Digitally identified and encrypted communication system for web-enabled applications

Abstract

Systems and methods for providing secure, uninterrupted, and privatized public network communications via a privacy bridge between users and the web-enabled applications. The privacy bridge operates as a secure broker, ensuring that the web-enabled applications access is restricted to the users with authorized and valid application access management configured digital certificates, whereas all other connection attempts are blocked. Systems and methods can further include an active agent service operating on user nodes, preventing manipulation of the deployed digital certificates, and automating the deployment and renewal of user digital certificates.

Description

DIGITALLY IDENTIFIED AND ENCRYPTED COMMUNICATION SYSTEM FOR WEB- ENABLED APPLICATIONSFIELD OF THE INVENTION

[0001] The invention may be embodied as system or method relating to cybersecurity and privacy of connections established via a public network with connectivity to the cloud, data centers, hybrid networks, edge-to-edge, edge-to-cloud, and Internet of Things (loT). The present invention touches on topics such as the Internet, Public Key Infrastructure (PKI), Secure Socket Layer Security (SSL), Transport Layer Security (TLS), Mutual Transport Layer Security (mTLS), Hypertext Transfer Protocol (HTTP), Hypertext Transfer Protocol Secure (HTTPS), Short Message Service (SMS), Multipurpose Internet Mail Extensions (MIME), Secure Multipurpose Internet Mail Extensions (S / MIME), Certificate Authority (CA), X.509 standard, digital certificates, Certificate- Based Authentication (CBA), Certificate-Based Access (CBA), Virtual Private Network (VPN), Identity and Access Management (IAM), Privileged Access Management (PAM), Single Sign-On (SSO), Software as a Service (SaaS), Security as a Service (SECaaS), PKI as a Service (PKIaaS), SSL inspection, Man-in-the-Middle (MitM) attack, Structured Query Language (SQL) injection, cross site scripting (XSS), domain spoofing, domain hijack, i.e. domain theft, and the like.BACKGROUND

[0002] Migration from corporate data centers to cloud-based solutions, accelerated by work from anywhere, resulted in moving away from desktop applications to cloud-based applications. That migration created an on-going high demand for cyber-secure topologies governing how organizations, employees, third- party providers, and customers conduct daily operations in thecloud. What was once simple and relatively secure, such as operating behind a firewall in an isolated corporate network, turned into a breachable mesh of connections exposing organizations to cyberattacks and phishing. Solutions, such as VPN, SSO, password management, Two-Factor Authentication (2FA), and Multi-Factor Authentication (MFA) are being breached, and the resulting harm is significant, particularly with regard to a breached organization's ability to conduct business, the negative impact on the breached organization's brand, financial loss, and legal costs.

[0003] Authentication credentials such as, a password, Personal Identification Number (PIN), or One-Time Passcode (OTP) are not a proof of identity, be it human or machine. Instead, these are merely permissions to connect to an application or a machine. Theft and sharing of authentication credentials can and has resulted in unauthorized access to systems, and serious consequences have been imposed on such breached organizations. SSL / TLS is a server-side web traffic protection, but does not and cannot provide a digital identity of the user connecting to the web-enabled application. The "digital identity" is that of the user herself or the machine, thereby identifying who or what is actually using the authentication credentials. Use of the digital identity acts to prevent the use of stolen or shared authentication credentials.

[0004] The digital certificates, implemented via PKI conforming to X.509, are an internationally recognized and accepted standard for the digital identity. Systems using PKI are complex to deploy and manage, require a specialized work force to set-up and maintain, and are costly. Therefore, there is a need for the automation of a digital certificate management, including automated deployment on the user nodes.

[0005] Existing methods and systems of delivering the digital certificate to the user via the public network are not secure. In addition, such methods and systems are complex and inefficient. As such, there is a need for methods and systems that provide secure delivery of a digital certificate package to the user that is simple and quick from the user’s perspective.

[0006] Unsecure connections used by an authorized user (e.g. an employee) to access and use the web-enabled applications via the public network can result in MitM attacks and ransomware being used against that organization, i.e. an entity using the web-enabled applications accessed over the public network, which may halt or significantly hinder the organization's daily operations. Therefore, there is a need to provide the secure and private communications between the user nodes and the web-enabled applications that are accessed and used via the public network. Further, there is a need for a system to create and manage rules, which may be X.509 compliant, for the organization to implement the secure and private communications between the user node and the node hosting the web-enabled application that is accessed and used via the public network.SUMMARY

[0007] The present invention relates to systems and methods for the uninterrupted and private public network communications between nodes facilitating the connection between the user node and the node hosting the web-enabled application.

[0008] Systems and methods according to the invention include: a) an application access management (AAM) console for creating and managing AAM rules and an AAM configuration setup profile for deploying an AAM configuration setup on the node and creating AAM configured digital certificates; b) a node with the deployed AAM configuration setup operating as a privacy bridge controlling access to the web-enabled applications, establishing a SSL / TLS handshake between the user node, i.e. node operated by a user, and the public network node hosting the web-enabled application; c) root-signed digital certificates created according to the AAM rules for the web-enabled application access; d) a digital certificates management system operating as PKIaaS; and e) access to the root-signing CA to validate the requesting digital certificate.

[0009] Further embodiment of the invention relates to a method carried out by a collection of programs and tools, such as forms, reports, and database objects to create and manage the AAM rules that define the rules by which the users are granted or denied access to the web-enabled applications, and in so doing are managed under a variety of conditions and events. The AAM console according to the invention may a) create the AAM configuration setup for the privacy bridge, and b) provide attributes for creating the AAM configured digital certificates, or AAM configured digital certificate signed user-side tokens.

[0010] Information provided via the AAM console may be used to manage data for the AAM configuration setup on the privacy bridge. The combination of a) attributes associated with the AAM configured digital certificate, and b) a web-enabled application's Uniform Resource Locator (URL), i.e., a web address, are used together to control access to or from the public network thereby controlling rights of access and use of the web-enabled application.

[0011] Embodiments of the present invention may be implemented via PKI conforming to X.509, an internationally recognized and accepted standard for the digital identity and a personalized encryption based on the user's private key. The X.509 standard defines a format of the digital certificates, and private and public keys.

[0012] Further embodiment of the invention relates to systems and methods of deploying and managing digital certificates, and may include a) an active agent that may be client-deployed on the user nodes, and b) an active agent manager server deployed in the public network. The digital certificates management system may be operated as PKIaaS, which may reduce organizational complexities by shifting the need for a specialized work force and infrastructure maintenance to the web-enabled application provider. Via the invention, deploying and managing the digital certificates becomes an activity controlled and managed by the active agent client and the active agent manager server. The active agent client may be comprised of a) operational software, and b) an active agent scheduler service running on the user node. The active agent manager server may be deployed in the public network. The active agent manager server may comprise a) a server and software for answering and fulfilling requests by the active agent client, and b) a web service for receiving and acting on connection requests made by the active agent client.

[0013] Further embodiment of the invention relates to systems and methods for secure downloading of the digital certificates. The invention may use multiple channels for delivering the digital certificates. Such channels may include, for example, the Internet, email, and wireless, i.e. SMS. Where a digital certificate package delivery is distributed across multiple channels, a chance that a malicious party, i.e. hacker, can gain simultaneous real-time access to all employed channels of delivery are minimized. A method according to the invention may be carried out by sending a message having a) instructions for downloading the digital certificates, and b) a link, which may be in the form of a tokenized URL for accessing a personalized, one time use web page. Such a method may have a means for selecting a recipient’s consent options, which may be selected by the recipient in compliance with privacy regulations, such as the U.S. Telephone Consumer Protection Act (TCPA), California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA), U.S. Cellular Telecommunications and Internet Association (CTIA) guidelines, Canada’s Antispam Legislation (CASL), EU General Data Protection Regulation (GDPR), UK Data Protection Act 2018, and similar. In a method according to the invention, the password furnished by the recipient is used to limit access to the digital certificate package, thereby ensuring delivery to the intended recipient of a digital certificate’s private key.

[0014] The privacy bridge, as presented by the invention, is a gateway tasked with determining the validity of the connection between the web-enabled application and the user node. The privacy bridge determines whether the user's digital certificate indicates the user is authorized to access the web-enabled application, and makes this determination before the user node is permitted to connect to the node hosting that web-enabled application. The privacy bridge permits only those connections that can present the authorized and valid AAM configured digital certificate. Thisrestricted access privatizes the web-enabled application URL, making it a privatized application domain restricting access to the users with the authorized and valid AAM configured digital certificates. Those connections that cannot present the authorized and valid AAM configured digital certificates are dropped before the connection to the web-enabled application domain is established. The connection that is permitted to be established between the user node and the web-enabled application domain is secure, uninterrupted and private.

[0015] Digitally identified, secure and private connectivity, as presented by the invention, provides privacy and security of the connection, preventing data theft and modification, MitM attacks, SQL injection, domain spoofing, domain hijacks i.e. domain thefts, XSS, and a malware deployment. In addition, the digital identity combined with two-way encryption provides an unambiguous method whereby each party involved in a transactional activity will have difficulty credibly denying the results of that activity. A digital signature of the user node and a web-enabled application server digital certificate, present a reliable fact as to who were the parties to a transaction.BRIEF DESCRIPTION OF DRAWINGS

[0016] FIG. 1 is a flowchart showing a method of creating the AAM rules and the AAM configuration setup according to the invention. Using the AAM console, the organization creates the AAM rules for accessing the web-enabled application. Using the AAM rules, the attributes are provided and used to create the AAM configured digital certificates and the AAM configuration setup.

[0017] FIG. 2 is a flowchart showing the details of a method of creating the AAM rules and the AAM configuration setup profile, and distributing of the AAM configuration setup and the attributes for creating AAM configured digital certificates according to the invention. Using the AAM console, the user creates the AAM rules for accessing the web-enabled applications. Using the AAM console, the user creates the AAM configuration setup profile from the saved AAM rules. Using the AAM console, from the AAM configuration setup profile the user creates the AAM configuration setup for deployment on the privacy bridge. Using the AAM console, from the AAM configuration setup profile the user provides the attributes to create the AAM configured digital certificates.

[0018] FIG. 3 is a flowchart describing a method according to the invention in which a digitally identified and encrypted communications link is established via the public network.

[0019] FIG. 4 schematically depicts the functionality of the privacy bridge, which includes permitting only authorized users to connect to the web-enabled application. Only the users that have been authorized to access the particular web-enabled application and provisioned with the AAM configured digital certificate for that particular web-enabled application, are permitted to connect to that web-enabled application. The authorized users gain seamless, uninterrupted, digitally identified, encrypted, and private connections to the web-enabled applications. Connection requests from unauthorized users, i.e. users not provisioned with the valid and active AAM configured digital certificate, are dropped instantly.

[0020] FIG. 5 schematically depicts access by the authorized user to the web-enabled application via the public network, and having the privacy bridge accepted the AAM configured digital certificate checked by the signing CA for status and validity.

[0021] FIG. 6 is a flowchart describing an automated digital certificate management method according to the invention that includes installing the active agent client and the active agent scheduler service.

[0022] FIG. 7 is a flowchart describing an automated digital certificate management method according to the invention that includes executing the active agent scheduler service and managing the active agent client and digital certificates.

[0023] FIG. 8 is a flowchart identifying aspects of a method according to the invention that results in a secure, personalized and simple to use system for downloading a digital certificate package.

[0024] Although embodiments of the invention have been described herein, the invention is not limited to such embodiments. The claims which follow are directed to the invention, and are intended to further describe the invention, but are not intended to limit the scope of the invention.DETAILED DESCRIPTION

[0025] Again, the present invention relates to systems and methods for the uninterrupted, private and the digitally identified public network communications between nodes facilitating the connection between a user's node and the node hosting the web-enabled application.

[0026] FIG. 1 is a flowchart showing a method of creating the AAM rules and the AAM configuration setup according to the invention. Shown in FIG. 2, without limitation, using the AAM console, the organization creates the AAM rules for accessing the web-enabled application 100. Using the AAM rules, the attributes are provided and used to create the AAM configuration setup and the AAM configured digital certificates 110.

[0027] FIG. 2 is a flowchart showing the details of a method according to the invention, of creating the AAM rules and the AAM configuration setup profile, and from the AAM configuration setup profile creating the AAM configuration setup and the attributes for creating the AAM configured digital certificates. Shown in FIG. 2, without limitation, is the user using the AAM console creating the AAM rules 200. The user saves the created AAM rules in the AAM repository 210. Using the AAM console, the user creates the AAM configuration setup profile 220 from the AAM rules saved in the AAM repository. Using the AAM console, the user uses the AAM configuration setup profile for creating the AAM configuration setup for the privacy bridge in a form according to the AAM requirements for the AAM supported connections 230. Also, using the AAM console, the user uses the AAM configuration setup profile to provide attributes for creating the AAM configured digital certificates 240.

[0028] FIG. 3 is a flowchart showing a process describing a method according to the invention, in which the digitally identified and encrypted two-way tunnel connection 370 is established between the node 305 and the privatized application domain 360, i.e. the web-enabled application domain accessible only via the privacy bridge residing on the public network. The node 305 can be a computer, PC, laptop, notebook, mobile phone, mobile device, loT, command and control (C&C) server, and similar. Shown in FIG. 3, without limitation, is a) the user selecting the URL on a browser 300 to connect to the privatized application domain 360, b) the user selecting a mobile app 301 to connect to the privatized application domain 360, c) the loT 302 requesting the connection to the privatized application domain 360, and d) the C&C server 303 requesting the connection to the privatized application domain 360.

[0029] Upon requesting the connection to the privatized application domain 360, the user selecting the URL on the browser 300, or the user selecting the mobile app 301, or the loT requesting the connection 302, or the C&C server requesting the connection 303, may select the digital certificate 310 installed on the node 305, wherein the request for the connection is directed to the privacy bridge 320. The privacy bridge 320 checks for the existence of the digital certificate 330. Wherein the digital certificate exists, i.e. is present, the privacy bridge 320 checks whether the digital certificate is past its validity end date 330. Wherein the digital certificate exists and the digital certificate is not past its validity end date, i.e. is active, the privacy bridge checks whether the digital certificate is registered 330 on the privacy bridge for the connection to the privatized application domain 360. Wherein the digital certificate does not exist, or the digital certificate is past the validity end date, i.e. not active, or is not registered on the privacy bridge to connect to the privatized application domain 332, the privacy bridge drops the request for a connection and stops the process 333, and submits the process meta-data 334 to the operational database 390 for storage.Wherein the digital certificate exists and is not past its validity end date and is registered to connect on the privacy bridge to connect to the privatized application domain 331, the privacy bridge requests the digital certificate validation from the digital certificate signing CA 340. The digital certificate validation may be done as an Online Certificate Status Protocol (OCSP) request. The digital certificate signing CA 340 returns a validation status to the privacy bridge for further action 350. Wherein the digital certificate is not valid, i.e. is revoked 352, the privacy bridge drops the request for a connection and stops the process 353, and submits the event meta-data 354 to the operational database 390 for storage. Wherein the digital certificate is valid, i.e. not revoked 351, the privacy bridge directs the request for the connection to the privatized application domain 360. The privatized application domain 360 node establishes the uninterrupted, digitally identified, and encrypted two-way tunnel connection 370 with the node 305, and submits the process meta-data 380 to the operational database 390 for storage.

[0030] FIG. 4 is a diagram showing the functionality of the privacy bridge 430, which controls the request of the user 400, connecting to the web-enabled application 440. The authorized user 410, i.e. the user with the authorized and valid AAM configured digital certificate on her node, and the unauthorized user 420, i.e. the user without the authorized and valid AAM configured digital certificate, have their request for the connection directed to the privacy bridge 430. The privacy bridge 430 checks for the existence of the authorized and valid AAM configured digital certificate. The request for the connection by the unauthorized user 420 is immediately dropped 450, and no connection to the web-enabled application 440 is established. The request for the connection by the authorized user 410 is directed via the privacy bridge 430 to the web-enabled application 440. The web-enabled application 440 node establishes the uninterrupted, digitally identified, and encrypted two-way tunnel connection 460 with the authorized user 410 node, enabling the user 400 to access her web-enabled application 440.

[0031] FIG. 5 is a diagram showing the authorized user 500, i.e. the user with the authorized and valid AAM configured digital certificate 511 on her user device 510, requesting a connection to the web-enabled application 540 hosted on the web-enabled application server 545 from her user device 510 with the installed AAM configured digital certificate 511. Request for the connection is directed to the privacy bridge 520. The privacy bridge 520 submits the digital certificate 511 of the authorized user 500, to the digital certificate signing CA 530 for validation. Upon confirming the digital certificate validity, the privacy bridge 520 directs the request for a connection to the web- enabled application server 545. Optionally, the web-enabled application server 545 may request additional web-enabled application access validation from its IAM system 560. The web-enabledapplication server 545 establishes the uninterrupted, digitally identified, and encrypted two-way tunnel connection 550 with the authorized user 500.

[0032] FIG. 6 shows a flowchart of a process describing an active agent client software installation as part of an automated digital certificate management method according to the invention. Shown in FIG. 6 is the downloading of the active agent client software onto the node 600, i.e. a computer, mobile phone or mobile device. Upon downloading of the active agent client software onto the node 600, an installer, i.e. software executing the active agent client software installation process, checks whether the active agent client is installed, i.e. present, on the node 601. Wherein the active agent client is not present on the node 602, the installer performs the installation of the active agent client software 608. Wherein the active agent client is installed on the node, i.e. is present 603, the installer fetches installation instructions from an installation configuration setup 604. Wherein the instruction 605 is reinstalling the active agent client 606, the installer continues with installing of the active agent client software 608. Wherein the instruction 605 is not to reinstall the active agent client software 607, the installer alerts the user in a role of administrator, i.e. an administrator 623, and exits the installation process 624.

[0033] Upon performing the installation process of the active agent client software 608, the installer checks whether the active agent client software contains a node attributes extraction routine 609. Wherein there is no node attributes extraction routine present in the active agent client software 611, the installer checks whether the installation process was successful 617. Wherein there is the node attributes extraction routine present in the active agent client software 610, the installer fetches the installation instructions from the installation configuration setup 612. Wherein the instruction 613 is to install the node attributes extraction routine 615 on the node, the installer performs the installation of the node attributes extraction routine 616 on the node. Wherein the instruction 613 is not to install the node attributes extraction routine 614 on the node, the installer checks whether the installation process was successful 617.

[0034] Wherein installing was not successful 618, i.e. it failed, the installer fetches the installation instructions from the installation configuration setup 620. Wherein the instruction 621 to not repeat the installation process 622, the installer alerts the administrator 623 and exits the installation process 624. Wherein the instruction 621 is to repeat the installation process 625, the installer repeats the installation of the active agent client software 608. Wherein the installing of the active agent client software was successful 619, the active agent client starts the active agent scheduler service 630. Upon starting the active agent scheduler service 630, the active agent client submits process meta-data to the active agent manager server 631, wherein the active agent manager server saves the process meta-data 632, and stops the process 633.

[0035] FIG. 7 shows a flowchart of a process describing an automated digital certificate management method according to the invention. Shown in FIG. 7 is the active agent scheduler service periodically restarting, i.e. cycling, the active agent client 700 checking whether the node attributes extraction routine is installed 702 on the node running the active agent scheduler service. Wherein there is no installed node attributes extraction routine on the node 704, the active agent client connects to the active agent manager server wherein the active agent manager checks for active agent client software patches 728. Wherein there is the installed node attributes extraction routine on the node 706, the active agent client executes the node attributes extraction routine and submits the results of the extraction to the active agent manager server 708. The active agent manager compares received extracted node attributes to previously saved node attributes 710 and checks whether the received and saved node attributes are identical 712. Wherein the received and saved node attributes are not identical 714, the active agent manager alerts the administrator 718, submits the process meta-data 720 to the active agent manager for saving 792 in the active agent manager database, and stops the process 722. Wherein the received and saved node attributes are identical 716, the active agent manager checks for active agent client software patches 728.

[0036] The active agent manager compares the latest version of the active agent client software residing on the active agent manager server to the installed version of the active agent client 730 and submits a result of the comparison back to the active agent client residing on the node for comparison 732. Wherein the active agent client software version residing on the active agent manager server is the same or older version than the active agent client version residing on the node 734, the active agent client connects to the active agent manager server to check for the digital certificates to be installed or deinstalled 766. Wherein the active agent client software version residing on the active agent manager server is a later version, i.e. higher, than the active agent client version residing on the node 736, the active agent client downloads the latest active agent client software from the active agent manager server and proceeds with installing the active agent client software patch on the active agent client node 738. The installer checks the status of the active agent client software patch installation on the active agent client node 740. Upon successfully installing the active agent client software patch 742 the active agent client connects to the active agent manager server to check for the digital certificates to be installed or deinstalled 766.

[0037] Upon unsuccessful installation of the active agent client software patch 744, the installer fetches instructions from the installation configuration setup 746 and checks the instructions whether to reinstall the active agent client software patch 748. Wherein the instruction is not to reinstall the active agent client software patch 749, the installer alerts the administrator 760, submits process meta-data 762 to the active agent manager server for saving 792 in the activeagent manager database, and stops the installation process 764. Wherein the instruction is to reinstall the active agent client software patch 750, the installer continues with installing of the active agent client software patch 752, and checks the success of the installation process 754. Wherein the reinstallation process was unsuccessful 758, the installer alerts the administrator 760, submits the process meta-data 762 to the active agent manager server for saving 792 in the active agent manager database, and stops the installation process 764. Wherein the reinstallation process was successful 756, the active agent client connects to the active agent manager server to check for the digital certificates to be installed or deinstalled 766.

[0038] Upon connecting to the active agent manager server to check for the digital certificate to be installed or deinstalled 766, the active agent manager checks whether there are digital certificates to be installed or deinstalled 768. Wherein there are no digital certificates to be installed or deinstalled 774, the installer submits the process meta-data to the active agent manager server for saving 792 in the active agent manager database.

[0039] Wherein there are the digital certificates on the active agent manager server to be installed on the node hosting the active agent client 770, the active agent manager fetches the digital certificates from the CA 776, and submits the digital certificates to the node hosting the active agent client 778. Upon receiving the digital certificates from the active agent manager server, the active agent client installs the digital certificates on the node hosting the active agent client 780 and submits the status of the installation process to the active agent manager for checking of the status of the installation process 784. Wherein there are the digital certificates to be deinstalled 772, the active agent manager submits serial numbers of the digital certificates to be deinstalled to the active agent client on the node storing the respective digital certificates. The active agent client deinstalls the digital certificates with the serial numbers matching those submitted by the active agent manager 782, and submits the process status to the active agent manager server, wherein the active agent manager checks the status of the process 784.

[0040] Wherein the process was unsuccessful 786, the active agent manager alerts the administrator 790 for further action, and saves the process meta-data 792 in the active agent manager database. Wherein the process was successful 788, the active agent manager saves the process meta-data 792 in the active agent manager database. Upon saving the meta-data in the active agent manager database, the active agent manager exits the process 794.

[0041] FIG. 8 shows a flowchart describing a process of a secure, personalized and simple to use system for downloading a digital certificate package according to the invention. Shown in FIG. 8 is the administrator sending an instruction message, such as email, to a digital certificate package recipient, i.e. recipient, to download the digital certificate package, with the one-time use tokenizedURL, personalized for the recipient 800. Upon receiving the instruction message, the recipient starts with the digital certificate package download process by selecting the tokenized URL received in the instruction message 810, requesting a connection to the CA server hosting the tokenized URL. The CA server checks the validity of the tokenized URL for expiry 820. Wherein the tokenized URL is expired 821, the recipient is prompted by the CA server to request a new digital certificate package instruction message from the administrator 830. Wherein the tokenized URL is not expired 822, the CA server checks whether the tokenized URL was previously used for the downloading of the digital certificate package 840. Wherein the tokenized URL was previously used for the downloading of the digital certificate package 841, the CA server disconnects the web session with the recipient, exiting the process 850. Wherein the tokenized URL was not previously used for the downloading of the digital certificate 842, the CA server opens a web page prompting the recipient to accept the terms of service (TOS) 870 before proceeding with the download process. Wherein the recipient refuses to accept the TOS 872, the CA server disconnects the web session with the recipient, exiting the process 880. Wherein the recipient accepts the TOS 871, the CA server checks organizational digital certificate deployment rules whether the recipient is mandated to perform the OTP verification 890.

[0042] Wherein the recipient is not mandated to perform the OTP verification 892, the CA server opens a new web page requesting the recipient to enter a password, to password protect the digital certificate package 1040 for the download to prevent unauthorized installation of the digital certificate. Wherein the recipient is mandated to perform the OTP verification 891, the CA server checks whether there is an option for the recipient to grant or opt out of a consent for receiving the OTP verification 900.

[0043] Wherein the recipient has an option to either grant or opt out of the OTP consent 901, the CA server opens an OTP consent web page requesting the recipient to either grant or opt out of the OTP consent 910. Wherein the recipient opts out, i.e. refuses to grant the OTP consent 912, the CA server exits the digital certificate download process 920. Wherein the recipient grants the OTP consent 911, the CA server opens a web page for the recipient to request the OTP 930. Wherein the recipient has no option to opt out of the OTP consent 902, the CA server opens a web page for the recipient to request the OTP 930 and the recipient is mandated to request the OTP from the CA server.

[0044] Upon receiving the OTP from the CA server 940, the recipient enters the received OTP into the OTP verification web page 950 wherein the CA server checks whether the OTP verification was performed within the predetermined time limit 960. Wherein the performing of the OTP verification exceeds the predetermined time limit 961, the OTP verification web page checks thenumber of OTP requests against the predetermined maximum of the OTP requests 970. Wherein the number of OTP requests exceeds the predetermined maximum of the OTP requests 971, the OTP verification web page alerts the administrator 980 and exits the digital certificate download process 990. Wherein the number of OTP requests does not exceed the predetermined maximum of the OTP requests 972, the OTP verification web page prompts the recipient to request the OTP again 930 and repeat the OTP verification process. Wherein the OTP verification does not exceed the predetermined time limit 962, the OTP verification web page compares the entered OTP to the OTP sent to the recipient 1000. Whereas both OTPs, sent and received, do not match 1002, the OTP verification web page checks that the number of OTP requests does not exceed the predetermined maximum of the OTP requests 1010. Wherein the number of OTP requests exceeds the predetermined maximum of the OTP requests 1011, the CA server alerts the administrator 1020 and exits the digital certificate download process 1030. Wherein the number of OTP requests does not exceed the predetermined maximum of the OTP requests 1012, the OTP verification web page prompts the recipient to request the OTP again 930 and repeat the OTP verification process. Whereas both OTPs, sent and received, match, i.e. are identical 1001, the CA server opens a create password web page 1040 for the recipient to create her own password to password protect the digital certificate package 1050 during the download process.

[0045] Upon entering and re-entering the password for validation 1050, the CA server checks whether the password and the re-entered password are identical 1060. Wherein the passwords are not identical 1062, the CA server checks the predetermined maximum number of the password verifications 1070, and wherein the number of password verification attempts exceeds the predetermined maximum number of the password verifications 1071, the CA server alerts the administrator 1080 and exits the digital certificate download process 1090. Wherein the number of password verification attempts does not exceed the predetermined maximum number of the password verifications 1072, the recipient is prompted to enter and re-enter the password one more time 1050. Wherein the entered and re-entered passwords are identical 1061, the CA server creates the digital certificate package, password protected with the recipient’s own password 1100, and the CA server opens a digital certificate package download web page and prompts the recipient to download and save the package on the node 1110 where the digital certificate is to be installed.

[0046] The digital certificate package download web page checks the result of the download activity 1120. Wherein the digital certificate package download was unsuccessful 1122, the CA server alerts the administrator 1140, and saves the digital certificate download process meta-data in the operational database 1190. Upon resolving the issue of the failed download, the administrator 1150 restarts the digital certificate download process 1160. Wherein the digital certificate packagedownload was successful 1121, the CA server opens a digital certificate installation instructions web page 1170, blocks the messaged tokenized URL preventing the future use of the same tokenized URL 1180, and saves the digital certificate download process meta-data in the operational database 1190.

[0047] Upon saving the digital certificate download process meta-data in the operational database 1190, the CA server stops the digital certificate package download process 1200, terminating all further activities.

Claims

AMENDED CLAIMS received by the International Bureau on 17 June 2025 (17.06.2025)1. A method for establishing a connection between a node and a web-enabled application via a public network, comprising: via an application access management (AAM) console, a user creating AAM rules governing access over the public network to the web-enabled applications; via an application access management (AAM) console, associating the AAM rules with the web-enabled application domain, i.e. Uniform Resource Locator (URL); using the AAM repository, storing the AAM rules; using the AAM rules, creating an AAM configuration setup profile based on the AAM rules; using the AAM configuration setup profile for creating AAM defined digital certificates and the privacy bridge AAM configuration setup; providing digital certificates management services operating as a PKI as a Service (PKIaaS); opening a web browser and using the web browser to request a connection to the web- enabled application; opening a mobile app to connect to the web-enabled application; requesting the connection from an loT to the web-enabled application; requesting the connection from a command and control (C&C) server to the web-enabled application; selecting a digital certificate to connect to the web-enabled application; via the privacy bridge, determining whether the provided digital certificate is among those associated with the web-enabled application;via the privacy bridge, determining whether the provided digital certificate is not past its validity end date, i.e. is active; via a certificate authority (CA), confirming whether the identified digital certificate is valid, i.e. not revoked; denying a request to establish the connection with the web-enabled application by the privacy bridge when the digital certificate is determined not to be valid or not active; denying a request to establish the connection with the web-enabled application by the privacy bridge when the digital certificate is not present; via the node hosting the web-enabled application domain, i.e. a web-enabled application domain server, accepting connection requests from the privacy bridge, and rejecting all other connection requests; via the privacy bridge establishing the connection between the web-enabled application server and a node hosting the valid and active AAM configured digital certificate, creating an uninterrupted, digitally identified, and encrypted two-way tunnel between connecting nodes; and recording information about process activities, wherein the information includes meta-data, such as, a timestamp of an event, an Internet Protocol (IP) address of the connecting node, an IP address of a processing node, the digital certificate attributes, an exit code of a program call, and similar, and the meta-data is stored in an operational database.

2. The method of claim 1, wherein the AAM rules are created based on the X.509 standard for root signed digital certificates.

3. The method of claim 1, wherein the AAM console is a collection of programs and tools, such as forms, reports, and database objects to create and manage AAM rules, and comprises one or more modules operated by a user.

4. The method of claim 1, wherein the user may be one or more of the following:a) a human; b) a machine; c) an loT ; d) a command and control (C&C) program and / or a routine; e) an advanced intelligence (Al) / artificial intelligence (Al) unit, such as, a program and / or a routine; and / or f) any combination of these (a to e).

5. The method of claim 3, wherein the one or more modules of the AAM console may comprise a form, server portal, database portal, database object for storing and managing rules, reports, report templates, spreadsheets, graphic objects, tables, views, and similar.

6. The method of claim 1, wherein the AAM configuration setup profile is a mapping of the AAM rules associated with the web-enabled application URL and may comprise an electronic or a digital object.

7. The method of claim 6, wherein the electronic object may comprise a text file, spreadsheet, rich text format document, image, or any electronic document that can be interpreted as a readable text by the node.

8. The method of claim 6, wherein the digital object may comprise data stored in a database repository, data stored in a computer memory, data stored on an off-line media storage such as, a CD disc, DVD disc, Blu-ray disc, magnetic tape, USB memory stick, optical storage, and similar.

9. The method of claim 1, wherein the AAM repository may comprise a data and file storage system, such as a relational database, hierarchical database, object-relational database, Lightweight Directory Access Protocol (LDAP) database, spreadsheet file, NoSQL database, or any other data and file storage system that provides data and file storage, management, and retrieval functionality.

10. The method of claim 1, wherein the node may be a computer, personal computer (PC), laptop, notebook, mobile phone, mobile device, wearable, i.e. computing device worn on the body, loT, medical loT, server, web server, application server, command and control (C&C) server, database (DB) server, network computer (NC), License Plate Recognition (LPR) camera,Closed-Circuit Television (CCTV) camera, smart traffic light, telematics, electronic gate, smart sensor, photo scanner, optical character recognition device, printer, plotter, additive manufacturing printer, manufacturing and / or warehouse management robot, radio-frequency identification (RFID) reader, payment terminal, a computer dedicated to a particular function, and similar, and wherein the node may be a physical or virtual machine (VM).

11. The method of claim 1, wherein the node may be a personal device, such as a laptop, notebook, PC, mobile phone, mobile device, and wearable, or a computer deployed in one or more of the following: a) the cloud; b) in data centers; and / or c) any combination of these (a through b).

12. A method of claim 1, wherein the connection is established via the public network in combination with a communication protocol selected from one or more of the following: the Internet, land-line telephony, Broadband Over Power Lines (BPL), over the air (OTA) communication, wireless communication, mobile telephony (6G, 5G, LTE, 4G, 3G, 2G, 1G), Bluetooth, radio frequency (RF), and the like, and wherein end nodes of the public network, such as, computers, mobile phones, mobile devices, loT, medical loT, smart sensors, servers, web servers, printers, plotters, additive manufacturing printers, manufacturing and warehouse management robots, telematics, LPR cameras, CCTV cameras, smart traffic lights, electronic gates, RFID readers, payment terminals, a computer dedicated to a particular function, and similar.

13. The method of claim 1, wherein the digital certificate management services may comprise: a) interconnected nodes; b) a CA; c) an active agent infrastructure that includes an active agent client and an active agent manager; d) web services deployed on the active agent manager server; e) database and web portals to create, store, and manipulate data required for the C&C of the active agent manager server and for fulfillment of the active agent client's requests; and f) optionally, programs and / or routines to extract a node’s attributes such as, a serial number, computer name, manufacturer, and similar.

14. The method of claim 13, wherein the active agent client may comprise: a) operational software; b) an active agent scheduler service running on the user node; and c) optionally, a node attributes extracting routines and / or programs.

15. The method of claim 14, wherein the operational software may comprise: a) a production software, i.e. programs and / or routines used in an organization’s daily operations; and b) an installer, i.e. programs and / or routines for downloading, installing, and patching, i.e. updating, operational software.

16. The method of claim 13, wherein the active agent manager server may comprise: a) a server and a software for answering and fulfilling requests by the active agent client; and b) a web service for receiving and acting on connection requests made by the active agent client.

17. The method of claim 14, wherein the node attributes extracting routines and / or programs may comprise a combination of proprietary operating system tools, such as Microsoft Windows WMIC, Apple MacOS lOKit, and similar, and custom build programs and routines.

18. The method of claim 1, wherein the digital certificate management services may further comprise: a) creating a tokenized Uniform Resource Locator (URL), i.e. the URL with a one-time use token, which may be the URL for a personalized web page; b) sending an email to a recipient device wherein the email includes the tokenized URL identifying a web page; c) via the recipient device, using the tokenized URL to open the web page; d) via the CA server, evaluating the tokenized URL; e) wherein the tokenized URL is evaluated to be expired, requesting the email from the administrator for the digital certificate to be resent; f) wherein the tokenized URL is evaluated to be associated with a previously downloaded digital certificate, terminating the download process;g) wherein the tokenized URL is active (not expired) and has not been previously used to download a digital certificate, prompting the recipient via the web page to accept terms of service, and receiving the consent; h) via the CA server, checking the organizational digital certificate deployment rules to accept or bypass the recipient’s mobile number one-time passcode (OTP) verification; i) prompting the recipient to provide consent via the web page to receive the OTP; j) terminating the digital certificate download if the recipient’s consent to receive the OTP is not provided; k) wherein the recipient’s consent to receive the OTP is provided, then sending the OTP via a delivery channel, which may be wireless, email, or telephony; l) prompting the recipient to enter the OTP via the web page; m) via the CA server, checking the amount of time since sending the OTP and requesting another OTP when the time exceeds a limit predetermined by previously established download rules; n) alerting the administrator when the number of OTP requests exceeds a limit predetermined by previously established rules; o) wherein the OTP is entered, then via the CA server, verifying the validity of the entered OTP; p) requesting a new OTP when the OTP verification fails; q) alerting the administrator when the number of OTP requests exceeds a limit predetermined by previously established rules; r) wherein the entered OTP is verified, then prompting the recipient to use a web page to enter a private password for protecting the digital certificate package; s) prompting the recipient to re-enter the private password when the password verification fails and is limited by the number of private password verification attempts predetermined by the organizational digital certificate download rules; t) alerting the administrator when the number of private password verification attempts exceeds a predetermined limit, i.e. the predetermined maximum number of private password verification attempts; u) wherein the password is verified, protecting the digital certificate package via the CA server using the private password and downloading the digital certificate package to the recipient’s device; v) via the CA server, blocking the tokenized URL upon successful digital certificate package download;w) via the CA server, alerting the administrator when the digital certificate package process fails; and x) via the CA server, saving the digital certificate download process meta-data in the operational database.

19. The method of claim 18, wherein the sending and downloading steps are carried out by interconnected nodes via a public network, wherein one or more of the nodes may be a machine that carries out an activity, such as a web server, application server, database server, email server, and similar.

20. The method of claim 1 , wherein the active agent client has been installed on an end node, and wherein an active agent client scheduler is operating on the end node.

21. The method of claim 1, wherein the web-enabled application is an application accessible over the public network and may be hosted on the node identified by the web-enabled application URL, i.e. web-enabled application domain.

Images