Enterprise instant message aggregator

• US 7,890,084 B1
• Filed: 10/30/2006
• Issued: 02/15/2011
• Est. Priority Date: 10/30/2006
• Status: Active Grant

• Current Assignee: Cellco Partnership, Inc. (Verizon Communications Inc.)
• Original Assignee: Cellco Partnership, Inc. (Verizon Communications Inc.)
• Inventors: Patel, Biren, Dudziak, Thaddeus Jude, Kupsh, Jerry
• Primary Examiner(s): DESIR, PIERRE LOUIS
• Application Number:
  US11/589,309
• Time in Patent Office: 1,569 Days
• Field of Search: 455/466, 455/561, 455/415, 455/411
• US Class Current: 455/411
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic

Abstract

A disclosed enterprise instant messaging (IM) service aggregator enables validation of mobile stations and/or users for enterprise IM service through a wireless communication network; and in the examples, the enterprise IM service provides a secure messaging environment that allows IM traffic to/from wireless mobile stations. The security offered may be unique to and controlled by each enterprise, for example, by enabling each enterprise to generate its own encryption key for distribution through the aggregator and by allowing mobile stations to generate their own keys for distribution back through the aggregator to the enterprise IM servers. As disclosed, the login credentials are encrypted from the mobile station to the enterprise IM server. The use of standard encryption methods within the call flows allows a simple method of ensuring that only authorized users can access the enterprise servers and that the messages will be encrypted by the strongest possible means.

Claims

1. A mobile communication network, comprising:

a wireless data network; and

an enterprise instant messaging (IM) service aggregator, the aggregator comprising;

at least one enterprise gateway aggregating secure connections to and from secure links coupled to IM servers of a plurality of enterprise communities, for enterprises subscribing to mobile IM service through the communication network;

at least one mobile station gateway coupled to the wireless data network of the communication network serving a plurality of mobile stations, the at least one mobile station gateway aggregating sessions for mobile stations of users affiliated with the enterprise communities; and

a service control connected to the enterprise and mobile gateways to control IM sessions between mobile stations and the IM servers of the enterprise communities through the mobile communication network, wherein the service control is configured to;

validate authorization of one mobile station attempting to access enterprise IM service of the mobile communication network;

for the validly authorized one mobile station, encrypt login information of a user of the authorized mobile station and forward the encrypted login information to an identified one of the IM servers for enterprise validation of user authentication for access to the identified IM server;

responsive to the user of the one mobile station being successfully validated by the identified IM server, provide a key of the aggregator to the one mobile station for use in communication of a security key of the one mobile station to the identified IM server, the security key of the one mobile station being for use in encrypted communications of one or more IM messages at least through the mobile communication network between the one mobile station and the identified IM server; and

receive a message from an IM server of one of the enterprises indicating that service to an identified mobile station should be terminated, and in response, transmit an instruction through the wireless data network to the identified mobile station instructing the identified mobile station to remove all IM messages and/or enterprise IM credentials from the identified mobile station.

2. The mobile communication network of claim 1, wherein the at least one mobile station gateway comprises:

a gateway server coupled between the service control and an IM server of the communication network, for mobile stations having a predetermined configuration; and

a gateway server coupled between the service control and the wireless data network, for mobile stations of a configuration different from the predetermined configuration.

3. The mobile communication network of claim 2, wherein the predetermined configuration comprises an operating system of a predetermined type running on mobile stations.

4. The mobile communication network of claim 3, wherein:

the operating system comprises the Binary Runtime Environment for Wireless (BREW) operating system; and

mobile stations having the different configuration are non-BREW devices.

5. The mobile communication network of claim 1, wherein the service control is further configured to provide a message to initiate provisioning through the wireless data network to a mobile station attempting access that is not yet authorized for enterprise IM service through the mobile communication network.

6. The mobile communication network of claim 1, wherein the service control is further configured to provide a protocol conversion, between a protocol used for IM communication for the mobile station and a protocol used for IM communication for the identified IM server.

7. A mobile communication network for a carrier, comprising

a wireless data network;

a provisioning system of the carrier; and

an enterprise instant messaging (IM) service aggregator, the aggregator comprising;

at least one enterprise gateway aggregating secure connections to and from secure links coupled to IM servers of a plurality of enterprise communities, for enterprises subscribing to mobile IM service through the communication network;

at least one mobile station gateway coupled to the wireless data network of the communication network serving a plurality of mobile stations, the at least one mobile station gateway aggregating sessions for mobile stations of users affiliated with the enterprise communities; and

a service control connected to the enterprise and mobile gateways to control IM sessions between mobile stations and the IM servers of the enterprise communities through the mobile communication network, wherein the service control is configured to;

receive a first request for enterprise service from a requesting mobile station, in the service control;

determine whether or not the requesting mobile station is authorized to utilize the enterprise IM service through the mobile communication network;

in response to a determination that the requesting mobile station is not authorized to utilize the enterprise IM service through the mobile communication network, initiate a communication between the requesting mobile station and the provisioning system of the carrier providing the IM service through the mobile wireless communication network, to provision the requesting mobile station for enterprise IM service through the mobile communication network; and

after successful completion of communication to provision of the requesting mobile station for enterprise IM service, establish a two-way encrypted secure communication link through the mobile communication network, between an IM server of an identified one of a plurality of enterprise IM communities served by the network and the requesting mobile station for exchange of encrypted IM message payload data;

wherein to establish the two-way encrypted secure communication link, the service control is further configured to provide a key of the aggregator to the requesting mobile station for use in communication of a security key of the requesting mobile station to the IM server of the identified IM community, the security key of the requesting mobile station being for use in encrypted communications of one or more IM messages at least through the mobile communication network between the requesting mobile station and the IM server of the identified enterprise IM community and

wherein the service control is further configured to receive a message from an IM server of one of the enterprises indicating that service to an identified mobile station should be terminated, and in response, transmit an instruction through the wireless data network to the identified mobile station instructing the identified mobile station to remove all IM messages and/or enterprise IM credentials from the identified mobile station.

8. The mobile communication network of claim 7, wherein to establish the two-way encrypted secure communication link, the service control is further configured to:

receive a second request for enterprise service from the requesting mobile station, in the service control;

check whether or not the requesting mobile station is authorized to utilize the enterprise IM service through the mobile communication network; and

upon determining that the requesting mobile station is authorized to utilize the enterprise IM service through the mobile communication network, establish the two-way encrypted secure communication link through the mobile communication network, between the IM server of the identified enterprise IM community and the requesting mobile station for the exchange of the encrypted IM message payload data.