Secure communications across multiple protocols

• US 7,546,460 B2
• Filed: 03/30/2005
• Issued: 06/09/2009
• Est. Priority Date: 03/30/2005
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Maes, Stephane H.
• Primary Examiner(s): JUNG, DAVID YIUK
• Application Number:
  US11/095,703
• Publication Number:
  US 20060230266A1
• Time in Patent Office: 1,532 Days
• Field of Search: 713/168, 713/150, 713/153
• US Class Current: 713/168
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

Systems, methods, and devices for secure communications across multiple protocols are disclosed. In one embodiment, the method comprises receiving, at an access device, an encryption key. The access device analyzes the communication to determine a portion of the communication to be encrypted and to determine an additional portion of the communication to remain unencrypted by the first encryption process. The method further comprises encrypting the portion of the communication using the first encryption process and the encryption key, and transmitting the communication from the access device.

Claims

1. A method of providing secure communications across multiple protocols, comprising:

analyzing, using an access device, a communication to be transmitted to a destination using a first protocol to determine a first portion of the communication to encrypt using a first encryption process and to determine an additional portion of the communication to remain unencrypted by the first encryption process;

encrypting, using the access device, the first portion of the communication using the first encryption process and a determined encryption key; and

after the encrypting, transmitting the communication from the access device to the destination using the first protocol, the communication including the encrypted first portion and the additional portion unencrypted by the first encryption process,

wherein an intermediate component between the access device and the destination is able to convert the unencrypted additional portion from a first protocol to a second protocol, without decrypting the first portion, and transmit the communication to the destination using the second protocol.

2. The method of claim 1, wherein determining the first portion comprises determining a payload portion of the communication.

3. The method of claim 1, wherein determining the first portion comprises determining a message portion of the communication.

4. The method of claim 1, wherein determining the first portion comprises determining at least one argument included in the communication, the argument shared by the first protocol and the second protocol.

5. The method of claim 1, wherein transmitting the communication comprises transmitting an email communication, the first portion including a message portion of the email communication and the additional portion including commands associated with a mobile email protocol.

6. The method of claim 1, further comprising, before transmitting the communication, compressing the first portion of the communication.

7. The method of claim 1, further comprising:

receiving, with the access device, device provisioning information; and

extracting the encryption key from the device provisioning information.

8. The method of claim 1, further comprising:

receiving the communication from the access device at an intermediate server;

converting, at the intermediate server, the additional portion of the communication from the first protocol to the second protocol without decrypting the first portion; and

after the converting, transmitting the communication from the intermediate server to the destination,

wherein the destination is an application server.

9. The method of claim 8, wherein the communication comprises an email, and wherein converting the additional portion comprises converting the additional portion from a mobile email protocol to one of Internet Mail Access Protocol (IMAP) or Post Office Protocol (POP).

10. The method of claim 8, further comprising:

receiving the communication at the application server;

obtaining a decryption key; and

decrypting, at the application server, the portion of the communication using the decryption key.

11. The method of claim 1, further comprising:

receiving, at the access device, an updated encryption key;

encrypting, at the access device, a portion of a second communication using the updated encryption key; and

after the encrypting, transmitting the second communication from the access device, the second communication including the encrypted portion and an additional portion of the second communication.

12. The method of claim 11, wherein transmitting the second communication comprises transmitting the second communication on a first communication channel and wherein receiving the updated encryption key comprises receiving the encryption key on a second communication channel.

13. The method of claim 11, wherein receiving the updated encryption key comprises receiving an encrypted communication including the updated encryption key.

14. The method of claim 1, further comprising:

receiving a second communication at the access device; and

decrypting a first portion of the second communication using the encryption key.

15. A method of providing secure communications across multiple protocols, comprising:

analyzing, using an application server, a communication to be transmitted using a first protocol to determine a portion of the communication to encrypt using a first encryption process and to determine an additional portion to remain unencrypted by the first encryption process;

encrypting, using the encryption key and the first encryption process at the application server, the first portion of the communication to be transmitted to an access device via an intermediate server; and

after the encrypting, transmitting the communication to the intermediate server using the first protocol, the communication including the encrypted first portion and the additional portion unencrypted by the first encryption process,

wherein the intermediate server is able to convert the unencrypted additional portion from a first protocol to a second protocol, without decrypting the first portion, and transmit the communication to the access device using the second protocol.

16. The method of claim 15, further comprising:

obtaining the encryption key by negotiating with the access device.

17. The method of claim 15, further comprising:

receiving, at the application server, a device capability communication, the device capability communication including configuration information for the access device; and

wherein the encryption key is obtained by determining the encryption key based at least in part on information included in the device capability communication.

18. The method of claim 15, wherein the encryption key is obtained by determining the encryption key based at least in part on device setting information.

19. An access device for sending and receiving communications across multiple protocols, comprising:

a processor;

memory for storing an encryption key and instructions that, when executed by the processor, provide logic for analyzing a communication to determine a first portion of the communication to be encrypted using a first encryption process, to determine an additional portion of the communication to remain unencrypted by the first encryption process, the instructions when executed further providing logic for encrypting the first portion using the encryption key and the first encryption process; and

a communication component to transmit the communication to a destination using a first protocol, the communication including the encrypted first portion and the additional portion unencrypted by the first encryption process,

wherein an intermediate component between the access device and the destination is able to convert the unencrypted additional portion from a first protocol to a second protocol, without decrypting the first portion, and transmit the communication to the destination using the second protocol.

20. The access device of claim 19, wherein the access device comprises a wireless device.

21. The access device of claim 20, wherein the wireless device comprises a mobile telephone.

22. An application server, comprising:

a processor;

memory storing instructions that, when executed by the processor, provide application logic to obtain an encryption key and to encrypt a first portion of a communication using the encryption key and a first encryption process; and

a communications interface operable to transmit the communication to an intermediate server using a first protocol for forwarding to a destination access device, the communication including the encrypted first portion and an additional portion not encrypted by the first encryption process,

wherein the intermediate server is able to convert the unencrypted additional portion from a first protocol to a second protocol, without decrypting the first portion, and transmit the communication to the destination access device using the second protocol.

23. The application server of claim 22, further comprising a data storage to store device setting information for the access device and wherein the application logic is configured to obtain the encryption key by determining the encryption key based at least in part on the device setting information.

24. A system of providing secure communications across multiple protocols, comprising:

an access device operable to encrypt a first portion of a communication using a first encryption process and to transmit the communication to an intermediate server using a first protocol, the communication including the encrypted first portion and an additional portion not encrypted by the first encryption process;

the intermediate server, communicatively coupled with the access device, operable to convert the additional portion from first protocol to a second protocol and to transmit the converted communication to an application server using the second protocol; and

the application server, communicatively coupled with the intermediate server, the application server configured to receive the communication in the second protocol and decrypt the encrypted portion of the communication.