System and method for secure communication

#This invention relates to distributed computing, where software running on a client system interacts with software running on remote server systems. In particular, the invention relates to a system and method for secure communication.

#Software developers wish to provide programmatic functionality over the Internet through the creation of web services. These web services provide some valuable technology in which the developer has expertise. Web services are often deployed in such a way that the user of the web service has a direct connection with a server.

#One problem that arises from this process of exposing the web services for consumption over the web by an end user application is that in order to protect unauthorized access of these web services over the Internet, the web services must somehow incorporate authentication and authorization of users and other security measures. When a user wishes to use a web service on a server, the server usually needs to ensure that the user is authorized to have access. This authentication of the user is typically done by sending the user's name and password to the server which then verifies the given data before granting access. Since the authentication data is sensitive, it is desirable to be sent over a secured channel, such as the hypertext transfer protocol over secure socket layer (https), which encrypts the data. Using a secured channel is safer but slower than an unsecured channel since it requires the extra encryption/decryption steps.

#The invention will be further understood from the following description with reference to the drawings in which:

#FIG. 1 shows an example of a secure communication module in accordance with an embodiment of the present invention;

#FIG. 2 is a flowchart showing a method for providing a pool of authentication identifiers in accordance with an embodiment of the present invention;

#This description contains references to login and logon procedures. The embodiments of the inventions described in this specification apply to both login and logon procedures. A login reference is intended to include a logon reference and vice versa.

#FIG. 1 shows a secure communication module 100 in accordance with an embodiment of the present invention. An aspect of the secure communication module 100 relates to the use of a pool of authentication IDs during network communication. The pool of authentication IDs contains a plurality of authentication IDs. The secure communication module 100 comprises an authentication identifier (ID) provider 101 and an authentication ID validator 102. The authentication ID provider 101 assigns a pool of authentication IDs to a client application when the client application logs onto a network service such as a web service. The authentication ID validator 102 authenticates authentication IDs. The authentication IDs may be passed as parameters during network communication, as will be described below. The authentication ID provider 101 and the authentication ID validator 102 may comprise software code or code embedded in hardware. Other components may be added to the secure communication module 100, including a communication module for receiving and sending communication.

#The user of a client application logs onto a network service by sending client application credentials, typically a user name and password, over a secured channel as described above. In return, the client application receives a group or pool of authentication IDs. The pool of authentication IDs returned is secure since the pool is sent back over the secured channel. The exact number of IDs returned may vary depending on the system administration requirements for the network service 21. Once the client application has this pool of authentication IDs, the client application may use a different authentication ID with each successive method call to the network service 21. The authentication ID that is used expires upon use so that it can not be reused. This means that even if an eavesdropper is able to compromise an authentication ID, the eavesdropper will not be able to use it since it can only be used once.