Patent ID: 6993651
Filing Date: 2006-01-31
Classification: H04L

Abstract:
1. A system with a local application entity and communications means by which the local application entity can communicate with peer remote application entities on other systems, the communication means including a transport entity for providing transport services, and a transport-independent, session-level security entity logically positioned above the transport entity and visible to the local application entity, the security entity being operative to set up secure communication sessions with peer security entities in other systems and comprising: key-exchange handshake means for conducting a handshake with a said peer security entity associated with a particular remote application entity with which said local application entity wishes to communicate, this handshake involving the exchange of key-related data for use in generating session keys; and secure channel means for enabling messages to be passed between the local application entity and said particular remote application entity with authentication and/or encryption of these messages being effected using the session keys generated from said key-related data whereby to secure these messages in passage between the cooperating security entities; the handshake means including: first means, operative in the course of said handshake, to pass to said peer security entity a first indication in the form of explicit information about what services are required by the local application entity, to receive back from said peer security entity a second indication explicitly advising what specific attributes are required of the local application entity by the remote application entity for carrying out said services, to select on the basis of said second indication first attribute justifications in the form of one or more certificates from a set of available attribute justifications, and to pass the selected first attribute justifications to said peer security entity, and second means, operative in the course of said handshake, to pass to said peer security entity a third indication explicitly advising what specific attributes are required of the remote application entity by the local application entity, and to receive second attribute justifications, in the form of one or more certificates, from said peer security entity; wherein said handshake as a three message handshake, the first message passing from the local security entity to said peer security entity and including said first and third indications, the second message passing from the peer security entity to the local security entity and including said second indication and said second attribute justifications, and the third message passing from the local security entity to said peer security entity and including said first attribute justifications.