Secure end-to-end transport through intermediary nodes

• US 8,127,342 B2
• Filed: 09/23/2010
• Issued: 02/28/2012
• Est. Priority Date: 01/08/2002
• Status: Expired due to Term

• Current Assignee: Seven Networks LLC (SoftBank Group Corp.)
• Original Assignee: Seven Networks Inc
• Inventors: Sikes, Mark, Boynton, Lee R., Fiatal, Trevor A., Burke, Scott M.
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US12/889,252
• Publication Number:
  US 20110099363A1
• Time in Patent Office: 523 Days
• Field of Search: 726/15
• US Class Current: 726/4
• CPC Class Codes: H04B 7/04 using two or more spaced independent antennas
• CPC Class Codes: H04B 7/0417 Feedback systems
• CPC Class Codes: H04B 7/0617 for beam forming
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 51/58 Message adaptation for wireless communication
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 4/12 : Messaging; Mailboxes; Announcements
• CPC Class Codes: H04W 52/0261 : managing power supply demand, e.g. depending on battery level
• CPC Class Codes: H04W 76/10 : Connection setup
• CPC Class Codes: H04W 88/06 : adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals
• CPC Class Codes: Y02D 10/00 : Energy efficient computing, e.g. low power processors, power management or thermal management
• CPC Class Codes: Y02D 30/70 : in wireless communication networks

Abstract

A communication network encrypts a first portion of a transaction associated with point-to-point communications using a point-to-point encryption key. A second portion of the transaction associated with end-to-end communications is encrypted using an end-to-end encryption key.

Claims

1. A system for secure communication in a mobile network, the system comprising:

a server configured to;

encrypt or decrypt an item in a plurality of transactions in the mobile network based on a security association associated with a data type of the item;

wherein, the server is communicatively coupled to the mobile network, the mobile network including an endpoint of the plurality of transactions.

2. The system of claim 1, wherein the security association which is associated with the data type is specified in an encryption schema.

3. The system of claim 2, wherein, the server is configured with the encryption schema.

4. The system of claim 2, wherein, one of the plurality of transactions is generated by a mobile device, wherein, the mobile device is configured with the encryption schema.

5. The system of claim 1, wherein the plurality of types of item comprises one or more of:

email data, calendar data, contact data, and task data.

6. The system of claim 1, wherein the plurality of transactions comprise a data synchronization transaction.

7. The system of claim 1, wherein, one of the plurality of transactions is generated by a mobile device.

8. The system of claim 1, wherein, the server is further coupled to at least one enterprise network communicatively, said at least one enterprise network includes at least one endpoint of the plurality of transactions.

9. The system of claim 1, wherein, the server is intermediary to the mobile network and the at least one enterprise network.

10. The system of claim 1, wherein the server is further configured to:

process the plurality of transactions having a plurality of types of items;

associate each of the plurality of types of item with a corresponding security associations in accordance with an encryption schema.

11. The system of claim 1, wherein, the security association is associated with a given channel in the plurality of transactions.

12. A method for secure communication in a mobile network, the method comprising:

encrypting or decrypting an item in the plurality of transactions in the mobile network based on a security association with a data type of the item;

receiving the item from, or transmitting the item to, an endpoint for the plurality of transactions via the mobile network.

13. The method of claim 12, further comprising,

processing the plurality of transactions having multiple types of items;

associating each of the multiple types of item with a corresponding security association;

correlating the corresponding security association with a given channel in the plurality of transactions.

14. The method of claim 12, wherein at least one of the plurality of transactions comprises multiple data types of items.

15. The method of claim 12, wherein the security association comprises a point-to-point security association.

16. The method of claim 12, wherein the security association specifies a cryptographic algorithm or a cryptographic key length.

17. The method of claim 12, wherein one of the plurality of transactions is associated with multiple security associations.

18. The method of claim 12, wherein an encryption schema specifies a associations between data types of items and security associations.

19. The method of claim 12, wherein the security association comprises an end-to-end security association.

20. A mobile device for secure communication in a mobile network, the mobile device comprising:

A processor configured to, associate a data type of an item with a security associations;

encrypt or decrypt the item a plurality of transactions in the mobile network based on the security association;

communicate with the mobile network, the mobile network including an endpoint of the plurality of transactions.

21. The mobile device of claim 20, wherein the security association which is associated with the data type is specified in an encryption schema.

22. The mobile device of claim 20, wherein the security association specifies a cryptographic algorithm or a cryptographic key length.