Secure end-to-end transport through intermediary nodes

• US 9,344,393 B2
• Filed: 10/01/2013
• Issued: 05/17/2016
• Est. Priority Date: 01/08/2002
• Status: Expired due to Term

• Current Assignee: Seven Networks LLC (SoftBank Group Corp.)
• Original Assignee: Seven Networks LLC (SoftBank Group Corp.)
• Inventors: Boynton, Lee R., Fiatal, Trevor A., Burke, Scott M., Sikes, Mark
• Primary Examiner(s): Smithers, Matthew
• Application Number:
  US14/043,772
• Publication Number:
  US 20150372987A1
• Time in Patent Office: 959 Days
• US Class Current: 1/1
• CPC Class Codes: H04B 7/04 using two or more spaced independent antennas
• CPC Class Codes: H04B 7/0417 Feedback systems
• CPC Class Codes: H04B 7/0617 for beam forming
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 51/58 Message adaptation for wireless communication
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/0471 applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 67/1095 Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 4/12 : Messaging; Mailboxes; Announcements
• CPC Class Codes: H04W 52/0261 : managing power supply demand, e.g. depending on battery level
• CPC Class Codes: H04W 76/10 : Connection setup
• CPC Class Codes: H04W 88/06 : adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals
• CPC Class Codes: Y02D 10/00 : Energy efficient computing, e.g. low power processors, power management or thermal management
• CPC Class Codes: Y02D 30/70 : in wireless communication networks

Abstract

A communication network encrypts a first portion of a transaction associated with point-to-point communications using a point-to-point encryption key. A second portion of the transaction associated with end-to-end communications is encrypted using an end-to-end encryption key.

Claims

1. A method for independently encrypting channels of data in a transaction, comprising:

encryption of a first data channel in the transaction using a first security association;

encryption of a second data channel in the transaction using a second security association;

encryption of an arbitrary number of additional data channels contained within the transaction using a unique security association for each channel,

wherein the first data channel consists of point-to-point control data and the second data channel consists of end-to-end content data.

2. A method according to claim 1 wherein the control data in the first data channel includes transaction authentication and routing information, and the end-to-end content data in the second data channel includes contents of email messages, electronic files, or other electronic data.

3. A method according to claim 1 including:

negotiation of a first encryption key and security association for the first data channel between a mobile device and a server operating as a transfer agent for the transaction;

negotiation of a second encryption key and security association for the second data channel between a mobile device and a computer operating as an endpoint for the transaction; and

negotiation of a third encryption key and security association for the first data channel between the server and an endpoint.

4. A method according to claim 3 including:

decryption of the first data channel at the server using the first encryption key; and

re-encryption of the first data channel at the server using the third encryption key.

5. A method according to claim 4 including leaving the second data channel in the transaction at the server encrypted and unmodified.

6. A method according to claim 1 including leaving a third data channel in the transaction unencrypted.

7. A method according to claim 1 including:

assigning each item in the transaction to one of the data channels;

separating different items in the transaction according to the assigned data channel;

encoding the separated items into data groups;

encrypting some or all of the data groups using the security associations assigned to the data channel corresponding to each data group; and

encoding the processed data groups into one or more packets.

8. A method according to claim 7 including:

receiving the packets;

separating contents of the packets according to the different data channels;

decrypting only the separated contents which correspond to known security associations;

decoding the decrypted contents into items; and

processing the transaction according to the decoded items while the contents of data channels with unknown security associations remain encrypted and unmodified.

9. A method according to claim 1 including:

encoding a first set of packets containing only the data encrypted using the first security association;

encoding a second set of packets containing only the data encrypted using the second security association; and

encoding a packet header that contains unencrypted data, the packet header identifying a data size for the first set of packets and the second set of packets; and

transporting the first set of packets and then transporting the second set of packets immediately after the first set of packets.

10. A computing device, comprising:

a processor transmitting or receiving a transaction having a first portion of data encrypted using a first security association and a second portion of data encrypted using a second security association,

wherein the first portion of data comprises control information used for transporting the transaction over a network and the second portion of data comprises contents of a file, document, message, or document request.

11. A computing device according to claim 10 wherein the processor is located either in a mobile device, a desktop computer, a server, or another computing node.

12. A computing device according to claim 10 wherein the processor sends the transaction to an intermediary server for forwarding to an endpoint, the processor negotiating a point-to-point encryption key only with the intermediary server and negotiating an end-to-end encryption key only with the endpoint.

13. A computing device according to claim 10 wherein the processor separates data items in the transaction into different data channels, and separately encodes and encrypts the different data channels according to the corresponding security associations.

14. A computing device according to claim 10 wherein the processor encodes the transaction into multiple packets each one of the packets containing data encrypted using the same encryption key.

15. A computing device according to claim 10 wherein the processor generates a header that identifies a first set of the packets containing data encrypted using a first encryption key and a second set of the packets containing data encrypted using a second encryption key.

16. A system, comprising:

a server receiving a transaction containing a first portion of data encrypted using a first known encryption key and a second portion of data encrypted using a second unknown encryption key, the server decrypting the first portion of data to determine how to process the transaction while the second portion of data remains encrypted,

wherein the transaction includes a third unencrypted portion of data, the server combining the decrypted first portion of data with the third unencrypted portion of data and processing the transaction according to the combined first and third portions of data.

17. A system according to claim 16 wherein the server re-encrypts at least some of the decrypted first portion of data using a third encryption key, and combines the re-encrypted first portion of data with the encrypted second portion of data to form a new transaction.

18. A system according to claim 17 including multiple servers each performing different operations on the transaction while being transported between two endpoints, the multiple servers negotiating point-to-point encryption keys and encrypting portions of the transaction using the negotiated encryption keys when the transaction is transported between multiple servers.

19. A method for encrypting information, comprising:

programming a network processing device to associate different types of items in transactions with different security associations;

processing various different transactions at the network processing device;

correlating security associations with different data channels in the transactions;

encrypting or decrypting the items in the transactions according to the corresponding security associations,

configuring the network processing device with different security associations containing encryption keys, the security associations correlated with at least some of the data channels;

decrypting only the items from the data channels having corresponding known security associations with configured encryption keys, while keeping the channels without known security associations encrypted;

processing the transactions according to the decrypted items;

re-encrypting only the items in the processed transactions having corresponding security associations while preserving unmodified the data channels without known security associations and

transporting the transactions containing re-encrypted and/or unmodified data channels to an endpoint.

20. A method according to claim 19 including:

separating items in the received transactions into channels associated with the different security associations;

encoding the items in each channel into bit arrays; and

encrypting or decrypting the bit arrays for each channel according to the associated encryption.

21. A method according to claim 19 including configuring the network processing device with an encryption schema that associates different types of items in the transactions with the different security associations, the network processing device encrypting or decrypting items in various received or transmitted transactions according to the configured encryption schema.

22. A method according to claim 21 including configuring the network processing device with the encryption schema by loading a list of the security associations into the network processing device, the list indexing the different items.

23. A method for independently encrypting channels of data in a transaction, comprising:

encryption of a first data channel in the transaction using a first security association;

encryption of a second data channel in the transaction using a second security association;

encryption of an arbitrary number of additional data channels contained within the transaction using a unique security association for each channel;

negotiation of a first encryption key and security association for the first data channel between a mobile device and a server operating as a transfer agent for the transaction;

negotiation of a second encryption key and security association for the second data channel between a mobile device and a computer operating as an endpoint for the transaction; and

negotiation of a third encryption key and security association for the first data channel between the server and an endpoint.

24. A method for independently encrypting channels of data in a transaction, comprising:

encryption of a first data channel in the transaction using a first security association;

encryption of a second data channel in the transaction using a second security association;

encryption of an arbitrary number of additional data channels contained within the transaction using a unique security association for each channel; and

leaving a third data channel in the transaction unencrypted.

25. A method for independently encrypting channels of data in a transaction, comprising:

encryption of a first data channel in the transaction using a first security association;

encryption of a second data channel in the transaction using a second security association;

encryption of an arbitrary number of additional data channels contained within the transaction using a unique security association for each channel;

assigning each item in the transaction to one of the data channels;

separating different items in the transaction according to the assigned data channel;

encoding the separated items into data groups;

encrypting some or all of the data groups using the security associations assigned to the data channel corresponding to each data group; and

encoding the processed data groups into one or more packets.

26. A method for independently encrypting channels of data in a transaction, comprising:

encryption of a first data channel in the transaction using a first security association;

encryption of a second data channel in the transaction using a second security association;

encryption of an arbitrary number of additional data channels contained within the transaction using a unique security association for each channel;

encoding a first set of packets containing only the data encrypted using the first security association;

encoding a second set of packets containing only the data encrypted using the second security association;

encoding a packet header that contains unencrypted data, the packet header identifying a data size for the first set of packets and the second set of packets; and

transporting the first set of packets and then transporting the second set of packets immediately after the first set of packets.

27. A computing device, comprising:

a processor transmitting or receiving a transaction having a first portion of data encrypted using a first security association and a second portion of data encrypted using a second security association,

wherein the processor separates data items in the transaction into different data channels, and separately encodes and encrypts the different data channels according to the corresponding security associations.

28. A computing device, comprising:

a processor transmitting or receiving a transaction having a first portion of data encrypted using a first security association and a second portion of data encrypted using a second security association,

wherein the processor encodes the transaction into multiple packets each one of the packets containing data encrypted using the same encryption key.

29. A computing device, comprising:

a processor transmitting or receiving a transaction having a first portion of data encrypted using a first security association and a second portion of data encrypted using a second security association,

wherein the processor generates a header that identifies a first set of the packets containing data encrypted using a first encryption key and a second set of the packets containing data encrypted using a second encryption key.

30. A method for encrypting information, comprising:

programming a network processing device to associate different types of items in transactions with different security associations;

processing various different transactions at the network processing device;

correlating security associations with different data channels in the transactions; and

encrypting or decrypting the items in the transactions according to the corresponding security associations;

separating items in the received transactions into channels associated with the different security associations;

encoding the items in each channel into bit arrays; and

encrypting or decrypting the bit arrays for each channel according to the associated encryption.

31. A method for encrypting information, comprising:

programming a network processing device to associate different types of items in transactions with different security associations;

processing various different transactions at the network processing device;

correlating security associations with different data channels in the transactions;

encrypting or decrypting the items in the transactions according to the corresponding security associations; and

configuring the network processing device with an encryption schema that associates different types of items in the transactions with the different security associations, the network processing device encrypting or decrypting items in various received or transmitted transactions according to the configured encryption schema.

32. A method according to claim 31 including configuring the network processing device with the encryption schema by loading a list of the security associations into the network processing device, the list indexing the different items.