Device and method for secured communication

• US 8,812,701 B2
• Filed: 05/19/2009
• Issued: 08/19/2014
• Est. Priority Date: 05/21/2008
• Status: Active Grant

• Current Assignee: Uniloc 2017 LLC (SoftBank Group Corp.)
• Original Assignee: Uniloc Luxembourg S.à r.l. (f/k/a Uniloc Luxembourg S.A.) (Uniloc Corporation Pty. Limited)
• Inventors: Etchegoyen, Craig S., Harjanto, Dono, Davis, Bradley C.
• Primary Examiner(s): Tran, Jimmy H
• Application Number:
  US12/468,288
• Publication Number:
  US 20090292816A1
• Time in Patent Office: 1,918 Days
• Field of Search: 709/229, 709/203, 709/219, 713/150, 713/15, 713/186, 713/194, 726/26, 726/29
• US Class Current: 709/229
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network

Abstract

Devices and methods are provided for securing communication between a traffic management center (TMC) and a traffic controller via utilization of a field security device. In one embodiment, the field security device transmits a device identifier to the TMC upon being powered up or connected to the traffic controller. The device identifier is generally based on a combination of user-configurable and non-user-configurable parameters of the field security device. In response to the TMC authenticating the device identifier, the field security device establishes a secure private network (SPN) between the field security device and the TMC.

Claims

1. A field security device for providing a secure private network (SPN) between a field traffic controller and a traffic management center (TMC), comprising:

a first connector for interfacing with the field traffic controller;

a communication module;

at least one processor operatively coupled to the first connector and the communication module; and

a memory module operatively coupled to the at least one processor and comprising executable code that when executed by the processor enables the processor to;

access a public network via the communication module;

locate an authentication server of the TMC via the public network;

generate a device identifier from machine parameters of the field security device, the device identifier uniquely identifying the field security device, the machine parameters including at least one user-configurable parameter and at least one non-user-configurable parameter wherein the at least one non-user-configurable parameter comprises a data sector damage measurement of a storage device;

send the device identifier to the authentication server via the communication module; and

in response to the authentication server authenticating the device identifier from the field security device, establish the SPN between the field security device and the TMC, wherein the established SPN tunnels across at least one segment of the public network.

2. The field security device of claim 1, wherein the at least one non-user-configurable parameter comprises at least one of CPU ID, CPU model, CPU manufacturer, and CPU voltage for the field security device.

3. The field security device of claim 1, wherein the at least one user-configurable parameter comprises one of hard disk volume name, user name, device name, user password, and hard disk initialization date for the field security device.

4. The field security device of claim 1, wherein the device identifier is generated by utilizing at least one irreversible transformation of the at least one user-configurable parameter and the at least one non-user-configurable parameter of the field security device.

5. The field security device of claim 4, wherein the device identifier is generated by utilizing a cryptographic hash function on the at least one user-configurable parameter and the at least one non-user-configurable parameter of the field security device.

6. The field security device of claim 1, wherein the communication module is adapted for wireless communication.

7. The field security device of claim 1, wherein the public network comprises the Internet.

8. The field security device of claim 1, wherein the public network comprises a wireless communication network, the wireless communication network implementing at least one of CDMA and GSM standards.

9. The field security device of claim 1, wherein the public network comprises a wireless communication network, the wireless communication network implementing at least one of 802.11a, 802.11b, 802.11g, 802.11n, and 802.11p standards.

10. The field security device of claim 1, wherein the traffic controller comprises a traffic signal.

11. The field security device of claim 1, wherein the traffic controller comprises a surveillance camera.

12. The field security device of claim 1, wherein the traffic controller is housed in a field traffic cabinet.

13. The field security device of claim 1 further configured to detect attempted network intrusions, wherein the memory module when executed by the processor enables the processor to determine the MAC ID of the field traffic controller, relay the MAC ID to the TMC, and allow the field traffic controller to communicate with the TMC via the SPN only if the TMC has authenticated the MAC ID.

14. The field security device of claim 1 further configured to detect attempted network intrusions, wherein the memory module when executed by the processor enables the processor to determine the MAC ID of the field traffic controller, relay a derivation of the MAC ID to the TMC, and allow the field traffic controller to communicate with the TMC via the SPN only if the TMC has authenticated the derivation of the MAC ID.

15. The field security device of claim 1 further configured for mutual authentication with the TMC, wherein the memory module when executed by the processor enables the processor to receive a server device identifier from the authentication server, compare the received server device identifier to authorized server device identifiers, and establish the SPN in response to the received server identifier matching one of the authorized server device identifiers.

16. An authentication server for providing a secure private network (SPN) between a traffic management center (TMC) and a field security device, the field security device being in operative communication with a field traffic controller, comprising:

a communication module adapted to receive a device identifier over a public network from the field security device;

at least one processor operatively coupled to the communication module; and

a memory module operatively coupled to the at least one processor and comprising executable code that when executed by the processor enables the processor to;

in response to the communication module receiving the device identifier from the field security device, (i) compare the received device identifier to authorized device identifiers stored in a database, each authorized device identifier corresponding to a known field security device;

(ii) generate a server device identifier from machine parameters of the authentication server, the server device identifier uniquely identifying the authentication server, the machine parameters including at least one user-configurable parameter and at least one non-user-configurable parameter wherein the at least one non-user-configurable parameter comprises a data sector damage measurement of a storage device, and (iii) send the server device identifier to the field security device via the communication module for authentication of the server device identifier by the field security device; and

in response to the received device identifier matching one of the authorized device identifiers, and in response to authentication of the server device identifier by the field security device, establish the SPN between the field security device and the TMC, wherein the established SPN tunnels across at least one segment of the public network.

17. The server of claim 16, wherein the authentication server is located at the TMC.

18. The server of claim 16, wherein the communication module is adapted for wireless communication.

19. The server of claim 16, wherein the public network comprises the Internet.

20. A network device for securely communicating with a traffic management center (TMC), comprising:

a communication module adapted to access a public network;

at least one processor operatively coupled to the communication module; and

a memory module operatively coupled to the at least one processor and comprising executable code that when executed by the processor enables the processor to;

access the public network via the communication module;

locate an authentication server of the TMC via the public network;

generate a device identifier from machine parameters of the field security device, the device identifier uniquely identifying the field security device, the machine parameters including at least one user-configurable parameter and at least one non-user-configurable parameter wherein the at least one non-user-configurable parameter comprises a data sector damage measurement of a storage device;

send the device identifier to the authentication server via the communication module; and

in response to the authentication server authenticating the device identifier from the network device, establish a secure private network (SPN) between the network device and the TMC, wherein the established SPN tunnels across at least one segment of the public network.

21. The network device of claim 20, wherein the network device comprises one of a laptop computer or a mobile phone.

22. The network device of claim 20, wherein the at least one non-user-configurable parameter comprises at least one of CPU ID, CPU model, CPU manufacturer, and CPU voltage for the network device.

23. The network device of claim 20, wherein the at least one user-configurable parameter comprises one of hard disk volume name, user name, device name, user password, and hard disk initialization date for the network device.

24. The network device of claim 20, wherein the device identifier is generated by utilizing at least one irreversible transformation of the at least one user-configurable parameter and the at least one non-user-configurable parameter of the network device.

25. The network device of claim 24, wherein the device identifier is generated by utilizing a cryptographic hash function on the at least one user-configurable parameter and the at least one non-user-configurable parameter of the network device.

26. The network device of claim 20, wherein the communication module is adapted for wireless communication.

27. The network device of claim 20, wherein the public network comprises the Internet.

28. The network device of claim 20 wherein the executable code is executed by the processor in response to powering on the device.

29. A method for providing a secure private network (SPN) between a device and a traffic management center (TMC), comprising:

accessing a public network;

locating an authentication server of the TMC via the public network;

generating a device identifier from machine parameters of the device, the device identifier uniquely identifying the device, the machine parameters including at least one user-configurable parameter and at least one non-user-configurable parameter wherein the at least one non-user-configurable parameter comprises a data sector damage measurement of a storage device;

sending the device identifier to the authentication server via the communication module; and

in response to the authentication server authenticating the device identifier, establishing the SPN between the TMC and the device, wherein the established SPN tunnels across at least one segment of the public network.

30. The method of claim 29, wherein establishing the SPN comprises establishing the SPN between the TMC and a field security apparatus.

31. The method of claim 29, wherein establishing the SPN comprises establishing the SPN between the TMC and a network device.

32. The method of claim 29 wherein all steps of the method are performed by a processor executing software stored in memory on the device, in response to powering on the device.