Secure end-to-end transport through intermediary nodes
A communication network encrypts a first portion of a transaction associated with point-to-point communications using a point-to-point encryption key. A second portion of the transaction associated with end-to-end communications is encrypted using an end-to-end encryption key.
1. A method comprising:
encrypting, at a first computer, first data of a first data path in a transaction using a first security association, wherein the first data path is through an intermediary server that provides connectivity between the first computer and a second computer, and wherein the first security association is not known to the intermediary server;
wherein the transaction comprises a transaction message that includes control data and payload data;
transmitting the control data to the intermediary server, wherein the control data includes a token associated with the intermediary server and the token provides transaction routing information;
encrypting second data of a second data path using a second security association, wherein the second data path is distinct from the intermediary server; and
transmitting the payload data through the second data path.
2. The method of claim 1 , wherein the first computer is a first mobile device, and the first mobile device and the intermediary server are coupled over a mobile network.
3. The method of claim 2 , wherein the mobile network provides an Internet protocol (IP) infrastructure of a wireless service provider.
4. The method of claim 3 , wherein the first mobile device is a source for the transaction and the second computer is a target for the transaction.
5. The method of claim 3 , wherein the second computer is a second mobile device.
6. The method of claim 5 , wherein the transaction message includes a device identification associated with the second mobile device.
7. The method of claim 6 , wherein the transaction message is modified by the first computer based on the device identification.
8. The method of claim 6 , wherein the device identification is associated within the intermediary server to a third security association between the intermediary server and the second computer.
9. The method of claim 3 , wherein the second computer is a personal computer.
10. The method of claim 1 , wherein the payload data is decrypted and displayed on the second computer.
11. The method of claim 1 , wherein the token is issued by the intermediary server.
12. The method of claim 11 , wherein the token is issued in response to a username and a password.
13. A method implemented on an intermediary server, the method comprising:
receiving a username and a password from a first computer;
authenticating the username and the password with a user database;
issuing a token for the first computer after authenticating the username and the password, wherein a first point-to-point security association is negotiated with the first computer and a second point-to-point security association is negotiated with a second computer;
receiving a transaction message from the second computer, the transaction message comprising control data and payload data, wherein the control data includes information that provides authentication of a source of the transaction and transaction routing information, wherein the information includes the token; and
transmitting the payload data to the first computer based on the transaction routing information.
14. The method of claim 13 , wherein the first computer is a first mobile device, and the first mobile device and the intermediary server are coupled over a mobile network.
15. The method of claim 14 , wherein the mobile network provides an Internet protocol (IP) infrastructure of a wireless service provider.
16. The method of claim 15 , wherein the second computer is a second mobile device.
17. The method of claim 15 , wherein the second computer is a personal computer.
18. The method of claim 15 , wherein the transaction message includes a device identification associated with the first mobile device.
19. The method of claim 18 , wherein the transaction message is modified by the second computer based on the device identification.
20. The method of claim 19 , wherein the method further comprises associating the first point-to-point security association with the device identification.
21. The method of claim 20 , wherein the device identification provides the transaction routing information for the intermediary server.
22. The method of claim 13 , wherein the transaction message has a third security association and the payload data is encrypted payload data.
23. A server for processing a transaction, the server having a processor configured to:
receive a username and a password from a first computer;
authenticate the username and the password with a user database;
issue a token for the first computer after authenticating the username and the password, wherein a first point-to-point security association is negotiated with the first computer and a second point-to-point security association is negotiated with a second computer;
receive a transaction message from the second computer, the transaction message comprising control data and payload data, wherein the control data includes information that provides authentication of a source of the transaction and transaction routing information, wherein the information includes the token; and
transmit the payload data to the first computer based on the transaction routing information.
24. The server of claim 23 , wherein the first computer is a first mobile device, and the first mobile device and the server are coupled over a mobile network.
25. The server of claim 24 , wherein the mobile network provides an Internet protocol (IP) infrastructure of a wireless service provider.
26. The server of claim 25 , wherein the second computer is a second mobile device.
27. The server of claim 25 , wherein the second computer is a personal computer.
28. The server of claim 25 , wherein the transaction message includes a device identification associated with the first mobile device.
29. The server of claim 28 , wherein the transaction message is modified by the second computer based on the device identification.
30. The server of claim 29 , wherein the processor is further configured to associate the first point-to-point security association with the device identification.
31. The server of claim 30 , wherein the device identification provides the transaction routing information for the server.
32. The server of claim 23 , wherein the transaction message has a third security association and the payload data is encrypted payload data.
33. A first computer having a processor configured to:
encrypt first data of a first data path in a transaction using a first security association, wherein the first data path is through an intermediary server that provides connectivity between the first computer and a second computer, and wherein the first security association is not known to the intermediary server;
wherein the transaction comprises a transaction message that includes control data and payload data;
transmit the control data to the intermediary server, wherein the control data includes a token associated with the intermediary server and the token provides transaction routing information;
encrypt second data of a second data path using a second security association, wherein the second data path is distinct from the intermediary server; and
transmit the payload data through the second data path.
34. The first computer of claim 33 , wherein the first computer is a first mobile device, and the first mobile device and the intermediary server are coupled over a mobile network.
35. The first computer of claim 34 , wherein the mobile network provides an Internet protocol (IP) infrastructure of a wireless service provider.
36. The first computer of claim 35 , wherein the first mobile device is a source for the transaction and the second computer is a target for the transaction.
37. The first computer of claim 35 , wherein the second computer is a second mobile device.
38. The first computer of claim 37 , wherein the transaction message includes a device identification associated with the second mobile device.
39. The first computer of claim 38 , wherein the transaction message is modified by the second computer based on the device identification.
40. The first computer of claim 38 , wherein the device identification is associated within the intermediary server to a third security association between the intermediary server and the second computer.
41. The first computer of claim 35 , wherein the second computer is a personal computer.
42. The first computer of claim 33 , wherein the payload data is decrypted and displayed on the second computer.
43. The first computer of claim 33 , wherein the token is issued by the intermediary server.
44. The first computer of claim 43 , wherein the token is issued in response to a username and a password.