Method and nework for ensuring secure forwarding of messages

• US 20050083947A1
• Filed: 09/27/2002
• Published: 04/21/2005
• Est. Priority Date: 09/28/2001
• Status: Active Grant

• Current Assignee: MPH Technologies Oy
• Original Assignee: MPH Technologies Oy
• Inventors: Nuopponen, Antti, Vaarala, Sami
• Granted Patent: US 7,620,810 B2
• Time in Patent Office: Days
• US Class Current: 370/395.510
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 76/20 Manipulation of established connections
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]

Abstract

The method and network ensure secure forwarding of a message in a telecommunication network that has at least one first terminal and another terminal. The first terminal moves from a first address to a second address. A secure connection between the first address of the first terminal and the other terminal defining at least the addresses of the two terminals is established. When the first terminal moves from the first address to a second address, the connection is changed to be between the second address and to the other terminal by means of a request from the first terminal and preferably a reply back to the first terminal.

Claims

1. A method for ensuring secure forwarding of a message in a telecommunication network, having at least one mobile terminal and another terminal, the method comprising:

a) establishing a secure connection between a first address of the mobile terminal and the other terminal, the secure connection defined by at least the addresses of the two terminals,

b) the mobile terminal moving from the first address to a second address, and

c) changing the connection to be defined between the second address and the other terminal by means of a request message from the mobile terminal to the other terminal to change the address in the definition of the secure connection to the second address.

2. The method of claim 1, characterized in that, the secure connection is established in step a) by forming a Security Association (SA) using the IPSec protocols.

3. The method of claim 1, characterized in that in step c) a reply back to the mobile terminal is sent from the other terminal after the request from the mobile terminal to change the address.

4. The method of claim 1, characterized in that the registration request and/or the reply message is encrypted and/or authenticated by using the same SA already established.

5. The method of claim 1, characterized in that the change of addresses in the secure connection as a result of the request message is performed by means of a central register of current address of the terminals belonging to the network.

6. The method of claim 1 wherein the method further comprises providing a telecommunication network that has at least one mobile terminal and another terminal and a secure connection defined between a first address of the mobile terminal and the other terminal, characterized by means for changing the connection to be defined between a second address of the mobile terminal and the other terminal.

7. The method of claim 6, characterized in that the mobile terminal and the other terminal forms an end-to-end connection whereby the secure connection is an IPSec transport connection or IPSec tunnel connection.

8. The method of claim 6, characterized in that one of or both of the mobile terminal and the other terminal is a security gateway protecting one or more computers, whereby IPSec tunnel mode or IPSec together with a tunneling protocol is used for the secure connection between the mobile terminal and the other terminal.

9. The method of claim 6, characterized in that both terminals are mobile terminals.

10. The method of claim 9, wherein the method further comprises providing a central register of current locations of the terminals belonging to the network.