Claims:We Claim:

1. A method for performing secure operations in web mailing system, the method comprising:
storing credentials of the email on the storage device or local storage of the mail client system by a secure credential management system;
connecting to web server by mail client system and invoke the applet present on the web server and execute it on the mail client system by a secure processing module;
retrieving credentials from storage device or local storage of mail client system for processing;
performing secure functionalities on the emails by a dynamic link library stored on the main client system by the secure processing module;
providing a secure interface between the dynamic link library and the mail client application by a secure Interfacing unit, the interface containing an applet which is downloaded and executed on the mail client; and
sending secure email to the web server.

2. The method as claimed in claim 1, wherein the secure processing module further comprises few steps to perform signing of applet by:
generating credentials for the applet and storing them in the applet keystore;
creating certificate for the applet;
creating the applet jar file and signing it;
attaching the signed jar file with the certificate and sending it to the recipient; and
downloading the signed applet at the recipient side wherein the JRE on the client verifies the applet using the certificate.

3. The method as claimed in claim 1, wherein all the users of the mailing system are assigned credentials stored in storage devices or local system prior to using the mailing system by secure credential management system.

4. The method as claimed in claim 1, wherein the applet loads the link library stored on the main client system.

5. The method as claimed in claim 1, wherein the secure processing module ensures that the applet is verified by the client system before executing it and prevents the execution of potentially dangerous or malicious operations.

6. The method as claimed in claim 1, wherein the invocation of the applet guarantees that the applet code gets executed on the client machine thereby ensuring that the dynamic link library is executed on the client side instead of the web server side.

7. The method as claimed in claim 1, wherein the execution of the applet ensures that the loading of the dynamic link library happens on the client system and thereby secure functionalities happen on the client system.

8. The method as claimed in claim 1, wherein the secure interface ensures that the data in plain doesn’t have to travel to the web server for securing and verification purposes.

9. The method as claimed in claim 1, wherein the secure interface ensures that credentials need not be stored in the web server for performing secure operations of mails. Instead it facilitates the secure operations to be performed through the credentials which are safely stored in the client machine.

10. A system for performing secure operations in web mailing system, the system comprising:
a secure credential management system, wherein the secure credential management system stores credentials of the email on the storage device or local storage of the mail client system;
a secure processing module, wherein the secure processing module includes few steps:
connecting to web server by mail client system and invoke the applet present on the web server and execute it on the mail client system;
retrieving credentials from storage device or local storage of mail client system for processing;
performing secure functionalities on the emails by a dynamic link library stored on the main client system;
sending secure email to the web server.
11. The system as claimed in claim 10, further comprising a secure Interfacing unit, wherein the secure interfacing unit provides a secure interface between the dynamic link library and the mail client application, the interface containing an applet which is downloaded and executed on the mail client.

, Description:FORM 2
THE PATENTS ACT, 1970
(39 of 1970)
&
THE PATENTS RULES, 2003
COMPLETE SPECIFICATION
(See section 10, rule 13)
“A method and system for performing secure operations in web mailing system without transfer of credentials across the network”
By
Bharat Electronics Limited,
Corporate Office,
Outer Ring Road, Nagavara,
Bangalore-560045
The following specification particularly describes the invention and the manner in which it is to be performed.

Field of the invention
The present invention mainly relates to web mailing system and more particularly to a method and system for effectively using secure features in Web mailing systems to provide secure functionalities in web client without transferring the credentials or plain data across the network.
Background of the invention
Webmail (or web-based email) is well known in the art which is an email available for use online and stored in an Internet server mailbox. These are usually free email accounts that are operated from a website. Examples of webmail software are Roundcube and SquirrelMail. Examples of webmail providers are AOLMail, Gmail, Outlook.com and Yahoo! Mail. Many webmail providers also offer email access by a desktop email client using standard email protocols, while many internet service providers provide a webmail client as part of the email service included in their internet service package.
As with any web application, webmail's main advantage over the use of a desktop email client is the ability to send and receive email anywhere from a web browser. Its main disadvantage is the need to be connected to the internet while using it. There exist also other software tools to integrate parts of the webmail functionality into the OS (e.g. creating messages directly from third party applications via MAPI).
However in the currently existing mailing systems, email is prone to disclosure of information. By means of some available tools, persons other than the designated recipients can read the email contents.
Email protection is securing of email messages to protect the content from being read by other entities than the intended recipients. To protect the email it may also include authentication. It can rely on public-key infrastructure, in which users can each publish a certificate that others can use to secure messages, while keeping secret credential they can use to verify such messages or to digitally secure and verify messages they send. Protocols for email securing include: Bitmessage, OpenPGP, S/MIME, and TLS.
Another way to provide protection is by securing Mail sessions. The STARTTLS SMTP extension is a TLS (SSL) layer on top of the SMTP connection. While it protects traffic from being sniffed during transmission, it is technically not securing of emails because the content of messages is revealed to, and can be altered by, intermediate email relays. In other words, the securing takes place between individual SMTP relays, not between the sender and the recipient. When both relays support STARTTLS, it may be used regardless of whether the email's contents are secured using another protocol.
Document, US 8788808 B2 describes a Method and a corresponding system for authenticating software products. A digital certificate and a corresponding credential required to sign each product are stored on a server computer. Whenever a user needs to sign a product, he/she logs on a client computer and transmits a corresponding request to the server computer. The server computer verifies whether the request has been received from an authorized subject; for example, an address of the client computer and an identifier of the user are compared with a predefined list. If the result of the verification is positive, the product is signed and returned to the client computer. For this purpose, a script called on the server computer includes either an instruction passing the access password to a signing tool as a parameter or an instruction causing the signing tool to import the access password from a registry of the server computer.
Further, document US 20130283362 A1 describes a web extension authenticating a user using a token based authentication scheme. A token is retrieved from a client application to authenticate the user. The web extension transmits the token to a server component to have the server component authenticate the user. The server component validates the token using a validation library. The user is mapped to the token and authenticated upon validating the token.
Therefore there is a need in the art with improved method and system for providing secure functionalities in web client without transferring the credentials or plain data across the network.
Objective of the invention
The main objective of the present invention is to provide a method and system for effectively performing secure operations on web client. This is achieved by storing credentials of the user on the client side either on a storage device or on the local system. Further, the securing of data happens on the client side not in the web server and the secured data is sent to the web server.
Summary of the Invention
An aspect of the present invention is to address at least the above-mentioned problems and/or disadvantages and to provide at least the advantages described below.
Accordingly, in one aspect of the present invention relates to a method for performing secure operations in web mailing system, the method comprising: storing credentials of the email on the storage device of the mail client system while sending an email by a secure credential management system, connecting to web server by mail client system and invoke the applet present on the web server and execute it on the mail client system by a secure processing module, retrieving credentials from storage device or local storage of mail client system for processing, performing secure functionalities on the emails by a dynamic link library stored on the mail client system by the secure processing module, providing a secure interface between the dynamic link library and the mail client application by a secure Interfacing unit, the interface containing an applet which is downloaded and executed on the mail client and sending secure email to the web server.
Another aspect of the present invention relates to a system for performing secure operations in web mailing system, the system comprising: a secure credential management system, wherein the secure credential management system stores credentials of the email on the storage device or local storage of the mail client system while sending an email, a secure processing module, wherein the secure processing module includes few steps: connecting to web server by mail client system and invoke the applet present on the web server and execute it on the mail client system, retrieving credentials from storage device or local storage of mail client system for processing, performing secure functionalities on the emails by a dynamic link library stored on the main client system, sending secure email to the web server and a secure interfacing unit which provides a secure interface between the dynamic link library and the mail client application, the interface containing an applet which is downloaded and executed on the mail client.
Other aspects, advantages, and salient features of the invention will become apparent to those skilled in the art from the following detailed description, which, taken in conjunction with the annexed drawings, discloses exemplary embodiments of the invention.

Brief description of the drawings
The above and other aspects, features, and advantages of certain exemplary embodiments of the present invention will be more apparent from the following description taken in conjunction with the accompanying drawings in which:
Figure 1 shows a basic scheme of web mailing system according to one embodiment of the present invention.
Figure 2 shows a block diagram of an information processing system implemented on a web server according to one embodiment of the present invention.
Figure 3 shows a block diagram illustrating the credential retrieval and link library processing by the secure processing system in the web server according to one embodiment of the present invention.
Figure 4 shows a flowchart illustrating the credential retrieval, execution of dynamic link library and performing secure operations on the mail client according to one embodiment of the present invention.
Persons skilled in the art will appreciate that elements in the figures are illustrated for simplicity and clarity and may have not been drawn to scale. For example, the dimensions of some of the elements in the figure may be exaggerated relative to other elements to help to improve understanding of various exemplary embodiments of the present disclosure.
Throughout the drawings, it should be noted that like reference numbers are used to depict the same or similar elements, features, and structures.
Detailed description of the invention
The following description with reference to the accompanying drawings is provided to assist in a comprehensive understanding of exemplary embodiments of the invention as defined by the claims and their equivalents. It includes various specific details to assist in that understanding but these are to be regarded as merely exemplary. Accordingly, those of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the invention. In addition, descriptions of well-known functions and constructions are omitted for clarity and conciseness.
The terms and words used in the following description and claims are not limited to the bibliographical meanings, but, are merely used by the inventor to enable a clear and consistent understanding of the invention. Accordingly, it should be apparent to those skilled in the art that the following description of exemplary embodiments of the present invention are provided for illustration purpose only and not for the purpose of limiting the invention as defined by the appended claims and their equivalents.
It is to be understood that the singular forms “a,” “an,” and “the” include plural referents unless the context clearly dictates otherwise. Thus, for example, reference to “a component surface” includes reference to one or more of such surfaces.
By the term “substantially” it is meant that the recited characteristic, parameter, or value need not be achieved exactly, but that deviations or variations, including for example, tolerances, measurement error, measurement accuracy limitations and other factors known to those of skill in the art, may occur in amounts that do not preclude the effect the characteristic was intended to provide.
Figures discussed below, and the various embodiments used to describe the principles of the present disclosure in this patent document are by way of illustration only and should not be construed in any way that would limit the scope of the disclosure. Those skilled in the art will understand that the principles of the present disclosure may be implemented in any suitably arranged communications system. The terms used to describe various embodiments are exemplary. It should be understood that these are provided to merely aid the understanding of the description, and that their use and definitions in no way limit the scope of the invention. Terms first, second, and the like are used to differentiate between objects having the same terminology and are in no way intended to represent a chronological order, unless where explicitly stated otherwise. A set is defined as a non-empty set including at least one element.
The present invention is a method and system for performing secure operations on the client side rather than on the web server in a web mailing system is proposed. Credentials are stored in the client system either on a storage device or on the local system.
Figure 1 shows a basic scheme of web mailing system according to one embodiment of the present invention.
The figure shows the basic scheme of web mailing system. The figure depicts an information processing system network 100 in which the current invention may be implemented. Information processing system network 100 consists of a network of computers and network devices connected via communication links.Mail Client 101 is connected to the web server 102 which is connected to mail server 103. Mail server is connected to directory server 104. Network 100 uses TCP/IP (Transmission Control Protocol/Internet Protocol) suite to communicate.
In the present invention, the system performs secure operations on the client side rather than on the web server. Credentials are stored in the client system either on a storage device or on the local system instead of web server. In the present invention, whenever a user needs to send a secure mail, one/he logs onto a web client. After successful authentication to the server, the client composes the mail by choosing the secure option. On sending the mail, a method gets executed on the client system, which retrieves the credentials, and the library to perform the secure operation gets executed on the client side. This method and system ensures that both the credentials and plain data will not travel to web server and the credentials will not be stored in web server for secure operations to take place.

Figure 2 shows a block diagram of an information processing system implemented on a web server according to one embodiment of the present invention.
The figure shows a block diagram illustrating the components of a Mailing system. Mail client 201 composes and sends mails to Mail server 203 via web server 202. Directory server 204 contains user information and is used for validating users. External storage device, if present, will be plugged onto Mail client 201.This server allows users to communicate with other users connected to the same Mail server or to different Mail servers.
Figure 3 shows a block diagram illustrating the credential retrieval and link library processing by the secure processing system in the web server according to one embodiment of the present invention.
The figure illustrates the credential retrieval and link library processing by the secure processing system in the web server. Each mail user is provided with his credential details. The user logs in to the mail client 300. The client 300 connects to the web server 304 on port 8080. The Secure credential management system 301 stores the credentials on the client system. The credentials which are present on the client system are retrieved by the process 302. The secure processing module 303 executes the dynamic link library present on the client system which performs secure operations on the mail data. This secured data is then sent to the mail server 305.
Figure 4 shows a flowchart illustrating the credential retrieval, execution of dynamic link library and performing secure operations on the mail client according to one embodiment of the present invention.
The figure shows a flowchart illustrating the credential retrieval, execution of dynamic link library and performing secure operations on the mail client. The flowchart describes the process for executing the code on client system so that neither the credentials nor the plain data travels across the network. Mail client 401 connects to the web server (step 402) on port 8080. The web application on the web server contains an applet code which is executed on the client machine (step 403). The computer devised method then retrieves the credentials from the client (step 404). The secure processing module loads the dynamic link library present on the client system, to perform secure operations on the mail content (step 405). The secured mail is then sent to the web server (step 406).
The applet must be a trusted applet, to be authorized to perform the operations required by the software application. Regular applets are executed by default in a controlled environment through the process of sandboxing, wherein potentially dangerous operations are denied. On the contrary, a trusted applet is given special privileges that allow performing those operations. The target computer is prompted for granting special privileges to the applet.
The authentication of the applets is based on a Public Key Infrastructure (PKI). The applets are signed at the sender side and verified at the recipient side. Firstly, the credentials required for signing/verification of applets are created and stored in a key store. A certificate is created and exported. A jar file is created from the applet class file and is signed with the credential of the applet. The certificate is attached with the signed jar file and sent to the recipient. At the recipient side, the browser will download the signed applet and the JRE on the client will verify the applet using the certificate.
The method of performing secure operations in web mailing system, the method comprising: storing credentials of the email on the storage device or local storage of the mail client system while sending an email by a secure credential management system, connecting to web server by mail client system and invoke the applet present on the web server and execute it on the mail client system by a secure processing module, retrieving credentials from storage device or local storage of mail client system for processing, performing secure functionalities on the emails by a dynamic link library stored on the main client system by the secure processing module, providing a secure interface between the dynamic link library and the mail client application by a secure Interfacing unit which is downloaded and executed on the mail client and sending secure email to the web server.
The secure processing module further comprises few steps to perform signing of applet by: generating credentials for the applet and storing them in the applet keystore, creating certificate for the applet, creating the applet jar file and signing it, attaching the signed jar file with the certificate. Further all the users of the mailing system are assigned credentials stored in storage devices or their local system prior to using the mailing system by secure credential management system.
The applet loads the link library stored on the main client system. The invocation of the applet guarantees that the applet code gets executed on the client machine thereby ensuring that the dynamic link library is executed on the client side instead of the web server side. The execution of the applet ensures that the loading of the dynamic link library happens on the client system and thereby secure functionalities happen on the client system.
The secure processing module ensures that the applet is verified by the client system before executing it and prevents the execution of potentially dangerous or malicious operations. The Secure interface unit also ensures that the data in plain doesn’t have to travel to the web server for securing and verification purposes. The securing and verification process happens in the mail client system only i.e. the mail goes out of the client system only after being secured. The Secure interface unit ensures that credentials need not be stored in the web server for performing secure operations of mails. Instead it facilitates the secure operations to be performed through the credentials which are safely stored in the client machine.
In another embodiment of the present invention describes a system for performing secure operations in web mailing system, the system comprising: a secure credential management system, wherein the secure credential management system stores credentials of the email on the storage device or local storage of the mail client system while sending an email, a secure processing module, wherein the secure processing module includes few steps: connecting to web server by mail client system and invoke the applet present on the web server and execute it on the mail client system, retrieving credentials from storage device or local storage of mail client system for processing, performing secure functionalities on the emails by a dynamic link library stored on the main client system, sending secure email to the web server and a secure Interfacing unit, wherein the secure interfacing unit provides a secure interface between the dynamic link library and the mail client application, the interface containing an applet which is downloaded and executed on the mail client.
Figures are merely representational and are not drawn to scale. Certain portions thereof may be exaggerated, while others may be minimized. Figures illustrate various embodiments of the invention that can be understood and appropriately carried out by those of ordinary skill in the art.
In the foregoing detailed description of embodiments of the invention, various features are grouped together in a single embodiment for the purpose of streamlining the disclosure. This method of disclosure is not to be interpreted as reflecting an intention that the claimed embodiments of the invention require more features than are expressly recited in each claim. Rather, as the following claims reflect, inventive subject matter lies in less than all features of a single disclosed embodiment. Thus, the following claims are hereby incorporated into the detailed description of embodiments of the invention, with each claim standing on its own as a separate embodiment.
It is understood that the above description is intended to be illustrative, and not restrictive. It is intended to cover all alternatives, modifications and equivalents as may be included within the spirit and scope of the invention as defined in the appended claims. Many other embodiments will be apparent to those of skill in the art upon reviewing the above description. The scope of the invention should, therefore, be determined with reference to the appended claims, along with the full scope of equivalents to which such claims are entitled. In the appended claims, the terms “including” and “in which” are used as the plain-English equivalents of the respective terms “comprising” and “wherein,” respectively.

We Claim:

1. A method for performing secure operations in web mailing system, the method comprising:
storing credentials of the email on the storage device or local storage of the mail client system by a secure credential management system;
connecting to web server by mail client system and invoke the applet present on the web server and execute it on the mail client system by a secure processing module;
retrieving credentials from storage device or local storage of mail client system for processing;
performing secure functionalities on the emails by a dynamic link library stored on the main client system by the secure processing module;
providing a secure interface between the dynamic link library and the mail client application by a secure Interfacing unit, the interface containing an applet which is downloaded and executed on the mail client; and
sending secure email to the web server.

2. The method as claimed in claim 1, wherein the secure processing module further comprises few steps to perform signing of applet by:
generating credentials for the applet and storing them in the applet keystore;
creating certificate for the applet;
creating the applet jar file and signing it;
attaching the signed jar file with the certificate and sending it to the recipient; and
downloading the signed applet at the recipient side wherein the JRE on the client verifies the applet using the certificate.

3. The method as claimed in claim 1, wherein all the users of the mailing system are assigned credentials stored in storage devices or local system prior to using the mailing system by secure credential management system.

4. The method as claimed in claim 1, wherein the applet loads the link library stored on the main client system.

5. The method as claimed in claim 1, wherein the secure processing module ensures that the applet is verified by the client system before executing it and prevents the execution of potentially dangerous or malicious operations.

6. The method as claimed in claim 1, wherein the invocation of the applet guarantees that the applet code gets executed on the client machine thereby ensuring that the dynamic link library is executed on the client side instead of the web server side.

7. The method as claimed in claim 1, wherein the execution of the applet ensures that the loading of the dynamic link library happens on the client system and thereby secure functionalities happen on the client system.

8. The method as claimed in claim 1, wherein the secure interface ensures that the data in plain doesn’t have to travel to the web server for securing and verification purposes.

9. The method as claimed in claim 1, wherein the secure interface ensures that credentials need not be stored in the web server for performing secure operations of mails. Instead it facilitates the secure operations to be performed through the credentials which are safely stored in the client machine.

10. A system for performing secure operations in web mailing system, the system comprising:
a secure credential management system, wherein the secure credential management system stores credentials of the email on the storage device or local storage of the mail client system;
a secure processing module, wherein the secure processing module includes few steps:
connecting to web server by mail client system and invoke the applet present on the web server and execute it on the mail client system;
retrieving credentials from storage device or local storage of mail client system for processing;
performing secure functionalities on the emails by a dynamic link library stored on the main client system;
sending secure email to the web server.
11. The system as claimed in claim 10, further comprising a secure Interfacing unit, wherein the secure interfacing unit provides a secure interface between the dynamic link library and the mail client application, the interface containing an applet which is downloaded and executed on the mail client.

Abstract
The present invention mainly relates to a method and system for effectively using secure features in Web mailing systems to provide secure functionalities in web client without transferring the credentials or plain data across the network. In one embodiment, the method comprising: storing credentials of the email on the storage device or local storage of the mail client system by a secure credential management system, connecting to web server by mail client system and invoke the applet present on the web server and execute it on the mail client system by a secure processing module, retrieving credentials from storage device or local storage of mail client system for processing, performing secure functionalities on the emails by a dynamic link library stored on the main client system by the secure processing module, providing a secure interface between the dynamic link library and the mail client application by a secure Interfacing unit, the interface containing an applet which is downloaded and executed on the mail client and sending secure email to the web server.
Figure 3 (for publication)