Secure data exchange between data processing systems

• US 7,895,446 B2
• Filed: 09/25/2006
• Issued: 02/22/2011
• Est. Priority Date: 06/01/1999
• Status: Expired due to Term

• Current Assignee: Meta Platforms, Inc. (f/k/a Facebook, Inc.)
• Original Assignee: AOL Inc. (Apollo Global Management, Inc.)
• Inventors: Hendren, C. Hudson III, Harada, Larry T., Purdum, Christopher S., Dolecki, Mark A.
• Primary Examiner(s): Kim; Jung
• Assistant Examiner(s): Nobahar; Abdulhakim
• Application Number:
  US11/535,056
• Publication Number:
  US 20070124471A1
• Time in Patent Office: 1,611 Days
• Field of Search: 713/154, 713/182, 713/185, 713/150, 713/155, 709/217, 709/219, 709/229, 709/223, 709/225, 726/2, 726/5, 726/9, 726/14, 726 26- 30, 705/14, 705/26, 705/27, 705/52, 705/18, 705/50, 705/64, 705/76
• US Class Current: 713/185
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/561 Adding application-functional data or data for application control, e.g. adding metadata
• CPC Class Codes: H04L 67/568 Storing data temporarily at an intermediate stage, e.g. caching

Abstract

A data transfer method performed at a proxy server includes intercepting a data request from a client computer that is directed to a target server, encrypting profile information, augmenting the data request by adding the encrypted profile information to the data request, and sending the augmented data request to the target server. A data transfer method that is performed at an information server includes receiving a data request from a proxy server, extracting profile information added to the data request by the proxy server, using the extracted profile information to generate a response, and sending the response to the proxy server.

Claims

1. A data transfer method, the method comprising:

receiving a request from a client application that is directed to a server;

retrieving an identifier based on an identity of a user of the client application;

modifying the request to include the retrieved identifier; and

sending the modified request to the server such that the server extracts the retrieved identifier, accesses a storage associated with the server in which user profile information for the user was stored prior to the server receiving the request, retrieves the user profile information from the storage associated with the server based on the extracted identifier, generates a response to the request based on the retrieved user profile information, and sends the response to the client application.

2. The method of claim 1 further comprising:

receiving an initial request from the client application that is directed to the server;

determining the identity of the user of the client application in response to receiving the initial request;

retrieving the user profile information based on the identity of the user;

encrypting the user profile information;

appending the encrypted profile information to the initial request to generate a modified initial request;

sending the modified initial request to the server such that the server parses the modified initial request to extract the encrypted user profile information, decrypts the encrypted user profile information extracted from the modified initial request, stores the decrypted user profile information in the storage associated with the server, generates an initial response to the initial request based on the decrypted user profile information, generates the identifier, and sends the initial response and the identifier;

receiving the identifier from the server;

storing the identifier in a storage;

receiving the initial response from the server; and

forwarding the initial response to the client application.

3. The method of claim 2 wherein encrypting the user profile information comprises determining a session key and using the session key to encrypt the user profile information.

4. The method of claim 3 further comprising:

encrypting the session key; and

appending the encrypted session key to the initial request to create the modified initial request.

5. The method of claim 4 wherein:

using the session key to encrypt the user profile information comprises using the session key and a symmetric encryption algorithm to encrypt the user profile information, and

encrypting the session key comprises encrypting the session key using a public key encryption algorithm and a public key associated with the server.

6. The method of claim 2 wherein determining the identity of the user comprises:

determining an IP address of the client computer; and

querying a database to determine an identity associated with the IP address in the database.

7. The method of claim 1 wherein receiving the request from the client application includes receiving the request at a proxy server.

8. A data processing method performed by a server, the method comprising:

receiving a modified request, wherein the modified request was created by inserting an identifier corresponding to a user of a client application into a request sent by the client application;

accessing a storage associated with the server, wherein profile information for the user of the client application was stored in the storage prior to the server receiving the modified request;

extracting the identifier from the modified request;

retrieving the user profile information from the storage associated with the server based on the extracted identifier;

generating a response to the request based on the retrieved user profile information; and

sending the response to the client application.

9. The method of claim 8 further comprising:

receiving an initial modified request, wherein the initial modified request includes encrypted user profile information inserted into an initial request;

extracting the encrypted user profile information;

decrypting the encrypted user profile information extracted from the initial modified request;

storing the decrypted user profile information in the storage associated with the server;

generating the identifier; and

sending the identifier.

10. The method of claim 9 wherein

the initial modified request includes a session key, and

decrypting the encrypted user profile information comprises decrypting the encrypted user profile information extracted from the initial modified request using the session key.

11. The method of claim 10 further comprising decrypting the session key.

12. The method of claim 11 wherein:

decrypting the session key comprises decrypting the session key using a public key algorithm and a private key of the server, and

decrypting the encrypted user profile information using the session key comprises decrypting the encrypted user profile information using a symmetric decryption algorithm and the session key.

13. The method of claim 8 further comprising:

receiving a flush directive; and

in response to receiving the flush directive, discarding the user profile information stored in the local storage.

14. The method of claim 8 wherein receiving the modified request includes receiving the modified request from a proxy server.

15. A machine-readable storage device having a computer program embodied thereon, the computer program comprising instructions for causing a processing device to:

receive a request from a client application that is directed to a server;

retrieve an identifier based on an identity of a user of the client application;

modify the request to include the retrieved identifier; and

send the modified request to the server such that the server extracts the retrieved identifier, accesses a storage associated with the server in which user profile information for the user was stored prior to the server receiving the request, retrieves the user profile information from the storage associated with the server based on the extracted identifier, generates a response to the request based on the retrieved user profile information, and sends the response to the client application.

16. The machine-readable storage device of claim 15 wherein the computer program further comprises instructions for causing the processing device to:

receive an initial request from the client application that is directed to the server;

determine the identity of a user of the client computer in response to receiving the initial request;

retrieve the user profile information based on the identity of the user;

encrypt the user profile information;

append the encrypted profile information to the initial request to generate a modified initial request;

send the modified initial request to the server such that the server parses the modified initial request to extract the encrypted user profile information, decrypts the encrypted user profile information extracted from the modified initial request, stores the decrypted user profile information in the storage associated with the server, generates an initial response to the initial request based on the decrypted user profile information, generates the identifier, and sends the initial response and the identifier;

receive the identifier from the server;

store the identifier in a storage;

receive the initial response from the server; and

forward the initial response to the client application.

17. The machine-readable storage device of claim 16 wherein, to encrypt the user profile information, the computer program further comprises instructions for causing the processing device to determine a session key and using the session key to encrypt the user profile information.

18. The machine-readable storage device of claim 17 wherein the computer program further comprises instructions for causing the processing device to:

encrypt the session key; and

append the encrypted session key to the initial request to create the modified initial request.

19. The machine-readable storage device of claim 18 wherein:

to use the session key to encrypt the profile information, the computer program further comprises instructions for causing the processing device to use the session key and a symmetric encryption algorithm to encrypt the user profile information, and

to encrypt the session key, the computer program further comprises instructions for causing the processing device to encrypt the session key using a public key encryption algorithm and a public key associated with the server.

20. The machine-readable storage device of claim 15 wherein the computer program further comprises instructions for causing processing device to send a flush directive to the server such that the server discards the user profile information stored in the storage associated with the server.

21. The machine-readable storage device of claim 15 wherein the request from the client application is received at a proxy server.

22. A machine-readable storage device having a computer program embodied thereon, the computer program comprising instructions for causing a server to:

receive a modified request, wherein the modified request was created by inserting an identifier corresponding to a user of a client application into a request sent by the client application;

access a storage associated with the server, wherein profile information for the user of the client application was stored in the storage prior to the server receiving the modified request;

extract the identifier from the modified request;

retrieve the user profile information from the storage associated with the server based on the extracted identifier;

generate a response to the request based on the retrieved user profile information; and

send the response to the client application.

23. The machine-readable storage device of claim 22 wherein the computer program further comprises instructions for causing the server to:

receive an initial modified request, wherein the initial modified request includes encrypted user profile information inserted into an initial request;

extract the encrypted user profile information;

decrypt the encrypted user profile information extracted from the initial modified request;

store the decrypted user profile information in the storage associated with the server;

generate the identifier; and

send the identifier.

24. The machine-readable storage device of claim 23 wherein

the initial modified request includes a session key, and

to decrypt the encrypted user profile information, the computer program further comprises instructions for causing the server to decrypt the encrypted user profile information extracted from the initial modified request using the session key.

25. The machine-readable storage device of claim 24 wherein the computer program further comprises instructions for causing the server to decrypt the session key.

26. The machine-readable storage device of claim 25 wherein:

to decrypt the session key, the computer program further comprises instructions for causing the server to decrypt the session key using a public key algorithm and a private key of the server, and

to decrypt the encrypted user profile information using the session key, the computer program further comprises instructions for causing the server to decrypt the encrypted user profile information using a symmetric decryption algorithm and the session key.

27. The machine-readable storage device of claim 22 wherein the computer program further comprises instructions for causing the proxy server to:

receive a flush directive from the proxy server; and

discard the user profile information stored in the local storage.

28. The machine-readable storage device of claim 22 wherein the modified request is received from a proxy server.

29. A data transfer method, the method comprising:

receiving a request from a client application that is directed to a server;

retrieving an identifier based on an identity of a user of the client application;

modifying the request to include the retrieved identifier; and

sending the modified request to the server such that the server extracts the retrieved identifier, retrieves user profile information from a location other than the modified request based on the extracted identifier, generates a response to the request based on the retrieved user profile information, and sends the response to the proxy server.

30. A data processing method performed by a server, the method comprising:

receiving a modified request, wherein the modified request was created by inserting an identifier corresponding to a user of a client application into a request sent by the client application;

extracting the identifier from the modified request;

retrieving user profile information from a location other than the received, modified request based on the extracted identifier;

generating a response to the request based on the retrieved user profile information; and

sending the response to the client application.