Secure communication of information over a wireless link

• US 9,002,010 B2
• Filed: 09/10/2009
• Issued: 04/07/2015
• Est. Priority Date: 09/10/2009
• Status: Active Grant

• Current Assignee: Lenovo International Limited (Lenovo Group Ltd.)
• Original Assignee: Lenovo Enterprise Solutions (Singapore) Pte., Ltd. (Lenovo Group Ltd.)
• Inventors: Campbell, Keith M., Kantesaia, Rajiv N., Pagan, William G., Stracuzza, Marc V., Womack, Michael N.
• Primary Examiner(s): Colin, Carl
• Assistant Examiner(s): LAVELLE, GARY E
• Application Number:
  US12/556,685
• Publication Number:
  US 20110058674A1
• Time in Patent Office: 2,035 Days
• Field of Search: 713/150, 713/153, 713/171, 726/22, 726/26, 380/262, 380/270, 380/283, 380/33
• US Class Current: 380/270
• CPC Class Codes: G06F 13/00 Interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units interface circuits for specific input/output devices G06F3/00 ; multiprogram control therefor G06F9/46; multiprocessor systems G06F15/16
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G11B 20/00862 wherein the remote server can grant the permission to use a content
• CPC Class Codes: G11B 20/00869 wherein the remote server can deliver the content to a receiving device
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]

Abstract

Secure communication of information over a wireless link with apparatus including a blade management module and a plurality of blade servers, the blade servers connected for data communications with the blade management module through at least one wired link, the blade servers also connected for data communications with the blade management module through at least one wireless link, including sharing an encryption key between the blade management module and one or more of the blade servers only through the at least one wired link connecting the blade management module to the one or more blade servers; encrypting information by the blade management module with the encryption key; transmitting the encrypted information by the blade management module to the one or more blade servers through the at least one wireless link; and decrypting the encrypted information by the blade server with the encryption key.

Claims

1. A method of secure communication of information over a wireless link,

the method carried out in apparatus that includes a blade management module and a plurality of blade servers, the blade servers connected for data communications with the blade management module through at least one wired link, the blade servers also connected for data communications with the blade management module through at least one wireless link,

the method comprising:

generating a separate encryption key by each of the plurality of blade servers;

generating a new encryption key by the blade management module periodically;

sharing the separate encryption key between the blade management module and the plurality of blade servers only through the at least one wired link connecting the blade management module to the blade servers, including transmitting, by each blade server that generated the separate encryption key, the separate encryption key generated by the blade server to the blade management module only through the at least one wired link connecting the blade management module to the blade server; and

periodically transmitting the new encryption key from the blade management module to the plurality of blade servers only through the at least one wired link connecting the blade management module to the plurality of blade servers;

encrypting information by the blade management module with the separate encryption key, including encrypting the information separately with each separate encryption key;

transmitting the encrypted information by the blade management module to the one or more blade servers through the at least one wireless link, including transmitting to each blade server encrypted information encrypted with the separate encryption key generated by the blade server to which the encrypted information is transmitted; and

transmitting the encrypted information to the plurality of blade servers only after each of the blade servers acknowledges receipt of the new encryption key; and

authorizing by the blade management module through the wireline connections between the blade management module and the blade servers only a subset of the blade servers in possession of the new encryption key to use the new encryption key to decrypt the encrypted information; and

decrypting the encrypted information with the new encryption key by each blade server in the subset of the blade servers.

2. The method of claim 1 wherein:

periodically transmitting the new encryption key further comprises sharing the new encryption key with all the blade servers in the apparatus only through the at least one wired link connecting the blade management module to the blade servers; and

transmitting the encrypted information further comprises broadcasting the same encrypted information to all the blade servers in the apparatus.

3. An apparatus for secure communication of information over a wireless link, the apparatus comprising:

a blade management module and a plurality of blade servers, the blade servers connected for data communications with the blade management module through at least one wired link, the blade servers also connected for data communications with the blade management module through at least one wireless link; and

a computer processor and a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions which when executed upon the computer processor cause the apparatus to function by;

generating a separate encryption key by each of the plurality of blade servers;

generating a new encryption key by the blade management module periodically;

sharing the separate encryption key between the blade management module and the plurality of blade servers only through the at least one wired link connecting the blade management module to the blade servers, including transmitting, by each blade server that generated the separate encryption key, the separate encryption key generated by the blade server to the blade management module only through the at least one wired link connecting the blade management module to the blade server; and

periodically transmitting the new encryption key from the blade management module to the plurality of blade servers only through the at least one wired link connecting the blade management module to the plurality of blade servers;

encrypting information by the blade management module with the separate encryption key, including encrypting the information separately with each separate encryption key;

transmitting the encrypted information by the blade management module to the one or more blade servers through the at least one wireless link, including transmitting to each blade server encrypted information encrypted with the separate encryption key generated by the blade server to which the encrypted information is transmitted; and

transmitting the encrypted information to the plurality of blade servers only after each of the blade servers acknowledges receipt of the new encryption key; and

authorizing by the blade management module through the wireline connections between the blade management module and the blade servers only a subset of the blade servers in possession of the new encryption key to use the new encryption key to decrypt the encrypted information; and

decrypting the encrypted information with the new encryption key by each blade server in the subset of the blade servers.

4. The apparatus of claim 3 wherein:

periodically transmitting the new encryption key further comprises sharing the new encryption key with all the blade servers in the apparatus only through the at least one wired link connecting the blade management module to the blade servers; and

transmitting the encrypted information further comprises broadcasting the same encrypted information to all the blade servers in the apparatus.

5. A computer program product for secure communication of information over a wireless link, the computer program product comprising computer program instructions for operation of apparatus including a computer processor, a blade management module and a plurality of blade servers, the blade servers connected for data communications with the blade management module through at least one wired link, the blade servers also connected for data communications with the blade management module through at least one wireless link, the computer program product disposed upon a non-signal machine-readable storage medium, the computer program product comprising computer program instructions which when executed upon the computer processor cause the apparatus to function by:

generating a separate encryption key by each of the plurality of blade servers;

generating a new encryption key by the blade management module periodically;

sharing the separate encryption key between the blade management module and the plurality of blade servers only through the at least one wired link connecting the blade management module to the blade servers, including transmitting, by each blade server that generated the separate encryption key, the separate encryption key generated by the blade server to the blade management module only through the at least one wired link connecting the blade management module to the blade server; and

periodically transmitting the new encryption key from the blade management module to the plurality of blade servers only through the at least one wired link connecting the blade management module to the plurality of blade servers;

encrypting information by the blade management module with the separate encryption key, including encrypting the information separately with each separate encryption key;

transmitting the encrypted information by the blade management module to the one or more blade servers through the at least one wireless link, including transmitting to each blade server encrypted information encrypted with the separate encryption key generated by the blade server to which the encrypted information is transmitted; and

transmitting the encrypted information to the plurality of blade servers only after each of the blade servers acknowledges receipt of the new encryption key; and

authorizing by the blade management module through the wireline connections between the blade management module and the blade servers only a subset of the blade servers in possession of the new encryption key to use the new encryption key to decrypt the encrypted information; and

decrypting the encrypted information with the new encryption key by each blade server in the subset of the blade servers.

6. The computer program product of claim 5 wherein:

periodically transmitting the new encryption key further comprises sharing the new encryption key with all the blade servers in the apparatus only through the at least one wired link connecting the blade management module to the blade servers; and

transmitting the encrypted information further comprises broadcasting the same encrypted information to all the blade servers in the apparatus.