A system and method of exploiting the security of a secure communication channel to secure a non-secure communication channel

Abstract

The present invention features a system and method for establishing a secure communication channel between a client and an application server. In one embodiment, a ticket service generates a ticket having an identifier and a session key. A communications device obtains the ticket from the ticket service and transmits the ticket to a client over a secure communication channel. The client transmits the identifier of the ticket to an application server over an application communication channel. The application server then obtains a copy of the session key of the ticket from the ticket service. Communications exchanged between the client and the application server over the application communication channel are then encrypted using the session key to establish the application communication channel as a secure communication channel.

Description

CROSS REFERENCE TO RELATED APPLICATIONS [0001] This Application is a Continuation of application Ser. No. 09 / 706117 filed on Nov. 3, 2000.FIELD OF THE INVENTION [0002] The invention relates generally to client-server computer networks. More specifically, the invention relates to a system and method for securely accessing software applications using a remote display protocol. BACKGROUND OF THE INVENTION [0003] Software applications that are requested to be remotely displayed on a client computer, or client, are commonly accessed with a graphical or windowing terminal session. When a user requests an application on a client computer, the application executes on a server and typically the input information (e.g., mouse and keyboard information) and display information are transmitted from the server computer to the client computer. Graphical or windowing terminal sessions often make use of unauthenticated connections between the client and the server. Alternatively, the graphical or wi...

AI Technical Summary

Benefits of technology

[0036] In a further embodiment, the session key is substantially equivalent to a null value (i.e., the ticket contains only a nonce or a nonce and a constant value for the session key). When the session key is substantially equivalent to a null value, the client 10 does not transmit the user's login information (e.g., password) between the client 10 and the applicati

Problems solved by technology

Graphical or windowing terminal sessions often make use of unauthenticated connections between the client and the server.

However, the current ticket-based authentication schemes are limited in several areas.

First, the ticket is typically transmitted to the client over a non-secure communication channel, thereby allowing an eavesdropper to intercept the ticket and retrieve the encryption key.

Second, the current schemes do not take advantage of secure web pages.

For example, current ticket-based authentication schemes make transactions over the internet, such as purchases, unsafe because proprietary information, such as a purchaser's credit card information, can be transmitted to a non-secure web page.

Third, software applications executing on a server are commonly transmitted over a nonsecure communication channel for display on a remote display protocol on a client machine.

Fourth, although the ticket can typically be used only one time (i.e., making it a “one-time use” ticket) and having no further value after its first use, the one-time use ticket does not protect the user's password (which is used for login into an operating system or an application) from an eavesdropper on the ticket's first transmission.

Therefore, the user's password is still not completely protected from interception and the server is consequently not authenticated to the client.

Images