Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
  • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
  • H04L63/0457—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply dynamic encryption, e.g. stream encryption
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/12—Detection or prevention of fraud
  • H04W12/121—Wireless intrusion detection systems [WIDS]; Wireless intrusion prevention systems [WIPS]
  • H04W12/122—Counter-measures against attacks; Protection against rogue devices
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W76/00—Connection management
  • H04W76/20—Manipulation of established connections
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
  • H04L63/1441—Countermeasures against malicious traffic
  • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/18—Network architectures or network communication protocols for network security using different networks or channels, e.g. using out of band channels
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
  • H04L69/14—Multichannel or multilink protocols
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
  • H04L69/30—Definitions, standards or architectural aspects of layered protocol stacks
  • H04L69/32—Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
  • H04L69/322—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions
  • H04L69/324—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions in the data link layer [OSI layer 2], e.g. HDLC

Definitions

• the present invention relates to a method and system for providing secure communications and, in particular, to a method and system for splitting a sensitive message to be communicated into plural packets (perhaps having variable lengths) and then transmitting the individual packets from a source to a destination with a selected varying time interval between successive packets.
• a message to be communicated over an unsecure communications link is fragmented into a plurality of packets. These individual packets may, if desired, have varying lengths.
• a transmitter module then individually transmits the packets over the unsecure communications link. The transmissions of the individual packets are made by the module in such a fashion as to introduce a varying (perhaps, randomly or pseudo-randomly) selected inter-packet time interval (delay) between successive packets.
• the transmitted packets are received and reassembled to regenerate the original message.
• This protocol for non-timely transmission of the individual message packets serves to make it more difficult for an eavesdropper to capture all of the message packets and reconstruct the transmitted message.
• Enhanced security is provided by not only transmitting the packets in a non-timely manner, but also by either sending the packets over different transmission paths supported by the communications link or disordering the packets in a random or pseudo random manner prior to transmission.
• FIGURE 1 is a block diagram of a communications system implementing a security protocol in accordance with the present invention
• FIGURE 2 is a flow diagram illustrating a method of operation concerning the security protocol of the present invention.
• FIGURE 1 a block diagram of a communications system 10 implementing a security protocol in accordance with the present invention.
• the communications system 10 includes an origination node
• the origination node 12 includes a source 18 for generating message traffic.
• the source 18 generated messages are then handled by a transmitter module 20 for transmission over the communications link 16 towards the destination node 14.
• a receiver module 22 in the destination node 14 receives the transmitted messages, and outputs the messages to a message sink 24.
• the transmitter module 20 includes a first functionality 26 for taking a message received from the source 18 and fragmenting the message into a plurality of individual packets. The fragmenting process may, if desired, generate individual packets of varying, rather than consistent, lengths. The transmitter module 20 then utilizes a second functionality 28 for transmitting the generated individual packets in a non-timely fashion.
• non-timely it is meant that the individual packets are transmitted by the transmitter module 20 over the communications link 16 with a varying inter-packet time interval (delay) between successive packets in the source originated message. This introduced delay between packets may be of either a randomly or pseudo randomly selected duration.
• the introduced varying inter-packet time delay serves to enhance the security of packet transmission over the communications link 16 as a potential eavesdropper does not know when each of the successive packets comprising the complete message are to be transmitted. Delays may be selectively chosen (from packet to packet) in a variable range from as short as - 3 -
• the third functionality 30 further introduces a random or pseudo random disordering of the message packets prior to non-timely transmission over the communications link 16.
• the fourth functionality 32 further introduces the transmission of the individual packets over different ones of a plurality of communications paths 34 supported by the communications link 16.
• the paths 34 may comprise different logical or physical channels within the communications link 16.
• the receiver module 22 includes a message reassembly functionality 36 for receiving the non-timely transmitted packets (perhaps in either or both a disordered manner and/or from different paths 34), and then coordinating the reconstruction of the original message as generated by the source 18. The reconstructed message is then output by the functionality 36 to the sink 24 for further processing and handling.
• the functionality 36 includes appropriate memory (not shown) for temporarily caching received message packets prior to processing and completion of the message reconstruction action.
• the system 10 comprises a telecommunications system
• the origination node 12 sends a message on behalf of a user (such as a user mobile station)
• the destination node 14 comprises a network communications node (such as a mobile switching center or home location register)
• the communications link 16 comprises a signaling network of the telecommunications system.
• the message being communicated in a fragmented, non-timely manner may comprises sensitive telecommunications information such as authentication data.
• the secure transmission protocol of the present invention accordingly provides a level of defense against the interception of this sensitive mobile station information and possible cloning of the mobile station.
• step 100 a message is originated for transmission.
• step 102 that originated message is fragmenting into a plurality of individual packets.
• the fragmenting process of step 102 may, if desired, generate individual packets of - 4 -
• step 104 the generated individual packets are optionally disordered in either a random or a pseudo random manner.
• the generated individual packets are then transmitted in step 106 in a non-timely fashion such that there is introduced between the transmission of individual packets a randomly or pseudo randomly varying inter-packet time interval (delay).
• the non- timely transmission of step 106 may further involve selectively transmitting the individual packets over different ones of a plurality of communications paths (such as plural physical or logical channels).
• step 108 the non- timely transmitted packets are received. Reassembly of the packets back into the original message occurs in step 110. This step of reassembly in step 110 accounts not only for the introduced inter- packet time delay, but also for any optionally introduced variance in packet size, packet disordering or differences in transmission path.
• the regenerated message is then output in step 112.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Computer Hardware Design (AREA)
• Computing Systems (AREA)
• General Engineering & Computer Science (AREA)
• Data Exchanges In Wide-Area Networks (AREA)
• Mobile Radio Communication Systems (AREA)

Priority Applications (4)

Applications Claiming Priority (2)

Publications (1)

Family

ID=22144090

Family Applications (1)

Country Status (7)

Cited By (11)

Families Citing this family (4)

Citations (4)

• 1999
  • 1999-04-27 GB GB0026379A patent/GB2353683A/en not_active Withdrawn
  • 1999-04-27 WO PCT/SE1999/000686 patent/WO1999059293A1/en active Application Filing
  • 1999-04-27 BR BR9910423-7A patent/BR9910423A/pt not_active IP Right Cessation
  • 1999-04-27 CN CN99806123A patent/CN1300489A/zh active Pending
  • 1999-04-27 CA CA002331612A patent/CA2331612A1/en not_active Abandoned
  • 1999-04-27 AU AU44019/99A patent/AU4401999A/en not_active Abandoned
  • 1999-05-07 AR ARP990102182A patent/AR015289A1/es not_active Application Discontinuation

Patent Citations (4)

Also Published As

Similar Documents

Legal Events