Piggy-backed key exchange protocol for providing secure low-overhead browser connections from a client to a server using a trusted third party

A system for establishing a sure connection between a client application and a server application using pre-existing message types, said system comprising:

• means for piggy-backing a first portion of security information onto a first message sent from said client application to said server application, wherein said first message uses a first pre-existing message type and wherein said first portion is to be used by said server application in establishing said secure connection;
• means for forwarding said first portion from said server application to a trusted third party TTP);
• means for decrypting said first portion at said TTP;
• means for returning a version of said decrypted first portion from said TTP to said server application;
• and
• means for piggy-backing a second portion of security information onto a second message sent from said server application to said client application, wherein said second message responds to said first message and uses a second pre-existing message type and wherein said second portion is to be used by said client application in establishing said secure connection.

A method for establishing a secure connection between a client application and a server application using pre-existing message types, said method comprising the steps of:

• piggy-backing a first portion of security information onto a first message sent from said client application to said server application, wherein said first message uses a first pre-existing message type and wherein said first portion is to be used by said server application in establishing said secure connection;
• forwarding said first portion from said server application to a trusted third party (TTP);
• decrypting said first portion at said TTP;
• returning a version of said decrypted first portion from said TTP to said server application;
• and
• piggy-backing a second portion of security information onto a second message sent from said server application to said client application, wherein said second message responds to said first message and uses a second pre-existing message type and wherein said second portion is to be used by said client application in establishing said secure connection.

A method for securely establishing a connection between a client application and a server application using a trusted third party (TTP) as an intermediary, further comprising steps of:

• sending, from the client application to the server application, a first message that uses a first pre-existing message type, wherein:
• the first message requests information from the server application, and includes a parameter portion and a proposed encoding scheme portion;
• the parameter portion contains zero or more parameters that may be used by the server application in creating the requested information, and is encrypted using a proposed encoding scheme that is identified in the proposed encoding scheme portion;
• and the proposed encoding scheme portion is encrypted using a first encoding scheme shared by the client application and the TTP;
• forwarding, from the server application to the TTP upon receiving the first message, the proposed encoding scheme portion;
• decrypting the forwarded proposed encoding scheme portion, upon receipt at the TTP, using the first encoding scheme, thereby revealing the proposed encoding scheme to the TTP;
• returning the revealed proposed encoding scheme from the TTP to the server application;
• using the returned proposed encoding scheme portion, upon receipt at the server application, to decrypt the parameter portion, thereby revealing the zero or more parameters to the server application;
• using the revealed zero or more parameters, if necessary, by the server application in creating the requested information;
• encrypting the created information, using a second encoding scheme that enables the client application to decrypt the encrypted information;
• and
• sending, from the server application to the client application, a second message that uses a second pre-existing message type, wherein the second message responds to the first message and includes the encrypted information.