in a database processing system, the method comprising:

generating a client message at the client;

retrieving an embedded server public key from a read-only memory structure in an article of manufacture in the client, the read-only memory structure having an embedded client private key, the embedded server public key and the embedded client private key not being related by a public/private key pair relationship, the embedded client private key being associated with a client public key generated and stored exclusively outside the client;

encrypting the client message with the embedded server public key;

sending the client message to the server;

receiving a server message including application code from the server at the client in response to the client message, the application code having a first portion encrypted with a server private key and a second portion which is not encrypted by a public key algorithm, wherein the first portion of the application code is small relative to the second portion of the application code;

authenticating the first portion of the application code with the embedded server public key; and

authenticating the second portion of the application code using an integrity checking algorithm that is less computationally expensive than a public key algorithm,

wherein the application code is either program source code or compiled program source code.

2. The method of claim 1 further comprising:

retrieving client authentication data;

retrieving the embedded client private key from the read-only memory structure in the article of manufacture in the client;

encrypting the client authentication data with the embedded client private key; and

storing the encrypted client authentication data in the client message.

3. The method of claim 2 further comprising:

retrieving an embedded client serial number from the read-only memory structure in the article of manufacture in the client; and

storing a copy of the embedded client serial number in the client message.

4. A method for secure communication between a client and a server in a data processing system, the method comprising:

receiving a client message from the client;

retrieving a server private key;

decrypting the client message with the server private key;

retrieving a client serial number from the decrypted client message;

retrieving a client public key that is associatively stored with the retrieved client serial number, wherein the client public key corresponds to an embedded client private key in a read-only memory structure in an article of manufacture in the client and is generated and stored exclusively outside the client; and

generating a server message including application code at the server in response to the client message, the application code having a first portion encrypted with the server private key and a second portion which is not encrypted by a public key algorithm, the first portion being authenticable with a server public key and the second portion being authenticable with an integrity checking algorithm that is less computationally expensive than a public key algorithm, wherein the first portion of the application code is small relative to the second portion of the application code;

wherein the read-only memory structure has an embedded server public key, the embedded server public key and the embedded client private key not being related by a public/private key pair relationship,

wherein the application code is either program source code or compiled program source code.

5. The method of claim 4 further comprising:

retrieving encrypted client authentication data from the client message;

decrypting the client authentication data with the retrieved client public key; and

verifying the decrypted client authentication data.