Security control in a communication system

• US 8,825,998 B2
• Filed: 04/17/2007
• Issued: 09/02/2014
• Est. Priority Date: 04/18/2006
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Lescuyer, Pierre, Lucidarme, Thierry
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): HOLMES, ANGELA R
• Application Number:
  US11/787,498
• Publication Number:
  US 20080072034A1
• Time in Patent Office: 2,695 Days
• Field of Search: 713/153, 713/166, 713/168, 726/26, 380/258, 455/456.1, 455/410
• US Class Current: 713/153
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04W 12/00 Security arrangements; Authentication; Protecting privacy or anonymity
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 12/67 Risk-dependent, e.g. selecting a security level depending on risk profiles

Abstract

A method includes controlling security in a communication system that involves a node capable of routing traffic according to one or more security algorithms with respective security levels. The node is adapted to estimate at least one safety degree relating to the node, to select at least one security algorithm of the one or more security algorithms, depending on the estimated safety degree; and to activate the at least one security algorithm.

Claims

1. A communication system comprising a plurality of nodes, each node capable of routing traffic in a communication system according to a plurality of security algorithms with respective security levels and comprising:

an estimation module for estimating at least one safety degree relating to the each node;

a selection module for selecting at least one security algorithm of the plurality of security algorithms, depending on the safety degree estimated by the estimation module; and

an activation module for activating the at least one security algorithm selected by the selection module,

wherein each node is connected to at least another node of the plurality of nodes.

2. The communication system as set forth in claim 1, wherein the selection module is arranged for selecting at least one security algorithm with a relatively low security level when the estimated safety degree is relatively high and for selecting at least one security algorithm with a relatively high security level when the estimated safety degree is relatively low.

3. The communication system as set forth in claim 1, wherein the security algorithm of the plurality comprise at least one of authentication, ciphering, or integrity algorithms.

4. The communication system as set forth in claim 1, wherein the estimation module takes account of a type of location in which the each node is placed.

5. The communication system as set forth in claim 1, wherein the estimation module takes account of a number of security attacks the each node faced in a previous time period.

6. The communication system as set forth in claim 1, wherein the estimation module takes account of a type of security attacks the each node faced in a previous time period.

7. The communication system as set forth in claim 1, wherein the estimation module takes account of subscription or equipment characteristics to which at least part of the traffic to be routed by the each node relates.

8. The communication system as set forth in claim 1, wherein the traffic to be routed by the node comprises a plurality of flows and wherein the estimation module is arranged for estimating a safety degree for each of the plurality of flows respectively.

9. The communication system as set forth in claim 1, comprising means for at least partially disabling the node when the estimated safety degree is below a predetermined value.

10. The communication system as set forth in claim 1, wherein the node is arranged for being connected to at least another node of the communication system, and wherein the estimation module is arranged for estimating the safety degree by taking account of a safety degree relating to at least the other node.

11. The communication system as set forth in claim 10, comprising a sending module for sending at least another node of the communication system an estimated safety degree related to the at least another node.

12. The communication system as set forth in claim 10, comprising means for detecting a change in the related estimated safety degree and means for informing at least another node of the communication system accordingly.