METHOD AND APPARATUS FOR PROVIDING SERVICE PROVIDER-CONTROLLED COMMUNICATION SECURITY

• US 20120275598A1
• Filed: 06/10/2011
• Published: 11/01/2012
• Est. Priority Date: 04/29/2011
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Vimpari, Markku Kalevi, Alakontiola, Jukka Sakari
• Granted Patent: US 9,450,752 B2
• Time in Patent Office: Days
• US Class Current: 380/255
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 63/304 intercepting circuit switched data communications lawful interception of wireless network communications H04W12/02
• CPC Class Codes: H04L 9/0872 using geo-location information, e.g. location data, time, relative position or proximity to other entities
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms

Abstract

An approach is provided for service provider controlled communication security. A security platform receives a connection request from a client device. The security platform determines context information associated with the device, access network, a user of the device, or a combination thereof, and then processes and/or facilitates a processing of the context information to determine one or more encryption ciphers to offer for the session. Next, the security platform causes, at least in part, establishment of the connection request using, at least in part, the one of the offered encryption ciphers.

Claims

1. A method comprising facilitating a processing of and/or processing (1) data and/or (2) information and/or (3) at least one signal, the (1) data and/or (2) information and/or (3) at least one signal based, at least in part, on the following:

a connection request from a device;

context information associated with the device, the access network, a user of the device, or a combination thereof;

a processing of the context information to determine one or more encryption ciphers provided by a terminating end-point; and

an establishment of the connection request using, at least in part, the one or more encryption ciphers.

2. A method of claim 1, wherein the (1) data and/or (2) information and/or (3) at least one signal are further based, at least in part, on the following:

a processing of the context information to determine location information,

wherein the one or more encryption ciphers are determined based, at least in part, on the location information.

3. A method of claim 2, wherein the location information is based, at least in part, on a network address, a network code, a country code, or a combination thereof associated with the device.

4. A method of claim 3, wherein the (1) data and/or (2) information and/or (3) at least one signal are further based, at least in part, on the following:

probe data associated with the device;

a processing of the probe data to determine to verify the network address, the network code, the country code, or a combination thereof

5. A method of claim 1, wherein the (1) data and/or (2) information and/or (3) at least one signal are further based, at least in part, on the following:

an input for specifying a range of network addresses; and

a comparison of a network address of the device against the range of network addresses;

wherein the one or more encryption ciphers are determined based, at least in part, on the comparison.

6. A method of claim 1, wherein the (1) data and/or (2) information and/or (3) at least one signal are further based, at least in part, on the following:

a processing of the context information to determine a strength of encryption for the connection request,

wherein the one or more encryption ciphers are determined based, at least in part, on the strength of the encryption.

7. A method of claim 1, wherein the strength of encryption is specified, at least in part, by a governmental authority, a regulatory entity, a service provider, or a combination thereof.

8. A method of claim 2, wherein the location information is a country of origin, and the (1) data and/or (2) information and/or (3) at least one signal are further based, at least in part, on the following:

a collection of source address and mobile network code/mobile country code relations in a database; and

a determination of the country of origin based, at least in part, on the database.

9. A method of claim 1, wherein at least one of the one or more encryption ciphers supports one or more lawful interception requirements of a locality associated with the device.

10. A method of claim 1, wherein the one or more encryption ciphers operate via one or more cryptographic protocols including, at least in part, a Transport Layer Security protocol or a Secure Sockets Layer protocol.

11. An apparatus comprising:

at least one processor; and

at least one memory including computer program code for one or more programs,

the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following,

receive a connection request from a device;

determine context information associated with the device, a user of the device, or a combination thereof;

process and/or facilitate a processing of the context information to determine one or more encryption ciphers; and

establish the connection request using, at least in part, the one or more encryption ciphers.

12. An apparatus of claim 11, wherein the apparatus is further caused to:

process and/or facilitate a processing of the context information to determine location information,

wherein the one or more encryption ciphers are determined based, at least in part, on the location information.

13. An apparatus of claim 12, wherein the location information is based, at least in part, on a network address, a network code, a country code, or a combination thereof associated with the device.

14. An apparatus of claim 13, wherein the apparatus is further caused to:

determine probe data associated with the device;

process and/or facilitate a processing of the probe data to determine to verify the network address, the network code, the country code, or a combination thereof

15. An apparatus of claim 11, wherein the apparatus is further caused to:

receive an input for specifying a range of network addresses; and

cause, at least in part, a comparison of a network address of the device against the range of network addresses;

wherein the one or more encryption ciphers are determined based, at least in part, on the comparison.

16. An apparatus of claim 11, wherein the apparatus is further caused to:

process and/or facilitate a processing of the context information to determine a strength of encryption for the connection request,

wherein the one or more encryption ciphers are determined based, at least in part, on the strength of the encryption.

17. An apparatus of claim 11, wherein the strength of encryption is specified, at least in part, by a governmental authority, a regulatory entity, a service provider, or a combination thereof

18. An apparatus of claim 12, wherein the location information is a country of origin, and the apparatus is further caused to:

determine to collect source address and mobile network code/mobile country code relations in a database; and

determine the country of origin based, at least in part, on the database.

19. An apparatus of claim 11, wherein at least one of the one or more encryption ciphers supports one or more lawful interception requirements of a locality associated with the device.

20. An apparatus of claim 11, wherein the one or more encryption ciphers operate via one or more cryptographic protocols including, at least in part, a Transport Layer Security protocol or a Secure Sockets Layer protocol.