Method and network for ensuring secure forwarding of messages

• US 7,620,810 B2
• Filed: 09/27/2002
• Issued: 11/17/2009
• Est. Priority Date: 09/28/2001
• Status: Expired due to Term

• Current Assignee: MPH Technologies Oy
• Original Assignee: MPH Technologies Oy
• Inventors: Vaarala, Sami, Nuopponen, Antti
• Primary Examiner(s): Moazzami, Nasser G
• Assistant Examiner(s): Yalew, Fikremariam
• Application Number:
  US10/490,932
• Publication Number:
  US 20050083947A1
• Time in Patent Office: 2,608 Days
• Field of Search: 713/161, 380/247
• US Class Current: 713/161
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 76/20 Manipulation of established connections
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]

Abstract

The method and network ensure secure forwarding of a message in a telecommunication network that has at least one first terminal and another terminal. The first terminal moves from a first address to a second address. A secure connection between the first address of the first terminal and the other terminal defining at least the addresses of the two terminals is established. When the first terminal moves from the first address to a second address, the connection is changed to be between the second address and to the other terminal by means of a request from the first terminal and preferably a reply back to the first terminal.

Claims

1. A method for ensuring secure forwarding of a message in a telecommunication network, having at least one mobile terminal and another terminal and a security gateway therebetween, the method comprising:

a) establishing a secure connection between a first address of the mobile terminal and an address of the security gateway, the secure connection defined by at least the addresses of the mobile terminal and the security gateway,

b) the mobile terminal changing from the first address to a second address,

c) while at the second address, the mobile terminal sending a request message to the address of the security gateway to request the security gateway to change the secure connection to be defined between the second address and the address of the security gateway,

in response to the request message from the mobile terminal, the security gateway changing an address definition of the secure connection from the first address to the second address, the mobile terminal sending a secure message in the secure connection from the second address of the mobile terminal to the other terminal via the security gateway,

the secure connection being established by forming a Security Association (SA) using IPSec protocols, and the request message and/or a reply message being encrypted and/or authenticated by using the same SA already established.

2. The method of claim 1, wherein in step c) a reply back to the mobile terminal is sent from the security gateway after the request from the mobile terminal to change the address.

3. The method of claim 1 wherein the method further comprises the security gateway sending back a reply message to the mobile terminal at the second address to confirm the address change.

4. The method of claim 3, wherein the mobile terminal and the other terminal form an end-to-end connection whereby the secure connection is an IPSec transport connection or IPSec tunnel connection.

5. The method of claim 3, wherein a tunneling protocol is used for the secure connection between the mobile terminal and the security gateway.

6. The method of claim 3, wherein the other terminal is a mobile terminal.

7. A method for ensuring secure forwarding of a message in a telecommunication network, having at least one mobile terminal and another terminal and a security gateway therebetween, the method comprising:

a) establishing a secure connection between a first address of the mobile terminal and an address of the security gateway,

the secure connection defined by at least the addresses of the mobile terminal and the security gateway,

b) the mobile terminal moving from the first address to a second address,

c) while at the second address, the mobile terminal sending a request message to the address of the security gateway to request the security gateway to change the secure connection to be defined between the second address and the address of the security gateway,

the security gateway changing an address definition of the secure connection from the first address to the second address, and

the other terminal sending a secure message in the secure connection to the second address of the mobile terminal via the security gateway.