PROXY SERVER, METHOD FOR REALIZING PROXY, AND SECURE COMMUNICATION SYSTEM AND METHOD THEREOF

• US 20090044280A1
• Filed: 08/28/2008
• Published: 02/12/2009
• Est. Priority Date: 02/28/2006
• Status: Abandoned Application

• Current Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Inventors: PAN, Zhong, ZHAO, Quanbo, WU, Xuyong
• Application Number:
  US12/200,761
• Publication Number:
  US 20090044280A1
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04W 88/182 Network node acting on behalf of an other network entity, e.g. proxy
• CPC Class Codes: H04W 92/20 between access points

Abstract

A proxy server having proxy server address information is provided to serve as an agent for at least one base station to perform secure communication. A method for realizing proxy and secure communication system are also provided to prevent the change of network address allocation from interfering main services of a base station. In addition, a secure communication method between license-exempt devices is provided to ensure the license-exempt devices not to be attacked and to remain at normal work. In the present invention, the network address of a base station is only restricted in a trusted range instead of being broadcasted in a public network, thus reducing the probability of attack to the base station in a wired network.

Claims

1. A proxy server, having proxy server address information, comprising:

a proxy database, adapted to store base station address information of at least one base station and base station identification information corresponding to the base station address information; and

a processing unit, adapted to replace the base station source address information in a first message from the at least one source base station with the proxy server address information of the proxy server, and send a second message carrying the proxy server address information to a target address.

2. The proxy server according to claim 1, further comprising:

a base station side logic interface, adapted to receive the first message from the at least one base station, and send a third message to the at least one base station; and

a network side logic interface, adapted to send the second message to the target address, and receive the second message from the source address.

3. The proxy server according to claim 1, wherein the at least one base station is a license-exempt band base station.

4. The proxy server according to claim 1, wherein the proxy server comprises a coexistence proxy server;

and

the proxy server is integrated with the base station in an entity.

5. A method for realizing proxy by the proxy server of claim 1, comprising:

A. pre-storing base station address information of at least one base station and base station identification information corresponding to the base station address information;

B. replacing base station source address information in a first message from the at least one base station with proxy server address information of the proxy server; and

C. sending a second message carrying the proxy server address information to a target address.

6. The method according to claim 5, wherein the Step B further comprises:

parsing the first message from the at least one base station, and adopting a processing unit to add the base station identification information corresponding to the base station address information of the at least one base station into the first message when no base station identification information exists in the first message from the at least one base station, so as to generate the second message carrying the base station identification information and the proxy server address information.

7. The method according to claim 5, wherein the Step A further comprises:

pre-storing a mapping relationship table to establish a corresponding relationship between the base station address information of the at least one base station and the base station identification information;

the Step B further comprises;

receiving, by the processing unit, the second message from any source address, looking up the base station address information in the mapping relationship table according to the base station identification information, altering the target address of the second message into the base station address information according to the base station address information, and then sending the base station address information to a third message.

8. The method according to claim 7, further comprising:

receiving the first message from the at least one base station, and sending the third message to the at least one base station; and

sending the second message to the target address, and receiving the second message from the source address.

9. The method according to claim 5, wherein the Step A further comprises:

storing an illegal proxy server address list in the database, and shielding, by the processing unit, information from illegal proxy servers according to the illegal proxy server address list.

10. The method according to claim 5, wherein the base station identification comprises, but not limited to, a globally unique base station identification or an unique identification in the proxy server for the BS according to internal rules of the proxy server.

11. A secure communication system, comprising:

at least one base station, and the proxy server of claim 1 adapted to serve as an agent for the at least one base station to perform secure communication.

12. The secure communication system according to claim 11, wherein each base station is connected to a proxy server;

or multiple base stations share one proxy server;

or

one base station is connected to one multiple proxy servers.

13. A secure communication method, for achieving secure communication at least between a first base station and a second base station, wherein the first base station comprises at least one first proxy server, the method comprising:

I. sending, by the first base station, a first message to the second base station, wherein the first message comprises a first network address of the first proxy server and a first base identification of the first base station; and

II. sending, by the second base station, a contact request message to the first base station according to the first base station identification carried in the first message, and sending, by the first base station, a response message to the second base station to achieve secure communication with the second base station.

14. The method according to claim 13, wherein the Step II yet comprises:

II1. sending, by the second base station, a request message to the first proxy server according to the received first network address, and forwarding, by the first proxy server, the request message from the second base station to the first base station; and

II2. sending, by the first base station, a response message to the first proxy server, and forwarding, by the first proxy server, the response message from the first base station to the second base station.

15. The method according to claim 13, wherein the first base station wirelessly broadcasts the first message, and receives the contact request message through wired connection;

and in the Step II, before sending the contact response message, the method further comprises;

determining, by the first base station, whether the contact request message directly comes from the second BS, and if the contact request message directly comes from the second BS, proceeding to Step II;

if the contact request message does not directly come from the second BS, performing the following steps;

T1. determining whether the contact request message comes from the first proxy server, and if the contact request message comes from the first proxy server, performing Step T2;

if the contact request message does not come from the first proxy server, performing Step T3;

T2. sending, by the first BS, a feedback message to the second BS through the first proxy server so as to establish a secure connection with the second BS, and ending the process; and

T3. determining, by the first BS, the contact request message as an illegal contact request, then discarding the message, and ending the process.

16. The method according to claim 13, further comprising:

S1. receiving, by the second base station, a report message from the first base station, and obtaining from the report message the network address of the proxy server and the base station identification of the first base station;

S2. determining, by the second base station, whether the first base station is a base station sharing mutual trust with the second base station, and if the first base station is a base station sharing mutual trust with the second base station, performing Step S3;

if the first base station is not a base station sharing mutual trust with the second base station, performing Step S4;

S3. directly sending, by the second base station, the contact request message to the network address of the first base station or the first proxy server;

receiving, by the second base station, the feedback message from the first base station or the first proxy server so as to directly contact the first base station and ending the process; and

S4. sending, by the second base station, the contact request message to the first proxy server of the first base station through a second proxy server of the second base station; and

receiving, by the second base station, the feedback message from the first base station through the second proxy server so as to contact the first base station.

17. The method according to claim 13, wherein the first message further comprises a real-time key.