SECURE END-TO-END TRANSPORT THROUGH INTERMEDIARY NODES

• US 20110099363A1
• Filed: 09/23/2010
• Published: 04/28/2011
• Est. Priority Date: 01/08/2002
• Status: Active Grant

• Current Assignee: Seven Networks LLC (SoftBank Group Corp.)
• Original Assignee: Seven Networks Inc
• Inventors: Boynton, Lee R., Burke, Scott M., Sikes, Mark, Fiatal, Trevor A.
• Granted Patent: US 8,127,342 B2
• Time in Patent Office: Days
• US Class Current: 713/150
• CPC Class Codes: H04B 7/04 using two or more spaced independent antennas
• CPC Class Codes: H04B 7/0417 Feedback systems
• CPC Class Codes: H04B 7/0617 for beam forming
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 51/58 Message adaptation for wireless communication
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 4/12 : Messaging; Mailboxes; Announcements
• CPC Class Codes: H04W 52/0261 : managing power supply demand, e.g. depending on battery level
• CPC Class Codes: H04W 76/10 : Connection setup
• CPC Class Codes: H04W 88/06 : adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals
• CPC Class Codes: Y02D 10/00 : Energy efficient computing, e.g. low power processors, power management or thermal management
• CPC Class Codes: Y02D 30/70 : in wireless communication networks

Abstract

A communication network encrypts a first portion of a transaction associated with point-to-point communications using a point-to-point encryption key. A second portion of the transaction associated with end-to-end communications is encrypted using an end-to-end encryption key.

Claims

1-27. -27. (canceled)

28. A computerized system for secure communication comprising a network processing device configured to, at least:

process a plurality of transactions containing a plurality of types of item;

associate each of the plurality of types of item with at least one of a plurality of security associations in accordance with a configured encryption schema;

correlate the plurality of security associations with a plurality of channels in the plurality of transactions; and

encrypt or decrypt a plurality of items in the plurality of transactions in accordance with a corresponding security association and the configured encryption schema.

29. A computerized system according to claim 28, wherein the plurality of types of item comprises email data.

30. A computerized system according to claim 28, wherein the plurality of types of item comprises at least two of:

email data, calendar data, contact data, and task data.

31. A computerized system according to claim 28, wherein the plurality of transactions comprise at least one data synchronization transaction.

32. A computerized system according to claim 28, further comprising a plurality of mobile devices that generate the plurality of transactions.

33. A computerized system according to claim 28, further comprising:

at least one mobile network communicatively coupled to the network processing device, said at least one mobile network containing at least one endpoint of the plurality of transactions; and

at least one enterprise network communicatively coupled to the network processing device, said at least one enterprise network containing at least one endpoint of the plurality of transactions.

34. One or more computer-readable media having collectively thereon computer-executable instructions that configure one or more computers to collectively, at least:

process a plurality of transactions containing a plurality of types of items;

associate each of the plurality of types of items with at least one of a plurality of security associations in accordance with a configured encryption schema;

correlate the plurality of security associations with a plurality of channels in the plurality of transactions; and

encrypt or decrypt a plurality of items in the plurality of transactions in accordance with a corresponding security association and the configured encryption schema.

35. One or more computer-readable media according to claim 34, wherein at least one of the plurality of transactions comprises a plurality of data packets.

36. One or more computer-readable media according to claim 34, wherein at least one of the plurality of transactions comprises multiple of the plurality of types of items.

37. One or more computer-readable media according to claim 34, wherein the plurality of security associations comprises at least one point-to-point security association and at least one end-to-end security association.

38. One or more computer-readable media according to claim 34, wherein at least one of the plurality of security associations specifies a cryptographic algorithm and a cryptographic key length.

39. One or more computer-readable media according to claim 34, wherein at least one of the plurality of transactions is associated with multiple of the plurality of security associations.

40. One or more computer-readable media according to claim 34, wherein the configured encryption schema specifies a plurality of associations between multiple of the plurality of types of items and multiple of the plurality of security associations.

41. One or more computer-readable media having collectively thereon a data structure that configures one or more computers, the data structure comprising:

a first portion of a transaction encrypted using a first known encryption key, the first portion of the transaction containing point-to-point control data; and

a second portion of the transaction encrypted using a second unknown encryption key, the second portion of the transaction containing end-to-end content data,

wherein the first portion of the transaction is decrypted to determine how to process the transaction while the second portion of the transaction remains encrypted.

42. One or more computer-readable media according to claim 41, wherein the first known encryption key is known to an intermediary network processing node and the second unknown encryption key is unknown to the intermediary network processing node.

43. One or more computer-readable media according to claim 41, wherein the data structure further comprises an unencrypted third portion of the transaction.

44. One or more computer-readable media according to claim 43, wherein the network processing node is intermediary to at least one mobile network containing at least one endpoint of the transaction and to at least one enterprise network containing at least one endpoint of the transaction.

45. One or more computer-readable media according to claim 41, wherein the data structure further comprises an unencrypted third portion of the transaction.

46. One or more computer-readable media according to claim 45, wherein the transaction comprises a plurality of data packets and the unencrypted third portion of the transaction contains data corresponding to header portions of the plurality of data packets.

47. One or more computer-readable media according to claim 41, wherein the second portion of the transaction contains at least two of:

email data, calendar data, contact data, and task data.