Method and system for ensuring secure forwarding of messages

• US 20050177722A1
• Filed: 09/27/2002
• Published: 08/11/2005
• Est. Priority Date: 09/28/2001
• Status: Active Grant

• Current Assignee: MPH Technologies Oy
• Original Assignee: MPH Technologies Oy
• Inventors: Nuopponen, Antti, Vaarala, Sami, Pietikainen, Panu
• Granted Patent: US 8,037,302 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 60/00 Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
• CPC Class Codes: H04W 76/10 Connection setup
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]

Abstract

The method is for ensuring secure forwarding of a message is performed in a telecommunication network that has at least one terminal from which the message is sent and at least one other terminal to which the message is sent. One or more secure connections are established between different addresses of the first terminal and address of the other terminal. The connections define at least said addresses of the two terminals. When the first terminal moves from one address to another address, a secure connection, which endpoints are the new address of the first terminal and the address of the other terminal, is registered to be at least one of the active connections.

Claims

1. A method for ensuring secure forwarding of a message in a telecommunication network, comprising at least one first terminal from which the message is sent and at least one other terminal to which the message is sent, the method comprising:

a) establishing one or more secure connections between different addresses of the first terminal and address of the other terminal, these connections defining at least said addresses of the two terminals,

b) the first terminal moving from one address to another address, and

c) registering a secure connection between said other address and the other terminal address to be at least one of the active connections to be used.

2. The method of claim 1, characterized in that a new secure connection between the other address of the first terminal and the address of the other terminal is formed for the registration in step c) if such a secure connections does not already exist.

3. The method of claim 1, characterized in that, the secure connection is established in step a) and by forming one or more Security Associations (SAs) using the IPSec protocols.

4. The method of claim 1, characterized in that the message to be forwarded consists of IP packets.

5. The method of claim 1, characterized in that, after step b), when the first terminal intend to send a message from the address it has moved to it first checks whether a secure connection between the new address and the other terminal already exists.

6. The method of claim 5, characterized in that the existence of the new secure connection is checked by means of a connection table.

7. The method of claim 1, characterized in that, in step c), the actual connection(s) to be used is/are registered by means of a signaling message or signaling message exchange between the mobile terminal and the other terminal.

8. The method of claim 1, characterized in that, the new (second) address of the mobile terminal is updated automatically by the other terminal when the first terminal sends a message from its new address.

9. The method of claim 1, characterized in that the a key exchange being a part of the forming of the secure connection in step a) and is performed manually.

10. The method of claim 1, characterized in that a key exchange being a part of the forming of the secure connection in step a) and claim 2 is performed with IKE or some other automated key exchange protocol.

11. The method of claim 1, characterized in that the secure connection between the new address of the first terminal and the other terminal is in step c) registered for immediate and/or later use.

12. The method of claim 11, characterized in that the registration for later use is made by the other terminal in a connection table.

13. The method of claim 3, characterized in that when sending message through the secure connection IPSec transport mode is used to secure traffic between the mobile computer and the destination computer.

14. The method of claim 13, characterized in that a tunneling protocol is used together with IPSec to provide a tunneling capability.

15. The method of claim 14, characterized in that where the Layer 2 Tunneling Protocol (L2TP) tunneling protocol is used together with PSec to provide a tunneling capability.

16. The method of claim 3, characterized in that when sending message through the secure connection IPSec tunnel mode is used to secure traffic between the mobile computer and the destination computer.

17. A system for ensuring secure forwarding of a message in a telecommunication network, comprising at least one first terminal from which the message is sent and at least one other terminal to which the message is sent, characterized by means for forming secure connections between the address of the other terminal and different addresses of the first terminal, tables with lists of said secure connections, and registrations means for forming such lists.

18. (canceled)