Method and system for sending a message through a secure connection
The method and system enable secure forwarding of a message from a first computer to a second computer via an intermediate computer in a telecommunication network. A message is formed in the first computer or in a computer that is served by the first computer, and in the latter case, sending the message to the first computer. In the first computer, a secure message is then formed by giving the message a unique identity and a destination address. The message is sent from the first computer to the intermediate computer after which the destination address and the unique identity are used to find an address to the second computer. The current destination address is substituted with the found address to the second computer, and the unique identity is substituted with another unique identity. Then the message is forwarded to the second computer.
1. An intermediate computer for secure forwarding of messages in a telecommunication network, comprising:
an intermediate computer configured to connect to a telecommunication network;
the intermediate computer configured to receive an encrypted signaling message from a first computer, the first computer being a mobile computer connected to the telecommunication network using a wireless connection;
the intermediate computer configured to access a first mapping between a first unique identity and an address of the first computer;
the intermediate computer configured to change the address of the first computer in the first mapping after receiving the encrypted signaling message from the first computer;
the intermediate computer configured to access a second mapping between a second unique identity and an address of a second computer;
the intermediate computer configured to receive from the first computer a first message containing a first encrypted payload and a single field containing the second unique identity, the first encrypted payload encrypted with a first encryption key derived from a key exchange protocol and the first message being encapsulated with an encapsulation protocol;
the intermediate computer configured to use the second unique identity and the second mapping to find the address of the second computer;
the intermediate computer configured to forward the first encrypted payload to the second computer using the encapsulation protocol, wherein the intermediate computer does not have the first encryption key;
the intermediate computer configured to receive from the second computer a second message containing a second encrypted payload and a single field containing the first unique identity, the second encrypted payload encrypted with a second encryption key derived from the key exchange protocol and the second message being encapsulated with the encapsulation protocol;
the intermediate computer configured to use the first unique identity and the first mapping to find the address of the first computer;
the intermediate computer configured to forward the second encrypted payload to the first computer using the encapsulation protocol, wherein the intermediate computer does not have the second encryption key; and
the intermediate computer configured to perform a retransmission protocol to prevent dropped messages between the first computer and the intermediate computer.
2. The intermediate computer of claim 1 , wherein the retransmission protocol is based on a sequence number.
3. The intermediate computer of claim 1 , wherein the retransmission protocol is based on a replay protection window.
4. The intermediate computer of claim 1 , wherein the encapsulation protocol is SSL or TLS.
5. The intermediate computer of claim 1 , wherein the encapsulation protocol supports NAT traversal.
6. The intermediate computer of claim 1 , wherein the encapsulation protocol is UDP.