Method and system for providing security in proximity and Ad-Hoc networks

• US 20050239438A1
• Filed: 09/09/2004
• Published: 10/27/2005
• Est. Priority Date: 04/27/2004
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Naghian, Siamak
• Granted Patent: US 7,907,934 B2
• Time in Patent Office: Days
• US Class Current: 455/410
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/61 Time-dependent
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles
• CPC Class Codes: H04W 28/18 Negotiating wireless communication parameters
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A method, system, and node provides security in a network such as a mobile proximity network and a mobile Ad-Hoc network. The security is provided by setting at least one of security parameters for a connection of a node to another node of the network. At least one context-awareness parameter is checked, and at least one of the security parameters is set depending on the result of the check of the at least one context-awareness parameter.

Claims

1. A method for providing security in a network which comprises at least one node, the method comprising:

setting at least one of a plurality of security parameters for a connection of a node to another node of the network, wherein at least one context-awareness parameter is checked, and at least one of the plurality of security parameters is set depending on a result of the check of the at least one context-awareness parameter.

2. A method according to claim 1, wherein the at least one node comprises a mobile node.

3. A method according to claim 1, wherein the network comprises at least one of a mobile proximity network and a mobile Ad-Hoc network.

4. A method according to claim 1, further comprising providing a number of security classes, each having their security provisions, and the result of the check of the at least one context-awareness parameter indicates one of the security classes.

5. A method according to claim 1, wherein the at least one context-awareness parameter comprises at least one of type of context, actual sender/receiver/user group, time-dependent context, location information, and communications mode.

6. A method according to claim 1, further comprising defining the plurality of security parameters with at least one of accessibility, integrity, and confidentiality of proximity and ad hoc applications.

7. A method according to claim 1, further comprising setting the at least one context-awareness parameter by a user which defines a set of applications to be accepted or supported by said user and security degrees to be used for the set of applications.

8. A method according to claim 1, further comprising configuring security classes and related security procedures to the system and/or to the at least one node.

9. A method according to claim 1, further comprising establishing a signaling connection between an overlay network and the node, wherein said signaling connection is used for delivery of context information to the node when the node starts interacting with the overlay network.

10. A method according to claim 1, further comprising performing a mapping between context, represented by the at least context-awareness parameter, and the at least one security parameter by the network, and results of the mapping are sent to the node via a signaling connection.

11. A method for providing security in a network which comprises at least one node, the method comprising:

setting at least one of a plurality of security parameters for a connection of a node to another node of the network, wherein at least one context-awareness parameter is checked, and at least one of the plurality of security parameters is set depending on a result of the check of the at least one context-awareness parameter,

wherein a connection is established between a first and a second node of an ad-hoc network via a direct radio link, wherein when the first node requests a service from the second node, the second node checks required security based on a context of the service, starts negotiating with the first node about establishing the required security, and provides the service to the first node after establishment of the required security.

12. A method according to claim 11, further comprising checking, with the second node, history data related to the originating first node, and

deciding on providing or not providing the requested service dependent on the history data.

13. A system for providing security in a network, the system comprising:

a node, wherein security is provided by setting at least one of a plurality of security parameters for a connection of the node to another node of a network,

wherein the node or another element is configured to check at least one context-awareness parameter, and to set at least one of the plurality of security parameters depending on a result of the check of the at least one context-awareness parameter.

14. A system according to claim 13, wherein the at least one node comprises a mobile node.

15. A system according to claim 13, wherein the network comprises at least one of a mobile proximity network and a mobile Ad-Hoc network.

16. A system according to claim 13, wherein a number of security classes is provided, each having their security provisions, and the result of the check of the at least one context-awareness parameter indicates one of the plurality of security classes.

17. A system according to claim 13, wherein the at least one context-awareness parameter comprises at least one of type of context, actual sender/receiver/user group, time-dependent context, location information, and communications mode.

18. A system according to claim 13, wherein the security parameters define at least one of accessibility, integrity, and confidentiality of proximity and ad hoc applications.

19. A system according to claim 13, wherein a setting means operable by a user is provided for setting the at least one context-awareness parameter by the user which the at least one context-awareness parameter defines a set of applications to be accepted or supported by the user and security provisions to be used for the set of applications.

20. A system according to claim 13, wherein security classes and related security procedures are configured to the system or to the node.

21. A system according to claim 13, wherein the system is configured to establish a signaling connection between an overlay network and the node, wherein the signaling connection provides for delivery of context information to the node when the node starts interacting with the overlay network.

22. A system according to claim 13, wherein the network performs a mapping between a context, represented by the at least context-awareness parameter, and the at least one security parameter, and to send results of the mapping to the node via the signaling connection.

23. A system for providing security in a network, the system comprising:

a node, wherein security is provided by setting at least one of a plurality of security parameters for connection of the node to another node of a network,

wherein the node or another element is configured to check at least one context-awareness parameter, and to set at least one of the plurality of security parameters depending on a result of the check of the at least one context-awareness parameter; and

an ad-hoc network including a first and a second mobile node wherein the first and second mobile nodes are configured

to establish a connection via a direct radio link,

wherein the first node requests a service from the second node, the second node is configured to check a required security based on a context of the service,

to start negotiating with the first node about establishing the required security, and

to provide the service to the first node after establishment of the required security.

24. A system according to claim 23, wherein the second node is configured to check history data related to the first node, and to decide on providing or not providing the requested service dependent on the history data.

25. A node connectable to another node of a network, the node comprising:

means for setting at least one of a plurality of security parameters for a connection of the node to the another node of the network;

wherein the node is configured

to check at least one context-awareness parameter; and

to set at least one of the plurality of security parameters depending on a result of the check of the at least one context-awareness parameter.

26. A node according to claim 25, wherein the node comprises a mobile node.

27. A node according to claim 25, wherein the node includes a user interface allowing a user to start a request, enter parameter options or select functional options supported by the node.

28. A node according to claim 25, wherein the node includes a subscriber identity module (SIM) which is used as a security basis for establishing security transactions within a mobile network.

29. A node according to claim 25, wherein the node includes a control unit, which is connected to interfaces of the node, wherein the interfaces include interfaces for proximity and ad-hoc networks, and interfaces for network infrastructure.

30. A node according to claim 29, wherein the node includes a card reader into which a card is inserted, and

a memory unit,

the card reader and the memory unit connected to the control unit so that the control unit is able to read and write data from or into the card and from or into the memory unit.

31. A node according to claim 30, wherein the memory unit includes a secured memory area storing information about security aspects of other nodes of a mobile network, the secured memory area including at least one of the following information:

authentication data related to the node,

ad-hoc level identities of the node,

security keys used by the node, and

a distance to the node measured as a number of hops between the node and a trunk node.

32. A node according to claim 25, which is configured to establish a connection to another node via a direct radio link, wherein when the another node requests a service from the node, the node is configured to check a required security based on a context of the service, to start negotiating with the another node about establishing the required security, and to provide the service to the another node after establishment of the required security.

33. A node according to claim 32, wherein the node is configured to check history data related to the another node, and to decide on providing or not providing the service dependent on the history data.