Network-implemented method using client's geographic location to determine protection suite

• US 20080155645A1
• Filed: 12/22/2006
• Published: 06/26/2008
• Est. Priority Date: 12/22/2006
• Status: Abandoned Application

• Current Assignee: AT&T Properties, LLC (AT&T, Inc.)
• Original Assignee: AT&T Properties, LLC (AT&T, Inc.)
• Inventors: Hutnik, Stephen M., Peri, James G., Satterlee, Michael J.
• Application Number:
  US11/644,756
• Publication Number:
  US 20080155645A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 69/24 Negotiation of communication capabilities

Abstract

A server is adapted to communicate with client devices using a selected one of a plurality of alternative protection suites. The server receives from a terminal device information that identifies an offered list of protection suites supported by the terminal device. A particular one of the protection suites that is supported by both the server and the terminal device is selected by the server in a deterministic way. If use of a particular protection suite is prohibited by law in the geographical region where the terminal device is located, the server selects a different matching protection suite in substitution for the protection suite that it otherwise would have selected. The server identifies the selected protection suite to the terminal device and thereafter communicates with the terminal device based on the parameter values in the protection suite.

Claims

1. A method for use by a first entity adapted to communicate with other entities using a selected one of a plurality of supported values of at least one parameter that controls at least one aspect of the communication, the method comprising,

receiving an Offer from a second entity that contains offered values for the parameter, and

transmitting a Proposal to the second entity that identifies as the selected value one of the offered values that is also one of the supported values,

the selected value being a) a particular one of the offered and supported values as long as communications with the second entity using that particular value would be permissible at the second entity'"'"'s location and b) a different one of the offered and supported values otherwise.

2. The method of claim 1 wherein the at least one parameter is a security parameter.

3. The method of claim 2 wherein the security parameter is an encryption algorithm.

4. The method of claim 3 wherein values of the security parameter are identifiers of respective encryption algorithms.

5. The method of claim 1 wherein said different one of the offered and supported values is such that communications with the second entity would not be impermissible at the second entity'"'"'s location as a result of said selected value being said different one of the offered and supported values.

6. The method of claim 1 wherein said first entity is a network server and said second entity is a client of the server.

7. The method of claim 1 wherein said first entity is a virtual private network gateway, said second entity is a client of said virtual private network, and communications between said gateway and said client traverse a public network.

8. The method of claim 7 wherein said public network is the Internet.

9. The method of claim 1 wherein said receiving an Offer and said transmitting a Proposal conform to at least one IPSec protocol.

10. The method of claim 1 wherein said impermissible communications are communications that would violate any legal restriction wherein the second entity is located.

11. The method of claim 1 wherein

said supported values have an order of preference,

said particular one of the offered and supported values is selected based on said order of preference, and

said different one of the offered and supported values is lower in said order of preference than said particular one of the offered and supported values.

19. The method of claim 1 wherein

said preferred one of the offered and server-supported suites is the one of the offered suites that is highest in said order of preference and said different one of the offered and server-supported suites is lower in said order of preference than said preferred suite.

12. A method for use by a server adapted to communicate with clients in a manner defined at least in part by a selected one of a plurality of suites each comprising one or more server-supported values of respective parameters, the method comprising,

receiving an Offer from a client that contains two or more offered suites of values for the parameters, and

transmitting a Proposal to the client that identifies as the selected suite one of the offered suites that is also one of the suites of server-supported values,

the selected suite being a preferred one of the offered and server-supported suites determined based on an order of preference of the server-supported suites except when use of said preferred suite would cause communications with the client to violate one or more legal restrictions, in which case the selected suite is a different one of the offered and server-supported suites whose use would not cause communications with the client to violate said one or more legal restrictions.

13. The method of claim 12 wherein at least one of the parameters is a security parameter.

14. The method of claim 13 wherein the security parameter is an encryption algorithm.

15. The method of claim 14 wherein each value of said one of the parameters is an identifier of a respective different encryption algorithm.

16. The method of claim 12 wherein said server is a virtual private network gateway, and communications between said gateway and said client traverse a public network.

17. The method of claim 16 wherein said public network is the Internet.

18. The method of claim 16 wherein said receiving an Offer and said transmitting a Proposal conform to at least one IPSec protocol.