Networks

• US 20090013380A1
• Filed: 11/05/2004
• Published: 01/08/2009
• Est. Priority Date: 11/19/2003
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson, Vodafone Group PLC
• Original Assignee: Telefonaktiebolaget LM Ericsson, Vodafone Group PLC
• Inventors: Naslund, Mats, Gehrmann, Christian, Jonsson, Annika, Gurleyen, Bulent Ozgur, Chandrasiri, Pubudu
• Granted Patent: US 8,776,183 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 65/1016 IP multimedia subsystem [IMS]
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 4/06 Selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS]; Services to user groups; One-way selective calling services
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support
• CPC Class Codes: H04W 84/10 Small scale networks; Flat hierarchical networks

Abstract

A Personal Area Network Security Domain (PSD) is formed between devices (142, 150, 152, 154 and 156). The PSD allows the sharing of data and/or resources between the devices within the PSD. The devices within the PSD are located remotely from one another. For example, communication between device (150 and 156) will be performed via mobile or cellular telephone network (120), the Internet (140) and mobile or cellular telephone network (126). Each network (120, 126) is provided with a PSD Hub, which enables an IPsec secure connection between the devices (150 and 156) to be established.

Claims

1. A system including:

plurality of devices;

administration means for allowing selected devices to be associated together as a group by providing each device with security data and identification data, the security data of each device being interpretable by each other device within the group, particular modes of communication only being allowed between devices within the group having such security data, and the identification data identifying each device within the group for the purpose of delivering data to that device but not necessarily being recognisable by other devices not in said group; and

routing means having an external identifier recognisable by devices not in said group for routing communications via a communication medium and for communicating data originating from one device within said group received via said communication medium by means of the external identifier to another device within said group using the identification data.

2. The system of claim 1, comprising a plurality of said routing means.

3. The system of claim 2, wherein said routing means are operable to route said data securely therebetween via said communication medium.

4. The system of claim 1, wherein the data is transmitted by IPsec.

5. The system of claim 1, wherein the external identifier is a unique public IP address or telephone number.

6. The system of claim 1, wherein the identification data comprises a respective local IP address assigned to each device by the administration means.

7. The system of claim 1, wherein at least one of the devices comprises a mobile telecommunications terminal and is operable to communicate with an associated one of the routing means via a mobile telecommunications network.

8. The system of claim 7, wherein the routing means includes means for authenticating the mobile terminal.

9. The system of claim 8, wherein the authenticating means is operable to authenticate the mobile terminal using data relating to the subscription of the mobile terminal with the mobile telecommunications network.

10. The system of claim 9, wherein the mobile telecommunications terminal includes a smart card storing data for exchange with said authentication means.

11. The system of claim 7, wherein the mobile telecommunications network is a GSM network.

12. The system of claim 7, wherein the mobile telecommunications network is a UMTS (3G) network.

13. The system of claim 7, wherein data is exchanged between the mobile telecommunications terminal and the routing means by a GPRS link.

14. The system of claim 1, wherein data is exchanged between the mobile telecommunications terminal and the routing means using Session Initiation Protocol (SIP).

15. The system of claim 2, wherein

the routing means are operable to exchange external identifiers therebetween.

16. The system of claim 2, including means for generating an IP address for enabling communications to be routed between respective ones of the routing means.

17. The system of claim 1, wherein each device stores a key.

18. The system of claim 1, wherein the routing means is operable to generate a public-private key pair.

19. The system of claim 17, wherein the device associated with the routing means is operable to generate a certificate using the public key of the routing means and the device'"'"'s key.

20. The system of claim 19, wherein the routing means is operable to authenticate itself with the administration means using said certificate.

45. The system of claim 1, wherein the communication medium comprises the Internet.

21. A method of configuring an IP address to allow data exchange between a first device “

A” and

a second device “

B”

that are associated with one another in a group, the group having a group identifier “

Group-ID”

, and each device having unique identifier “

Group-Member-ID”

within the group, and where the devices are coupled to one another for communication therebetween via respective communication hubs “

Hub-A” and

“

Hub-B”

, the method including providing each of said devices with a unique IP address within said group.

22. The method of claim 21, including:

allocating a range of IP addresses as follows;

first octet of the IP address=10 (Fixed).X.Y.Z;

where X,Y,Z is calculated as follows;

X=[Hash(Group-ID)][0, 1, 2 . . . 15],

Y=[Hash(IDn][7, 8, . . . 15]

Z=[Hash(Group-Member-ID)][0, 1, 2 . . . 7];

where the IDn is either Group-Member-ID or an identifier of a device acting as a gateway device for a plurality of the devices,

where the final IP address=10.X.Y.Z, and

where “

Hash”

is a hash function.

23. The method of claim 22, wherein “

Hash”

is a MD5 algorithm.

24. A method of enabling communication between a plurality of devices, the method including associating selected devices together as a group by providing each device with security data and identification data, the security data of each device being interpretable by each other device within the group, particular modes of communication only being allowed between devices within the group having such security data, and the identification data identifying each device within the group for the purpose of delivering data to that device but not necessarily being recognisable by other devices not in said group;

and routing data originating from one device within said group by routing means, having an external identifier recognisable by devices not in said group for routing communications via a communication medium, which communicates that data received via the communication medium by means of the external identifier to another device within said group using the identification data.

25. The method of claim 24, including providing a plurality of said routing means.

26. The method of claim 25, wherein said routing means route said data securely therebetween via said communication medium.

27. The method of claim 24, wherein the data is transmitted by IPsec.

28. The method of claim 24, wherein the external identifier is a unique public IP address or telephone number.

29. The method of claim 24, wherein the identification data comprises a respective local IP address assigned to each device.

30. The method of claim 24, wherein at least one of the devices comprises a mobile telecommunications terminal which communicates with an associated one of the routing means via a mobile telecommunications network.

31. The method of claim 30, wherein the routing means authenticates the mobile terminal.

32. The method of claim 31, wherein the mobile terminal is authenticated using data relating to the subscription of the mobile terminal with the mobile telecommunications network.

33. The method of claim 32, wherein a smart card associated with the mobile telecommunications terminal stores data to perform said authentication.

34. The method of claim 30, wherein the mobile telecommunications network is a GSM network.

35. The method of claim 28, wherein the mobile telecommunications network is a UMTS (3G) network.

36. The method of claim 30, wherein data is exchanged between the mobile telecommunications terminal and the routing means by a GPRS link.

37. The method of claim 24, wherein using Session Initiation Protocol (SIP).

38. The method of claim 25, wherein respective ones of the routing means exchange external identifiers therebetween.

39. The method of claim 25, including generating an IP address for enabling communications to be routed between respective ones of the routing means.

40. The system of claim 24, wherein each device stores a key.

41. The system of claim 24, wherein the routing means generates public-private key pairs.

42. The method of claim 40, wherein the device associated with the routing means generates a certificate using the public key of the routing means and the device'"'"'s key.

43. The method of claim 42, wherein the routing means authenticates itself within the group using said certificate.

46. The method of claim 24, wherein the communication medium comprises the Internet.

44. A routing node for enabling communication between a plurality of devices which are associated together as a group by providing each device with security data and identification data, the security data of each device being interpretable to each other device within the group, particular modes of communication only being allowed between devices within the group having such security data, and the identification data identifying each device within the group for the purpose of delivering data to that device but not necessarily being recognisable by other devices not in said group;

wherein the routing node has an external identifier recognisable by devices not in said group for routing communications via a communication medium, and communicates data originating from one device within said group received via said communication medium by means of the external identifier to another device within said group using the identification data.

47. The method of claim 44, wherein the communication medium comprises the Internet.