Method and apparatus for providing an adaptable security level in an electronic communication

• US 10,097,559 B2
• Filed: 05/15/2017
• Issued: 10/09/2018
• Est. Priority Date: 04/13/2006
• Status: Active Grant

• Current Assignee: Blackberry Limited
• Original Assignee: Certicom Corporation (Blackberry Limited)
• Inventors: Struik, Marinus
• Primary Examiner(s): PYZOCHA, MICHAEL J
• Application Number:
  US15/595,542
• Publication Number:
  US 20170310681A1
• Time in Patent Office: 512 Days
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method of communicating in a secure communication system, comprises the steps of assembling a message at a sender, then determining a frame type, and including an indication of the frame type in a header of the message. The message is then sent to a recipient and the frame type used to perform a policy check.

Claims

1. A method of communicating between a first correspondent and a second correspondent in a data communication system comprising:

assembling a data stream at said first correspondent, said data stream having at least one frame, said frame having a header and data;

determining, by the first correspondent, a security level for said frame;

incorporating, by the first correspondent, in said header, an indication of a frame type and an indication of said security level; and

forwarding, by the first correspondent, said frame to said second correspondent, wherein said frame type is associated with a policy, and said policy indicates a minimum security level for said frame type, said frame being acceptable by said second correspondent if said security level meets the minimum security level and said frame being not acceptable by said second correspondent if said security level does not meet the minimum security level.

2. The method according to claim 1 further comprising said second correspondent:

receiving said frame;

determining said frame type from said header; and

correlating said frame type to said policy to determine if said frame is acceptable for at least one attribute of said frame.

3. The method according to claim 2 further comprising said second correspondent accepting said frame if said policy is met, and rejecting said frame if said policy is not met.

4. The method according to claim 2 wherein said header includes a representation of a key and said policy indicates an acceptable frame type for said key.

5. The method according to claim 2 wherein said policy indicates frame types vulnerable to an attack where one or more combinations of security features of said frame are present, said method comprising said second correspondent rejecting said frame if one of said one or more combinations is found.

6. The method according to claim 2 wherein said indication of said security level includes one or more security bits indicative of said security level, and said method comprises said second correspondent extracting said security bits to determine said security level.

7. The method according to claim 2 wherein said policy comprises a look up table correlating said frame type to said at least one attribute.

8. The method according to claim 1 wherein said frame further comprises a footer comprising one or more bits representing an error code.

9. The method according to claim 1 wherein said header comprises a key identifier, a representation of a key corresponding to said key identifier, and an originator for determining an acceptability of said frame type.

10. A method of verifying a communication between a first correspondent and a second correspondent in a data communication system comprising said second correspondent:

receiving, at said second correspondent and from said first correspondent, a frame having a header and data, said header including an indication of a frame type and an indication of a security level;

determining, by said second correspondent, said frame type from said header;

correlating, by said second correspondent, said frame type to a policy, wherein the policy indicates a minimum security level for said frame type; and

determining, by said second correspondent and based on said policy, whether to accept said frame type according to whether said security level meets the minimum security level.

11. The method according to claim 10 further comprising accepting said frame if said policy is met, and rejecting said frame if said policy is not met.

12. The method according to claim 10 wherein said header includes a representation of a key and said policy indicates an acceptable frame type for said key.

13. The method according to claim 10, wherein said indication of said security level includes one or more security bits indicative of said security level, and the method further comprises extracting said security bits to determine said security level.

14. The method according to claim 10, wherein said frame further comprises a footer comprising one or more bits representing an error code.

15. The method according to claim 10, wherein said header comprises a key identifier, a representation of a key corresponding to said key identifier, and an originator for determining an acceptability of said frame type.