Secure customer interface for Web based data management

• US 7,814,533 B2
• Filed: 05/23/2005
• Issued: 10/12/2010
• Est. Priority Date: 09/26/1997
• Status: Expired due to Fees

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: Verizon Business Global LLC (Verizon Communications Inc.), Verizon Communications Inc.
• Inventors: Shifrin, Gerald A., Devine, Carol Y., Shoulberg, Richard W.
• Primary Examiner(s): Revak; Christopher A
• Application Number:
  US11/134,943
• Publication Number:
  US 20050210296A1
• Time in Patent Office: 1,968 Days
• Field of Search: None
• US Class Current: 726/3
• CPC Class Codes: G06F 11/0709 in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems
• CPC Class Codes: G06F 11/0757 by exceeding a time limit, i.e. time-out, e.g. watchdogs
• CPC Class Codes: G06F 11/0769 Readable error formats, e.g. cross-platform generic formats, human understandable formats
• CPC Class Codes: G06F 11/0775 Content or structure details of the error report, e.g. specific table structure, specific error fields
• CPC Class Codes: G06F 11/0781 Error filtering or prioritizing based on a policy defined by the user or on a policy defined by a hardware/software module, e.g. according to a severity level
• CPC Class Codes: G06F 11/0784 Routing of error reports, e.g. with a specific transmission path or data flow
• CPC Class Codes: G06F 11/202 where processing functionality is redundant redundant communication control functionality G06F11/2005, redundant storage control functionality G06F11/2089
• CPC Class Codes: G06F 11/32 with visual or acoustical indication of the functioning of the machine
• CPC Class Codes: G06F 11/324 Display of status information
• CPC Class Codes: G06F 11/327 Alarm or error message display
• CPC Class Codes: G06F 11/328 Computer systems status display G06F11/327 takes precedence
• CPC Class Codes: G06F 11/3495 for systems
• CPC Class Codes: G06F 16/972 Access to data in other repository systems, e.g. legacy data or dynamic Web page generation
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 2201/81 Threshold
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06F 2201/875 Monitoring of systems including the internet
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2149 : Restricted operating environment
• CPC Class Codes: G06Q 10/10 : Office automation; Time management
• CPC Class Codes: G06Q 10/107 : Computer-aided management of electronic mailing [e-mailing]
• CPC Class Codes: G06Q 20/102 : Bill distribution or payments
• CPC Class Codes: G06Q 20/382 : insuring higher security of transaction
• CPC Class Codes: G06Q 30/02 : Marketing; Price estimation or determination; Fundraising
• CPC Class Codes: G06Q 30/06 : Buying, selling or leasing transactions
• CPC Class Codes: G06Q 30/0601 : Electronic shopping [e-shopping]
• CPC Class Codes: G06Q 30/0609 : Buyer or seller confidence or verification
• CPC Class Codes: G06Q 30/0635 : Processing of requisition or of purchase orders
• CPC Class Codes: G06Q 99/00 : Subject matter not provided for in other groups of this subclass
• CPC Class Codes: H04L 12/14 : Charging , metering or billing arrangements for data wireline or wireless communications
• CPC Class Codes: H04L 12/1428 : Invoice generation, e.g. customization, lay-out, database processing, algorithms for calculating the bill or formatting invoices as WWW pages invoicing in general G06Q30/04
• CPC Class Codes: H04L 41/0213 : Standardised network management protocols, e.g. simple network management protocol [SNMP]
• CPC Class Codes: H04L 41/0233 : Object-oriented techniques, for representation of network management data, e.g. common object request broker architecture [CORBA]
• CPC Class Codes: H04L 41/024 : using relational databases for representation of network management data, e.g. managing via structured query language [SQL]
• CPC Class Codes: H04L 41/0253 : using browsers or web-pages for accessing management information
• CPC Class Codes: H04L 41/06 : Management of faults, events, alarms or notifications
• CPC Class Codes: H04L 41/0681 : Configuration of triggering conditions
• CPC Class Codes: H04L 41/08 : Configuration management of networks or network elements address allocation H04L61/50
• CPC Class Codes: H04L 41/0803 : Configuration setting
• CPC Class Codes: H04L 41/0879 : Manual configuration through operator
• CPC Class Codes: H04L 41/0895 : Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
• CPC Class Codes: H04L 41/122 : of virtualised topologies, e.g. software-defined networks [SDN] or network function virtualisation [NFV]
• CPC Class Codes: H04L 41/142 : using statistical or mathematical methods
• CPC Class Codes: H04L 41/18 : Delegation of network management function, e.g. customer network management [CNM]
• CPC Class Codes: H04L 41/22 : comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/28 : Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 41/5009 : Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 41/5022 : by giving priorities, e.g. assigning classes of service
• CPC Class Codes: H04L 41/5029 : Service quality level-based billing, e.g. dependent on measured service level customer is charged more or less
• CPC Class Codes: H04L 41/5032 : Generating service level reports
• CPC Class Codes: H04L 41/5061 : characterised by the interaction between service providers and their network customers, e.g. customer relationship management
• CPC Class Codes: H04L 41/5064 : Customer relationship management
• CPC Class Codes: H04L 41/5067 : Customer-centric QoS measurements
• CPC Class Codes: H04L 41/5074 : Handling of user complaints or trouble tickets
• CPC Class Codes: H04L 41/5083 : wherein the managed service relates to web hosting
• CPC Class Codes: H04L 41/5096 : wherein the managed service relates to distributed or central networked applications
• CPC Class Codes: H04L 43/00 : Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/024 : by adaptive sampling
• CPC Class Codes: H04L 43/045 : for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/06 : Generation of reports
• CPC Class Codes: H04L 43/062 : related to network traffic
• CPC Class Codes: H04L 43/065 : related to network devices
• CPC Class Codes: H04L 43/067 : using time frame reporting
• CPC Class Codes: H04L 43/0805 : by checking availability
• CPC Class Codes: H04L 43/0811 : by checking connectivity
• CPC Class Codes: H04L 43/0817 : by checking functioning
• CPC Class Codes: H04L 43/0829 : Packet loss
• CPC Class Codes: H04L 43/0847 : Transmission error
• CPC Class Codes: H04L 43/0852 : Delays
• CPC Class Codes: H04L 43/0876 : Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/0888 : Throughput
• CPC Class Codes: H04L 43/0894 : Packet rate
• CPC Class Codes: H04L 43/091 : Measuring contribution of individual network components to actual service level
• CPC Class Codes: H04L 43/10 : Active monitoring, e.g. heartbeat, ping or trace-route
• CPC Class Codes: H04L 43/106 : using time related information in packets, e.g. by adding timestamps
• CPC Class Codes: H04L 43/16 : Threshold monitoring
• CPC Class Codes: H04L 51/00 : User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 51/04 : Real-time or near real-time messaging, e.g. instant messaging [IM]
• CPC Class Codes: H04L 51/222 : using geographical location information, e.g. messages transmitted or received in proximity of a certain spot or area
• CPC Class Codes: H04L 63/02 : for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0209 : Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0218 : Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0236 : Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/0272 : Virtual private networks
• CPC Class Codes: H04L 63/0281 : Proxies
• CPC Class Codes: H04L 63/0428 : wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 : wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0464 : using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/08 : for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 : using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 : providing single-sign-on or federations
• CPC Class Codes: H04L 63/0823 : using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 : using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/162 : at the data link layer
• CPC Class Codes: H04L 63/166 : at the transport layer
• CPC Class Codes: H04L 63/168 : above the transport layer
• CPC Class Codes: H04L 63/18 : using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 65/1101 : Session protocols
• CPC Class Codes: H04L 65/401 : wherein the services involve a main real-time session and one or more additional parallel real-time or time sensitive sessions, e.g. white board sharing or spawning of a subconference
• CPC Class Codes: H04L 65/80 : Responding to QoS
• CPC Class Codes: H04M 15/00 : Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/41 : Billing record details, i.e. parameters, identifiers, structure of call data record [CDR]
• CPC Class Codes: H04M 15/43 : Billing software details
• CPC Class Codes: H04M 15/44 : Augmented, consolidated or itemized billing statement or bill presentation
• CPC Class Codes: H04M 15/49 : Connection to several service providers
• CPC Class Codes: H04M 15/51 : for resellers, retailers or service providers
• CPC Class Codes: H04M 15/58 : based on statistics of usage or network monitoring
• CPC Class Codes: H04M 15/705 : Account settings, e.g. limits or numbers or payment
• CPC Class Codes: H04M 15/721 : using the Internet
• CPC Class Codes: H04M 15/745 : Customizing according to wishes of subscriber, e.g. friends or family
• CPC Class Codes: H04M 15/80 : Rating or billing plans; Tariff determination aspects
• CPC Class Codes: H04M 15/8044 : Least cost routing
• CPC Class Codes: H04M 15/83 : Notification aspects
• CPC Class Codes: H04M 15/8351 : before establishing a communication
• CPC Class Codes: H04M 15/84 : Types of notifications
• CPC Class Codes: H04M 2215/0104 : Augmented, consolidated or itemised billing statement, e.g. additional billing information, bill presentation, layout, format, e-mail, fax, printout, itemised bill per service or per account, cumulative billing, consolidated billing
• CPC Class Codes: H04M 2215/0108 : Customization according to wishes of subscriber, e.g. customer preferences, friends and family, selecting services or billing options, Personal Communication Systems [PCS]
• CPC Class Codes: H04M 2215/0152 : General billing plans, rate plans, e.g. charge rates, numbering plans, rate centers, customer accounts
• CPC Class Codes: H04M 2215/0164 : Billing record, e.g. Call Data Record [CDR], Toll Ticket[TT], Automatic Message Accounting [AMA], Call Line Identifier [CLI], details, i.e. parameters, identifiers, structure
• CPC Class Codes: H04M 2215/0168 : On line or real-time flexible customization or negotiation according to wishes of subscriber
• CPC Class Codes: H04M 2215/0176 : Billing arrangements using internet
• CPC Class Codes: H04M 2215/018 : On-line real-time billing, able to see billing information while in communication, e.g. via the internet
• CPC Class Codes: H04M 2215/0188 : Network monitoring; statistics on usage on called/calling number
• CPC Class Codes: H04M 2215/42 : Least cost routing, i.e. provision for selecting the lowest cost tariff
• CPC Class Codes: H04M 2215/46 : Connection to several service providers
• CPC Class Codes: H04M 2215/54 : Resellers-retail or service providers billing, e.g. agreements with telephone service operator, activation, charging/recharging of accounts
• CPC Class Codes: H04M 2215/7009 : Account settings, e.g. users, terminals, limits, numbers or payment
• CPC Class Codes: H04M 2215/7045 : Using Internet or WAP
• CPC Class Codes: H04M 2215/745 : Least cost routing, e.g. Automatic or manual, call by call or by preselection
• CPC Class Codes: H04M 2215/81 : Notifying aspects, e.g. notifications or displays to the user
• CPC Class Codes: H04M 2215/8108 : before establishing a communication
• CPC Class Codes: H04M 2215/8129 : Type of notification
• CPC Class Codes: H04M 2215/82 : Advice-of-Charge [AOC], i.e. notify subscriber of charges/cumulative charge; meter at the substation
• CPC Class Codes: H04M 3/5175 : Call or contact centers supervision arrangements
• CPC Class Codes: H04M 3/5191 : interacting with the Internet
• CPC Class Codes: Y10S 379/90 : Internet, e.g. Internet phone, webphone, internet-based telephony
• CPC Class Codes: Y10S 707/99931 : Database or file accessing
• CPC Class Codes: Y10S 707/99937 : Sorting
• CPC Class Codes: Y10S 707/99938 : Concurrency, e.g. lock management in shared database
• CPC Class Codes: Y10S 707/99939 : Privileged access
• CPC Class Codes: Y10S 707/99944 : Object-oriented database structure
• CPC Class Codes: Y10S 715/969 : Network layout and operation interface

Abstract

An integrated series of security protocols is disclosed that protect remote user communications with remote enterprise services, and simultaneously protect the enterprises services from third parties. In the first layer, an implementation of the Secure Sockets Layer (SSL) version of HTTPS provides communications security, including authentication of the enterprise web server and the security of the transmitted data. The protocols provide for an identification of the user, and an authentication of the user to ensure the user is who he/she claims to be and a determination of entitlements that the user may avail themselves of within the enterprise system. Session security is described, particularly as to the differences between a remote user'"'"'s copper wire connection to a legacy system and a user'"'"'s remote connection to the enterprise system over a “stateless” public Internet, where each session is a single transmission, rather than an interval of time between logon and logoff, as is customary in legacy systems. Security for the enterprise network and security for the data maintained by the various enterprise applications is also described.

Claims

1. A system for providing secure communications, the system comprising:

means for authenticating a secure server to a browser over a public data network;

means for encrypting communications between the browser and the secure server with a first security protocol;

means for authenticating a user of the browser and a set of entitlements of the user at log on with an authentication server;

means for encrypting communications within a private network with a second security protocol; and

means for creating a session management object at each log on to authenticate the browser at each communication from the browser during a communications session.

2. The system according to claim 1, further comprising:

means for providing a plurality of application resources to the user within the private network.

3. The system according to claim 2, wherein a digital certificate is used by the means for authenticating the secure server.

4. The system according to claim 3, wherein public key encryption is utilized to encrypt communications between the browser and the private network.

5. The system according to claim 4, wherein the means for authenticating the secure server utilizes a negotiated Secure Socket Layer (SSL) protocol to authenticate the secure server and encrypt communications between the browser and the secure server.

6. The system according to claim 3, further comprising:

means for downloading a collection of objects to the browser for session management following a successful log on, wherein a digital certificate is used to authenticate the objects to the user.

7. The system according to claim 1, further comprising:

means for creating a user object at log on, and populating the user object with entitlement for the application resources obtained from a user database maintained within the private network.

8. The system according to claim 7, further comprising:

means for populating the user object as the user accesses one of the application resources maintained within the private network.

9. The system according to claim 1, further comprising:

means for generating a session cookie for the browser, and examining the cookie at each session transmission to maintain session security.

10. The system according to claim 1, further comprising:

means for packet filtering communications between the browser and the secure server within the private network.

11. The system according to claim 10, further comprising:

means for creating a proxy to filter communications between the secure server and an application resource within the private network.

12. The system according to claim 1, wherein public key encryption is used for the security protocol within the private network.

13. The system according to claim 1, further comprising:

means for downloading a collection of objects to the browser for session management following a successful log on.

14. The system according to claim 1, further comprising:

means for embedding calls to applets in a log on page presented to the user at log on.

15. The system according to claim 6, further comprising:

means for embedding calls to objects in a web page presented to the user at log on, the objects providing interactive sessions with the private network, the sessions including client authentication, session authentication and transaction requests for the private network.

16. A method for providing security in a communications network, the method comprising:

communicating with a secure web server through a firewall, wherein the secure web server manages secure sessions over a public data network, the secure web server supporting secure socket layer (SSL) for encrypted communication, the secure web server further providing session management including user identification, validation and session management to link the session with a user;

communicating with a plurality of proxy services and a plurality of system resources using an internal network, wherein the plurality of system resources provides communications network management capabilities for the user, each of the system resources being responsive to a request to generate user data or instructions relating to the communications network; and

providing verification of system access after user entitlements have been verified.

17. A method according to claim 16, wherein the secure web server is accessible by a plurality of web browsers that enable interactive secure communications and provide an integrated interface for the user, each of the web browsers supporting user identification, user authentication and secure sockets layer (SSL) communications protocol, wherein digital certificates are utilized to authenticate the secure web server to the web browsers.

18. A method according to claim 16, wherein the session management further includes web cookie generation at each instance of user identification to link a session with the user through a plurality of discrete user communications in the session to verify the user at each transmission in the session.

19. A method according to claim 18, wherein the cookie is generated by a program on a separate server during an entitlements communications, after identification and authentication of the user.

20. A method according to claim 17, wherein the web browser secure socket layer encrypts user identification, authentication and a session management cookie during each transmission.

21. A method according to claim 18, wherein the session cookies provide simultaneous session management for a plurality of system resource platforms.

22. A method according to claim 16, wherein the communication with the secure web server is over an encrypted socket connection.

23. A method according to claim 17, wherein a first encryption algorithm is utilized for transmission of all user data between the secure web server and the browser, and a second encryption algorithm is utilized for transmission of all user data with the secure web server.

24. A method according to claim 17, wherein each user request from the web browser is encrypted with a public key provided by the communications network, and each of the user requests includes an encrypted cookie for user authentication.

25. An apparatus for providing security in a communications network, the apparatus comprising:

means for communicating with a secure web server through a firewall, wherein the secure web server manages secure sessions over a public data network, the secure web server supporting secure socket layer (SSL) for encrypted communication, the secure web server further providing session management including user identification, validation and session management to link the session with a user;

means for communicating with a plurality of proxy services and a plurality of system resources using an internal network, wherein the plurality of system resources provides communications network management capabilities for the user, each of the system resources being responsive to a request to generate user data or instructions relating to the communications network; and

means for providing verification of system access after user entitlements have been verified.

26. An apparatus according to claim 25, wherein the secure web server is accessible by a plurality of web browsers that enable interactive secure communications and provide an integrated interface for the user, each of the web browsers supporting user identification, user authentication and secure sockets layer (SSL) communications protocol, wherein digital certificates are utilized to authenticate the secure web server to the web browsers.

27. An apparatus according to claim 25, wherein the session management further includes web cookie generation at each instance of user identification to link a session with the user through a plurality of discrete user communications in the session to verify the user at each transmission in the session.

28. An apparatus according to claim 27, wherein the cookie is generated by a program on a separate server during an entitlements communications, after identification and authentication of the user.

29. An apparatus according to claim 26, wherein the web browser secure socket layer encrypts user identification, authentication and a session management cookie during each transmission.

30. An apparatus according to claim 27, wherein the session cookies provide simultaneous session management for a plurality of system resource platforms.

31. An apparatus according to claim 25, wherein the communication with the secure web server is over an encrypted socket connection.

32. An apparatus according to claim 26, wherein a first encryption algorithm is utilized for transmission of all user data between the secure web server and the browser, and a second encryption algorithm is utilized for transmission of all user data with the secure web server.

33. An apparatus according to claim 26, wherein each user request from the web browser is encrypted with a public key provided by the communications network, and each of the user requests includes an encrypted cookie for client authentication.

34. A method for providing an integrated and secure customer interface, the method comprising:

supporting interactive sessions, via an applet, with a communications network, the sessions including client authentication, session authentication and transaction requests for the communications network; and

encrypting each of the sessions with a public key provided by the communications network, each session also including session authentication with a cookie, the session cookie being encrypted with the public key during transmission of each transaction request to a secure server, wherein a security firewall is provided on either side of the secure server to prevent direct public access to the communications network.

35. A method according to claim 34, wherein the communications network includes a plurality of application servers for receiving transaction requests from the secure web server, the secure web server encrypting each of the transaction requests with a public key algorithm before transmission to a selected one of the application servers.

36. A method according to claim 35, further comprising:

receiving transaction requests, at a dispatch server, from the secure web server, the dispatch server dispatching the request to the selected one of the application servers.

37. A method according to claim 34, wherein the communications network includes a router based firewall between the secure server and the public data network, and a proxy based firewall between the secure web server and any one of the applications servers.

38. A method according to claim 34, wherein one of the applets is a client object, the client object being populated with a first set of entitlement at log on, and a second set of entitlement during a session with a selected application server.

39. A method according to claim 34, the communications network further includes an authentication server for determining entitlement for a client object following authentication.

40. An apparatus for providing an integrated and secure customer interface, the apparatus comprising:

means for supporting interactive sessions, via an applet, with a communications network, the sessions including client authentication, session authentication and transaction requests for the communications network; and

means for encrypting each of the sessions with a public key provided by the communications network, each session also including session authentication with a cookie, the session cookie being encrypted with the public key during transmission of each transaction request to a secure server, wherein a security firewall is provided on either side of the secure server to prevent direct public access to the communications network.

41. An apparatus according to claim 40, wherein the communications network includes a plurality of application servers for receiving transaction requests from the secure web server, the secure web server encrypting each of the transaction requests with a public key algorithm before transmission to a selected one of the application servers.

42. An apparatus according to claim 41, further comprising:

means for receiving transaction requests, at a dispatch server, from the secure web server, the dispatch server dispatching the request to the selected one of the application servers.

43. An apparatus according to claim 40, wherein the communications network includes a router based firewall between the secure server and the public data network, and a proxy based firewall between the secure web server and any one of the applications servers.

44. An apparatus according to claim 40, wherein one of the applets is a client object, the client object being populated with a first set of entitlement at log on, and a second set of entitlement during a session with a selected application server.

45. An apparatus according to claim 40, the communications network further includes an authentication server for determining entitlement for a client object following authentication.