SECURITY BASED NETWORK ACCESS SELECTION

• US 20090007246A1
• Filed: 06/28/2007
• Published: 01/01/2009
• Est. Priority Date: 06/28/2007
• Status: Active Grant

• Current Assignee: Motorola Solutions, Inc.
• Original Assignee: Motorola, Inc. (Motorola Solutions, Inc.)
• Inventors: Gutowski, Gerald J., Benes, Stanley J.
• Granted Patent: US 9,325,737 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method and wireless device select a set of secure network connections (230) between a wireless device (108) in a wireless communication system and a target destination system (238). A first security assessment (708) associated with each of a plurality of base station connections associated with respective each of a plurality of base stations (116) available for wireless communications with the wireless device (108) is performed. A second security assessment (716) associated with each of a plurality of subsequent network connections available between the plurality of base stations (116) and a target destination system (238) is performed. A set of base station connections from the plurality of base station connections are prioritized according to predetermined security criteria associated with the wireless device (108). A set of subsequent network connections from the plurality of subsequent network connections (230) are prioritized according to predetermined security criteria associated with the wireless device (108).

Claims

1. A method of selecting a set of secure network connections between a wireless device in a wireless communication system and a target destination system, the method comprising:

performing a first security assessment associated with each of a plurality of base station connections associated with respective each of a plurality of base stations available for wireless communications with the wireless device;

performing a second security assessment associated with each of a plurality of subsequent network connections available between the plurality of base stations and a target destination system; and

prioritizing, in response to performing the first security assessment and the second security assessment, a set of base station connections from the plurality of base station connections and a set of subsequent network connections from the plurality of subsequent network connections according to predetermined security criteria associated with the wireless device.

2. The method of claim 1, wherein the first security assessment is performed with at least one of:

a wireless device;

at least one of the plurality of base stations,

an internal information processing system operated by a service provider of the wireless communication system, and

an external information processing system operated by a third party service provider; and

wherein the second security assessment is performed with at least one of;

the wireless device;

at least one of the plurality of base stations;

an internal information processing system operated by a service provider of the wireless communication system; and

an external information processing system operated by a third party service provider.

3. The method of claim 1, wherein the prioritizing of the set of base station connections is performed with at least one of:

the wireless device;

at least one of the plurality of base stations;

an internal information processing system operated by a service provider of the wireless communication system, and

an external information processing system operated by a third party service provider; and

wherein the set of subsequent network connections is prioritized with at least one of;

the wireless device;

at least one of the plurality of base stations;

an internal information processing system operated by a service provider of the wireless communication system, and

an external information processing system operated by a third party service provider.

4. The method of claim 3, further comprising:

determining, in response to performing the second security assessment, that the plurality of subsequent network connections fail to substantially satisfy the at least one security requirement;

disconnecting, in response to determining that the plurality of subsequent network connections fail to substantially satisfy the at least one security requirement, from the dynamically selected base station;

connecting to another base station in the plurality of base stations based on a priority level associated with the other base station, wherein a priority level is associated with each base station in the plurality of base stations based on at least one security level provided by each base station; and

performing the second security assessment associated with the plurality of subsequent network connections between the other base station and the target destination system.

5. The method of claim 1, further comprising:

determining at least one security requirement for at least one network connection for communicating between the wireless device and the target destination system;

dynamically selecting, in response to the set of base station connections being prioritized, a base station connection in the set of base station connections, wherein the selected base station connection satisfies the at least one security requirement;

dynamically selecting, in response to the set of subsequent network connections being prioritized, at least one subsequent network connection in the set of subsequent network connections, wherein the selected at least one subsequent network connection satisfies the at least one security requirement; and

communicating with the target destination system via the dynamically selected base station connection and the dynamically selected at least one subsequent network connection.

6. The method of claim 5, wherein the dynamically selecting the subsequent network connection further comprises:

dynamically selecting the subsequent network connection in response to

a priority level associated with each subsequent network connection in the plurality of subsequent network connections, wherein the priority level is based on the at least one security level provided by each subsequent network connection.

7. The method of claim 1, further comprising:

receiving a respective over-the-air message from each base station in the plurality of base stations, the respective over-the-air message comprising security information associated with each base station.

8. The method of claim 1, wherein performing the first security assessment further comprises:

determining at least one security level provided by each base station in the plurality of base stations; and

wherein the prioritizing further comprises

associating a priority level with each base station connection in the set of base station connections based on the at least one security level provided by each base station.

9. The method of claim 1, wherein performing the second security assessment further comprises:

connecting with a dynamically selected base station, wherein the base station is selected from the plurality of base stations in response to the first security assessment;

determining at least one security level provided by each subsequent network connection in the plurality of subsequent network connections available for communications with the dynamically selected base station; and

associating, in response to the determining, a priority level with each subsequent network connection in the plurality of subsequent network connections available for communications with the dynamically selected base station based on the at least one security level provided by each such subsequent network connection.

10. The method of claim 1, further comprising:

transmitting a request to an information processing system for security information associated with the plurality of base stations, wherein the information processing system is one of

an internal information processing system operated by a service provider of the wireless communication system, and

an external information processing system operated by a third party service provider; and

receiving the security information from the information processing system, wherein the security information comprises at least one of;

security levels associated with each base station in the plurality of base stations;

a candidate list comprising priority levels associated with the plurality of base stations;

security levels associated with each subsequent network connection in the plurality of subsequent network connections; and

a candidate list comprising priority levels associated with the plurality of subsequent network connections.

11. A method, with an information processing system, for assessing security provided by a plurality of networks, the method comprising:

receiving a request from a wireless device for security information associated with at least one of a plurality of base stations and a plurality of subsequent network connections available between the plurality of base stations and a target destination system;

performing, in response to the receiving, a first security assessment associated with each of a plurality of base station connections associated with respective each of the plurality of base stations; and

performing, in response to the receiving, a second security assessment associated with each of the plurality of subsequent network connections, wherein each subsequent network connection in the plurality of subsequent network connections comprises a plurality of network components for allowing communication with the at least one target destination system.

12. The method of claim 11, further comprising:

determining, in response to performing the first security assessment, at least one security level associated with each base station in the plurality of base stations;

determining, in response to performing the second security assessment, at least one security level associated with each subsequent network connection in the subsequent network connections; and

transmitting at least one of a prioritized list of base stations and a prioritized list of subsequent network connections to the wireless device, wherein each prioritized list is based at least in part on the at least one security level associated with each base station and the at least one security level associated with each subsequent network connection.

13. A wireless device comprising:

a memory;

a processor communicatively coupled to the memory;

a transceiver communicatively coupled to the memory and the processor; and

a security monitor service manager, communicatively coupled to the memory, the processor, and the transceiver, wherein the security monitor service manager is adapted to;

determine at least one security requirement for at least one network connection for communicating to a target destination system;

analyze a first security assessment associated with each of a plurality of base station connections associated with respective each of a plurality of base stations;

dynamically select, in response to analyzing the first security assessment, a base station from the plurality of base stations that satisfies the at least one security requirement;

analyze a second security assessment associated with each of a plurality of subsequent network connections available between the plurality of base stations and the target destination system; and

dynamically select, in response to analyzing the second security assessment, a subsequent network connection from the plurality of subsequent network connections that satisfies the at least one security requirement.

14. The wireless device of claim 13, wherein the first security assessment is performed by one of:

the wireless device;

at least one of the base stations in the plurality of base stations,

an internal information processing system operated by a service provider of a wireless communication system, and

an external information processing system operated by a third party service provider.

15. The wireless device of claim 14, wherein performing the first security assessment further comprises:

determining at least one security level provided by each base station in the plurality of base stations;

associating, in response to performing the first security assessment, a priority level with each base station based on the one least one security level provided by each base station; and

dynamically selecting the base station based from the plurality of base stations based on the priority level associated with each base station.

16. The wireless device of claim 13, wherein the security monitor service manager with the transceiver establishes communication with the target destination system via the dynamically selected base station through the dynamically selected subsequent network connection.

17. The wireless device of claim 13, wherein the security monitors service manager is further adapted to:

transmitting a request to an information processing system for security information associated with the plurality of base stations; and

receiving the security information from the information processing system, wherein the security information comprises at least one of;

security levels associated with each base station in the plurality of base stations;

a candidate list comprising priority levels associated with the plurality of base stations;

security levels associated with each subsequent network connection in the plurality of subsequent network connections; and

a candidate list comprising priority levels associated with the plurality of subsequent network connections.

18. The wireless device of claim 13, wherein the security monitors service manager is further adapted to:

determining, in response to the second security assessment being performing, that the plurality of subsequent network connections fail to substantially satisfy the security requirement;

disconnecting, in response to determining that the plurality of subsequent network connections fail to substantially satisfy the security requirement, from the dynamically selected base station;

connecting to another base station in the plurality of base stations based on the priority level associated with base station; and

performing the second security assessment associated with the plurality of subsequent network connections existing between the at least one base station the at least one destination, wherein the at least one base station is the another base station.

19. The wireless device of claim 13, wherein the second security assessment is performed by one of:

the wireless device;

the least one of the base stations in the plurality of base stations;

an internal information processing system operated by a service provider of a wireless communication system, and

an external information processing system operated by a third party service provider.

20. The wireless device of claim 13, wherein performing the second security assessment further comprises:

determining at least one security level provided by each subsequent network connection in the plurality of subsequent network connections;

associating, in response to the determining, a priority level with each subsequent network connection in the plurality of subsequent network connections based on the at least one security level provided by each subsequent network connection; and

dynamically selecting the network connection from the plurality of subsequent network connections based on the priority level associated with each subsequent network connection.