Mobile security architecture
View Patent ↗Security and mobility overlay architecture (SAMOA) includes security management and secure transport functions for fixed or mobile security subscriber units (SSUs). SSUs within SAMOA are authenticated, authorized, and provided with shared session keys by the security management function. The keys allow each SSU to communicate with the secure transport network, which provides secure connections to other SSUs. Because shared-key, rather than public-key session keys are preferably used, the problems associated with public-key certificate authorities and hierarchies are avoided. The security management function and the secure transport network can be layered efficiently on top of existing Internet protocol (IP) networks and are thus applicable to a wide range of systems that support IP, including 3G wireless, wireless LANs (e.g., 802.11x), wired LANs, and dial-up networks.
1. A security management and secure transport system comprising:
a security agent node group (SANG) serving as a system-wide security authority and having at least one security agent node (SAN); and
a transport agent node group (TANG) serving as a backbone for secure communications and having at least one transport agent node (TAN), wherein:
a security subscriber unit (SSU) communicates with the SANG over a non-secure link to establish a first session key at the SSU;
then the SAN communicates with the TANG, wherein (1) the SAN transmits information to the TANG via a path that bypasses the SSU and (2) the TANG uses the information to establish the first session key at the TANG; and
then the SSU communicates with the TANG over a secure link based on the first session key.
2. The system of claim 1 , wherein:
the SANG has two or more SANs that are linked to each other via a first secure protocol;
the TANG has two or more TANs that are linked to each other via a second secure protocol.
3. The system of claim 2 , wherein at least one of the first and second secure protocols is IPSEC.
4. The system of claim 2 , wherein:
the TANG forms a secure transport overlay network adapted to:
provide TAN-to-TAN routing; and
set up and revise transport connections for the SSU; and
the SANG is adapted to manage the distribution of shared keys to TANG and SANG nodes.
5. The system of claim 4 , wherein at least one SAN shares a common hardware platform with at least one TAN.
6. The system of claim 1 , wherein one or more additional SSUs register with the SANG to each establish one or more corresponding session keys that allows each of the one or more additional SSUs to securely connect to the TANG and thereby to securely connect to any other of the one or more additional SSUs and the SSU.
7. The system of claim 6 , wherein:
the system is adapted to support a planned session for the SSU and the one or more additional SSUs, the planned session identified by a session ID;
the SSU and the one or more additional SSUs are adapted to join and leave the planned session by use of the session TD; and
the TANG is adapted to use the session ID in routing packets to and from the SSU and the one or more additional SSUs.
8. The system of claim 1 , wherein:
the SANG supports proxy authentication to support virtual private networks;
the SANG supports billing for SSU communication sessions; and
the security management and secure transport system supports secure multicasting.
9. The system of claim 1 , wherein:
the SANG and the SSU each have a copy of a first shared key;
the SANG conveys to the SSU a first method of processing the first shared key, without conveying the first shared key itself; and
the SANG and the SSU independently implement the first method to generate, and thereby establish, local copies of the first session key based on the first shared key.
10. The system of claim 9 , wherein:
the SANG conveys to the TANG a second method of processing a second shared key that is shared between the SANG and the TANG, wherein the SANG and the TANG independently implement the second method to generate, based on the second shared key, local copies of the second session key; and
the SANG establishes a secure communication link to the TANG based on the second session key and conveys the first session key to the TANG over the secure communication link.
11. The system of claim 9 , wherein each of at least two SANs in the SANG has a copy of the first shared key associated with the SSU.
12. The system of claim 1 , wherein the TANG is overlaid on a wireless network.
13. The system of claim 1 , wherein at least one TAN maintains at least part of a hash table to facilitate routing in the TANG, wherein the at least one TAN maintains an entry in the hash table for at least one SSU that is currently connected to the TAN.
14. The system of claim 1 , wherein the SSU registers with the SANG via an initial access node (IAN).
15. The system of claim 14 , wherein the SANG is adapted to approve registration of the SSU via more than one IAN at a time.
16. The system of claim 1 , wherein at least one SAN comprises a server running a version of the remote authentication dial-in user services (RADIUS) protocol.
17. The system of claim 1 , wherein at least one SAN in the SANG and the SSU mutually authenticate each other based on a shared key.
18. The system of claim 1 , wherein the system is able to page an idle SSU and the idle SSU is adapted to wake up in response to the page.
19. The system of claim 1 , wherein a home TAN in the TANG supports forwarding of packets from the home TAN to a current connection agent node (CAN) TAN using a tunneling protocol.
20. The system of claim 1 , wherein the SANG directs a mobile SSU to access the TANG via a single TAN for more than one registration with the system as the mobile SSU moves between access points in the system.
21. The system of claim 1 , wherein at least one TAN in the TANG supports enterprise policy lists.
22. The system of claim 1 , wherein at least one of the TANG and the SANG is reachable by an IP layer datagram.
23. The system of claim 1 , wherein the SSU initiates a connection with the system.
24. The system of claim 1 , wherein links between TANs in the TANG are pre-provisioned.
25. The system of claim 1 , wherein, when the TAN receives a packet that is not destined for an SSU, the TAN detunnels the packet and passes it to an ordinary internet router for non-secure routing to its destination.
26. The system of claim 1 , wherein the secure link based on the first session key bypasses the SANG.
27. A method for security management and secure transport comprising:
linking one or more security agent nodes (SANs) via a first secure protocol to each other into a security agent node group (SANG), and
linking one or more transport agent nodes (TANs) via a second secure protocol to each other into a transport agent node group (TANG),
providing a first shared key to a first security subscriber unit (SSU), wherein the first shared key is known to the SANG, and
using the first shared key to establish a first session key that allows the first SSU to securely connect to the TANG.
28. The method of claim 27 , wherein:
the SANG has two or more SANs that are linked to each other via a first secure protocol;
the TANG has two or more TANs that are linked to each other via a second secure protocol;
wherein at least one of the first and second secure protocols is IPSEC.
29. The method of claim 27 , wherein at least two SSUs register with the SANG to each establish at least one session key that allows each SSU to securely connect to the TANG and thereby to securely connect to each other.
30. The method of claim 29 , further comprising establishing a planned session for the at least two SSUs, wherein:
the planned session is identified by a session ID;
each of the at least two SSUs can join and leave the planned session by use of the session ID; and
the TANG uses the session ID in routing packets to and from the at least two SSUs.
31. The method of claim 27 , wherein at least one TAN in the TANG supports enterprise policy lists.
32. The method of claim 27 , further comprising:
conveying the first session key from the SANG to the TANG over a secure communication link.
33. The method of claim 27 , wherein:
the TANG forms a secure transport overlay network adapted to:
serve as a backbone for secure communications;
provide TAN-to-TAN routing; and
set up and revise transport connections for the SSU; and
the SANG is adapted to manage the distribution of shared keys to TANG and SANG nodes.
34. The method of claim 33 , wherein at least one SAN shares a common hardware platform with at least one TAN.
35. The method of claim 27 , wherein the secure connection from the SSU to the TANG bypasses the SANG.