Secure transport for mobile communication network

• US 7,827,597 B2
• Filed: 10/19/2007
• Issued: 11/02/2010
• Est. Priority Date: 01/08/2002
• Status: Expired due to Term

• Current Assignee: Seven Networks LLC (SoftBank Group Corp.)
• Original Assignee: Seven Networks Inc
• Inventors: Boynton, Lee R., Burke, Scott M., Fiatal, Trevor A., Sikes, Mark
• Primary Examiner(s): SMITHERS, MATTHEW
• Application Number:
  US11/875,785
• Publication Number:
  US 20080037787A1
• Time in Patent Office: 1,110 Days
• Field of Search: 726/11
• US Class Current: 726/4
• CPC Class Codes: H04B 7/04 using two or more spaced independent antennas
• CPC Class Codes: H04B 7/0417 Feedback systems
• CPC Class Codes: H04B 7/0617 for beam forming
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 51/58 Message adaptation for wireless communication
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 4/12 : Messaging; Mailboxes; Announcements
• CPC Class Codes: H04W 52/0261 : managing power supply demand, e.g. depending on battery level
• CPC Class Codes: H04W 76/10 : Connection setup
• CPC Class Codes: H04W 88/06 : adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals
• CPC Class Codes: Y02D 10/00 : Energy efficient computing, e.g. low power processors, power management or thermal management
• CPC Class Codes: Y02D 30/70 : in wireless communication networks

Abstract

A communication network encrypts a first portion of a transaction associated with point-to-point communications using a point-to-point encryption key. A second portion of the transaction associated with end-to-end communications is encrypted using an end-to-end encryption key.

Claims

1. A method for encrypting channels of data in a transaction comprising:

encryption of a first data channel in the transaction using a first security association known by a network intermediary device;

encryption of a second data channel in the transaction using a second security

association known by a network endpoint device but unknown to the network intermediary device,

wherein the first data channel consists of control data and the second data channel consists of payload data.

2. The method according to claim 1 wherein the first data channel consists of point-to-point data and the second data channel consists of end-to-end data.

3. The method according to claim 1 wherein the control data in the first data channel includes transaction authentication and routing information and the payload data in the second data channel includes the contents of email messages or electronic files.

4. The method according to claim 1 further comprising:

negotiating a first encryption key with the network intermediary device, the first encryption key used for encrypting/decrypting the control data in the first data channel; and

negotiating a second encryption key with the network endpoint device, the second encryption key used for encrypting/decrypting the payload data in the second data channel.

5. The method according to claim 1 further comprising leaving a third data channel in the transaction unencrypted.

6. The method according to claim 1 further comprising:

separating different items in the transaction into different data channels;

assigning different security associations to the different data channels;

encoding the separated items into data groups;

encrypting some or all of the data groups according to the security associations assigned to the data channels; and

encoding the processed data groups into one or more packets.

7. The method according to claim 1 further comprising:

encoding a first set of packets containing the control data in the first channel;

encoding a second set of packets containing the payload data in the second channel; and

encoding a packet header that contains unencrypted data, the packet header used for transporting the first and second set of packets to the network intermediary device and at least partially used to transport at least the second set of packets from the network intermediary device to the network endpoint device.

8. A network processing device, comprising:

one or more processors configured to;

receive a transaction from a first network device containing a first portion of data encrypted using a first known encryption key and a second portion of data encrypted using a second unknown encryption key;

decrypt the first portion of data using the first encryption key while the second portion of data remains encrypted;

using the decrypted first portion of data to authenticate the transaction; and

forwarding at least a portion of the transaction to a second network device when the transaction is authenticated.

9. The network processing device according to claim 8 wherein the one or more processors are further configured to negotiate the first encryption key with the first network device.

10. The network processing device according to claim 9 wherein the one or more processors are further configured to negotiate a third encryption key with the second network device, the first encryption key unknown to the second network device and the third encryption key unknown to the first network device.

11. The network processing device according to claim 10 wherein the one or more processors are further configured to re-encrypt at least some of the decrypted first portion of data using the third encryption key, and send both the re-encrypted first portion of data with the encrypted second portion of data to the second network device.

12. The network processing device according to claim 11 wherein the transaction includes a third unencrypted portion of data, the one or more processors further configured to combine at least some of the decrypted first portion of data with the third unencrypted portion of data and send the combined first and third portion of data to the second network device.

13. A method for encrypting information, comprising:

negotiating a first encryption key with a first endpoint;

receiving a transaction from the first endpoint containing control data encrypted using the first encryption key and payload data encrypted using a second unknown encryption key; and

decrypting the control data to determine how to process and relay the transaction over a network to a second endpoint while the payload data remains encrypted.

14. The method according to claim 13 further comprising:

negotiating a third encryption key with the second endpoint;

re-encrypting at least some of the decrypted control data into new encrypted control data using the third encryption key; and

relaying both the re-encrypted control data and the encrypted payload data to the second endpoint.

15. The method according to claim 13 further comprising:

receiving unencrypted data in the transaction;

re-encrypting the control data using a third encryption key

combining the re-decrypted control data with the unencrypted data; and

relaying the re-encrypted control data, unencrypted data, and encrypted payload data to the second endpoint.

16. An apparatus comprising a non-transitory computer-readable medium having instructions, when executed by a processor or multiple communicating processors, perform a method comprising:

negotiating a first encryption key with a first endpoint;

negotiating a second encryption key with a second endpoint;

receiving a transaction from the first endpoint directed to the second endpoint, the transaction including a first portion of data encrypted using the first encryption key and including a second portion of data encrypted using an unknown encryption key;

decrypting the first portion of data using the first encryption key;

re-encrypting at least some of the first portion of decrypted data using the second encryption key; and

forwarding the re-encrypted data and the encrypted second portion of data to the second endpoint.

17. The apparatus according to claim 16 further comprising:

separating items in the received transactions into channels associated with different security associations;

encoding the items in each channel into bit arrays; and

encrypting or decrypting the bit arrays for each channel according to the associated security associations.

18. The apparatus according to claim 16 further comprising:

using an encryption schema to associate different types of items in the transactions with different security associations;

encrypting or decrypting items in various received or transmitted transactions according to the encryption schema.

19. The apparatus according to claim 16 further comprising:

receiving a third portion of data in the transaction that is unencrypted; and

forwarding the third portion of unencrypted data to the second endpoint.