Method and apparatus for reducing bandwidth usage in secure transactions

• US 20060209789A1
• Filed: 03/04/2005
• Published: 09/21/2006
• Est. Priority Date: 03/04/2005
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Wander, Arvinderpal S., Gura, Nils, Gupta, Vipul
• Granted Patent: US 8,533,473 B2
• Time in Patent Office: Days
• US Class Current: 370/352
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 69/04 Protocols for data compression, e.g. ROHC
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 24/00 Supervisory, monitoring or testing arrangements
• CPC Class Codes: H04W 28/06 Optimizing the usage of the radio link, e.g. header compression, information sizing , discarding information system modifying transmission characteristic according to link quality by modifying frame length H04L1/0007; dynamic adaptation of the packet size for flow control or congestion control H04L47/365
• CPC Class Codes: H04W 76/10 Connection setup
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks
• CPC Class Codes: H04W 88/16 Gateway arrangements

Abstract

A secure end to end connection is established between a remote device having a wireless link and a control/monitoring location for the remote device through a gateway. During the establishing of the secure connection, a compressed message representation is used to communicate between the gateway and the remote device over the wireless link and an uncompressed message representation is used to communicate between the gateway and the first location. The establishment of the secure connection utilizes public-key algorithms.

Claims

1. A method for establishing a secure connection between a first location and a remote device, comprising utilizing a compressed message representation to communicate between a gateway and the remote device over a wireless link and an uncompressed message representation to communicate between the gateway and the first location during the establishing of the secure connection.

2. The method as recited in claim 1 wherein the wireless link between the gateway and the remote device comprises a multihop wireless link in which at least one additional remote device is coupled between the gateway and the remote device.

3. The method as recited in claim 1 further comprising:

utilizing a first network communication protocol between the first location and the gateway;

utilizing a second network communication protocol between the gateway system and the remote device.

4. The method as recited in claim 1 wherein establishing the secure connection comprises key establishment utilizing a public-key algorithm.

5. The method as recited in claim 4 wherein establishing the secure connection comprises key establishment utilizing one of Secure Sockets Layer (SSL) protocol and Internet Key Exchange.

6. The method as recited in claim 1 the first network communication protocol is a transfer control protocol (TCP).

7. The method as recited in claim 4 wherein establishing the secure connection utilizes one of RSA, elliptic curve cryptography (ECC), and Diffie-Hellman for key exchange.

8. The method as recited in claim 1 wherein certificate information is exchanged between the remote device and the gateway prior to utilizing a compressed message representation for establishing the secure connection.

9. The method as recited in claim 1 wherein the gateway utilizes compressed message representation with one or more remote devices and non-compressed message representation with one or more remote devices according to whether respective remote devices support compressed message representation.

10. The method as recited in claim 1 wherein the gateway receives a communication from one or more remote devices indicating whether respective remote devices support compressed message representation.

11. The method as recited in claim 1 wherein at least two gateways are communicatively coupled to the remote device and one of the gateways is utilized when the other gateway fails.

12. The method as recited in claim 1 further comprising sending control information to the remote device over the established secure connection from the first location to control a function associated with the remote device.

13. The method as recited in claim 1 wherein establishing the secure connection includes mutual authentication using certificates.

14. The method as recited in claim 1 wherein utilizing the compressed message representation comprises reducing information transmitted between the gateway and the remote device by removing fixed parts of an uncompressed message, and inserting a message identifier to identify at least one message template corresponding to the fixed parts of the uncompressed message.

15. The method as recited in claim 1 wherein utilizing the compressed message representation comprises reducing information transmitted between the gateway and the remote device by removing information from an uncompressed message that is implicitly known or derivable by a receiver of the compressed message.

16. The method as recited in claim 14 further comprising acquiring message data to populate a message template at the gateway by observation of uncompressed messages between the remote device and the first location used to establish secure communication.

17. The method as recited in claim 14 wherein template data is sent to the gateway by the remote device to establish the message template at the gateway as part communication between the gateway and the remote device independent of the communication between the remote device and the first location.

18. The method as recited in claim 14 further comprising after receiving a message having a compressed message representation, recreating the uncompressed message for transmission to the first location.

19. The method as recited in claim 14 wherein utilizing the compressed message representation comprises replacing a certificate with a certificate identifier.

20. The method as recited in claim 19 wherein the certificate identifier is a cryptographic hash of the certificate or a portion of the cryptographic hash.

21. The method as recited in claim 1 further comprising the gateway storing one or more certificates corresponding to one or more certificate identifiers.

22. The method as recited in claim 1 wherein the gateway communicates with a plurality of remote devices.

23. The method as recited in claim 1 wherein the remote device includes a sensor and information transmitted securely includes information detected by the sensor.

28. The system as recited in claim 24 as recited in claim 1 further comprising a plurality of remote devices communicatively coupled to the gateway over one or more wireless links and capable of secure communication with the first location utilizing a public-key algorithm for key establishment.

29. The system as recited in claim 28 where at least one of the remote devices communicates with the gateway over a multi-hop wireless link through at least one other of the remote devices.

24. A system for secure communication between a remote device and a first location, comprising:

a gateway coupled to send and receive messages over a wireless interface and a second interface, and wherein the gateway is configured to utilize a compressed message representation for messages sent and received over the wireless interface and an uncompressed message representation for messages sent and received over the second interface, and wherein the compressed message representation is utilized during establishment of the secure communication between the remote device and the first location.

25. The system as recited in claim 24 further comprising the remote device communicatively coupled to the gateway via the wireless interface and capable of sending and receiving wireless messages associated with establishment of a secure communication link using the compressed message representation.

26. The system as recited in claim 24 further comprising a controller for the remote device communicatively coupled to the remote device through the gateway, the gateway communicating with the controller through the second interface.

27. The system as recited in claim 24 wherein the gateway further comprises a suppressor module responsive to receipt of a message on the second interface from the first location, the message received as part of establishment of secure communication between the first location and the remote device coupled to the wireless interface, the suppressor module operable to remove fixed information from the received message to create a compressed message representation of the received message and wherein the gateway is operable to forward the received message in compressed message representation to the remote device via the wireless interface.

30. The system as recited in claim 27 wherein the suppressor module is configured to insert a message identifier to identify at least one message template corresponding to the fixed information removed from the message to create the compressed message representation.

31. The system as recited in claim 27 wherein the gateway further comprises a data recreator module to insert message data previously removed at the remote device to recreate an uncompressed message for transmission from the gateway to the first location.

32. The system as recited in claim 27 wherein the remote device comprises a data suppressor module, responsive to create one or more compressed messages for transmission to the wireless interface during establishment of secure communications with the first location.

33. The system as recited in claim 30 wherein the gateway further includes templates storing message data corresponding to the fixed information.

34. The system as recited in claim 30 wherein length information is removed from the message in creation of the compressed message format.

35. The system as recited in claim 24 further comprising the gateway storing one or more certificates corresponding to one or more certificate identifiers.

36. A device comprising:

a wireless interface;

a processing element; and

wherein during establishment of end to end secure communication with a monitoring device, the device is operable using the processing element to utilize a compressed message representation for messages sent and received over the wireless interface.

37. The device as recited in claim 36 further comprising a suppressor module operable to remove fixed information from an uncompressed message, to create a compressed message representation of the uncompressed message, the uncompressed message being used in establishing the end to end secure communication.

38. The device as recited in claim 37 wherein the suppressor module is configured to insert a message identifier to identify at least one message template corresponding to the fixed information removed from the message to create the compressed message representation.

39. The device as recited in claim 37 wherein the device further comprises a data recreator module to insert message data previously removed to recreate an uncompressed message for use by the device.

40. The device as recited in claim 37 wherein the device is an embedded device with limited computational resources.

41. The device as recited in claim 37 wherein the device is a low power device.