Method for transferring messages comprising extensible markup language information
Methods for transferring messages ( 30 ) comprising extensible markup language information from sources ( 104 ) via intermediates ( 105 ) to destinations ( 106 ) are provided with hop-by-hop encryption/decryption processes instead of end-to-end encryption/decryption processes to reduce a complexity and to make non-encrypted messages ( 30 ) available inside the intermediates ( 105 ). The encryption/decryption processes are different per hop. An encryption/decryption of the message ( 30 ) comprises an encryption/decryption of one or more fields of the message ( 30 ) and may comprise an addition/detection of a signature. The message ( 30 ) may comprise a start envelope field ( 32 ), a header field ( 33 - 35 ), a body field ( 36 - 38 ) and a stop envelope field ( 39 ). The message ( 30 ) may comprise a simple object access protocol message or SOAP message.
1. An intermediate network node, comprising:
a receiver operative to receive a firstly encrypted message from a predecessor network node for transmission to a successor network node;
a decryption unit operative to decrypt the firstly encrypted message according to a first encryption/decryption process to provide a regained message, the first encryption/decryption process being defined by the identities of the intermediate network node and the predecessor network node;
an encryption unit operative to encrypt the regained message according to a second encryption/decryption process to provide a secondly encrypted message, the second encryption/decryption process being defined by the identities of the intermediate network node and the successor network node; and
a transmitter operative to transmit the secondly encrypted message to the successor network node.
2. The intermediate network node of claim 1 :
wherein the decryption unit is operative to determine a decryption key according to the identities of the intermediate network node and the predecessor network node, and to decrypt the firstly encrypted message according to the first encryption/decryption process using the decryption key to provide the regained message; and
wherein the encryption unit is operative to determine an encryption key according to the identities of the intermediate network node and the successor network node, and to encrypt the regained message according to the second encryption/decryption process using the encryption key to provide the secondly encrypted message.
3. The intermediate network node of claim 2 :
wherein the decryption unit is operative to determine the decryption key independent of source or destination programs associated with firstly encrypted message; and
wherein the encryption unit is operative o determine the encryption key independent of source or destination programs associated with the firstly encrypted message.
4. The intermediate network node of claim 3 , wherein the firstly encrypted message comprises a header field indicating a destination of the firstly encrypted message, wherein the decryption unit is operative to decrypt the header field of the firstly encrypted message, and wherein the encryption unit is operative to encrypt the header field of the regained message.
5. The intermediate network node of claim 4 , where the decryption unit is operative to decrypt encrypted messages originating from at least one neighboring network node and is not arranged to decrypt encrypted messages originating from at least one non-neighboring network node, and where the encryption unit is arranged to encrypt regained messages destined for at least one neighboring network node and is not arranged to encrypt regained messages destined for at least one non-neighboring network node.
6. The intermediate network node of claim 5 , wherein the encryption unit is operative to add a signature to the secondly encrypted message.
7. The intermediate network node of claim 1 :
wherein the first encryption/decryption process is defined by the identities of the intermediate network node and the predecessor network node independent of source or destination programs associated with the firstly encrypted message; and
wherein the second encryption/decryption process is defined by the identities of the intermediate network node and the successor network node independent of source or destination programs associated with the firstly encrypted message.
8. The intermediate network node of claim 7 , where n the firstly encrypted message comprises a header field indicating a destination of the firstly encrypted message, wherein the decryption unit is operative to decrypt the header field of the firstly encrypted message, and wherein the encryption unit is operative to encrypt the header field of the regained message.
9. The intermediate network node of claim 7 , where the decryption unit is operative to decrypt encrypted messages originating from at least one neighboring network node and is not arranged to decrypt encrypted messages originating from at least one non-neighboring network node, and where the encryption unit is arranged to encrypt regained messages destined for at least one neighboring network node and is not arranged to encrypt regained messages destined for at least one non-neighboring network node.
10. The intermediate network node of claim 7 , wherein the encryption unit is operative to add a signature to the secondly encrypted message.
11. The intermediate network node of claim 1 , wherein the firstly encrypted message comprises a header field indicating a destination of the firstly encrypted message, wherein the decryption unit is operative to decrypt the header field of the firstly encrypted message, and wherein the encryption unit is operative to encrypt the header field of the regained message.
12. The intermediate network node of claim 1 , where the decryption unit is operative to decrypt encrypted messages originating from at least one neighboring network node and is not arranged to decrypt encrypted messages originating from at least one non-neighboring network node, and where the encryption unit is arranged to encrypt regained messages destined for at least one neighboring network node and is not arranged to encrypt regained messages destined for at least one non-neighboring network node.
13. The intermediate network node of claim 1 , wherein the encryption unit is operative to add a signature to the secondly encrypted message.
14. A method for transferring a message from a first network node via a second network node to a third network node, the method comprising:
at the second network node, receiving a firstly encrypted message from the first network node;
at the second network node, decrypting the firstly encrypted message according to a first encryption/decryption process to provide a regained message, the first encryption/decryption process being defined by the identities of the first and second network nodes;
at the second network node, encrypting the regained message according to a second encryption/decryption process to provide a secondly encrypted message, the second encryption/decryption process being defined by the identities of the second and third network nodes; and
transmitting the secondly encrypted message from the second network node to the third network node.
15. The method of claim 14 :
wherein decrypting the firstly encrypted message comprises:
determining a decryption key according to the identities of the first and second network nodes, and
decrypting the firstly encrypted message according to the first encryption/decryption process using the decryption key to provide the regained message; and
wherein encrypting the regained message comprises:
determining an encryption key according to the identities of the second and third network nodes, and
encrypting the regained message according to the second encryption/decryption process using the encryption key to provide the secondly encrypted message.
16. The method of claim 15 , wherein the decryption key and the encryption key are determined independent of source or destination programs associated with the firstly encrypted message.
17. The method of claim 14 , wherein the first and second encryption/decryption processes are defined independent of source or destination programs associated with the firstly encrypted message.
18. The method of claim 14 , wherein the firstly encrypted message comprises a header field indicating a destination of the firstly encrypted message, wherein decrypting the firstly encrypted message comprises decrypting the header field of the firstly encrypted message, and wherein encrypting the regained message comprises encrypting the header field of the regained message.
19. The method of claim 14 , comprising:
decrypting encrypted messages originating from at least one neighboring network node;
refraining from decrypting encrypted messages originating from at least one non-neighboring network node;
encrypting regained messages destined for at least one neighboring network node; and
refraining from encrypting regained messages destined for at least one non-neighboring network node.
20. The method of claim 14 , further comprising adding a signature to the secondly encrypted message.