Cryptographic web service

Abstract

A system that supports cryptographic web services is provided. A program running on program computing equipment may call a local cryptographic function. A web services interface such as a simple object access protocol interface on the program computing equipment makes a corresponding remote cryptographic function call to a web services interface such as a simple object access protocol interface at a cryptographic web service over a communications network such as the internet. At the cryptographic web service, a cryptographic engine implements cryptographic operations such as encryption and decryption operations. After successful authentication of the calling program, the cryptographic engine produces results for the remotely cryptographic function and returns the results to the program over the communications network.

1 . A method in which a program uses a cryptographic web service remotely over a communications network, comprising:
 at program computing equipment on which the program is implemented, calling a local cryptographic function from the program; and   in response to calling the local cryptographic function, calling a remote cryptographic function at the cryptographic web service that corresponds to the called local cryptographic function by sending information from a web services interface at the program computing equipment to a web services interface at the cryptographic web service over the communications network;   at the cryptographic web service, requesting a key from a key server over the communications network;   at the cryptographic web service, receiving the requested key from the key server over the communications network; and   at the cryptographic web service, producing results for the called remote cryptographic function using a cryptographic engine, wherein the results are produced by the cryptographic engine using the key from the key server.   
     
     
         2 . The method defined in  claim 1  further comprising:
 providing parameters for the local cryptographic function from the program.   
     
     
         3 . The method defined in  claim 1  wherein the web services interface at the program computing equipment comprises a simple object access protocol interface, the method further comprising:
 providing parameters for the local cryptographic function from the program; and   encoding the parameters with the simple object access protocol interface on the program computing equipment.   
     
     
         4 . The method defined in  claim 1  wherein the web services interface at the program computing equipment comprises a simple object access protocol interface and wherein the web services interface at the cryptographic web service comprises a simple object access protocol interface, the method further comprising:
 providing parameters for the local cryptographic function from the program;   encoding the parameters with the simple object access protocol interface on the program computing equipment;   receiving the encoded parameters with the simple object access protocol interface at the cryptographic web service; and   decoding the encoded parameters with the simple object access protocol interface at the cryptographic web service.   
     
     
         5 . The method defined in  claim 1  wherein the web services interface at the program computing equipment comprises a simple object access protocol interface and wherein the web services interface at the cryptographic web service comprises a simple object access protocol interface, the method further comprising:
 providing parameters for the local cryptographic function from the program;   encoding the parameters with the simple object access protocol interface on the program computing equipment;   receiving the encoded parameters with the simple object access protocol interface at the cryptographic web service;   decoding the encoded parameters with the simple object access protocol interface at the cryptographic web service; and   at the cryptographic web service calling the remote cryptographic function with the decoded parameters.   
     
     
         6 . The method defined in  claim 1  wherein the web services interface at the program computing equipment comprises a simple object access protocol interface and wherein the web services interface at the cryptographic web service comprises a simple object access protocol interface, the method further comprising:
 providing parameters for the local cryptographic function from the program;   encoding the parameters with the simple object access protocol interface on the program computing equipment;   receiving the encoded parameters with the simple object access protocol interface at the cryptographic web service;   decoding the encoded parameters with the simple object access protocol interface at the cryptographic web service;   at the cryptographic web service calling the remote cryptographic function with the decoded parameters; and   in response to calling the remote cryptographic function with the decoded parameters at the cryptographic web service, performing cryptographic operations with a cryptographic engine at the cryptographic web service using the decoded parameters.   
     
     
         7 . The method defined in  claim 1  wherein the web services interface at the program computing equipment comprises a simple object access protocol interface and wherein the web services interface at the cryptographic web service comprises a simple object access protocol interface, the method further comprising:
 providing parameters for the local cryptographic function from the program;   encoding the parameters with the simple object access protocol interface on the program computing equipment;   transmitting the encoded parameters to the simple object access protocol interface at the cryptographic web service from the simple object access protocol interface at the program computing equipment over the communications network in accordance with an address of the cryptographic web service and a function definition for the remote cryptographic function that are supplied in a web services description language file;   receiving the encoded parameters with the simple object access protocol interface at the cryptographic web service;   decoding the encoded parameters with the simple object access protocol interface at the cryptographic web service;   at the cryptographic web service calling the remote cryptographic function with the decoded parameters; and   in response to calling the remote cryptographic function with the decoded parameters at the cryptographic web service, performing cryptographic operations with a cryptographic engine at the cryptographic web service using the decoded parameters, wherein the decoded parameters include input data for the cryptographic engine and a cryptographic key.   
     
     
         8 . The method defined in  claim 1  further comprising:
 from authorization level information at the cryptographic web service, determining, for the program, a maximum allowed level of cryptographic functionality to be performed by the remote cryptographic function; and   at the cryptographic web service, performing the called remote cryptographic function from the determined maximum allowed level of cryptographic functionality.   
     
     
         9 . The method defined in  claim 1  further comprising:
 from the program, requesting a desired level of cryptographic functionality to be performed by the remote cryptographic function; and   from authorization level information at the cryptographic web service, determining whether the program is authorized to have the cryptographic web service perform the remote cryptographic function with the desired level of cryptographic functionality; and   if it is determined from the authorization level information at the cryptographic web service that the program is authorized to have the cryptographic web service perform the remote cryptographic function with the desired level of cryptographic functionality, performing the remote cryptographic function with the desired level of cryptographic functionality.   
     
     
         10 . A method in which a program uses a cryptographic web service remotely over a communications network, comprising:
 at program computing equipment on which the program is implemented, calling a local cryptographic function from the program; and   calling a remote cryptographic function at the cryptographic web service by calling a local cryptographic function at the program computing equipment, wherein calling the remote cryptographic function comprises providing parameters for the local cryptographic function from the program including at least one identifier, encoding the parameters with a web services interface at the program computing equipment, receiving the encoded parameters with a web services interface at the cryptographic web service, decoding the encoded parameters with the web services interface at the cryptographic web service;   at the cryptographic web service, requesting a key from a key server over the communications network using the identifier;   at the cryptographic web service, receiving the requested key from the key server over the communications network; and   at the cryptographic web service, producing results for the called remote cryptographic function using a cryptographic engine, wherein the results are produced by the cryptographic engine using the key from the key server.   
     
     
         11 . The method defined in  claim 10  wherein the web services interface at the program computing equipment comprises a simple object access protocol interface, wherein the web services interface at the cryptographic web service comprises a simple object access protocol interface, and wherein the remote cryptographic function comprises a decryption function, the method further comprising:
 at the cryptographic web service, decrypting one of the parameters from the program computing equipment using the decryption function and the key; and   conveying results from the decryption function to the program over the communications network using the simple object access protocol interfaces at the cryptographic web service and the program computing equipment.   
     
     
         12 . The method defined in  claim 10  wherein the web services interface at the program computing equipment comprises a simple object access protocol interface, wherein the web services interface at the cryptographic web service comprises a simple object access protocol interface, and wherein the remote cryptographic function comprises an identity-based-encryption decryption function, the method further comprising:
 at the cryptographic web service, decrypting one of the parameters from the program computing equipment using the identity-based-encryption decryption function and the key; and   conveying results from the identity-based-encryption decryption function to the program over the communications network using the simple object access protocol interfaces at the cryptographic web service and the program computing equipment.   
     
     
         13 . The method defined in  claim 10  wherein the web services interface at the program computing equipment comprises a simple object access protocol interface, wherein the web services interface at the cryptographic web service comprises a simple object access protocol interface, and wherein the remote cryptographic function comprises a public-key-cryptography decryption function, the method further comprising:
 at the cryptographic web service, decrypting one of the parameters from the program computing equipment using the public-key-cryptography decryption function and the key; and   conveying results from the public-key-cryptography decryption function to the program over the communications network using the simple object access protocol interfaces at the cryptographic web service and the program computing equipment.   
     
     
         14 . The method defined in  claim 10  wherein the web services interface at the program computing equipment comprises a simple object access protocol interface, wherein the web services interface at the cryptographic web service comprises a simple object access protocol interface, and wherein the remote cryptographic function comprises a symmetric-key cryptographic decryption function, the method further comprising:
 at the cryptographic web service, decrypting one of the parameters from the program computing equipment using the symmetric-key cryptographic decryption function and the key; and   conveying results from the symmetric-key cryptographic decryption function to the program over the communications network using the simple object access protocol interfaces at the cryptographic web service and the program computing equipment.   
     
     
         15 . The method defined in  claim 10  wherein the web services interface at the program computing equipment comprises a simple object access protocol interface and wherein the web services interface at the cryptographic web service comprises a simple object access protocol interface, the method further comprising:
 communicating over the communications network between the simple object access protocol interface at the program computing equipment and the simple object access protocol interface at the cryptographic web service using a transport protocol in which authentication credentials are included; and   checking the authentication credentials with the simple object access protocol interface at the cryptographic web service.   
     
     
         16 . The method defined in  claim 10  further comprising:
 at the cryptographic web service, determining whether authentication external to the cryptographic web service is required for the program based on configuration information stored at the cryptographic web service.   
     
     
         17 . The method defined in  claim 10  further comprising:
 at the cryptographic web service, determining whether the key has been cached before requesting the key.   
     
     
         18 . A method in which a program uses a cryptographic web service remotely over a communications network, comprising:
 calling a remote cryptographic function at the cryptographic web service by calling a local cryptographic function at the program computing equipment, wherein calling the remote cryptographic function comprises providing parameters for the local cryptographic function from the program including at least one data parameter, encoding the parameters with a web services interface at the program computing equipment, receiving the encoded parameters with a web services interface at the cryptographic web service, decoding the encoded parameters with the web services interface at the cryptographic web service;   at the cryptographic web service, analyzing the data parameter to produce analysis results; and   at the cryptographic web service, producing function results for the called remote cryptographic function based at least partly on the analysis results.   
     
     
         19 . The method defined in  claim 18  wherein producing the function results comprises using the analysis results at the cryptographic web service in determining how to perform cryptographic functions with a cryptographic engine. 
     
     
         20 . The method defined in  claim 18  wherein the producing the function results comprises selecting which encryption algorithm to use at the cryptographic web service based on whether the analysis results indicate that the data parameter included a credit card number. 
     
     
         21 . The method defined in  claim 18  further comprising:
 requesting a key from a key server over the communications network from the cryptographic web service; and   at the cryptographic web service, receiving the requested key from the key server over the communications network, wherein producing the function results comprises performing a cryptographic function using the requested key.   
     
     
         22 . The method defined in  claim 18  further comprising:
 requesting a key from a key server over the communications network from the cryptographic web service; and   at the cryptographic web service, receiving the requested key from the key server over the communications network, wherein producing the function results comprises performing a cryptographic function using the requested key and wherein the producing the function results comprises selecting which encryption algorithm to use at the cryptographic web service based on whether the analysis results indicate that the data parameter included a credit card number.