Secure end-to-end transport through intermediary nodes

• US 10,135,771 B2
• Filed: 06/30/2017
• Issued: 11/20/2018
• Est. Priority Date: 01/08/2002
• Status: Expired due to Term

• Current Assignee: Seven Networks LLC (SoftBank Group Corp.)
• Original Assignee: Seven Networks LLC (SoftBank Group Corp.)
• Inventors: Boynton, Lee R., Fiatal, Trevor A., Burke, Scott M., Sikes, Mark
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US15/639,014
• Publication Number:
  US 20170302636A1
• Time in Patent Office: 508 Days
• CPC Class Codes: H04B 7/04 using two or more spaced independent antennas
• CPC Class Codes: H04B 7/0417 Feedback systems
• CPC Class Codes: H04B 7/0617 for beam forming
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 51/58 Message adaptation for wireless communication
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 4/12 : Messaging; Mailboxes; Announcements
• CPC Class Codes: H04W 52/0261 : managing power supply demand, e.g. depending on battery level
• CPC Class Codes: H04W 76/10 : Connection setup
• CPC Class Codes: H04W 88/06 : adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals
• CPC Class Codes: Y02D 10/00 : Energy efficient computing, e.g. low power processors, power management or thermal management
• CPC Class Codes: Y02D 30/70 : in wireless communication networks

Abstract

A communication network encrypts a first portion of a transaction associated with point-to-point communications using a point-to-point encryption key. A second portion of the transaction associated with end-to-end communications is encrypted using an end-to-end encryption key.

Claims

1. A non-transitory computer-readable storage medium storing instructions to be implemented by a first computer having a processor, wherein the instructions, when executed by the processor, cause the first computer to perform steps comprising:

receiving a token issued by an intermediary server; and

transmitting a transaction message comprising payload data to the intermediary server, wherein the payload data is transmitted to a second computer by the intermediary server based on the token and the intermediary server is coupled to the second computer over a mobile network.

2. The non-transitory computer-readable storage medium of claim 1, wherein the payload data has a security association that is not known to the intermediary server.

3. The non-transitory computer-readable storage medium of claim 2, wherein the transaction message further comprises control data having a security association.

4. The non-transitory computer-readable storage medium of claim 3, wherein the control data comprises the token.

5. The non-transitory computer-readable storage medium of claim 4, wherein the intermediary server identifies and authenticates the transaction message based on the token.

6. The non-transitory computer-readable storage medium of claim 5, wherein the token provides transaction routing information to the intermediary server.

7. The non-transitory computer-readable storage medium of claim 1, wherein the token is issued in response to a registration of a user to the intermediary server.

8. The non-transitory computer-readable storage medium of claim 7, wherein the registration comprises authenticating a received username and password by the intermediary server to a user database.

9. The non-transitory computer-readable storage medium of claim 1, wherein mobile network provides an Internet protocol (IP) infrastructure of a wireless service provider.

10. The non-transitory computer-readable storage medium of claim 1, wherein the transaction message further comprises control data having a security association.

11. The non-transitory computer-readable storage medium of claim 10, wherein the control data comprises the token.

12. The non-transitory computer-readable storage medium of claim 11, wherein the intermediary server identifies and authenticates the transaction message based on the token.

13. The non-transitory computer-readable storage medium of claim 12, wherein the token provides transaction routing information to the intermediary server.

14. A method implemented on a first computer, the method comprising:

receiving a token issued by an intermediary server; and

transmitting a transaction message comprising payload data to the intermediary server, wherein the payload data is transmitted to a second computer by the intermediary server based on the token and the intermediary server is coupled to the second computer over a mobile network.

15. The method of claim 14, wherein the payload data has a security association that is not known to the intermediary server.

16. The method of claim 15, wherein the transaction message further comprises control data having a security association.

17. The method of claim 16, wherein the control data comprises the token.

18. The method of claim 17, wherein the intermediary server identifies and authenticates the transaction message based on the token.

19. The method of claim 18, wherein the token provides transaction routing information to the intermediary server.

20. The method of claim 14, wherein the token is issued in response to a registration of a user to the intermediary server.

21. The method of claim 20, wherein the registration comprises authenticating a received username and password by the intermediary server to a user database.

22. The method of claim 14, wherein the transaction message further comprises control data having a security association.

23. The method of claim 22, wherein the control data comprises the token.

24. The method of claim 23, wherein the intermediary server identifies and authenticates the transaction message based on the token.

25. The method of claim 24, wherein the token provides transaction routing information to the intermediary server.

26. A first computer having a processor configured for:

receiving a token issued by an intermediary server; and

transmitting a transaction message comprising payload data to the intermediary server, wherein the payload data is transmitted to a second computer by the intermediary server based on the token and the intermediary server is coupled to the second computer over a mobile network.

27. The first computer of claim 26, wherein the transaction message further comprises control data having a security association.

28. The first computer of claim 27, wherein the control data comprises the token.

29. The first computer of claim 28, wherein the intermediary server identifies and authenticates the transaction message based on the token.

30. The first computer of claim 29, wherein the token provides transaction routing information to the intermediary server.