SECURE END-TO-END TRANSPORT THROUGH INTERMEDIARY NODES

• US 20190068538A1
• Filed: 10/31/2018
• Published: 02/28/2019
• Est. Priority Date: 01/08/2002
• Status: Active Grant

• Current Assignee: Seven Networks LLC (SoftBank Group Corp.)
• Original Assignee: Seven Networks LLC (SoftBank Group Corp.)
• Inventors: Boynton, Lee R., Fiatal, Trevor A., Burke, Scott M., Sikes, Mark
• Granted Patent: US 10,693,531 B2
• Time in Patent Office: Days
• CPC Class Codes: H04B 7/04 using two or more spaced independent antennas
• CPC Class Codes: H04B 7/0417 Feedback systems
• CPC Class Codes: H04B 7/0617 for beam forming
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 51/58 Message adaptation for wireless communication
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 4/12 : Messaging; Mailboxes; Announcements
• CPC Class Codes: H04W 52/0261 : managing power supply demand, e.g. depending on battery level
• CPC Class Codes: H04W 76/10 : Connection setup
• CPC Class Codes: H04W 88/06 : adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals
• CPC Class Codes: Y02D 10/00 : Energy efficient computing, e.g. low power processors, power management or thermal management
• CPC Class Codes: Y02D 30/70 : in wireless communication networks

Abstract

A communication network encrypts a first portion of a transaction associated with point-to-point communications using a point-to-point encryption key. A second portion of the transaction associated with end-to-end communications is encrypted using an end-to-end encryption key.

Claims

1. A method for independently encrypting channels of data in a transaction, comprising:

encryption of a first data channel in the transaction using a first security association;

encryption of a second data channel in the transaction using a second security association; and

encryption of an arbitrary number of additional data channels contained within the transaction using a unique security association for each channel.

2. A method according to claim 1 wherein the first data channel consists of point-to-point control data and the second data channel consists of end-to-end content data.

3. A method according to claim 2 wherein the control data in the first data channel includes transaction authentication and routing information, and the end-to-end content data in the second data channel includes the contents of email messages, electronic files, or other electronic data.

4. A method according to claim 1 including:

negotiation of a first encryption key and security association for the first data channel between a mobile device and a server operating as a transfer agent for the transaction; and

negotiation of a second encryption key and security association for the second data channel between a mobile device and a computer operating as an endpoint for the transaction; and

negotiation of a third encryption key and security association for the first data channel between the server and an endpoint.

5. A method according to claim 4 including:

decryption of the first data channel at the server using the first encryption key; and

re-encryption of the first data channel at the server using the third encryption key.

6. A method according to claim 5 including leaving the second data channel in the transaction at the server encrypted and unmodified.

7. A method according to claim 1 including leaving a third data channel in the transaction unencrypted.

8. A method according to claim 1 including:

assigning each item in the transaction to one of the data channels;

separating the different items in the transaction according to the assigned data channel;

encoding the separated items into data groups;

encrypting some or all of the data groups using the security associations assigned to the data channel corresponding to each data group; and

encoding the processed data groups into one or more packets.

9. A method according to claim 7 including:

receiving the packets;

separating the contents of the packets according to the different data channels;

decrypting only the separated contents which correspond to known security associations;

decoding the decrypted contents into items; and

processing the transaction according to the decoded items while the contents of data channels with unknown security associations remain encrypted and unmodified.

10. A method according to claim 1 including:

encoding a first set of packets containing only the data encrypted using the first security association;

encoding a second set of packets containing only the data encrypted using the second security association; and

encoding a packet header that contains unencrypted data, the packet header identifying a data size for the first set of packets and the second set of packets; and

transporting the first set of packets and then transporting the second set of packets immediately after the first set of packets.