Telecommunication system, for example an IP telecommunication system, and equipment units for use in the system

• US 7,991,993 B2
• Filed: 04/01/2003
• Issued: 08/02/2011
• Est. Priority Date: 04/02/2002
• Status: Active Grant

• Current Assignee: WSOU Investments, LLC (WSOU Holdings, LLC)
• Original Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Inventors: Duquerroy, Laurence, Josset, Sebastien
• Primary Examiner(s): Song, Hosuk
• Assistant Examiner(s): Zee, Edward
• Application Number:
  US10/403,083
• Publication Number:
  US 20030188159A1
• Time in Patent Office: 3,045 Days
• Field of Search: 713/163, 713/153, 713/154, 713/162, 380/270, 380/278, 380/279, 719/328, 726/12
• US Class Current: 713/153
• CPC Class Codes: H04L 12/1836 with heterogeneous network architecture
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Abstract

The invention relates to a telecommunication system including a plurality of terminals divided into groups such that within each group each terminal can send multidestination messages to the other members of the group. Each terminal of a group is associated with encryption and decryption means so that each terminal can send multidestination messages that can be decrypted only by the other terminals of the group. The system includes a central server for distributing to each encryption and decryption means keys for secure transmission of communications within each group.

Claims

1. A telecommunication system including a plurality of terminals divided into groups and connected to a first telecommunication network, such that within a first group each terminal of said first group is configured to send multidestination messages to other terminals of said first group, wherein each terminal of said first group is associated with an encryption and decryption device so that each terminals of said first group is configured to send multidestination messages via the first telecommunication network that can only be decrypted by the other terminals of said first group,

wherein said plurality of terminals are connected to a terrestrial cable network and are configured to supply messages received from said first telecommunication network and decrypted by the respective encryption and decryption device to said cable network, and further configured to supply messages received from said cable network and encrypted by the respective encryption and decryption device to said first telecommunication network, and

the system further including a central server configured to distribute encryption and decryption keys to each encryption and decryption device for secure transmission of communications within each group.

2. The system claimed in claim 1, wherein the multidestination messages transmitted are transmitted in accordance with a network protocol.

3. The system claimed in claim 2, wherein said network protocol is chosen from the group comprising the following protocols:

IP, ATM, MPLS, Ethernet, PEP, PPPoE.

4. The system claimed in claim 1, wherein said plurality of terminals are interconnected by a broadcast network via satellite, or a local area network.

5. The system claimed in claim 4, wherein said plurality of terminals are configured to supply encrypted messages to said broadcast network or to said local area network.

6. The system claimed in claim 4, wherein said central server is connected to said plurality of terminals by said broadcast network.

7. The telecommunication system claimed in claim 1, wherein the central server transmits security elements to each multidestination message sender and receiver such that each sender is configured to encrypt said multidestination messages and each receiver is configured to decrypt the multidestination messages received so that a plurality of addressees in a group can receive the received encrypted messages simultaneously.

8. The telecommunication system claimed in claim 7, wherein said multidestination messages are network protocol packets.

9. The telecommunication system claimed in claim 7, wherein the telecommunication system is connected to a network for secure confidential transmission of said security elements to each message sender and receiver in a single-destination and/or multidestination mode.

10. The telecommunication system claimed in claim 9, wherein the security elements to be transmitted are from the group comprising:

functions and keys to be used to protect or to modify packets, packet encapsulation formats, filter data defining the packet destination group, and data relating to the service life of the security element.

11. The telecommunication system claimed in claim 10, wherein said security functions and modifications made to said network packets by said functions are separate and form strung units.

12. The telecommunication system claimed in claim 11, wherein the telecommunication system eliminates, adds, or replaces at least one unit.

13. The telecommunication system claimed in claim 11, wherein said strung units are from the group comprising:

the Encapsulating Security Payload Internet Protocol Security (ESP IPSec) protocol, the Authentication Header Internet Protocol Security (AH IPSec) protocol, encryption, authentication, tunnel mode, a spoofer Transmission Control Protocol (TCP) protocol, a proxy Internet Group Management Protocol (IGMP) protocol, and a Drop protocol.

14. The telecommunication system claimed in claim 7, wherein during a first phase of transmitting security elements to each multidestination message sender and receiver, said server communicates using single-destination messages with said senders and receivers using single-destination messages for the purposes of mutual authentication and setting up an encrypted tunnel.

15. The telecommunication system claimed in claim 14, wherein during a second phase of transmitting security elements to each multidestination message sender and receiver, configuration messages are sent to each sender and receiver in single-destination mode.

16. The telecommunication system claimed in claim 14, wherein multidestination configuration messages are sent to a plurality of senders and receivers during another phase.

17. The telecommunication system claimed in claim 7, wherein successful transmission of security elements to each sender and receiver of multidestination or single-destination messages is ensured.

18. The telecommunication system claimed in claim 17, wherein successful transmission of security elements to each sender and receiver of multidestination or single-destination messages is ensured by transmitting again a message not acknowledged by its addressee after a predetermined time.

19. The telecommunication system claimed in claim 18, wherein said security elements are sent to each sender/receiver using a multidestination message and each destination sender/receiver is associated with a predetermined acknowledgement time, which differs from one addressee to another, so that said server does not receive a plurality of negative acknowledgement signals simultaneously.

20. The telecommunication system claimed in claim 17, wherein successful transmission of security elements to each sender and receiver of multidestination or single-destination messages is ensured by associating a sequence number with each message.

21. The telecommunication system claimed in claim 20, wherein successful transmission of security elements to each sender and receiver of multidestination or single-destination messages is ensured by receiving acknowledgement messages including the sequence numbers of corresponding sent messages and for sending again messages corresponding to sequence numbers that have not been acknowledged.

22. The telecommunication system claimed in claim 20, wherein successful transmission of security elements to each sender and receiver of multidestination or single-destination messages is ensured by, for multidestination messages, detecting negative acknowledgements from senders/receivers indicating that they have not received messages for a given sequence number and transmitting again messages corresponding to the negative acknowledgements.

23. The system claimed in claim 4, wherein said broadcast network is a radio broadcast network.

24. The system claimed in claim 4, wherein said local area network is an Ethernet local network.

25. The telecommunication system claimed in claim 10, wherein said functions and keys to be used to protect packets encrypt, decrypt and authenticate packets.

26. The telecommunication system claimed in claim 10, wherein said packet encapsulation formats are IP formats.

27. An encryption and decryption device associated with a first terminal among a plurality of terminals, the encryption and decryption device including:

an interface connected to a first telecommunication network, configured to receive and send encrypted messages between the first terminal and at least a second terminal from among the plurality of terminals via said first telecommunication network,

an interface connected to a second network, configured to receive messages sent from at least said second terminal, via said second network, wherein messages are to be encrypted by said encryption and decryption device and transmitted by the first telecommunication network to the first terminal, and to deliver to at least said second terminal via the second network, messages received from the first terminal via said first telecommunication network that have been decrypted by said encryption and decryption device, and

an interface configured to receive encryption and decryption keys from a server, said encryption keys being used to encrypt a multidestination message to selected addressees forming part of the same group as said first terminal with which said encryption and decryption device is associated.

28. The device claimed in claim 27, wherein said first network is a radio or cable network or a satellite network, and said second network is a cable network.

29. The device claimed in claim 27, wherein a control plane and a data plane of said device are separate.

30. The device claimed in claim 27, wherein said messages are network protocol packets.

31. The device claimed in claim 30, wherein secure IP packets are sent in tunnel mode.

32. The device claimed in claim 31, wherein encrypted IP packets are transmitted with a first header relating to routing and a second header is addressed relating to security data of said encrypted IP packets.

33. The device claimed in claim 31, wherein second headers are sent and received with security data from the group comprising:

identification data enabling a terminal receiving said second headers to determine functions and keys to be used to return each secure IP packet that has been received to its original form and to verify its integrity and its source, data relating to segmentation of said secure IP packets, data relating to the service life of session keys, and a packet number.

34. The device claimed in claim 27, wherein the interface for said connection to said first telecommunication network is connected directly to an interface of a terminal of said second network.

35. A non-transitory computer readable storage medium storing a computer executable program comprising program code configured to carry out the functions of the encryption and decryption device according to claim 27, and is integrated into a network software stack of a terminal of said first telecommunication network.