Method and system for peer-to-peer enforcement

• US 8,233,883 B2
• Filed: 07/21/2010
• Issued: 07/31/2012
• Est. Priority Date: 03/22/2005
• Status: Active Grant

• Current Assignee: InterDigital Patent Holdings, Inc. (InterDigital, Inc.)
• Original Assignee: Swisscom AG (Government of Switzerland)
• Inventors: De Froment, Eric
• Primary Examiner(s): Thier, Michael
• Application Number:
  US12/840,902
• Publication Number:
  US 20100285776A1
• Time in Patent Office: 741 Days
• Field of Search: 455/411, 455/414.1, 455/422.1, 455/458
• US Class Current: 455/411
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 76/10 Connection setup
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

The present invention concerns a method and a system for establishing a dynamic peer-to-peer communications channel between a first terminal and a second terminal. A first terminal and a second terminal are connectable over secured communications channels to a secured network. The first terminal sends a connection request for establishing a communications channel between the terminals. The connection request is analyzed by an analyzer module. Based on network parameters of the terminals, the analyzer module searches for a further network, and establishes a peer-to-peer communications channel over this further network. Security of the peer-to-peer communications channel may be maintained by means of a central unit of the secured network.

Claims

1. A method for establishing a dynamic communications channel between a first terminal and a second terminal, said method comprising:

connecting the first terminal over a first secured communications channel to a secured network;

connecting the second terminal over a second secured communications channel to the secured network;

generating a connection request, at the first terminal, to establish a communications channel between the first terminal and the second terminal;

transmitting the connection request from the first terminal to the second terminal over the secured network;

intercepting the connection request transmitted from the first terminal to prevent the connection request from being received by the second terminal and analyzing the connection request by an analyzer module;

transmitting, by the analyzer module, a request to each of the first terminal and the second terminal for network parameters distinct to each of the first terminal and the second terminal;

receiving and analyzing the network parameters of the first terminal and of the second terminal by the analyzer module; and

transmitting a connection instruction to at least one of the first terminal or the second terminal from the analyzer module based on the analysis of the connection request and the network parameters of the terminals, said connection instruction including an instruction to enforce a peer-to-peer communications channel, over a network distinct from the secured network, between the first terminal and the second terminal,

wherein the analyzer module receives the network parameters of the first terminal and the network parameters of the second terminal from each of the first terminal and the second terminal, respectively, in response to the request from the analyzer module.

2. The method according to claim 1, further comprising:

establishing the peer-to-peer communications channel between the first terminal and the second terminal as a secured peer-to-peer communications channel based on at least one of an authentication module or an encryption module.

3. The method according to claim 2, further comprising:

providing at least one of an authentication key or an encryption key by a central unit of the secured network to at least one of the authentication module or the encryption module.

4. The method according to claim 3, further comprising:

receiving, at the central unit, parameters on the status of at least one of the first terminal or the second terminal at predetermined points in time; and

tearing down an established peer-to-peer communications channel as soon as the status of the at least one of the first terminal or the second terminal do not meet predetermined conditions.

5. The method according to claim 1, further comprising:

establishing the first secured communications channel between the first terminal and the secured network; and

establishing the second secured communications channel between the second terminal and the secured network,

wherein said establishing first and second secured communications channels comprises using public access points for connecting terminals to public networks, using public communications channels between the public networks and the secured network, and using cryptographic modules for authentication of the terminals and for encryption of the first and second secured communications channels between the terminals and the secured network.

6. The method according to claim 1, further comprising:

establishing the peer-to-peer communications channel between the first terminal and the second terminal using at least one public network.

7. The method according to claim 1, further comprising:

establishing the peer-to-peer communications channel between the first terminal and the second terminal over an ad-hoc network between the first terminal and the second terminal.

8. The method according to claim 1, wherein the first terminal includes a first network interface and the second terminal includes a second network interface, and the peer-to-peer communications channel is directly between the first network interface of the first terminal and the second network interface of the second terminal.

15. The method according to claim 1, further comprising:

searching, by the analyzer module, for the network distinct from the secured network capable of supporting the peer-to-peer communications channel based on the intercepted connection request and the network parameters of the first terminal and of the second terminal.

9. A system for establishing a dynamic communications channel between a first terminal and a second terminal, said system comprising:

the first terminal connected over a first secured communications channel to a secured network;

the second terminal connected over a second secured communications channel to the secured network; and

an analyzer module,

the first terminal including a transmitter configured to generate a connection request to establish a communications channel between the first terminal and the second terminal and to transmit the connection request from the first terminal to the second terminal over the secured network,

the analyzer module including a receiver configured to intercept the connection request transmitted from the first terminal to prevent the connection request from being received by the second terminal and to analyze the connection request generated by the first terminal, and

the analyzer module including a transmitter configured to transmit a request to each of the first terminal and the second terminal for the network parameters distinct to each of the first terminal and the second terminal,

wherein the receiver is further configured to receive the network parameters of the first terminal and the network parameters of the second terminal from each of the first terminal and the second terminal, respectively, in response to the request from the analyzer module, the analyzer module is further configured to analyze the received network parameters of the first terminal and the second terminal, and the transmitter is further configured to transmit a connection instruction to at least one of the first terminal or the second terminal based on the analysis of the connection request and the network parameters of the terminals, the connection instruction including an instruction to enforce a peer-to-peer communications channel, over a network distinct from the secured network, between the first terminal and the second terminal.

10. The system according to claim 9, wherein at least one of the first terminal or the second terminal includes at least one of an authentication module or an encryption module.

11. The system according to claim 10, wherein the secured network includes a central unit configured to provide at least one of an authentication key or an encryption key to the corresponding authentication module or encryption module.

12. The system according to claim 11, wherein the central unit further comprises:

a transmitter configured to request parameters on the status of at least one of the first terminal or the second terminal at predetermined points in time; and

a controller configured to tear down an established peer-to-peer communications channel as soon as the status of at least one of the first terminal or the second terminal does not meet predetermined conditions.

13. The system according to claim 9, wherein each of the first terminal and the second terminal further comprise a controller configured to establish an ad-hoc network between the first terminal and the second terminal.

14. A method for establishing a dynamic communications channel between a first terminal and a second terminal, said method comprising:

intercepting a connection request transmitted from the first terminal to the second terminal to prevent the connection request from being received by the second terminal at an analyzer, the connection request including instructions to establish a communications channel between the first terminal and the second terminal;

transmitting, by the analyzer, a request to each of the first terminal and the second terminal for the network parameters distinct to each of the first terminal and the second terminal

receiving, at the analyzer, network parameters of the first terminal and the second terminal from each of the first terminal and the second terminal, respectively, in response to the request from the analyzer module;

analyzing the intercepted connection request and the network parameters at the analyzer; and

transmitting, from the analyzer to at least one of the first terminal or the second terminal, a peer-to-peer connection instruction based on the analysis of the connection request and the network parameters of the terminals, the connection instruction including instructions to enforce a peer-to-peer communications channel over another network and between the first terminal and the second terminal.