System and method for secure data communications

A method of establishing a secure distributed system over a public network wherein the system is a superstructure over the network, having a three-layer hierarchic architecture comprising:

• a first layer having a secure system authority, which is a constant part in the secure system;
• a second layer having a plurality of secure servers;
• a third layer having a plurality of secure clients, which are user nodes with installed secure system client services;
• wherein each secure server and each secure client may be incorporated into the system at any time;
• wherein the minimal number of secure clients in system is two and the minimal number of secure servers is one;
• wherein said secure servers, said secure clients and said secure system authority are secure system nodes and provide a continuous secure sub-network over a public network;
• wherein any two secure system nodes, communicating via direct secure link within the system, use a private ciphering language for encrypting and decrypting secure message;
• wherein each private ciphering language consists of two ciphering sets each comprising a number (at least one) of ciphering algorithms and a collection of cipher-keys for every algorithm;
• wherein every ciphering set is used in one known direction of the secure link:
• one ciphering set is used for encryption by the first link node and for decryption by the second link node, and another ciphering set (in opposite direction) is used for encryption by the second link node and for decryption by the first link node;
• wherein a secure node registration with another secure node means that both nodes establish their private ciphering language for encrypting and decrypting a secure message transmitted between said secure nodes;
• wherein every secure client can reach directly any secure server with which it is registered;
• wherein every secure client can reach any other secure client via the mentioned above secure server(s);
• wherein every secure server can reach another secure server directly within the system, or via other secure server(s), or via the secure system authority;
• wherein every secure server is registered with the secure system authority;
• wherein each secure client is registered with at least one secure server;
• wherein two secure servers can be registered with one another;
• wherein there is no other type of registration except for the mentioned above registration types;
• wherein every secure message in addition to communication information according to the utilized communication protocol, contains specific secure communication information;
• wherein the secure servers perform routing functions for a secure message as specified in the secure communication information;
• wherein the secure system authority assists a secure server in determining a secure communication path, when required.