Method and system for ensuring secure forwarding of messages

• US 8,037,302 B2
• Filed: 09/27/2002
• Issued: 10/11/2011
• Est. Priority Date: 09/28/2001
• Status: Active Grant

• Current Assignee: MPH Technologies Oy
• Original Assignee: MPH Technologies Oy
• Inventors: Vaarala, Sami, Nuopponen, Antti, Pietikainen, Panu
• Primary Examiner(s): Barron, Jr., Gilberto
• Assistant Examiner(s): ALMEIDA, DEVIN E
• Application Number:
  US10/490,933
• Publication Number:
  US 20050177722A1
• Time in Patent Office: 3,301 Days
• Field of Search: 713/160, 713/162, 713/151, 713/171
• US Class Current: 713/160
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 60/00 Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
• CPC Class Codes: H04W 76/10 Connection setup
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]

Abstract

The method is for ensuring secure forwarding of a message is performed in a telecommunication network that has at least one terminal from which the message is sent and at least one other terminal to which the message is sent. One or more secure connections are established between different addresses of the first terminal and address of the other terminal. The connections define at least said addresses of the two terminals. When the first terminal moves from one address to another address, a secure connection, which endpoints are the new address of the first terminal and the address of the other terminal, is registered to be at least one of the active connections.

Claims

1. A method for ensuring secure forwarding of a message in a telecommunication network, comprising:

providing a first terminal from which the message is sent and a second terminal to which the message is sent,

a) establishing a first secure connection as being an active connection and extending between a first network address of the first terminal and an original network address of the second terminal, establishing a second secure connection extending between a second network address of the first terminal and the original network address of the second terminal,

b) the first terminal changing from the first network address to the second network address,

the first terminal checking whether the second secure connection already exists, and

c) when the second secure connection already exists, the second terminal registering the already established second secure connection as being the active connection without having to reestablish the second secure connection.

2. The method of claim 1, wherein the method further comprises establishing the second secure connection when the second secure connection does not already exist.

3. The method of claim 1, wherein the method further comprises establishing the first secure connection by using IPSec protocols.

4. The method of claim 1, wherein the method further comprises providing the message with IP packets.

5. The method of claim 1, wherein the method further comprises checking whether a secure connection between the new network address and the second terminal already exists.

6. The method of claim 5, wherein the method further comprises checking by using a connection table.

7. The method of claim 1, wherein the method further comprises using a signaling message or signaling message exchange between the first terminal and the second terminal.

8. The method of claim 1, wherein the method further comprises automatically updating the new network address of the first terminal by the second terminal when the first terminal sends a message from the new network address.

9. The method of claim 1, wherein the method further comprises using a key exchange when establishing the first secure connection.

10. The method of claim 2, wherein the method further comprises using a key exchange performed with Internet Key Exchange (IKE).

11. The method of claim 1, wherein the second secure connection is registered for immediate and/or later use.

12. The method of claim 11, wherein the registration for later use is made by the second terminal in a connection table.

13. The method of claim 3, wherein the method further comprises sending the message to secure traffic between a mobile computer and a destination computer.

14. The method of claim 13, wherein the method further comprises using a tunneling protocol together with IPSec to provide a tunneling capability.

15. The method of claim 14, wherein the method further comprises using a Layer 2 Tunneling Protocol (L2TP) tunneling protocol together with IPSec to provide a tunneling capability.

16. The method of claim 3, wherein the method further comprises using an IPSec tunnel mode to secure traffic between a mobile computer and a destination computer.