BACKGROUND ART: Digital financial transactions are known, such as ordering and paying for products over the Internet, paying suppliers using credit or debit cards, transferring money between accounts, etc. Security protocols, such as SSL, are implemented in certain transactions, such as banking transactions over the Internet, but these protocols are of a relatively low level. In other transactions, notably credit card payments, no special security measures are used and there is no authentication of the card and a transaction other than a check through the credit card issuer's"hot file". These checks are limited, because further checks on account balances, authorisation of payment, etc. are non-trivial i. e. involve considerable time/computational power.

It is known that so called"smart devices"can be used for increasing security and authentication for transactions over public networks. The term"smart devices"means smart cards, SIM cards or other secure integrated circuits- chips in pervasive computing devices and like that include a processor, non- volatile memory (e. g. Rom, EEPROM, mini-disk), optional volatile memory (RAM), and an operating system, that can store and process data. Smart devices, while being capable of being used for more functions and on a wider scale, ace currently used to a limited extend for identification, authorisation and storing information.

Security algorithms provide security protocols, where the security protocol is an established communication with a dialog between the communicating parties, using one or more security algorithm. Generally, the major security algorithms are symmetrical or asymmetrical. A symmetrical encryption algorithm, such as 3DES and Blowfish, uses the same encryption key for sender and receiver of a message. Currently there are symmetrical algorithms

with appropriate key lengths, which are not breakable. An asymmetrical encryption algorithm, e. g. RSA, uses public and private keys where for each security operation the sender and receiver use different keys. Currently there are asymmetrical algorithms with appropriate key lengths, which are not breakable.

This invention seeks to provide a security method, using cascaded encryption from unbreakable algorithms, applicable selectively, depending of the content of the message, the content of its data portions and the defined business rules established for the message portions and/or for the entire message.

DISCLOSURE OF THE INVENTION One aspect of the invention provides a method for creating suitable high security protocols for transmission of messages between two parties communicating over a public network, such as the Internet, using a base communication protocol, including the steps of : setting at least one condition for which a security level higher than the security level of the base communication protocol must be implemented; 'assessing each portion of the message to be transmitted to determine if a condition has been fulfilled for any portion of the message for separate encryption of each portion or for the entire message; and initiating an application (programming level) protocol to encrypt each portion of the message for which a condition has been fulfilled with the higher level encryption prior to submission of the message for transmission using the base communication protocol.

The base communication protocol may be any accepted communication protocol, such as TCP/IP, though preferable it is a secure protocol, such as SSL or another accepted security protocol, which provides a first low level of security.

Over the base communication protocol, different levels of security can be added including different encryption algorithms connected in a cascaded way, using application coding and application programming interface with the base communication protocol, building different cascaded application encryptions.

Different portions of the message may be encrypted with different application

level encryptions depending on predetermined conditions. For each application level encryption, the"application code"can involve smart devices. All applied application encryptions define the application level of the security protocol. The application level security protocol provides higher security capabilities that the base communication protocol.

The conditions for implementation of different encryption algorithms on the message portions may be selected from any desired criteria, such as value of money coded in a message portion, importance of the data concerned with the message, nature of the transaction concerned with the message and the like.

Examples are: message concerned stock and bond trades, account payments and inter account transfers; message portions as card/account/PIN numbers, passwords and so on. For instance, in a stock trade instruction the stock symbol of shares may be encrypted with one application level security algorithm, while the prices and number of shares may be encrypted with another application level security algorithm.

The method may also apply selected further cascaded encryption levels to the message when other predetermined conditions have been fulfilled. The applied cascaded application encryption algorithms define a chain of application level security algorithms, used in the security protocol. The encryption mechanism of the base communication protocol, if any, can be accepted as zero level of the cascading encryption. The other application level encryption algorithms add additional levels in the cascaded encryption. The preferred minimum level of application cascading is at least two-zero level and first level, including at least one application level cascading encryption.

The first cascaded application level security in the security protocol (used over the zero level cascaded encryption provided by the base communication protocol) may use symmetrical or asymmetrical algorithms as desired. The use of symmetrical encryption algorithms is preferred based on their relatively quicker performance. On the other hand asymmetrical algorithms are able to add higher level of security features, such as non-repudiation, digital signature etc. Thus it is preferred that at least when there are three application cascading security levels, one of them is symmetrical and another is asymmetrical.

Where one of the application level of the security protocol uses symmetrical algorithm, then it is preferred that the application level encryption is based on the concatenation of selected portions of two numbers, one of which is generated by one of the parties and the other is generated by the other of the parties to a communication.

Preferable the keys for the selected cascading protocols differ from one another, if same types of security algorithms are used in the cascaded path of algorithms.

All used security algorithms in the cascade are unbreakable algorithms with similar level of unbreakability : Further application levels of encryption may be applied if desired.

Preferably the application level encryptions are performed using keys and functions allocated only in a smart device and in the communication partner- the secure server, without executing any security application encryption algorithms outside of these processors.

Further features, variants and/or advantages of aspects of the invention will emerge from the following non-limiting description of examples of the invention made with reference to the accompanying schematic drawings.

BRIEF DESCRIPTION OF THE DRAWINGS: Figure 1 shows a system for achieving cascaded application encryption; Figure 2 shows a sub-system of the system of Figure 1 for creation an application level encryption symmetrical key.

BEST KNOWN MODE FOR CARRYING OUT THE INVENTION: Figures 1 and 2 illustrate a system for cascading transaction encryption that can be a few levels deep.

Figure 1 shows an application architecture 10 comprising a base communication protocol 12, e. g. SSL, a first level application symmetrical transaction encryption 14 (e. g. 3DES), a second level asymmetrical

encryption 16, a third application level symmetrical encryption 17, and plain data 18 that is to be encrypted and transmitted. The level of security of the SSL encryption can be very low, but is sufficient to prevent causal observation of the content of transmitted messages.

Figure 2 illustrates an application structure 20 for creating a symmetrical key 32 for application level symmetrical encryption for data transmitted between a smart device-smart card 22 and a secure bank server 24. The key 32 is created by: generating a random number RandNumbl in the smart card 22; generating another random number RandNumb2 in the bank server 24; defining the parts 26 and 28 of, respectively, RandNumbl and RandNumb2 to be concatenated; concatenating different parts of the random numbers 26 and 28; and generating a symmetrical key 32 that will be used as symmetrical application level encryption. The parts of the random numbers participating in the concatenation vary in each concatenation process, depending of the transaction history between the sender and receiver or depending of some algorithm for dynamic concatenation. The dynamics of the concatenation process adds another dependency and increases the level of security.

The concatenated values (how many bits from the first random number and how many bits from the second random number will participate in creation of the symmetrical key) are dependent on: content of the previous transmitted message; rules in the smart card and in the bank server determining the specific smart card behaviour; historical and current conditions for initiation of the transaction; dependencies between the current and previous transactions; and so on.

The cascading transaction encryption is an encryption mechanism, the cascading depth of which depends of the value represented by the data to be transmitted and the type of the data. The level of depth is selected for each data item in a message in accordance with the value of the item and the triggered condition for cascading encryption for that item.

The first application level cascading encryption in figure 1 (used over the zero level cascaded encryption provided by the base communication protocol) is a symmetrical encryption, such as 3DES or Blowfish, has a key that is different than the used in the base communication protocol and this key is created by

concatenation of two random numbers as set out above. The cascaded encryption level uses supporting encryption operations provided inside the customer's smart card and inside the bank server.

The second level application cascading encryption in figure 1 can be asymmetrical encryption, such as RSA, or a symmetrical encryption, executed inside the customer's smart card and inside the bank server.

The third level of application cascading encryption in figure 1 can be also symmetrical or asymmetrical encryption and it is executed inside the customer's smart card and inside the bank server.

In user-to-system secure communication, from all cascaded encryptions in the user's part, only the lowest one-from the base communication protocol can be executed outside the user's smart device (smart card), all higher level cascaded encryption-application level cascaded encryption should be executed inside the smart device. In system-to-system secure communication, all cascaded encryptions will be executed inside the systems, where for the application cascaded encryptions each system preferable will have a smart device for at least keeping the security keys or for execution of the entire security algorithms.

Thus, in this way, a data item determined to warrant four levels of cascaded encryption can be encrypted by 3DES algorithm on a zero level-base communication protocol, after that by Blowfish algorithm on a first level, after that by RSA algorithm on a second level and after that 3DES algorithm on a third level.

The order of cascading the encryption algorithms is not predefined, but is preferably symmetrical, then asymmetrical, then symmetrical, or vice versa.

The depth of the cascading is not predefined.

The invention is not limited to the precise details described above and shows in the drawings. Modifications may be made and other embodiments developed without departing from the scope of the invention are set out in the claim.