Method and system for sending a message through a secure connection

• US 9,838,362 B2
• Filed: 05/31/2017
• Issued: 12/05/2017
• Est. Priority Date: 01/22/2002
• Status: Expired due to Term

• Current Assignee: MPH Technologies Oy
• Original Assignee: MPH Technologies Oy
• Inventors: Nuopponen, Antti, Vaarala, Sami
• Primary Examiner(s): TOWFIGHI, AFSHAWN M
• Application Number:
  US15/609,312
• Publication Number:
  US 20170272409A1
• Time in Patent Office: 188 Days
• Field of Search: 709236, 709239, 709245
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 61/2557 Translation policies or rules
• CPC Class Codes: H04L 61/256 NAT traversal
• CPC Class Codes: H04L 61/4557 Directories for hybrid networks, e.g. including telephone numbers
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority

Abstract

The method and system enable secure forwarding of a message from a first computer to a second computer via an intermediate computer in a telecommunication network. A message is formed in the first computer or in a computer that is served by the first computer, and in the latter case, sending the message to the first computer. In the first computer, a secure message is then formed by giving the message a unique identity and a destination address. The message is sent from the first computer to the intermediate computer after which the destination address and the unique identity are used to find an address to the second computer. The current destination address is substituted with the found address to the second computer, and the unique identity is substituted with another unique identity. Then the message is forwarded to the second computer.

Claims

1. An intermediate computer for secure forwarding of messages in a telecommunication network, comprising:

an intermediate computer configured to connect to a telecommunication network;

the intermediate computer configured to be assigned with a first network address in the telecommunication network and to access a mapping between a unique identity and a network address of a first computer;

the intermediate computer configured to receive from a second computer a secure message sent to the first network address having an encrypted data payload of a message and the unique identity of the first computer, the data payload encrypted with a cryptographic key derived from a key exchange protocol; and

the intermediate computer configured to read the unique identity from the secure message sent to the first network address, to use the unique identity to find the network address of the first computer from the mapping, and to securely forward the encrypted data payload to the network address of the first computer using a network address of the intermediate computer as a source address of a forwarded message containing the encrypted data payload wherein the intermediate computer does not have the cryptographic key to decrypt the encrypted data payload.

2. The intermediate computer of claim 1, wherein the mapping is stored in a translation table.

3. The intermediate computer of claim 1, wherein the intermediate computer is further configured to substitute the unique identity read from the secure message with another unique identity prior to forwarding the encrypted data payload.

4. The intermediate computer of claim 2, wherein the translation table is stored at the intermediate computer.

5. The intermediate computer of claim 2, wherein the translation table includes two partitions, the second partition containing information fields related to the connection over which the secure message is sent to the first network address, the first partition containing information fields related to the connection over which the forwarded encrypted data payload is sent to a destination address.

6. The intermediate computer of claim 1, wherein the intermediate computer is not configured to access cryptographic keys used to encrypt or authenticate the messages.

7. The intermediate computer of claim 1, wherein the intermediate computer is configured to forward the encrypted data payload using SSL or TLS protocol.

8. The intermediate computer of claim 1, wherein the intermediate computer is configured to receive secure messages using SSL or TLS protocol.

9. The intermediate computer of claim 1, wherein the unique identity read from the secure message includes one or more Security Parameter Index values.

10. The intermediate computer of claim 2, wherein the intermediate computer is configured to modify the translation table entry address fields in response to a signaling message sent from the first computer when the first computer changes its address such that the intermediate computer can know that the address of the first computer is changed.

11. The intermediate computer of claim 1, wherein the intermediate computer is a server.

12. The intermediate computer of claim 1, wherein the source address of the forwarded message is the same as the first network address.

13. The intermediate computer of claim 1, wherein the intermediate computer is configured to receive a request to update the mapping with a new address of the first computer.

14. The intermediate computer of claim 13, wherein the request to update the mapping is encrypted and/or authenticated.

15. The intermediate computer of claim 13, wherein the request is encrypted and/or authenticated using IPsec protocols.

16. The intermediate computer of claim 13, wherein the request is encrypted and/or authenticated using SSL or TLS protocols.