Security control in a communication system

• US 20080072034A1
• Filed: 04/17/2007
• Published: 03/20/2008
• Est. Priority Date: 04/18/2006
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Nortel Networks Limited (Nortel Networks Corporation)
• Inventors: Lescuyer, Pierre, Lucidarme, Thierry
• Granted Patent: US 8,825,998 B2
• Time in Patent Office: Days
• US Class Current: 713/153
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04W 12/00 Security arrangements; Authentication; Protecting privacy or anonymity
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles

Abstract

The invention relates to a method of controlling security in a communication system comprising at least one node (1,1′,A-D) capable of routing traffic according to a plurality of security algorithms (9,9′) with respective security levels. The method comprises an estimation of at least one safety degree relating to said node, a selection of at least one security algorithm of said plurality, depending on said estimated safety degree, and an activation of said at least one security algorithm.

Claims

1. Method of controlling security in a communication system comprising at least one node (1,1′

,A-D) capable of routing traffic according to a plurality of security algorithms (9,9′

) with respective security levels, the method comprising the following steps;

estimating at least one safety degree relating to said node;

selecting at least one security algorithm of said plurality, depending on said estimated safety degree; and

activating said at least one security algorithm.

2. Method as claimed in claim 1, wherein the security algorithm selection is such that at least one security algorithm with a relatively low security level is selected when said estimated safety degree is relatively high and at least one security algorithm with a relatively high security level is selected when said estimated safety degree is relatively low.

3. Method as claimed in claim 1 or 2, wherein the security algorithms of said plurality comprise at least ones of authentication, ciphering and integrity algorithms.

4. Method as claimed in any one of the foregoing claims, wherein the estimated safety degree takes account of a type of location in which said node is placed.

5. Method as claimed in any one of the foregoing claims, wherein the estimated safety degree takes account of a number of security attacks said node had to face in a previous time period.

6. Method as claimed in any one of the foregoing claims, wherein the estimated safety degree takes account of a type of security attacks said node had to face in a previous time period.

7. Method as claimed in any one of the foregoing claims, wherein the estimated safety degree takes account of subscription or equipment characteristics at least part of the traffic to be routed by said node relates to.

8. Method as claimed in any one of the foregoing claims, wherein the traffic to be routed by said node comprises several flows and wherein a safety degree is estimated for each flow respectively.

9. Method as claimed in any one of the foregoing claims, wherein the node is at least partially disabled when said estimated safety degree is below a predetermined value.

10. Method as claimed in any one of the foregoing claims, wherein said node is whole or part of an Ambient network.

11. Method as claimed in any one of the foregoing claims, wherein said node comprises a mobile device.

12. Method as claimed in any one of the foregoing claims, wherein the communication system comprises a plurality of nodes (1,1′

,A-D), each node being connected to at least another node of said plurality, and wherein the estimated safety degree relating to each node takes account of a safety degree relating to at least another node of said plurality.

13. Method as claimed in claim 12, wherein each node sends to at least another node of said plurality its related estimated safety degree.

14. Method as claimed in claim 12 or 13, wherein when one node of said plurality detects a change in its related estimated safety degree, it informs at least another node of said plurality accordingly.

30. Computer program product comprising code instructions for carrying out the method as claimed in any one of claims 1 to 14, when loaded and executed in at least one node (1,1′

,A-D) of a communication system.

15. Node (1,1′

,A-D) capable of routing traffic in a communication system according to a plurality of security algorithms (9,9′

) with respective security levels, the node comprising;

an estimation module (6,6′

) for estimating at least one safety degree relating to said node;

a selection module (7,7′

) for selecting at least one security algorithm of said plurality, depending on said safety degree estimated by the estimation module; and

an activation module (8,8′

) for activating said at least one security algorithm selected by the selection module.

16. Node as claimed in claim 15, wherein the selection module (6,6′

) is arranged for selecting at least one security algorithm with a relatively low security level when said estimated safety degree is relatively high and for selecting at least one security algorithm with a relatively high security level when said estimated safety degree is relatively low.

17. Node as claimed in claim 15 or 16, wherein the security algorithms of said plurality comprise at least ones of authentication, ciphering and integrity algorithms.

18. Node as claimed in any one of claims 15 to 17, wherein the estimation module (6,6′

) takes account of a type of location in which said node is placed.

19. Node as claimed in any one of claims 15 to 18, wherein the estimation module (6,6′

) takes account of a number of security attacks said node had to face in a previous time period.

20. Node as claimed in any one of claims 15 to 18, wherein the estimation module (6,6′

) takes account of a type of security attacks said node had to face in a previous time period.

21. Node as claimed in any one of claims 15 to 20, wherein the estimation module (6,6′

) takes account of subscription or equipment characteristics at least part of the traffic to be routed by said node relates to.

22. Node as claimed in any one of claims 15 to 21, wherein the traffic to be routed by said node comprises several flows and wherein the estimation module (6,6′

) is arranged for estimating a safety degree for each flow respectively.

23. Node as claimed in any one of claims 15 to 22, comprising means for at least partially disabling said node when said estimated safety degree is below a predetermined value.

24. Node as claimed in any one of claims 15 to 23, being whole or part of an Ambient network.

25. Node as claimed in any one of claims 15 to 24, comprising a mobile device.

26. Node as claimed in any one of claims 15 to 25, wherein the node is arranged for being connected to at least another node of the communication system, and wherein the estimation module is arranged for estimating said safety degree by taking account of a safety degree relating to at least said other node.

27. Node as claimed in claim 26, comprising a sending module for sending to at least another node of the communication system its related estimated safety degree.

28. Node as claimed in claim 26 or 27, comprising means for detecting a change in its related estimated safety degree and means for informing at least another node of the communication system accordingly.

29. Communication system comprising a plurality of nodes (1,1′

,A-D) as claimed in any one of claims 15 to 28, each node being connected to at least another node of said plurality.