US 7,444,674 B1Granted

End-to-end security of transactions between a mobile terminal and an internet server at the application level

AssigneeSwisscom Mobile AG

InventorsPierre-Alain Etique, Adriano Huber

Life of this patent

Estimating the term…

Loading patent…

Abstract

For end-to-end securing of transactions between a mobile terminal and an Internet server on the application layer, cryptographic transaction identification records, which are directed by the Internet server application to transaction partner applications in the mobile terminal, are stored, assigned to the mobile terminal, in a proxy server. In each case a record identification is transmitted to the mobile terminal for a stored transaction identification record as well as a proxy record, which is calculated by the proxy server from the respective stored transaction identification record. In each case a record identification and a proxy record are taken by the proxy server from the messages directed by the mobile terminal to the Internet server application. The correspondence of the taken proxy record with the proxy record is checked, which is calculable from the stored transaction identification record determined through the taken record identification, and, in the case of agreement, the stored transaction identification record determined through the taken record identification is transmitted to the Internet server application.

Claims19

Dependent claims

A method for end-to-end securing of transactions between a mobile terminal and an Internet server on an application level, in which method, for unambiguous identification of an application transaction, an Internet server application transmits transaction identification records to a transaction partner application and receives transaction identification records that are transmitted back to the Internet server application from the transaction partner application, for unambiguous identification of the application transaction, the method comprising:

transmitting a cryptographic transaction identification record, which is directed to transaction partner applications in the mobile terminal, from the Internet server to a proxy server;
storing, on the proxy server assigned to the mobile terminal, the cryptographic transaction identification record;
transmitting to the mobile terminal by the proxy server using a wireless protocol that does not support cookies, in each case, a first record identification corresponding to the stored cryptographic transaction identification record in the proxy server;
transmitting to the mobile terminal a first proxy record from the proxy server, said first proxy record calculated by the proxy server from the stored cryptographic transaction identification record, and said first proxy record produced being of a different form from the stored cryptographic transaction identification record;
taking in each case by the proxy server from messages directed by the mobile terminal to the Internet server application a second record identification and a second proxy record, said second proxy record based on the first proxy record received at the mobile terminal from the proxy server;
checking for a correspondence of the second proxy record with the first proxy record;
and
transmitting, in a case of there being a positive correspondence between the first and second proxy records, to the Internet server application the stored cryptographic transaction identification record, determined through the first record identification.

5 more elements

A proxy server, which is insertable in a communication path between a mobile terminal and an Internet server, which Internet server comprises at least one Internet server application, which, for unambiguous identification of an application transaction, transmits transaction identification records to a transaction partner application and receives transaction identification records that are transmitted back to the Internet server application by the transaction partner application, for unambiguous identification of the application transaction, the proxy server comprising:

first means for transmitting a cryptographic transaction identification record, which is directed to transaction partner applications in the mobile terminal, from the Internet server to a proxy server;
second, means for storing, on the proxy server, the cryptographic transaction identification record that is directed to the transaction partner applications in the mobile terminal, whereby the storing takes place assigned to the mobile terminal;
third, means for calculating a first proxy record from the stored cryptographic transaction identification record and for transmitting to the mobile terminal, using a wireless protocol that does not support cookies, the first proxy record as well as a first record identification for corresponding to the stored cryptographic transaction identification record, said first proxy record produced being of a different form from the stored cryptographic transaction identification record;
fourth, means for taking a second record identification and a second proxy record from messages that are directed from the mobile terminal to the Internet server application, said second proxy record based on the first proxy record received at the mobile terminal from the proxy server, and for checking for a correspondence of the second proxy record to the first proxy record;
and
fifth, means for transmitting, in a case of there being a positive correspondence between the first and second proxy records, to the Internet server application the stored cryptographic transaction identification record determined through the first record identification.

3 more elements

a transmitter configured to transmitting a cryptographic transaction identification record, which is directed to transaction partner applications in the mobile terminal, from the Internet server to a proxy server;
a memory unit configured to store, on the proxy server, the cryptographic transaction identification record that is directed to the transaction partner applications in the mobile terminal, whereby the storing takes place assigned to the mobile terminal;
a first unit configured to calculate a first proxy record from the stored cryptographic transaction identification record and to transmit to the mobile terminal, using a wireless protocol that does not support cookies, the first proxy record and a first record identification corresponding to the stored cryptographic transaction identification record, said first proxy record produced being of a different form from the stored cryptographic transaction identification record;
and
a second unit configured to obtain a second record identification and a second proxy record from messages directed from the mobile terminal to the Internet server application, wherein
said second proxy record is based on the first proxy record received at the mobile terminal from the proxy server;
and
said second unit is configured to check for a correspondence of the second proxy record to the first proxy record and to transmit, in a case of there being a positive correspondence between the first and second proxy records, to the Internet server application the stored cryptographic transaction identification record determined through the first record identification.

5 more elements

Dependencies are inferred from the claim text.

Facts

Application: 10/297,949Filed 26 Jun 2000
Granted: 28 Oct 2008
Term ends: Not estimatedThe source records don’t support an estimate.

Classification11 codes

G06Q 20/027
Involving a neutral party, e.g. certification authority, notary or trusted third party [TTP]: involving a payment switch or gateway
H04L 63/166
Implementing security features at a particular protocol layer: at the transport layer
H04L 67/04
Protocols: specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
H04L 67/34
Network arrangements or protocols for supporting network services or applications: involving the movement of software or configuration parameters