METHOD AND APPARATUS FOR PROVIDING AN ADAPTABLE SECURITY LEVEL IN AN ELECTRONIC COMMUNICATION

• US 20070255954A1
• Filed: 04/13/2007
• Published: 11/01/2007
• Est. Priority Date: 04/13/2006
• Status: Active Grant

• Current Assignee: Blackberry Limited
• Original Assignee: Certicom Corporation (Blackberry Limited)
• Inventors: Struik, Marinus
• Granted Patent: US 8,688,978 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method of communicating in a secure communication system, comprises the steps of assembling a message at a sender, then determining a frame type, and including an indication of the frame type in a header of the message. The message is then sent to a recipient and the frame type used to perform a policy check.

Claims

1. A method of communicating between a first correspondent and a second correspondent in a data communication system comprising:

assembling a data stream at said first correspondent, said data stream having at least one frame, said frame having a header and data;

incorporating in said header;

an indication of a frame type; and

forwarding said frame to said second correspondent to enable said second correspondent to determine the acceptability of said frame according to said frame type.

2. The method according to claim 1 further comprising said second correspondent:

receiving said frame;

determining said frame type from said header; and

correlating said frame type to a policy to determine if said frame type is acceptable for at least one attribute of said frame.

3. The method according to claim 2 further comprising accepting said frame is said policy is met, and rejecting said frame otherwise.

4. The method according to claim 2 wherein said header includes a representation of a key and said policy indicates an acceptable frame type for said key.

5. The method according to claim 2 wherein said header includes an indication of a security level and said policy indicates an acceptable frame type for said security level.

6. The method according to claim 2 wherein said policy indicates frame types vulnerable to an attack where one or more combinations of security features of said frame are present, said method comprising rejecting said frame if one of said combinations is found.

7. The method according to claim 1 comprising preparing said frame by selecting a security level and incorporating one or more security bits into said frame indicative of said security level.

8. The method according to claim 7 comprising any one or both of encrypting said data and signing said data according to said security level.

9. The method according to claim 7 wherein said security level is a minimum acceptable security level and said minimum acceptable security level is independent of said data.

10. The method according to claim 7 wherein said security level is a minimum acceptable security level and said minimum acceptable security level is dependent on said data.

11. The method according to claim 7 wherein said security level is a minimum acceptable security level and said minimum acceptable security level is partially data dependent such that said minimum acceptable security level differs according to said frame type.

12. The method according to claim 2 wherein said flame includes one or more security bits indicative of a security level, and said method comprises said second correspondent extracting said security bits to determine said security level wherein said policy indicates whether or not said frame type is acceptable for said security level.

13. The method according to claim 10 wherein said data is any one or both of encrypted and signed, said method comprising said second correspondent decrypting said data and/or authenticating said data according to said security bits.

14. The method according to claim 2 wherein said policy comprises a look up table correlating said frame type to said at least one attribute.

15. The method according to claim 1 wherein said frame further comprises a footer comprising one or more bits representing, an error code.

16. The method according to claim 1 wherein said header comprises a key identifier, a representation of a key corresponding to said key identifier, a security level, and an originator for determining the acceptability of said frame type.

17. A method of verifying a communication between a first correspondent and a second correspondent in a data communication system comprising said second correspondent:

receiving from said first correspondent, a frame having a header and data, said header including, an indication of a frame type;

determining said frame type from said header; and

correlating said frame type to a policy to determine if said frame type is acceptable for at least one attribute of said frame.

18. The method according to claim 17 further comprising accepting said frame is said policy is met, and rejecting said frame otherwise.

19. The method according to claim 17 wherein said Leader includes a representation of a key and said policy indicates an acceptable frame type for said key.

20. The method according to claim 17 wherein said header includes an indication of a security level and said policy indicates an acceptable frame type for said security level.

21. The method according to claim 17 wherein said policy indicates frame types vulnerable to an attack where one or more combinations of security features of said frame are present, said method comprising rejecting said frame if one of said combinations is found.

22. The method according to claim 20 wherein said security level is a minimum acceptable security level and said minimum acceptable security level is independent of said data.

23. The method according to claim 20 wherein said security level is a minimum acceptable security level and said minimum acceptable security level is dependent on said data.

24. The method according to claim 20 wherein said security level is a minimum acceptable security level and said minimum acceptable security level is partially data dependent such that said minimum acceptable security level differs according to said frame type.

25. The method according to claim 17 wherein said frame includes one or more security bits indicative of a security level, and said method comprises said second correspondent extracting said security bits to determine said security level wherein said policy indicates whether or not said frame type is acceptable for said security level.

26. The method according to claim 25 wherein said data is any one or both of encrypted and signed, said method comprising said second correspondent decrypting said data and/or authenticating said data according to said security bits.

27. The method according to claim 17 wherein said policy comprises a look up table correlating said frame type to said at least one attribute.

28. A method of communicating between a pair of correspondents in a data communication system comprising exempting one of said pair of correspondents from security rules associated with said communication system to enable said one correspondent to initialize communication with the other of said correspondents.

29. The method according to claim 28 wherein said other correspondent includes an indication of the status of said one correspondent and if said status indicates that said one correspondent is exempt from said security rules, enabling said one correspondent to begin a communication, and requiring, an initialization thereafter whereby subsequent to initialization said status is altered to indicate that said one correspondent is subject to said security rules.

30. The method according to claim 28 wherein said data communication system is a network, said other correspondent being a central correspondent responsible for controlling access to said network.