Secure end-to-end transport through intermediary nodes
A communication network encrypts a first portion of a transaction associated with point-to-point communications using a point-to-point encryption key. A second portion of the transaction associated with end-to-end communications is encrypted using an end-to-end encryption key.
1. A system for processing a transaction, the system having at least one processor configured for:
receiving an identifier sent from a first computer;
issuing a token for the first computer, wherein a first point-to-point security association is negotiated with the first computer and a second point-to-point security association is negotiated with a second computer;
receiving a transaction message from the second computer, the transaction message comprising control data and payload data, wherein:
the control data provides authentication of a source of the transaction and includes the token; and
the token provides transaction routing information; and
transmitting the payload data to the first computer based on the token.
2. The system of claim 1 , wherein the payload data is transmitted to the first computer via one or more intermediary servers.
3. The system of claim 2 , wherein the payload data is encrypted with a security association not known to the intermediary servers.
4. The system of claim 1 , wherein the token is issued to the first computer after authenticating the first computer.
5. The system of claim 1 , wherein the first computer is a mobile device and the second computer is a personal computer.
6. The system of claim 1 , wherein the first computer and the system are coupled over a mobile network that provides an Internet protocol (IP) infrastructure of a wireless service provider.
7. The system of claim 1 , wherein the payload data is decrypted and displayed on the first computer.
8. A method implemented on a system for processing a transaction, the method comprising:
receiving an identifier sent from a first computer;
issuing a token for the first computer, wherein a first point-to-point security association is negotiated with the first computer and a second point-to-point security association is negotiated with a second computer;
receiving a transaction message from the second computer, the transaction message comprising control data and payload data, wherein:
the control data provides authentication of a source of the transaction and includes the token; and
the token provides transaction routing information; and
transmitting the payload data to the first computer based on the token.
9. The method of claim 8 , wherein the payload data is transmitted to the first computer via one or more intermediary servers.
10. The method of claim 9 , wherein the payload data is encrypted with a security association not known to the intermediary servers.
11. The method of claim 8 , wherein the token is issued to the first computer after authenticating the first computer.
12. The method of claim 8 , wherein the first computer is a mobile device and the second computer is a personal computer.
13. The method of claim 8 , wherein the first computer and the system are coupled over a mobile network that provides an Internet protocol (IP) infrastructure of a wireless service provider.
14. The method of claim 8 , wherein the payload data is decrypted and displayed on the first computer.