Secure customer interface for web based data management
An integrated series of security protocols is disclosed that protect remote user communications with remote enterprise services, and simultaneously protect the enterprises services from third parties. In the first layer, an implementation of the Secure Sockets Layer (SSL) version of HTTPS provides communications security, including authentication of the enterprise web server and the security of the transmitted data. The protocols provide for an identification of the user, and an authentication of the user to ensure the user is who he/she claims to be and a determination of entitlements that the user may avail themselves of within the enterprise system. Session security is described, particularly as to the differences between a remote user's copper wire connection to a legacy system and a user's remote connection to the enterprise system over a “stateless” public Internet, where each session is a single transmission, rather than an interval of time between logon and logoff, as is customary in legacy systems. Security for the enterprise network and security for the data maintained by the various enterprise applications is also described.
1. A security system for communications network management having an integrated customer interface, said security system comprising:
at least one secure web server for managing secure sessions over the internet, said secure web server supporting secure socket layer for encrypted communication, said secure web server also providing session management including customer identification, validation and session management to link said session with said customer;
at least one dispatcher server for communicating with said secure web server through a firewall, and communicating with a plurality of proxy services and a plurality of system resources using an internal network, said dispatcher server providing verification of system access after customer entitlements have been verified; and
said plurality of system resources providing communications network management capabilities for said customer, each of said system resources responsive to a request to generate client data or instructions relating to said communications network.
2. The security system for communications network management as claimed in claim 1 further comprising:
a plurality of client web browsers that enable interactive secure communications with said security system and provide an integrated interface for said customer, each of said web browsers supporting client identification, client authentication and secure sockets layer communications protocol, wherein said system includes digital certificates to authenticate said secure web server to said client web browser.
3. The security system for communications network management as claimed in claim 2 wherein said client web browser secure socket layer encrypts client identification, authentication and a session management cookie during each transmission.
4. The security system for communications network management as claimed in claim 2 wherein said system includes a first encryption algorithm for transmission of all customer data between said secure web server and said client browser for transmission of all customer data between said secure web server and said dispatcher server and a second encryption algorithm.
5. The security system for communications network management as claimed in claim 2 wherein each client request from said web browser is encrypted with a public key provided by said communications network, and each of said client requests includes an encrypted client cookie for client authentication.
6. The security system for communications network management as claimed in claim 1 wherein said session management further includes web cookie generation at each instance of client identification to link a session with said customer through a plurality of discrete client communications in said session to verify said customer to said dispatcher server at each transmission in said session.
7. The security system for communications network management as claimed in claim 6 wherein said cookie is generated by a program on a separate server during an entitlements communications, after identification and authentication of the client.
8. The security system for communications network management as claimed in claim 6 wherein said session cookies provide simultaneous session management for a plurality of system resource platforms.
9. The security system for communications network management as claimed in claim 1 wherein said secure web server communicates with said dispatcher server over an encrypted socket connection.
10. The security system for communications network management as claimed in claim 9 wherein said system includes encryption between said secure web server and said dispatcher server.
11. The security system for communications network management as claimed in claim 1 further comprising:
at least one digital certificate for authenticating said secure web server to a plurality of client web browsers that enable interactive secure communications with said security system and provide an integrated interface for said customer, each of said web browsers supporting client identification, client authentication and secure sockets layer communications protocol.
12. The security system for communications network management as claimed in claim 11 , wherein said client web browser secure socket layer encrypts client identification, authentication and a session management cookie during each transmission.
13. The security, system for communications network management as claimed in claim 11 , wherein said system includes a first encryption algorithm for transmission of all customer data between said secure web server and said client browser for transmission of all customer data between said secure web server and said dispatcher server and a second encryption algorithm.
14. The security system for communications network management as claimed in claim 11 , wherein each client request from said web browser is encrypted with a public key provided by said communications network, and each of said client requests includes an encrypted client cookie for client authentication.
15. A system having an integrated and secure customer interface for communications network management, said system including a web browser for use on a client computer, and a secure web server having a system home page, said system comprising:
at least one applet embedded in said home page to provide interactive sessions with said communications network, said sessions including client authentication, session authentication and transaction requests for said communications network;
an encryption layer to provide encryption of each client session with a public key provided by said communications network, each session also including session authentication with a client cookie generated by said system, said session cookie being encrypted with said public key during transmission of each transaction request to said secure server; and
at least one security firewall on either side of said secure server to prevent direct public access to said communications network.
16. The system for communications network management as claimed in claim 15 , said communications network further including a plurality of application servers for receiving transaction requests from said secure web server, said secure web server encrypting each of said transaction requests with a public key algorithm before transmission to a selected one of said application servers.
17. The system for communications network management as claimed in claim 16 , said system further including a dispatcher server for receiving transaction requests from said secure web server, and dispatching said request to said selected one of said application servers.
18. The system for communications network management as claimed in claim 15 , wherein said communications network includes a router based firewall between said secure server and said public Internet, and a proxy based firewall between said secure web server and any one of said applications servers.
19. The system for communications network management as claimed in claim 15 , wherein one of said applets is a user object, said object being populated with a first set of entitlement at log on, and a second set of entitlement during a session with a selected application sever.
20. The system for communications network management as claimed in claim 15 , said communications network further including an authentication server which determines entitlement for a user object following authentication.