Secure connection between a server and a client device

Abstract

A method and system for facilitating a secure connection between a server and a client device is disclosed. The method is performed in a server and includes the steps of: receiving a request for a client implementation from an end-user agent of the client device; generating a protocol, an associated protocol description, and a client implementation based on the protocol; encrypting the protocol description and embedding the encrypted protocol description in the client implementation; and transmitting, to the end-user agent, the client implementation and an associated timestamp. In accordance with receiving, from the end-user agent, a request to initiate an encrypted connection to the server, the method includes performing a handshake. In accordance with the conditions of the handshake being met, a connection according to the protocol may be established.

Description

[0001] PCS-0002

[0002] SECURE CONNECTION BETWEEN A SERVER AND A CLIENT DEVICE

[0003] The present invention relates to a method and system for facilitating a secure connection between a server and a client device.

[0004] Brief description of the drawings

[0005] The accompanying drawings are included to provide a further understanding of embodiments and are incorporated into and a part of this specification. The drawings illustrate embodiments and together with the description serve to explain principles of embodiments. Other embodiments and many of the intended advantages of embodiments will be readily appreciated as they become better understood by reference to the following detailed description. The elements of the drawings are not necessarily to scale relative to each other. Like reference numerals designate corresponding similar parts.

[0006] Fig. 1 illustrates a block diagram representing a method,

[0007] Fig. 2 illustrates a block diagram representing a method, and

[0008] Fig. 3 illustrates a distributed computing environment.

[0009] Detailed description

[0010] Various exemplary embodiments and details are described hereinafter, with reference to the figures when relevant. It should be noted that the figures may or may not be drawn to scale and that elements of similar structures or functions are represented by like reference numerals throughout the figures. It should also be noted that the figures are only intended to facilitate the description of the embodiments. They are not intended as an exhaustive description of the invention or as a limitation on the scope of the invention. In addition, an illustrated embodiment needs not have all the aspects or advantages shown. An aspect or an advantage described in conjunction with a particular embodiment is not necessarily limited to that embodiment and can be practiced in any other embodiments even if not so illustrated, or if not so explicitly described.

[0011] Client-server applications are a fundamental model in the field of network computing where the client is a program or device (herein referred to as a client device) that requests services or resources from a server. A protocol is needed to define how data is transmitted between the client device and the server. In this context, a protocol includes a set of rules defining how data is transmitted and received over a network. A common PCS-0002 example is the use of JSON (JavaScript Object Notation) APIs (Application Programming Interfaces). JSON is a lightweight data-interchange format that is easy for humans to read and write, and easy for machines to parse and generate. APIs, on the other hand, are sets of definitions and protocols for building and integrating application software.

[0012] A protocol may be combined with one or more other protocols. For instance, one protocol may codify or define the specific requests and responses used by the application (e.g., the API), while another protocol may codify or define how to send generic requests and responses protected by an encryption scheme. These encrypted generic requests and responses may then be used to relay the former protocol.

[0013] A prevalent practice in client-server applications, especially in web applications, is to use well-known protocols for both data transmission and security. An example is transmitting JSON data over HTTP (Hypertext Transfer Protocol), secured by TLS (Transport Layer Security). HTTP is an application protocol for distributed, collaborative, hypermedia information systems, while TLS is a cryptographic protocol designed to provide communications security over a computer network.

[0014] However, this common approach has its drawbacks. The reliance on standard protocols makes it relatively straightforward to develop third-party clients or servers that can interact with the existing system. This raises some security concerns:

[0015] 1. Unauthorized Usage: This includes activities such as scraping content, bypassing content controls, or displaying content in unintended ways. Scraping refers to the extraction of data from websites, which can be problematic if it violates terms of service or intellectual property rights.

[0016] 2. Tampering: Crafting messages different from those made by the original application, with the intention to provoke unintended behaviors in the service or cause harm to the service, its provider, or users. This could involve manipulating data or disrupting service operations.

[0017] 3. Reverse Engineering: Analyzing the service to understand its inner workings, replicate its functionality, or for purposes that could harm the service, its provider, or users. Reverse engineering can lead to intellectual property theft or the creation of competing products.

[0018] In summary, there is a need for improved security protocols in client-server communications, addressing the vulnerabilities inherent in using standard, widely-known protocols. This includes the challenges of unauthorized access, data tampering, and reverse engineering, all of which pose significant risks to the integrity and confidentiality of the services provided. PCS-0002

[0019] It is an object of the present invention to mitigate these risks by providing a novel approach to client-server communication, thereby enhancing security in such interactions. In particular, it is desired to provide a method and system wherein the protocol is unique to a particular client-server session, and wherein the client implementation including the protocol is provided when needed. This can be used to make third-party protocol implementation impractical.

[0020] In a first aspect of the invention, a method for facilitating a secure connection between a server and a client device is disclosed.

[0021] The method may be performed in / executed on a server, such as one or more servers, such as a server hosted or operated by a service provider or developer of the client-server application. The server may include one or more processors configured to run / perform the method. For example, the method may be employed as an algorithm. The method may also be considered or denoted a tool providing a session-specific protocol for communication between a server and a client device. Thus, the method as described herein below may be converted to describe a tool, wherein one or more processors are configured to perform one or more of the disclosed steps below.

[0022] The method may be performed in / executed on two or more servers. In other words, the method may be split between multiple servers, such as to distribute tasks and / or increase security of the method. For example, parts of the method may be performed in a server hosted by the service provider or developer of the clientserver application, and parts of the method may be performed in a server hosted by a provider of the method / tool (e.g., a SaaS company providing the disclosed method to the service provider).

[0023] In the present context, the described client device may include a user agent, such as web browser. For example, the user agent may be a web browser.

[0024] In embodiments of the present disclosure, the client device does not have an already-existing implementation and trust. On the contrary, for example, in HTTPS, the user agent (e.g., a web browser) may already contain a client implementation. Thus, the present invention seeks to provide a method that also manages / generates a client implementation upon request.

[0025] The method may include one or more of the following steps: receiving a request for a client implementation from an end-user agent of the client device; PCS-0002 generating a protocol, an associated protocol description, and a client implementation based on the protocol; encrypting the protocol description and embedding the encrypted protocol description in the client implementation; transmitting, to the end-user agent, the client implementation, and an associated timestamp; and in accordance with receiving, from the end-user agent, a request to initiate an encrypted connection to the server, performing a handshake including: receiving an encrypted parameter and an associated timestamp from the end-user agent; decrypting the encrypted parameter for provision of a decrypted parameter; and in accordance with the decrypted parameter corresponding to the protocol description and the associated timestamp complying with a threshold, establishing a connection according to the protocol.

[0026] The inventors have found that the disclosed method provides an improved security in the connection between a server and a client-device with an end-user agent. In particular, since the connection is dependent on both an encrypted protocol description and time, the time available for any malicious third-party is reduced. Namely, considering reverse engineering of the client implementation a point of attack by a malicious third-party, such reverse engineering must include identifying the unique details of the implementation, include these in a malicious implementation, all within a limited time available (i.e., capped by the threshold associated with the timestamp, which may furthermore be signed / authorized by the server, so that it cannot be tampered with). Moreover, the protocol and client implementation are generated upon request. Thus, the method provides a unique / session-specific protocol and client implementation each time, thereby rendering reverse engineering (e.g., by a malicious third party) of such protocol or client implementation useless. Thus, the disclosed method provides a multi-layered security for the connection between the server and the client device / end-user agent of the client device and thus combats unauthorized implementations.

[0027] In the present context, a client device refers to a computing apparatus equipped with communication capabilities that allow it to initiate and receive data transmissions over a network. This apparatus can be, but is not limited to, personal computers, mobile phones, tablets, smart TVs, and other internet-enabled devices. The client device operates client software enabling it to interact with remote server applications. PCS-0002

[0028] In the present context, a (end-) user agent refers to a software entity that acts on behalf of an end-user to interact with server systems, typically over a network. In the context of web-based interactions, the user agent is often a web browser that requests and renders data from web servers. Commonly, the user agent identifies itself to the server through a unique user agent string, such as in the HTTP header, which includes information about the software's type, version, and the operating system on which it operates. This identification allows servers to tailor content delivery to the specific characteristics of the user agent, thereby optimizing the enduser experience. The web browser may be configured to load an HTML document, e.g., including a client JavaScript application, and to run this JavaScript application. In other words, an HTML document may include a client JavaScript application.

[0029] In the present context, a client implementation is responsible for initiating and managing secure communication with the server. For example, when a user navigates to a website, the client device sends a request to a server. The server responds, and they agree on the best method to secure the communication, typically involving a process known as a handshake. This process may include the exchange of cryptographic keys to encrypt the data being transmitted, ensuring the integrity and confidentiality of the data between the server and the client.

[0030] In the present context, a protocol may be associated with a protocol description. The protocol description may include a detailed explanation of the rules and procedures of the protocol. For example, the protocol description may include elements associated with the protocol's syntax (e.g., defines how the data is organized or packaged for transmission), semantics (e.g., defines how to interpret the different types of data that the protocol can handle), timing (e.g., specifies the speed at which data is sent and the timing of the signals for sending and receiving data), and error handling (e.g., specifies the methods used by the protocol to detect and correct errors that occur during data transmission).

[0031] The method includes the step of generating a protocol and a client implementation based on the protocol. Accordingly, the end-user agent of the client device does not have a client implementation already but rather receives such according to the method. This allows for the client implementation to be session-specific and tied to the protocol, thus ensuring that not only the protocol but also the client implementation is secured according to the security measures provided by the method (see discussion below). In one or more exemplary methods, the end-user agent is a browser, and the request for a client implementation is a request for an HTML document. PCS-0002

[0032] The step may include encrypting the protocol description and embedding the encrypted protocol description in the client implementation. Whereas being described as a separate step, it is appreciated that the encryption of the protocol description and the embedding of the encrypted protocol description in the client implementation may be performed simultaneously with the preceding step of generating the protocol, the protocol description, and the client implementation. In particular, generating the client implementation based on the protocol may include embedding an encrypted protocol description (i.e., based on the generated protocol description), such that the client implementation includes the encrypted protocol description once generated. The disclosed two- step action of generating followed by encrypting may thus be combined into a single step.

[0033] The method includes the step of transmitting, to the end-user agent, the client implementation, and an associated timestamp.

[0034] By an associated timestamp is meant that the transmission to the end-user agent is timed, so as to establish when the transmission took place. Preferably, the associated timestamp is signed / authorized by the server, so as to establish that the associated timestamp is indeed indicative of a genuine transmission between the server and the end-user agent. Thereby, a timestamp cannot be added later by a third-party, such as to bypass the security measure imposed by using the timestamp. The timestamp can be included in / form part of the associated protocol description, or it can be included in the step of encrypting the protocol description, so as to encrypt the timestamp as such.

[0035] The method includes a handshake. The handshake facilitates the establishment of a secure connection between the server and the end-user agent. In particular, once the client implementation has been transmitted to the end-user agent, the end-user agent is able to initiate the handshake from its end. Namely, via the client implementation received, the end-user agent can send / transmit, to the server, a request to initiate an encrypted connection to the server. In accordance with the conditions of the handshake being met (described below), a connection according to the protocol may be established.

[0036] The handshake includes, at the server, receiving an encrypted parameter and an associated timestamp from the end-user agent. As explained above, if the associated timestamp is included in / form part of the associated protocol description, or if it is included in the step of encrypting the protocol description, so as to encrypt the timestamp as such, the handshake may include receiving only an encrypted parameter. The timestamp may then be retrieved from the step of decrypting the encrypted parameter for provision of a decrypted parameter. In other words, the timestamp may be either explicitly or implicitly received in the step of receiving an PCS-0002 encrypted parameter and an associated timestamp from the end-user agent according to the step of the handshake.

[0037] The handshake includes decrypting the encrypted parameter for provision of a decrypted parameter. If the received encrypted parameter is genuine and initially encrypted by the server, the server is configured to decrypt the encrypted parameter according to the relevant decryption algorithm. If the encrypted parameter is not genuine, and the server is unable to decrypt the parameter, the handshake fails and a connection is not established. This provides a first layer of security.

[0038] Following decryption, the handshake includes comparing the decrypted parameter with the protocol description. If the decrypted parameter corresponds to the protocol description, the server can assume that a genuine encrypted description was received. In other words, the received encrypted parameter may at this point be established to be the initially encrypted protocol description.

[0039] Furthermore, the handshake includes checking whether the timestamp complies with a threshold. This threshold may be expressed in units of time. For example, the server may compare the timestamp (T_s) to a present time (T_p) at the server, and compliance is fulfilled if the time difference (AT = T_p -T_s) between the present time and the timestamp is less than / below the threshold. For example, for the sole purpose of discussing the mechanism, the threshold may be set to 60 seconds. Accordingly, in order for the timestamp to comply with this threshold, the associated timestamp must be received (e.g., the handshake must be initiated) within 60 seconds from generation of the protocol, the associated protocol description, and the client implementation. Thus, this part of the handshake ensures that the handshake is performed within a predefined amount of time since initial generation of the protocol, the associated protocol description, and the client implementation. It is appreciated that the threshold may be set according to the system and circumstances, and may, for example, depend on the speed of Internet connection or the required level of security. For example, in certain builds, it may be relevant to reduce the threshold to 1 second or less, whereas, if the build involves communication to end-user agents associated with remote (physical) areas with limited Internet connection / access and / or reduced Internet speed, the threshold may be more than 60 seconds, such as between 1 minute and 10 minutes, or even more.

[0040] The check for compliance of the timestamp with a threshold provides a second layer of security. Namely, the amount of time a potential (malicious) third-party has available for tampering with the process of connecting to the server is reduced. PCS-0002

[0041] If the conditions of the handshake are met, a connection according to the protocol may be established. Known mechanisms, procedures, or methods may be employed in or before the connection, such as a tunnel, is finally established without departing from the scope of the invention. For example, a key exchange between the enduser agent and the server may be performed based on the protocol. In other words, establishing a connection according to the protocol may be considered establishing the basis for a connection according to the protocol, thus indicating that further mechanisms, procedures, or methods may need to be employed without departing from the scope of the invention.

[0042] In one or more exemplary methods, the method includes post-processing the client implementation after generating the client implementation. Additional step(s) may be employed after generating the client implementation. In particular, the client implementation may be post-processed. In one or more examples, post-processing the client implementation includes obfuscating the client implementation. The obfuscation may be provided by known techniques, such as renaming of variables and functions, control flow alteration, data obfuscation, code encryption, etc.

[0043] Thereby, the client implementation (e.g., source code forming the client implementation) is intentionally made difficult to understand and interpret. In other words, the obfuscation protects the client implementation from being easily reverse-engineered or tampered with. By making the code more complex and less readable, it becomes more difficult for unauthorized individuals to understand how the software works, replicate its functionality, or identify potential vulnerabilities. Thereby, an additional layer of security is provided. In particular, it is noted that reverse-engineering of an obfuscated client implementation is made even more difficult due to the reduced time available as facilitated by the timestamp and associated threshold discussed above.

[0044] In one or more exemplary methods, transmitting the client implementation to the end-user agent includes embedding the client implementation as an inline script. For example, the inline script may thereby be written directly within the HTML of a web page, rather than being loaded externally.

[0045] In a second aspect of the invention, a system for facilitating a secure connection between a server and a client device is disclosed.

[0046] The system includes the server and the client device with an end-user agent, wherein the server includes one or more processors and the client device includes one or more processors, wherein the end-user agent of the PCS-0002 client device is configured to make a request for a client implementation including a protocol from the server. The one or more processors of the server are configured to: in response to receiving the request for a client implementation including a protocol, generate a protocol, an associated protocol description, and a client implementation based on the protocol; encrypt the protocol description and embed the encrypted protocol description in the client implementation; and transmit, to the end-user agent, the client implementation and an associated timestamp.

[0047] The end-user agent of the client device is configured to request an encrypted connection to the server, and the one or more processors of the server are configured to perform a handshake with the client device in response to receiving the request. The handshake is performed by the one or more processors of the server being configured to: receive an encrypted parameter and an associated timestamp from the end-user agent; decrypt the encrypted parameter for provision of a decrypted parameter; and in accordance with the decrypted parameter corresponding to the protocol description and the associated timestamp complying with a threshold, establish a connection according to the protocol.

[0048] It is appreciated that embodiments, including definitions, features, and benefits, as disclosed in relation to the first aspect of the invention are applicable to the system according to the second aspect of the invention. In particular, methods or steps thereof according to the first aspect of the invention may be considered and / or converted into instructions for one or more processors of the system according to the second aspect.

[0049] In one or more exemplary systems, the one or more processors of the server are configured to post-process the client implementation after generation of the client implementation.

[0050] In one or more exemplary systems, to post-process the client implementation includes to obfuscate the client implementation.

[0051] In one or more exemplary systems, to transmit the client implementation to the end-user agent includes to embed the client implementation as an inline script.

[0052] In one or more exemplary systems, the end-user agent is a browser, and wherein the request for a client implementation is a request for an HTML document. PCS-0002

[0053] In a third aspect of the invention, a computer readable storage medium storing one or more programs is disclosed, the one or more programs including instructions, which when executed by a server with an interface, a memory, and a processor, cause the server to be configured to operate in accordance with any one of the methods according to the first aspect.

[0054] In a fourth aspect of the invention, a server including one or more processors configured to perform any of the methods according to the first aspect of the invention is disclosed. The server may include an interface configured to communicate with a client device, such as via a network.

[0055] Detailed description of the figures

[0056] Fig. 1 illustrates a block diagram representing a method 1000. The method 1000 facilitates a secure connection between a server and a client device, is performed in a server, and includes the steps of: receiving 1002 a request for a client implementation (Cl) from an end-user agent of the client device; generating 1004 a protocol, an associated protocol description, and a client implementation based on the protocol; encrypting 1006 the protocol description and embedding the encrypted protocol description in the client implementation; transmitting 1008, to the end-user agent, the client implementation and an associated timestamp; and in accordance with receiving 1010, from the end-user agent, a request to initiate an encrypted connection to the server, performing 1010A a handshake including: receiving 1010AA an encrypted parameter and an associated timestamp from the end-user agent; decrypting 1010AB the encrypted parameter for provision of a decrypted parameter; in accordance with the decrypted parameter corresponding to the protocol description and the associated timestamp complying with a threshold, establishing 1010AC a connection according to the protocol.

[0057] It is to be noted that the step of establishing 1010AC a connection according to the protocol is only performed in accordance with a positive compliance check, i.e., if the decrypted parameter corresponds to the protocol PCS-0002 description (which was encrypted in step 1006) and the associated timestamp complies with a threshold. The threshold may be set in accordance with the use case, as has been discussed previously.

[0058] Fig. 2 illustrates a block diagram representing a method 1000' similar to the method of Fig. 1 but including two optional steps (dashed boxes). The steps identical to steps of method 1000 in Fig. 1 have been indicated by numerals only.

[0059] The method 1000' includes the optional step of post-processing 1005 the client implementation after generating 1004 the client implementation. Post-processing 1005 the client implementation may include obfuscating the client implementation according to methods described herein or commonly employed methods.

[0060] The method 1000' includes the optional step of embedding 1007 the client implementation as an inline script, as part of the step of transmitting 1006 the client implementation to the end-user agent.

[0061] Fig. 3 illustrates a distributed computing environment 100. The computing environment 100 includes a server 110 and a client device 120.

[0062] The server 110 and the client device 120 are connected by means of a network 130.

[0063] The method as disclosed herein, such as any of methods 1000 (Fig. 1) and 1000' (Fig. 2), may be performed in the server 110 and facilitate a secure connection between the server 110 and the client device 120. The connection as referred to herein is facilitated via the network 130, which may be the Internet. The connection may be wireless.

[0064] The server 110 and the client device 120 may each include one or more processors and one or more interfaces configured to communicate via the network, so as to establish a connection according to the method as disclosed herein.

[0065] It may be appreciated that Fig. 1 includes modules or operations which are illustrated with a solid line, and Fig.

[0066] 2 includes some modules or operations which are illustrated with a dashed line. The modules or operations which are included in a solid line are modules or operations which are included in the broadest example embodiment. The modules or operations which are included in a dashed line are example embodiments which may be included in, or a part of, or are further modules or operations which may be taken in addition to the modules or operations of the solid line example embodiments. It should be appreciated that these operations PCS-0002 need not be performed in order presented. Furthermore, it should be appreciated that not all of the operations need to be performed. The exemplary operations may be performed in any order and in any combination.

[0067] It is to be noted that the word "comprising" does not necessarily exclude the presence of other elements or steps than those listed. The words "comprising" and "including" may be used interchangeably.

[0068] It is to be noted that the words "a" or "an" preceding an element do not exclude the presence of a plurality of such elements.

[0069] It should further be noted that any reference signs do not limit the scope of the claims, that the exemplary embodiments may be implemented at least in part by means of both hardware and software, and that several "means", "units" or "devices" may be represented by the same item of hardware.

[0070] The various exemplary methods, devices, and systems described herein are described in the general context of method steps processes, which may be implemented in one aspect by a computer program product, embodied in a computer-readable medium, including computer-executable instructions, such as program code, executed by computers in networked environments. A computer-readable medium may include removable and nonremovable storage devices including, but not limited to, Read Only Memory (ROM), Random Access Memory (RAM), compact discs (CDs), digital versatile discs (DVD), etc. Generally, program modules may include routines, programs, objects, components, data structures, etc., that perform specified tasks or implement specific abstract data types. Computer-executable instructions, associated data structures, and program modules represent examples of program code for executing steps of the methods disclosed herein. The particular sequence of such executable instructions or associated data structures represents examples of corresponding acts for implementing the functions described in such steps or processes.

[0071] Although particular features have been shown and described, it will be understood that they are not intended to limit the claimed invention, and it will be made obvious to those skilled in the art that various changes and modifications may be made without departing from the scope of the claimed invention. The specification and drawings are, accordingly, to be regarded in an illustrative rather than restrictive sense. The claimed invention is intended to cover all alternatives, modifications, and equivalents.

Claims

PCS-0002Claims1. A method for facilitating a secure connection between a server and a client device, the method performed in a server and comprising the steps of: receiving a request for a client implementation from an end-user agent of the client device; generating a protocol, an associated protocol description, and a client implementation based on the protocol; encrypting the protocol description and embedding the encrypted protocol description in the client implementation; transmitting, to the end-user agent, the client implementation and an associated timestamp; and in accordance with receiving, from the end-user agent, a request to initiate an encrypted connection to the server, performing a handshake comprising: receiving an encrypted parameter and an associated timestamp from the end-user agent; decrypting the encrypted parameter for provision of a decrypted parameter; in accordance with the decrypted parameter corresponding to the protocol description and the associated timestamp complying with a threshold, establishing a connection according to the protocol.

2. The method according to claim 1 further comprising post-processing the client implementation after generating the client implementation.

3. The method according to claim 2, wherein post-processing the client implementation comprises obfuscating the client implementation.

4. The method according to any of claims 1-3, wherein transmitting the client implementation to the enduser agent comprises embedding the client implementation as an inline script.

5. The method according to any of claims 1-4, wherein the end-user agent is a browser, and wherein the request for a client implementation is a request for an HTML document.PCS-00026. A system for facilitating a secure connection between a server and a client device, the system comprising the server and the client device with an end-user agent, wherein the server comprises one or more processors and the client device comprises one or more processors, wherein the end-user agent of the client device is configured to make a request for a client implementation comprising a protocol from the server; and wherein the one or more processors of the server are configured to: in response to receiving the request for a client implementation comprising a protocol, generate a protocol, an associated protocol description, and a client implementation based on the protocol; encrypt the protocol description and embed the encrypted protocol description in the client implementation; and transmit, to the end-user agent, the client implementation and an associated timestamp; and wherein the end-user agent of the client device is configured to request an encrypted connection to the server, and wherein the one or more processors of the server are configured to perform a handshake with the client device in response to receiving the request, wherein the handshake is performed by the one or more processors of the server being configured to: receive an encrypted parameter and an associated timestamp from the end-user agent; decrypt the encrypted parameter for provision of a decrypted parameter; in accordance with the decrypted parameter corresponding to the protocol description and the associated timestamp complying with a threshold, establish a connection according to the protocol.

7. The system according to claim 6, wherein the one or more processors of the server are configured to post-process the client implementation after generation of the client implementation.

8. The system according to claim 7, wherein to post-process the client implementation comprises to obfuscate the client implementation.

9. The system according to any of claims 6-8, wherein to transmit the client implementation to the enduser agent comprises to embed the client implementation as an inline script.PCS-000210. The system according to any of claims 6-9, wherein the end-user agent is a browser, and wherein the request for a client implementation is a request for an HTML document.

Images