Security over a network

• US 7,213,143 B1
• Filed: 01/27/2003
• Issued: 05/01/2007
• Est. Priority Date: 01/27/2003
• Status: Active Grant

• Current Assignee: Genband US LLC (Ribbon Communications, Inc.)
• Original Assignee: Nortel Networks Limited (Nortel Networks Corporation)
• Inventors: Watson, Mark, Sharp, Iain
• Primary Examiner(s): Peeso; Thomas R.
• Application Number:
  US10/351,935
• Time in Patent Office: 1,555 Days
• Field of Search: 713/151, 713/152, 713/164, 713/166
• US Class Current: 713/151
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 65/1016 IP multimedia subsystem [IMS]
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04L 65/70 Media network packetisation

Abstract

According to one aspect of the present invention there is provided a method of preparing second protocol data for transmitting over a first protocol network comprising the steps of compressing the data to be transmitted in accordance with the first protocol, to produced first protocol compressed data and encrypting the first protocol compressed data in accordance with the first protocol to produce first protocol compressed and encrypted data. The invention consists of a means for the client to indicate to the first hop proxy that it wishes S/MIME encryption to be applied to part of an outgoing message. The first hop proxy then applies this encryption on behalf of the client. The encryption is therefore applied after the message has traversed the end terminal link. On the first proxy link, the message is sent without S/MIME encryption and can therefore benefit from compression (before the first hop IPSEC encryption is applied). A second aspect of the invention allows the support of end-to-end compression to be negotiated between end devices so that SIP compression can be applied to data before it is encrypted using S/MIME by the end system.

Claims

1. A method of preparing second protocol data for transmitting over a first protocol network comprising the steps of:

compressing the data to be transmitted in accordance with the first protocol, to produce first protocol compressed data; and

encrypting the first protocol compressed data in accordance with the first protocol to produce first protocol compressed and encrypted data;

wherein the method further comprises transmitting the second protocol data from a first end terminal supporting a second protocol to a second end terminal supporting a second protocol via the first protocol network.

2. The method of claim 1, further comprising transmitting the second protocol data from the first end terminal to a first proxy and then onto the network and from the network to a second proxy and then onto the second end terminal.

3. The method of claim 2, wherein compressing the data comprises compressing the data at a first end terminal and encrypting the data comprises encrypting the data at the first end terminal.

4. The method of claim 2, wherein compressing the data comprises compressing the data at a first end terminal and encrypting the data comprises encrypting the data at the first proxy.

5. The method of claim 1 wherein the first protocol is high bandwidth and the second protocol is low bandwidth.

6. The method of claim 1, wherein the first protocol is SIP and the second protocol is 3GPP packet data transport.

7. A method of transmitting second protocol data over a first protocol network comprising the steps of:

compressing the data to be transmitted in accordance with the first protocol, to produce first protocol compressed data;

encrypting the first protocol compressed data in accordance with the first protocol to produce first protocol compressed and encrypted data; and

transmitting the second protocol data from a first end terminal supporting a second protocol to a second end terminal supporting a second protocol over the first protocol network.

8. The method of claim 7, further comprising transmitting the second protocol data from the first end terminal to a first proxy and then onto the network and from the network to a second proxy and then onto the second end terminal.

9. The method of claim 8, wherein compressing the data comprises compressing the data at a first end terminal and encrypting the data comprises encrypting the data at the first end terminal.

10. The method of claim 9, wherein compressing the data comprises compressing the data at a first end terminal and encrypting the data comprises encrypting the data at the first proxy.

11. A method of receiving second protocol data which has been compressed and encrypted in accordance with a first protocol and which has been transmitted over a first protocol network comprising the steps of decrypting the first protocol compressed data in accordance with the first protocol and decompressing the data to be transmitted in accordance with the first protocol.

12. The method of claim 11, wherein the data has been transmitted from a first end terminal supporting a second protocol to a second end terminal supporting a second protocol via the network supporting the first protocol.

13. The method of claim 12, wherein the data has been transmitted from the first end terminal to a first proxy and then onto the network and from the network to a second proxy and then onto the second end terminal.

14. The method of claim 13, wherein decompressing the data comprises decompressing the data at a second end terminal and decrypting the data comprises decrypting the data at the second end terminal.

15. The method of claim 14, wherein decompressing the data comprises decompressing the data at a second end terminal and decrypting the data comprises decrypting the data at the second proxy.

16. Apparatus for preparing second protocol data for transmission over a first protocol network comprising:

a compressor for compressing the data to be transmitted in accordance with the first protocol, to produce first protocol compressed data; and

an encryptor for encrypting the first protocol compressed data in accordance with the first protocol to produce first protocol compressed and encrypted data;

wherein the apparatus is configured to transmit the second protocol data from a first end terminal supporting a second protocol to a second end terminal supporting a second protocol via the first protocol network.

17. The apparatus of claim 16, wherein the second protocol data is transmitted from the first end terminal to a first proxy and then onto the network and from the network to a second proxy and then onto the second end terminal.

18. The apparatus of claim 17, wherein the compressor and the encryptor are located at the first end terminal.

19. The apparatus of claim 17, wherein the compressor is located at the first end terminal and the encryptor is located at the first proxy.

20. Apparatus for receiving second protocol data which has been compressed and encrypted in accordance with a first protocol and which has been transmitted over a first protocol network, the apparatus being configured to decrypt the first protocol compressed data in accordance with the first protocol and decompress the data received in accordance with the first protocol, wherein the apparatus is further configured to receive the data from a first end terminal supporting a second protocol at a second end terminal supporting a second protocol via the first protocol network.

21. The apparatus of claim 20, wherein the data has been transmitted from the first end terminal to a first proxy and then onto the network and from the network to a second proxy and then onto the second end terminal.

22. The apparatus of claim 21, wherein decompressing the data comprises decompressing the data at a second end terminal and decrypting the data comprises decrypting the data at the second end terminal.

23. The apparatus of claim 22, wherein decompressing the data comprises decompressing the data at a second end terminal and decrypting the data comprises decrypting the data at the second proxy.

24. A system for transmitting data of a second protocol type over a first protocol type network, where in the system includes first and second end terminals which support the second protocol data, first and second proxy intermediate the respective end terminals and the network and a network supporting a first protocol and where in data is transmitted from the first terminal to the second terminal via the proxies and the network and wherein the data is firstly compressed and secondly encrypted in accordance with the first protocol before being transmitted on the network.

25. A program for a computer in a machine readable form having code portion arranged to perform the steps of preparing second protocol data for transmitting over a first protocol network comprising the steps of:

compressing the data to be transmitted in accordance with the first protocol, to produce first protocol compressed data; and

encrypting the first protocol compressed data in accordance with the first protocol to produce first protocol compressed and encrypted data;

wherein the method further comprises transmitting the second protocol data from a first end terminal supporting a second protocol to a second end terminal supporting a second protocol via the first protocol network.

26. A program for a computer in a machine readable form having code portion arranged to perform the steps of transmitting second protocol data over a first protocol network comprising the steps of:

compressing the data to be transmitted in accordance with the first protocol, to produce first protocol compressed data;

encrypting the first protocol compressed data in accordance with the first protocol to produce first protocol compressed and encrypted data; and

transmitting the second protocol data from a first end terminal supporting a second protocol to a second end terminal supporting a second Protocol over the first protocol network.