Secure communication methods and systems
Methods and systems for secure communications are provided. Secure end-to-end connections are established as separate multiple secure connections, illustratively between a first system and an intermediate system and between a second system and an intermediate system. The multiple secure connections may be bound, by binding Internet Protocol Security Protocol (IPSec) Security Associations (SAs) for the multiple connections, for example, to establish the end-to-end connection. In the event of a change in operating conditions which would normally require the entire secure connection to be re-established, only one of the multiple secure connections which form the end-to-end connection is re-established. Separation of end-to-end connections in this manner may reduce processing resource requirements and latency normally associated with re-establishing secure connections.
1. A method of managing a secure connection between an access system and a remote system, the secure connection comprising a secure connection between the access system and an intermediate system and a secure connection between the intermediate system and the remote system, the method comprising:
establishing the secure connection between the intermediate system and the remote system using credentials of the access system for the intermediate system;
establishing the secure connection between the access system and the intermediate system only after the secure connection between the intermediate system and the remote system has been established;
detecting a change in operating conditions of the access system; and
establishing a new secure connection between the access system and the intermediate system responsive to the detecting, whereby the secure connection between the access system and the remote system comprises the new secure connection between the access system and the intermediate system and the secure connection between the intermediate system and the remote system.
2. The method of claim 1 , wherein establishing a new secure connection comprises negotiating security parameters between the access system and the intermediate system.
3. The method of claim 1 , wherein the secure connection between the access system and the intermediate system is established by negotiating security parameters to be used between endpoint addresses, the endpoint addresses comprising an address of the intermediate system and an address of the access system, wherein the change in operating conditions comprises a change in the address of the access system to a new access system address, and wherein establishing a new secure connection comprises updating the endpoint address of the access system to the new access system address.
4. The method of claim 1 , wherein the secure connection between the access system and the intermediate system and the secure connection between the intermediate system and the remote system have respective Internet Protocol Security (IPSec) Protocol Security Associations (SAs).
5. The method of claim 1 , wherein the secure connection between the intermediate system and the remote system comprises a secure connection between the intermediate system and a second intermediate system and a secure connection between the second intermediate system and the remote system, the method further comprising:
detecting a change in operating conditions of the remote system; and
establishing a new secure connection between the second intermediate system and the remote system responsive to the detecting, whereby the secure connection between the intermediate system and the remote system comprises the secure connection between the intermediate system and the second intermediate system and the new secure connection between the second intermediate system and the remote system.
6. The method of claim 1 , wherein the secure connection between the access system and the remote system comprises one of a plurality of secure connections between the access system and at least one remote system including the remote system, the plurality of secure connections comprising the secure connection between the access system and the intermediate system and respective secure connections between the intermediate system and the at least one remote system.
7. A computer-readable medium storing instructions which when executed perform the method of claim 1 .
8. The method of claim 1 , wherein detecting comprises detecting a change in an address of the access system.
9. The method of claim 8 , wherein the address of the access system comprises an Internet Protocol (IP) address.
10. The method of claim 8 , wherein detecting a change in an address of the access system comprises receiving an address change notification.
11. The method of claim 1 , wherein the secure connection between the access system and the intermediate system comprises a connection through a first communication network, and wherein detecting comprises determining that a handoff of the connection from the first communication network to a second communication network is imminent.
12. The method of claim 11 , wherein determining that a handoff is imminent comprises at least one of: receiving a trigger for the handoff and determining a characteristic of a communication signal received from the access system on the secure connection between the access system and the intermediate system.
13. An intermediate system for managing a secure connection between an access system and a remote system, the secure connection comprising a secure connection between the access system and the intermediate system and a secure connection between the intermediate system and the remote system, the intermediate system comprising:
a transceiver for communicating with the access system and the remote system; and
a processor configured to establish the secure connection between the intermediate system and the remote system using credentials of the access system for the intermediate system, to establish the secure connection between the access system and the intermediate system only after the secure connection between the intermediate system and the remote system has been established, to detect a change in operating conditions of the access system, and to establish a new secure connection between the access system and the intermediate system through the transceiver responsive to a detected change in operating conditions of the access system, whereby the secure connection between the access system and the remote system comprises the new secure connection between the access system and the intermediate system and the secure connection between the intermediate system and the remote system.
14. The system of claim 13 , wherein the processor is configured to establish a new secure connection by negotiating security parameters for the new secure connection with the access system.
15. The system of claim 13 , wherein the secure connection between the access system and the intermediate system and the secure connection between the intermediate system and the remote system have respective Internet Protocol Security (IPSec) Protocol Security Associations (SAs), and wherein the processor comprises an IPSec client for establishing the new secure connection with an IPSec client of the access system.
16. The system of claim 13 , wherein the secure connection between the access system and the remote system comprises one of a plurality of secure connections between the access system and at least one remote system including the remote system, the plurality of secure connections comprising the secure connection between the access system and the intermediate system and respective secure connections between the intermediate system and the at least one remote system.
17. A communication system comprising:
an access system;
a remote system;
an intermediate system comprising the system of claim 13 for establishing a secure connection between the access system and the remote system by establishing respective secure connections between the access system and the intermediate system and between the intermediate system and the remote system; and
a second intermediate system comprising the system of claim 13 for establishing the secure connection between the intermediate system and the remote system by establishing respective secure connections between the intermediate system and the second intermediate system and between the second intermediate system and the remote system.
18. The system of claim 13 , wherein the change in operating conditions of the access system comprises a change in an address of the access system.
19. The system of claim 18 , wherein the address of the access system comprises an Internet Protocol (IP) address.
20. The system of claim 18 , wherein the processor is configured to detect a change in an address of the access system based on an address change notification received through the transceiver.
21. The system of claim 13 , wherein the secure connection between the access system and the intermediate system comprises a connection through a first communication network, and wherein the processor is configured to detect a change in operating conditions of the access system based on a determination that a handoff of the connection from the first communication network to a second communication network is imminent.
22. The system of claim 21 , wherein the determination that a handoff is imminent is made based on at least one of: a trigger for the handoff and a characteristic of a communication signal received from the access system through the transceiver.
23. The system of claim 13 , wherein the secure connection between the access system and the intermediate system is established by negotiating security parameters to be used between endpoint addresses, the endpoint addresses comprising an address of the intermediate system and an address of the access system, wherein the change in operating conditions comprises a change in the address of the access system to a new access system address, and wherein the processor is configured to establish a new secure connection by updating the endpoint address of the access system to the new access system address.
24. The system of claim 23 , further comprising:
a memory storing an identifier of the security parameters and the endpoint addresses,
wherein the processor is configured to update the endpoint address of the access system by storing in the memory the new access system address.