US6775772B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Piggy-backed key exchange protocol for providing secure low-overhead browser connections from a client to a server using a trusted third party
Assignee: Lenovo International Ltd
•
Filing: 1999-10-12
•
Granted: 2004-08-10
•
Expires: 2019-10-12
Abstract
Abstract A method, system, and computer program product for establishing security parameters that are used to exchange data on a secure connection. A piggy-backed key exchange protocol is defined, with which these security parameters are advantageously exchanged. By piggy-backing the key exchange onto other already-required messages (such as a client's HTTP GET request, or the server's response thereto), the overhead associated with setting up a secure browser-to-server connection is minimized. This technique is defined for a number of different scenarios, where the client and server may or may not share an encoding scheme, and is designed to maintain the integrity of application layer communication protocols. In one scenario, a client and a server exchange secure messages using a trusted third party.
Inventors
- 👤 Carl Binding
- 👤 Stefan Georg Hild
- 👤 Luke James O'Connor
- 👤 Sandeep K. Singhal
- 👤 Victor John Shoup
- 👤 Michael Steiner
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-04 17:26
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/04; H04L63/0428
Claims Analysis
Total Claims: 71
Claim 1
Independent Claim
197 words
A computer program product embodied on one or more computer-readable media, for establishing a secure connection between a client application and a server application using pre-existing message types, said computer program product comprising: computer-readable program code means for piggy-backing a first portion of security information onto a first message sent from said client application to said server application, wherein said first message uses a first pre-existing message type and wherein said first portion is to be used by said server application in establishing said secure connection; computer-readable program code means for forwarding said first portion from said server application to a trusted third party (TTP); computer-readable program code means for decrypting said first portion at said TTP; computer-readable program code means for returning a version of said decrypted first portion from said TTP to said server application; and computer-readable program code means for piggy-backing a second portion of security information onto a second message sent from said server application to said client application, wherein said second message responds to said first message and uses a second pre-existing message type and wherein said second portion is to be used by said client application in establishing said secure connection.
Claim 2
Dependent Claim
197 words
A computer program product embodied on one or more computer-readable media, for establishing a secure connection between a client application and a server application using pre-existing message types, said computer program product comprising: computer-readable program code means for piggy-backing a first portion of security information onto a first message sent from said client application to said server application, wherein said first message uses a first pre-existing message type and wherein said first portion is to be used by said server application in establishing said secure connection; computer-readable program code means for forwarding said first portion from said server application to a trusted third party (TTP); computer-readable program code means for decrypting said first portion at said TTP; computer-readable program code means for returning a version of said decrypted first portion from said TTP to said server application; and computer-readable program code means for piggy-backing a second portion of security information onto a second message sent from said server application to said client application, wherein said second message responds to said first message and uses a second pre-existing message type and wherein said second portion is to be used by said client application in establishing said secure connection.
Claim 3
Dependent Claim
40 words
The computer program product according to claim 1 , wherein said first pre-existing message type is a HyperText Transfer Protocol (HTTP) GET request message and wherein said second pre-existing message type is a response to said HTTP GET request message.
Claim 4
Dependent Claim
40 words
The computer program product according to claim 1 , wherein said first pre-existing message type is a HyperText Transfer Protocol (HTTP) POST request message and wherein said second pre-existing message type is a response to said HTTP POST request message.
Claim 5
Dependent Claim
40 words
The computer program product according to claim 1 , wherein said first pre-existing message type is a Wireless Session Protocol (WSP) GET request message and wherein said second pre-existing message type is a response to said WSP GET request message.
Claim 6
Dependent Claim
40 words
The computer program product according to claim 1 , wherein said first pre-existing message type is a Wireless Session Protocol (WSP) POST request message and wherein said second pre-existing message type is a response to said WSP POST request message.
Claim 7
Dependent Claim
108 words
The computer program product according to claim 1 , wherein said client application and said server application have no previously-existing common message encoding scheme, but said client application shares a first message encoding scheme with said TTP and said server application shares a second message encoding scheme with said TTP, and wherein: said first message requests a secure page from said server application, wherein said request further comprises an identifier of said secure page; and said second message sends a response to said secure page request to said client application, wherein said response further comprises a content portion encrypted using a session key generated by said server application.
Claim 8
Dependent Claim
49 words
The computer program product according to claim 6 , wherein: said first portion further comprises a first set of information encrypted using a public key of said TTP; and said second portion further comprises a nonce of said server application, encrypted using a public key of said client application.
Claim 9
Dependent Claim
22 words
The computer program product according to claim 7 , wherein said second portion further comprises a security certificate of said server application.
Claim 10
Dependent Claim
51 words
The computer program product according to claim 7 , wherein said first set of information comprises: zero or more parameters required for said secure page request; an identification of said client application; an identification of said server application; an identification of said TTP; a client nonce; and optionally including a timestamp.
Claim 11
Dependent Claim
20 words
The computer program product according to claim 7 , wherein said forwarded first portion comprises said first set of information.
Claim 12
Dependent Claim
39 words
The computer program product according to claim 7 , wherein said returned version of said decrypted first portion comprises a subset of said first set of information, wherein said subset is encrypted using a public key of said server.
Claim 13
Dependent Claim
37 words
The computer program product according to claim 11 , wherein said subset comprises: said zero or more parameters;, said identification of said client application; said client nonce; and said timestamp when said first set includes said timestamp.
Claim 14
Dependent Claim
69 words
The computer program product according to claim 1 , wherein: said client application and said server application have no previously-existing common message encoding scheme, but said client application shares a first message encoding scheme with said TTP and said server application shares a second message encoding scheme with said TTP; and said second message includes a content portion that is encrypted using a public key of said client application.
Claim 15
Dependent Claim
37 words
The computer program product according to claim 6 , wherein said forwarded first portion is encrypted using a public key of said TTP and said returned version is encrypted using a public key of said server application.
Claim 16
Dependent Claim
32 words
The computer program product according to claim 6 , wherein said forwarded first portion and said returned version are encrypted using a private key shared by said TTP and said server application.
Claim 17
Dependent Claim
25 words
The computer program product according to claim 7 , wherein said first portion comprises meta-information for a message encoding scheme proposed by said client application.
Claim 18
Dependent Claim
38 words
The computer program product according to claim 16 , further comprising: computer-readable program code means for piggy-backing additional information onto said first message, wherein said additional information comprises zero or more parameters required for said secure page request.
Claim 19
Dependent Claim
18 words
The computer program product according to claim 17 , wherein said parameters are encrypted using a client nonce.
Claim 20
Independent Claim
171 words
A system for establishing a sure connection between a client application and a server application using pre-existing message types, said system comprising: means for piggy-backing a first portion of security information onto a first message sent from said client application to said server application, wherein said first message uses a first pre-existing message type and wherein said first portion is to be used by said server application in establishing said secure connection; means for forwarding said first portion from said server application to a trusted third party TTP); means for decrypting said first portion at said TTP; means for returning a version of said decrypted first portion from said TTP to said server application; and means for piggy-backing a second portion of security information onto a second message sent from said server application to said client application, wherein said second message responds to said first message and uses a second pre-existing message type and wherein said second portion is to be used by said client application in establishing said secure connection.
Claim 21
Independent Claim
171 words
A system for establishing a sure connection between a client application and a server application using pre-existing message types, said system comprising: means for piggy-backing a first portion of security information onto a first message sent from said client application to said server application, wherein said first message uses a first pre-existing message type and wherein said first portion is to be used by said server application in establishing said secure connection; means for forwarding said first portion from said server application to a trusted third party TTP); means for decrypting said first portion at said TTP; means for returning a version of said decrypted first portion from said TTP to said server application; and means for piggy-backing a second portion of security information onto a second message sent from said server application to said client application, wherein said second message responds to said first message and uses a second pre-existing message type and wherein said second portion is to be used by said client application in establishing said secure connection.
Claim 22
Dependent Claim
38 words
The system according to claim 19 , wherein said first pre-existing message type is a HyperText Transfer Protocol (HTTP) GET request message and wherein said second pre-existing message type is a response to said HTTP GET request message.
Claim 23
Dependent Claim
38 words
The system according to claim 19 , wherein said first pre-existing message type is a HyperText Transfer Protocol (HTTP) POST request message and wherein said second pre-existing message type is a response to said HTTP POST request message.
Claim 24
Dependent Claim
38 words
The system according to claim 19 , wherein said first pre-existing message type is a Wireless Session Protocol (WSP) GET request message and wherein said second pre-existing message type is a response to said WSP GET request message.
Claim 25
Dependent Claim
38 words
The system according to claim 19 , wherein said first pre-existing message type is a Wireless Session Protocol (WSP) POST request message and wherein said second pre-existing message type is a response to said WSP POST request message.
Claim 26
Dependent Claim
106 words
The system according to claim 19 , wherein said client application and said server application have no previously-existing common message encoding scheme, but said client application shares a first message encoding scheme with said TTP and said server application shares a second message encoding scheme with said TTP, and wherein: said first message requests a secure page from said server application, wherein said request further comprises an identifier of said secure page; and said second message sends a response to said secure page request to said client application, wherein said response further comprises a content portion encrypted using a session key generated by said server application.
Claim 27
Dependent Claim
47 words
The system according to claim 24 , wherein: said first portion further comprises a first set of information encrypted using a public key of said TTP; and said second portion further comprises a nonce of said server application, encrypted using a public key of said client application.
Claim 28
Dependent Claim
20 words
The system according to claim 25 , wherein said second portion further comprises a security certificate of said server application.
Claim 29
Dependent Claim
49 words
The system according to claim 25 , wherein said first set of information comprises: zero or more parameters required for said secure page request; an identification of said client application; an identification of said server application; an identification of said TTP; a client nonce; and optionally including a timestamp.
Claim 30
Dependent Claim
18 words
The system according to claim 25 , wherein said forwarded first portion comprises said first set of information.
Claim 31
Dependent Claim
37 words
The system according to claim 25 , wherein said returned version of said decrypted first portion comprises a subset of said first set of information, wherein said subset is encrypted using a public key of said server.
Claim 32
Dependent Claim
35 words
The system according to claim 29 , wherein said subset comprises: said zero or more parameters; said identification of said client application; said client nonce; and said timestamp when said first set includes said timestamp.
Claim 33
Dependent Claim
67 words
The system according to claim 19 , wherein: said client application and said server application have no previously-existing common message encoding scheme, but said client application shares a first message encoding scheme with said TTP and said server application shares a second message encoding scheme with said TTP; and said second message includes a content portion that is encrypted using a public key of said client application.
Claim 34
Dependent Claim
35 words
The system according to claim 24 , wherein said forwarded first portion is encrypted using a public key of said TTP and said returned version is encrypted using a public key of said server application.
Claim 35
Dependent Claim
30 words
The system according to claim 24 , wherein said forwarded first portion and said returned version are encrypted using a private key shared by said TTP and said server application.
Claim 36
Dependent Claim
23 words
The system according to claim 25 , wherein said first portion comprises meta-information for a message encoding scheme proposed by said client application.
Claim 37
Dependent Claim
36 words
The system according to claim 34 , further comprising: computer-readable program code means for piggy-backing additional information onto said first message, wherein said additional information comprises zero or more parameters required for said secure page request.
Claim 38
Dependent Claim
16 words
The system according to claim 35 , wherein said parameters are encrypted using a client nonce.
Claim 39
Independent Claim
164 words
A method for establishing a secure connection between a client application and a server application using pre-existing message types, said method comprising the steps of: piggy-backing a first portion of security information onto a first message sent from said client application to said server application, wherein said first message uses a first pre-existing message type and wherein said first portion is to be used by said server application in establishing said secure connection; forwarding said first portion from said server application to a trusted third party (TTP); decrypting said first portion at said TTP; returning a version of said decrypted first portion from said TTP to said server application; and piggy-backing a second portion of security information onto a second message sent from said server application to said client application, wherein said second message responds to said first message and uses a second pre-existing message type and wherein said second portion is to be used by said client application in establishing said secure connection.
Claim 40
Independent Claim
164 words
A method for establishing a secure connection between a client application and a server application using pre-existing message types, said method comprising the steps of: piggy-backing a first portion of security information onto a first message sent from said client application to said server application, wherein said first message uses a first pre-existing message type and wherein said first portion is to be used by said server application in establishing said secure connection; forwarding said first portion from said server application to a trusted third party (TTP); decrypting said first portion at said TTP; returning a version of said decrypted first portion from said TTP to said server application; and piggy-backing a second portion of security information onto a second message sent from said server application to said client application, wherein said second message responds to said first message and uses a second pre-existing message type and wherein said second portion is to be used by said client application in establishing said secure connection.
Claim 41
Dependent Claim
38 words
The method according to claim 37 , wherein said first pre-existing message type is a HyperText Transfer Protocol (HTTP) GET request message and wherein said second pre-existing message type is a response to said HTTP GET request message.
Claim 42
Dependent Claim
38 words
The method according to claim 37 , wherein said first pre-existing message type is a HyperText Transfer Protocol (HTTP) POST request message and wherein said second pre-existing message type is a response to said HTTP POST request message.
Claim 43
Dependent Claim
39 words
The method according to claim 37 , wherein said first pre-existing message type is a Wireless Session Protocol (WSP) GET request message and wherein said second exist pre-existing message type is a response to said WSP GET request message.
Claim 44
Dependent Claim
38 words
The method according to claim 37 , wherein said first pre-existing message type is a Wireless Session Protocol (WSP) POST request message and wherein said second pre-existing message type is a response to said WSP POST request message.
Claim 45
Dependent Claim
106 words
The method according to claim 37 , wherein said client application and said server application have no previously-existing common message encoding scheme, but said client application shares a first message encoding scheme with said TTP and said server application shares a second message encoding scheme with said TTP, and wherein: said first message requests a secure page from said server application, wherein said request further comprises an identifier of said secure page; and said second message sends a response to said secure page request to said client application, wherein said response further comprises a content portion encrypted using a session key generated by said server application.
Claim 46
Dependent Claim
47 words
The method according to claim 42 , wherein: said first portion further comprises a first set of information encrypted using a public key of said TTP; and said second portion further comprises a nonce of said server application, encrypted using a public key of said client application.
Claim 47
Dependent Claim
20 words
The method according to claim 43 , wherein said second portion further comprises a security certificate of said server application.
Claim 48
Dependent Claim
49 words
The method according to claim 43 , wherein said first set of information comprises: zero or more parameters required for said secure page request; an identification of said client application; an identification of said server application; an identification of said TTP; a client nonce; and optionally including a timestamp.
Claim 49
Dependent Claim
18 words
The method according to claim 43 , wherein said forwarded first portion comprises said first set of information.
Claim 50
Dependent Claim
37 words
The method according to claim 43 , wherein said returned version of said decrypted first portion comprises a subset of said first set of information, wherein said subset is encrypted using a public key of said server.
Claim 51
Dependent Claim
35 words
The method according to claim 47 , wherein said subset comprises: said zero or more parameters; said identification of said client application; said client nonce; and said timestamp when said first set includes said timestamp.
Claim 52
Dependent Claim
67 words
The method according to claim 37 , wherein: said client application and said server application have no previously-existing common message encoding scheme, but said client application shares a first message encoding scheme with said TTP and said server application shares a second message encoding scheme with said TTP; and said second message includes a content portion that is encrypted using a public key of said client application.
Claim 53
Dependent Claim
35 words
The method according to claim 42 , wherein said forwarded first portion is encrypted using a public key of said TTP and said returned version is encrypted using a pubic key of said server application.
Claim 54
Dependent Claim
30 words
The method according to claim 42 , wherein said forwarded first portion and said returned version are encrypted using a private key shared by said TTP and said server application.
Claim 55
Dependent Claim
23 words
The method according to claim 43 , wherein said first portion comprises meta-information for a message encoding scheme proposed by said client application.
Claim 56
Dependent Claim
36 words
The method according to claim 52 , further comprising: computer-readable program code means for piggy-backing additional information onto said first message, wherein said additional information comprises zero or more parameters required for said secure page request.
Claim 57
Dependent Claim
16 words
The method according to claim 53 , wherein said parameters are encrypted using a client nonce.
Claim 58
Dependent Claim
21 words
The method according to claim 37 , wherein at least a portion of content included in said second message is encrypted.
Claim 59
Dependent Claim
34 words
The method according to claim 55 , wherein the encrypted portion is encrypted using a session key created from first information contained in said first portion and second information contained in said second portion.
Claim 60
Dependent Claim
36 words
The method according to claim 55 , wherein the encrypted portion is encrypted using a session key created from a client nonce contained in said first portion and a server nonce contained in said second portion.
Claim 61
Dependent Claim
31 words
The method according to claim 55 , wherein the encrypted portion is encrypted using a session key and wherein said second portion enables said client application to recreate said session key.
Claim 62
Dependent Claim
28 words
The method according to claim 57 , wherein said client application can recreate said session key upon receiving said server nonce and can thereby decrypt said encrypted portion.
Claim 63
Dependent Claim
39 words
The method according to claim 43 , wherein said fist set of information comprises: an identification of said client application; an identification of said server application; an identification of said TTP; a client nonce; and optionally including a timestamp.
Claim 64
Dependent Claim
30 words
The method according to claim 47 , wherein said subset comprises: said identification of said client application; said client nonce; and said timestamp when said first set includes said timestamp.
Claim 65
Dependent Claim
30 words
The method according to claim 37 , wherein said forwarded first portion is encrypted prior to forwarding, using a message encoding scheme understood by said TTP and said server application.
Claim 66
Dependent Claim
29 words
The method according to claim 37 , wherein said returned version is encrypted prior to returning, using a message encoding scheme understood by said TTP and said server application.
Claim 67
Dependent Claim
42 words
The method according to claim 37 , wherein said forwarded first portion is encrypted such that only said TTP can decrypt said forwarded first portion and said returned version is encrypted such that only said server application can decrypt said returned version.
Claim 68
Independent Claim
284 words
A method for securely establishing a connection between a client application and a server application using a trusted third party (TTP) as an intermediary, further comprising steps of: sending, from the client application to the server application, a first message that uses a first pre-existing message type, wherein: the first message requests information from the server application, and includes a parameter portion and a proposed encoding scheme portion; the parameter portion contains zero or more parameters that may be used by the server application in creating the requested information, and is encrypted using a proposed encoding scheme that is identified in the proposed encoding scheme portion; and the proposed encoding scheme portion is encrypted using a first encoding scheme shared by the client application and the TTP; forwarding, from the server application to the TTP upon receiving the first message, the proposed encoding scheme portion; decrypting the forwarded proposed encoding scheme portion, upon receipt at the TTP, using the first encoding scheme, thereby revealing the proposed encoding scheme to the TTP; returning the revealed proposed encoding scheme from the TTP to the server application; using the returned proposed encoding scheme portion, upon receipt at the server application, to decrypt the parameter portion, thereby revealing the zero or more parameters to the server application; using the revealed zero or more parameters, if necessary, by the server application in creating the requested information; encrypting the created information, using a second encoding scheme that enables the client application to decrypt the encrypted information; and sending, from the server application to the client application, a second message that uses a second pre-existing message type, wherein the second message responds to the first message and includes the encrypted information.
Claim 69
Independent Claim
284 words
A method for securely establishing a connection between a client application and a server application using a trusted third party (TTP) as an intermediary, further comprising steps of: sending, from the client application to the server application, a first message that uses a first pre-existing message type, wherein: the first message requests information from the server application, and includes a parameter portion and a proposed encoding scheme portion; the parameter portion contains zero or more parameters that may be used by the server application in creating the requested information, and is encrypted using a proposed encoding scheme that is identified in the proposed encoding scheme portion; and the proposed encoding scheme portion is encrypted using a first encoding scheme shared by the client application and the TTP; forwarding, from the server application to the TTP upon receiving the first message, the proposed encoding scheme portion; decrypting the forwarded proposed encoding scheme portion, upon receipt at the TTP, using the first encoding scheme, thereby revealing the proposed encoding scheme to the TTP; returning the revealed proposed encoding scheme from the TTP to the server application; using the returned proposed encoding scheme portion, upon receipt at the server application, to decrypt the parameter portion, thereby revealing the zero or more parameters to the server application; using the revealed zero or more parameters, if necessary, by the server application in creating the requested information; encrypting the created information, using a second encoding scheme that enables the client application to decrypt the encrypted information; and sending, from the server application to the client application, a second message that uses a second pre-existing message type, wherein the second message responds to the first message and includes the encrypted information.
Claim 70
Dependent Claim
65 words
The method according to claim 65 , wherein the second encoding scheme uses a session key created from a client nonce provided by the client application in the proposed encoding scheme portion and a server nonce provided by the server application, and wherein the second message also includes the server nonce in a portion that is encrypted using a public key of the client application.
Claim 71
Dependent Claim
124 words
The method according to claim 65 , wherein: the proposed encoding scheme portion is encrypted by the server, prior to forwarding to the TTP, using a third message encoding scheme shared by the server application and the TTP; the TTP decrypts the forwarded proposed encoding scheme portion, using the third message encoding scheme, prior to decrypting the forwarded proposed encoding scheme portion using the first encoding scheme; the TTP encrypts the revealed proposed encoding scheme, using the third message encoding scheme, prior to operation of the returning step; and the server application decrypts the returned proposed encoding scheme portion, using the third message encoding scheme, prior to operation of the step of using the returned proposed encoding scheme portion to decrypt the parameter portion.
References Cited (Backward Citations)
US5708780A
Cited
US5825890A
Cited
US5793966A
Cited
US5673322A
Cited
US5754772A
Cited
US5978840A
Cited
US6061790A
Cited
US5875296A
Cited
US5923756A
Cited
US6092196A
Cited
US6182142B1
Cited
US6643774B1
Cited
US6226752B1
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2007-08-10 | 2008-02-09 | 2008-08-10 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2011-08-10 | 2012-02-09 | 2012-08-10 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2015-08-10 | 2016-02-09 | 2016-08-10 | $7700.00 | Window Closed / Lapsed |