SECURITY FOR A HETEROGENEOUS AD HOC MOBILE BROADBAND NETWORK

• US 20090046861A1
• Filed: 08/08/2008
• Published: 02/19/2009
• Est. Priority Date: 08/17/2007
• Status: Abandoned Application

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Krishnaswamy, Dilip
• Application Number:
  US12/189,008
• Publication Number:
  US 20090046861A1
• Time in Patent Office: Days
• US Class Current: 380/270
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks
• CPC Class Codes: H04W 88/04 adapted for relaying to or from another terminal or user

Abstract

A server provides security for a heterogeneous ad hoc mobile broadband network. The server is configured to maintain an encrypted control session with an ad-hoc service provider and a mobile client while enabling the mobile client to support an encrypted data tunnel through the ad-hoc service provider.

Claims

1. A server, comprising:

a processing system configured to maintain an encrypted control session with an ad-hoc service provider and a mobile client while enabling the mobile client to support an encrypted data tunnel through the ad-hoc service provider.

2. The server of claim 1 wherein the processing system is further configured to enable the mobile client to support the encrypted data tunnel through the ad-hoc service provider to the server.

3. The server of claim 1 wherein the processing system is further configured to use a first session key for the encrypted control session with the ad-hoc service provider and a second session key for the encrypted control session with the mobile client, wherein the first session key is different from the second session key.

4. The server of claim 3 wherein the processing system is further configured to receive from the ad-hoc service provider the first session key encrypted with a public key for the server and receive from the mobile client the second session key encrypted with the public key for the server.

5. The server of claim 1 wherein the processing system is further configured to authenticate the ad-hoc service provider to establish the encrypted control session with the ad-hoc service provider.

6. The server of claim 1 wherein the processing system is further configured to authenticate the mobile client to establish the encrypted control session with the mobile client.

7. The server of claim 6 wherein the processing system is further configured to authenticate the mobile client through the ad-hoc service provider.

8. The server of claim 7 wherein the processing system is further configured to communicate to the ad-hoc service provider and the mobile client that the mobile client is authenticated.

9. The server of claim 1 wherein the processing system is further configured to assist in establishing an encrypted control session between the ad-hoc service provider and the mobile client.

10. The server of claim 9 wherein the processing system is further configured to assist in establishing the encrypted control session between the ad-hoc service provider and the mobile client by receiving a session key from one of the mobile client and ad-hoc service provider and providing the session key to the other one of the mobile client and ad-hoc service provider.

11. The server of claim 9 wherein the processing system is further configured to assist in establishing the encrypted control session between the ad-hoc service provider and the mobile client by generating a session key and providing the session key to the ad-hoc service provider and the mobile client.

12. The server of claim 1 wherein the processing system is further configured to assist in establishing an encrypted wireless link between the ad-hoc service provider and the mobile client.

13. The server of claim 12 wherein the processing system is further configured to assist in establishing the encrypted wireless link between the ad-hoc service provider and the mobile client by generating a wireless link encryption key and providing the wireless link encryption key to the ad-hoc service provider and the mobile client.

14. The server of claim 1 wherein the processing system is further configured to support a handoff of the mobile client from the ad-hoc service provider to another ad-hoc service provider.

15. The server of claim 14 wherein the processing system is further configured to support the handoff by establishing an encrypted control session with said another ad-hoc service provider.

16. The server of claim 14 wherein the processing system is further configured to authenticate the mobile client with said another ad-hoc service provider.

17. The server of claim 16 wherein the processing system is further configured to communicate to the mobile client that the mobile client has been authenticated with said another ad-hoc service provider.

18. The server of claim 14 wherein the processing system is further configured to support the handoff by assisting in establishing an encrypted control session between said another ad-hoc service provider and the mobile client.

19. The server of claim 18 wherein the processing system is further configured to assist in establishing the encrypted control session between said another ad-hoc service provider and the mobile client by generating a session key and providing the session key to said another ad-hoc service provider and the mobile client.

20. A server, comprising:

means for enabling a mobile client to support an encrypted data tunnel through an ad-hoc service provider; and

means for maintaining an encrypted control session with an ad-hoc service provider and a mobile client while enabling the mobile client to support the encrypted data tunnel through the ad-hoc service provider.

21. The server of claim 20 wherein the means for enabling the mobile client to support an encrypted data tunnel is configured to enable the mobile client to support the encrypted data tunnel through the ad-hoc service provider to the server.

22. The server of claim 20 wherein the means for maintaining an encrypted control session with an ad-hoc service provider and a mobile client comprises means for using a first session key for the encrypted control session with the ad-hoc service provider and means for using a second session key for the encrypted control session with the mobile client, wherein the first session key is different from the second session key.

23. The server of claim 22 further comprising means for receiving from the ad-hoc service provider the first session key encrypted with a public key for the server and means for receiving from the mobile client the second session key encrypted with the public key for the server.

24. The server of claim 20 further comprising means for authenticating the ad-hoc service provider to establish the encrypted control session with the ad-hoc service provider.

25. The server of claim 20 further comprising means for authenticating the mobile client to establish the encrypted control session with the mobile client.

26. The server of claim 25 wherein the means for authenticating the mobile client is configured to authenticate the mobile client through the ad-hoc service provider.

27. The server of claim 26 further comprising means for communicating to the ad-hoc service provider and the mobile client that the mobile client is authenticated.

28. The server of claim 20 further comprising means for assisting in establishing an encrypted control session between the ad-hoc service provider and the mobile client.

29. The server of claim 28 wherein the means for assisting in establishing an encrypted control session between the ad-hoc service provider and the mobile client comprises means for receiving a session key from one of the mobile client and ad-hoc service provider and means for providing the session key to the other one of the mobile client and ad-hoc service provider.

30. The server of claim 28 wherein the means for assisting in establishing an encrypted control session between the ad-hoc service provider and the mobile client comprises means for generating a session key and means for providing the session key to the ad-hoc service provider and the mobile client.

31. The server of claim 20 further comprising means for assisting in establishing an encrypted wireless link between the ad-hoc service provider and the mobile client.

32. The server of claim 31 wherein the means for assisting in establishing an encrypted wireless link between the ad-hoc service provider and the mobile client comprises means for generating a wireless link encryption key and means for providing the wireless link encryption key to the ad-hoc service provider and the mobile client.

33. The server of claim 20 further comprising means for supporting a handoff of the mobile client from the ad-hoc service provider to another ad-hoc service provider.

34. The server of claim 33 wherein the means for supporting a handoff is configured to support the handoff by establishing an encrypted control session with said another ad-hoc service provider.

35. The server of claim 33 further comprising means for authenticating the mobile client with said another ad-hoc service provider.

36. The server of claim 35 further comprising means for communicating to the mobile client that the mobile client has been authenticated with said another ad-hoc service provider.

37. The server of claim 33 wherein the means for supporting a handoff is configured to support the handoff by assisting in establishing an encrypted control session between said another ad-hoc service provider and the mobile client.

38. The server of claim 37 wherein the means for supporting a handoff is further configured to assist in establishing the encrypted control session between said another ad-hoc service provider and the mobile client by generating a session key and providing the session key to said another ad-hoc service provider and the mobile client.

62. The machine-readable medium of claim 20 wherein the instructions further comprise code for authenticating the ad-hoc service provider to establish the encrypted control session with the ad-hoc service provider.

39. A method of providing security to a network from a server, comprising:

enabling a mobile client to support an encrypted data tunnel through an ad-hoc service provider; and

maintaining an encrypted control session with an ad-hoc service provider and a mobile client while enabling the mobile client to support the encrypted data tunnel through the ad-hoc service provider.

40. The method of claim 39 wherein the mobile client is enabled to support the encrypted data tunnel through the ad-hoc service provider to the server.

41. The method of claim 39 wherein the encrypted control session is maintained with the ad-hoc service provider and the mobile client by for using a first session key for the encrypted control session with the ad-hoc service provider and using a second session key for the encrypted control session with the mobile client, wherein the first session key is different from the second session key.

42. The method of claim 41 further comprising receiving from the ad-hoc service provider the first session key encrypted with a public key for the server and receiving from the mobile client the second session key encrypted with the public key for the server.

43. The method of claim 39 further comprising authenticating the ad-hoc service provider to establish the encrypted control session with the ad-hoc service provider.

44. The method of claim 39 further comprising authenticating the mobile client to establish the encrypted control session with the mobile client.

45. The method of claim 44 wherein the mobile client is authenticated through the ad-hoc service provider.

46. The method of claim 45 further comprising communicating to the ad-hoc service provider and the mobile client that the mobile client is authenticated.

47. The method of claim 39 further comprising assisting in establishing an encrypted control session between the ad-hoc service provider and the mobile client.

48. The method of claim 47 wherein the establishment of the encrypted control session between the ad-hoc service provider and the mobile client is assisted by receiving a session key from one of the mobile client and ad-hoc service provider and providing the session key to the other one of the mobile client and ad-hoc service provider.

49. The method of claim 47 wherein the establishing an encrypted control session between the ad-hoc service provider and the mobile client is assisted by generating a session key and providing the session key to the ad-hoc service provider and the mobile client.

50. The method of claim 39 further comprising assisting in establishing an encrypted wireless link between the ad-hoc service provider and the mobile client.

51. The method of claim 50 wherein the establishment of the encrypted wireless link between the ad-hoc service provider and the mobile client is assisted by generating a wireless link encryption key and providing the wireless link encryption key to the ad-hoc service provider and the mobile client.

52. The method of claim 39 further comprising supporting a handoff of the mobile client from the ad-hoc service provider to another ad-hoc service provider.

53. The method of claim 52 wherein the handoff is supported by establishing an encrypted control session with said another ad-hoc service provider.

54. The method of claim 52 further comprising authenticating the mobile client with said another ad-hoc service provider.

55. The method of claim 54 further comprising communicating to the mobile client that the mobile client has been authenticated with said another ad-hoc service provider.

56. The method of claim 52 wherein the handoff is supported by assisting in establishing an encrypted control session between said another ad-hoc service provider and the mobile client.

57. The method of claim 56 wherein the handoff is supported by assisting in establishing the encrypted control session between said another ad-hoc service provider and the mobile client by generating a session key and providing the session key to said another ad-hoc service provider and the mobile client.

58. A machine-readable medium comprising instructions executable by a processing system in a server, the instructions comprising code for:

enabling a mobile client to support an encrypted data tunnel through the ad-hoc service provider; and

maintaining an encrypted control session with an ad-hoc service provider and a mobile client while enabling the mobile client to support the encrypted data tunnel through the ad-hoc service provider.

59. The machine-readable medium of claim 58 wherein the code for enabling the mobile client to support an encrypted data tunnel is configured to enable the mobile client to support the encrypted data tunnel through the ad-hoc service provider to the server.

60. The machine-readable medium of claim 58 wherein the code for maintaining an encrypted control session with an ad-hoc service provider and a mobile client comprises code for using a first session key for the encrypted control session with the ad-hoc service provider and code for using a second session key for the encrypted control session with the mobile client, wherein the first session key is different from the second session key.

61. The machine-readable medium of claim 60 wherein the instructions further comprise code for receiving from the ad-hoc service provider the first session key encrypted with a public key for the server and code for receiving from the mobile client the second session key encrypted with the public key for the server.

63. The machine-readable medium of claim 58 wherein the instructions further comprise code for authenticating the mobile client to establish the encrypted control session with the mobile client.

64. The machine-readable medium of claim 63 wherein the code for authenticating the mobile client is configured to authenticate the mobile client through the ad-hoc service provider.

65. The machine-readable medium of claim 64 wherein the instructions further comprise code for communicating to the ad-hoc service provider and the mobile client that the mobile client is authenticated.

66. The machine-readable medium of claim 58 wherein the instructions further comprise code for assisting in establishing an encrypted control session between the ad-hoc service provider and the mobile client.

67. The machine-readable medium of claim 66 wherein the code for assisting in establishing an encrypted control session between the ad-hoc service provider and the mobile client comprises code for receiving a session key from one of the mobile client and ad-hoc service provider and code for providing the session key to the other one of the mobile client and ad-hoc service provider.

68. The machine-readable medium of claim 66 wherein the code for assisting in establishing an encrypted control session between the ad-hoc service provider and the mobile client comprises code for generating a session key and code for providing the session key to the ad-hoc service provider and the mobile client.

69. The machine-readable medium of claim 58 wherein the instructions further comprise code for assisting in establishing an encrypted wireless link between the ad-hoc service provider and the mobile client.

70. The machine-readable medium of claim 69 wherein the code for assisting in establishing an encrypted wireless link between the ad-hoc service provider and the mobile client comprises code for generating a wireless link encryption key and code providing the wireless link encryption key to the ad-hoc service provider and the mobile client.

71. The machine-readable medium of claim 58 wherein the instructions further comprise code for supporting a handoff of the mobile client from the ad-hoc service provider to another ad-hoc service provider.

72. The machine-readable medium of claim 71 wherein the code for supporting a handoff is configured to support the handoff by establishing an encrypted control session with said another ad-hoc service provider.

73. The machine-readable medium of claim 71 wherein the instructions further comprise code for authenticating the mobile client with said another ad-hoc service provider.

74. The machine-readable medium of claim 73 wherein the instructions further comprise code for communicating to the mobile client that the mobile client has been authenticated with said another ad-hoc service provider.

75. The machine-readable medium of claim 71 wherein the code for supporting a handoff is configured to support the handoff by assisting in establishing an encrypted control session between said another ad-hoc service provider and the mobile client.

76. The machine-readable medium of claim 75 wherein the code for supporting a handoff is further configured to assist in establishing the encrypted control session between said another ad-hoc service provider and the mobile client by generating a session key and providing the session key to said another ad-hoc service provider and the mobile client.