NETWORK-ASSISTED PEER-TO-PEER SECURE COMMUNICATION ESTABLISHMENT

• US 20130110920A1
• Filed: 10/27/2011
• Published: 05/02/2013
• Est. Priority Date: 10/27/2011
• Status: Abandoned Application

• Current Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Original Assignee: Alcatel-Lucent USA, Inc. (Nokia Corporation)
• Inventors: Broustis, Ioannis, Sundaram, Ganapathy S.
• Application Number:
  US13/283,133
• Publication Number:
  US 20130110920A1
• Time in Patent Office: Days
• US Class Current: 709/204
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks

Abstract

Techniques are disclosed for establishing network-assisted secure communications in a peer-to-peer environment. For example, a method for secure communications comprises the following steps. A first computing device provides connectivity information associated therewith to a network server. The first computing device receives connectivity information respectively associated with one or more other computing devices from the network server. The first computing device, independent of the network server, establishes a security association with at least one of the one or more other computing devices. The first computing device, independent of the network server, participates in a secure peer-to-peer session with the at least one other computing device.

Claims

1. A method for secure communications, comprising:

providing, by a first computing device, connectivity information associated therewith to a network server;

receiving, at the first computing device, connectivity information respectively associated with one or more other computing devices from the network server;

establishing, by the first computing device and independent of the network server, a security association with at least one of the one or more other computing devices; and

participating, by the first computing device and independent of the network server, in a secure peer-to-peer session with the at least one other computing device.

2. The method of claim 1, further comprising requesting, by the first computing device, the connectivity information respectively associated with the one or more other computing devices from the network server.

3. The method of claim 1, further comprising periodically receiving, at the first computing device, the connectivity information respectively associated with the one or more other computing devices from the network server.

4. The method of claim 1, further comprising receiving, at the first computing device, the connectivity information respectively associated with the one or more other computing devices from the network server following receipt of updated connectivity information from at least one of the one or more other computing devices at the network server.

5. The method of claim 1, wherein the step of receiving, at the first computing device, the connectivity information respectively associated with one or more other computing devices from the network server further comprises reading, by the first computing device, one or more resource containers residing at the network server.

6. The method of claim 1, further comprising establishing, by the first computing device, a security association with the network server prior to providing its connectivity information to the network server.

7. The method of claim 1, further comprising registering, by the first computing device, with the network server prior to the first computing device providing its connectivity information to the network server.

8. The method of claim 7, further comprising de-registering the first computing device with the network server.

9. The method of claim 8, further comprising sending, by the first computing device, a de-register message to the network server.

10. The method of claim 8, further comprising receiving, at the first computing device, a de-register message from the network server.

11. The method of claim 8, wherein the registration of the first computing device is invalidated based on one or more de-registration criteria.

12. The method of claim 11, wherein the one or more de-registration criteria comprise at least one of an existence of a non-responsive condition on the part of the first computing device and an expiration condition associated with a registration time period.

13. The method of claim 1, wherein the step of establishing, by the first computing device, the security association with the at least one other computing device is performed in accordance with an identity based authenticated key exchange protocol.

14. The method of claim 13, wherein, during the establishment of the security association between the first computing device and the at least one other computing device, a session key is agreed upon for use in the secure peer-to-peer session.

15. The method of claim 1, wherein the network server comprises a single server device or multiple server devices.

16. The method of claim 15, wherein, when the network server comprises multiple server devices, different ones of the multiple server devices perform different operations with respect to the first computing device and the one or more other computing devices.

17. A computing device, comprising:

a memory; and

a processor device operatively coupled to the memory and configured to cause the computing device to;

provide connectivity information associated with the computing device to a network server;

receive from the network server connectivity information respectively associated with one or more other computing devices;

establish, independent of the network server, a security association with at least one of the one or more other computing devices; and

participate, independent of the network server, in a secure peer-to-peer session with the at least one other computing device.

18. A system, comprising:

a communications module; and

a cryptography module operatively coupled to the communications module;

wherein the communications module and the cryptography module cooperate to perform the steps of;

providing connectivity information to a network server;

receiving from the network server connectivity information respectively associated with one or more computing devices;

establishing, independent of the network server, a security association with at least one of the one or more computing devices; and

participating, independent of the network server, in a secure peer-to-peer session with the at least one computing device.

19. The system of claim 18, wherein the communications module is configured to operate as a client when initiating the secure peer-to-peer session.

20. The system of claim 18, wherein the communications module is configured to operate as a server when responding to initiation of the secure peer-to-peer session by at least one of the one or more computing devices.