WO2016144217A1 - Secure data transfer - Google Patents

Secure data transfer Download PDF

Info

Publication number
WO2016144217A1
WO2016144217A1 PCT/SE2015/050260 SE2015050260W WO2016144217A1 WO 2016144217 A1 WO2016144217 A1 WO 2016144217A1 SE 2015050260 W SE2015050260 W SE 2015050260W WO 2016144217 A1 WO2016144217 A1 WO 2016144217A1
Authority
WO
WIPO (PCT)
Prior art keywords
communication
node
address
scheme
communication scheme
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/SE2015/050260
Other languages
French (fr)
Inventor
Mats Jonsson
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Saab AB
Original Assignee
Saab AB
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Saab AB filed Critical Saab AB
Priority to PCT/SE2015/050260 priority Critical patent/WO2016144217A1/en
Priority to US15/556,669 priority patent/US10841095B2/en
Priority to SE1751040A priority patent/SE542300C2/en
Publication of WO2016144217A1 publication Critical patent/WO2016144217A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/06—Network architectures or network communication protocols for network security for supporting key management in a packet data network
    • H04L63/061—Network architectures or network communication protocols for network security for supporting key management in a packet data network for key exchange, e.g. in peer-to-peer networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/14—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols using a plurality of keys or algorithms
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
    • H04L69/161—Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
    • H04L69/162—Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields involving adaptations of sockets based mechanisms

Definitions

  • the present disclosure relates generally to a system, devices and methods thereof for providing a way to enable secure communication between communication nodes in a network.
  • Communicated information is at risk at being interrupted and/or compromised by external attackers.
  • DoS attacks are one of the most common ways to make resources unavailable to intended users. DoS attacks are commonly executed by saturating the target machine with communication requests so that it cannot handle the communication to the intended users. Specifically, a DoS attack is often directed at a specific port of a specific IP address.
  • US 8301789 B2 describes one example of such a method.
  • the document describes a port hopping technique where ports are dynamically switched during a communication session between two devices. The decision to switch ports is based on data length or packet count of a given transaction.
  • an aspect of the present invention is to provide a system, devices and methods thereof, which seek to mitigate, alleviate, or eliminate one or more of the above-identified deficiencies in the art and disadvantages singly or in any combination.
  • the disclosure provides for a method performed in a system of a network node and at least one communication node.
  • the method comprises: determining, in the network node, a set of available Internet Protocol, IP, addresses and a set of ports associated with each IP address;
  • the communication scheme is set up and distributed so that the communication nodes to be communicating know how and when to use what addresses and ports. By combining address hopping, port hopping and unique cryptographic keys, it is extremely hard, if not impossible, for an external entity to intercept all communication between end users. It is equally hard to perform a Denial-of- Service, DoS, attack.
  • the time slots of communication scheme are determined by the system owner so it is easy for the owner to control the timing of all communication and to cancel communications, as will be described later.
  • the communication node is an communication end node. Thus secure communication between communication end nodes is provided.
  • the communication node is an intermediate communication node, such as a network router. If intermediate communication nodes communicate according to a communication scheme, the route for communication between communication end nodes will continuously change. Thus, the security of the communication is increased.
  • the method comprises: continuously updating routing tables in the intermediary communication node based on the communication scheme.
  • the disclosure provides for a method performed in a network node, for distributing a communication scheme to provide a way to enable secure communication between communication nodes.
  • the method comprises: determining a set of available Internet Protocol, IP, addresses and a set of ports associated with each IP address;
  • the communication scheme is set up and distributed by the network node.
  • the distributing comprises: storing the communication scheme on a physical entity;
  • the communication scheme By physically distributing the communication scheme, it is ensured that the number of communication nodes in possession of the communication scheme is controlled. It is also easy to know if the communication scheme has been compromised by losing one of the physical entities. In other words, the physical distribution of the communication scheme ensures a more secure system.
  • the associating comprises that the combination of an IP address and port are different in adjacent time slots. If they are the same, the time the system uses the same combination of address and port may be long enough to initiate a DoS attack or to get hold of valuable information.
  • the associating comprises to associate each time slot with a random IP address of the available IP addresses and with a random port associated with the random IP address.
  • the assigning of IP address and port to the time slots is random so that there can be no way to predict the communication scheme.
  • the network node is a communication node.
  • method to produce the communication scheme is performed in a communication node and the communication scheme is then distributed to the other communication node with which the communication node will communicate.
  • the network node is a server and the disturbing comprises distributing the communication scheme to at least two communication nodes to enable the at least two communication nodes to communicate with each other securely.
  • the server may then be a control central for all communication schemes and handle which end notes will communication with what communication scheme and also control cancellations of communication schemes.
  • the unique cryptographic key is unique for all time slots. For maximum security the unique cryptographic key is never reused.
  • At least two time slots comprise unequal length with respect to one another.
  • the time slots do not need to be the same length. This can be used to further thwart attempts to compromise the communication.
  • the time slots are any length between 10 and 30 seconds or 30 and 59.9 seconds. Too short time lengths will heavily burden routers which will have to update address lists very often. Too long times will give potential interceptors more time to compromise the communication.
  • the method comprises: changing the communication scheme in at least one of the at least one communication nodes to disable communication between the communication nodes using that communication scheme.
  • communication nodes do not have the same communication scheme, communication will be disabled. This is useful if the network node suspects that the communication between communication nodes has been compromised or if one of the communication nodes is no longer trusted.
  • the distributing comprises to distribute a communication scheme which comprises a limited communication scheme based on a second time frame, which second time frame is a subframe of the time frame, for time limited access to the secure communication.
  • a communication scheme which comprises a limited communication scheme based on a second time frame, which second time frame is a subframe of the time frame, for time limited access to the secure communication.
  • the disclosure provides for a method performed in a
  • communication node for using a communication scheme to provide a way to enable secure communication between communication nodes.
  • the method comprises: receiving a communication scheme from a network node, wherein the communication scheme comprises a set of time slots, wherein each time slot is associated with an IP address of a set of available IP addresses, with a port associated with the IP address and with a unique cryptographic key; and communicating with another communication node in possession of a corresponding communication scheme by hopping between the IP addresses and ports according to the communication scheme and encrypting the communication using the unique cryptographic key.
  • the communication node is enabled to communicate according to the communication scheme.
  • the disclosure provides for a system of a network node and at least one communication node.
  • the network node comprises communication circuitry and processing circuit.
  • the processing circuitry is configured to: o determine a set of available Internet Protocol, IP, addresses and a set of ports associated with each IP address;
  • the at least one communication node comprises communication circuitry and processing circuit.
  • the processing circuitry is configured to: o receive, via the communication circuitry, a communication scheme from a network node, wherein the communication scheme comprises a set of time slots, wherein each time slot is associated with an IP address of a set of available IP addresses, with a port associated with the IP address and with a unique cryptographic key; and
  • o communicate, via the communication circuitry, with another communication node in possession of a corresponding communication scheme by hopping between the IP addresses and ports according to the communication scheme and encrypting the communication using the unique cryptographic key.
  • the disclosure provides for a network node.
  • the network node comprises communication circuitry and processing circuit.
  • the processing circuitry is configured to: o determine a set of available Internet Protocol, IP, addresses and a set of ports associated with each IP address;
  • the disclosure provides for a communication node.
  • the communication node comprises communication circuitry and processing circuit.
  • the processing circuitry is configured to: o receive a communication scheme from a network node, wherein the communication scheme comprises a set of time slots, wherein each time slot is associated with an IP address of a set of available IP addresses, with a port associated with the IP address and with a unique cryptographic key; and
  • the disclosure provides for a non-transitory computer readable medium, which, when executed on a network node, causes the network node to perform the method according to above when discussing the network node.
  • Figure 1 illustrates an example of two communication end nodes communicating over a network of communication nodes with a communication scheme received from the network node
  • Figures 2 illustrate an example of a network node
  • Figures 3 illustrate an example of a communication node
  • Figures 4 illustrate an example of a communication scheme
  • Figures 5 illustrate an example of a limited communication scheme
  • Figures 6 is a flow chart illustrating the proposed method, performed in the network node.
  • Figure 7 is a flow chart illustrating the proposed method, performed in the communication node.
  • Examples of such devices may for instance be any type of mobile phone, smartphone, laptop (such as standard, ultra portables, netbooks, and micro laptops), handheld computers, portable digital assistants, tablet computers, touch pads, gaming devices, accessories to mobile phones, e.g. wearable communication devices in the form of headphones/-sets, visors/goggles, bracelets, wristbands, necklaces, watches, headbands, rings, etc.
  • a communication device is any communication device equipped with communication means and can be e.g. a camera, a lamp post or vehicle.
  • Figure 1 shows an example of a system, for distributing and using a communication scheme 4 to provide a way to enable secure communication between communication nodes, with communication end nodes 2 communicating over a network of intermediary communication nodes 3 with one or several communication schemes received from a network node 1.
  • a communication scheme 4 to provide a way to enable secure communication between communication nodes, with communication end nodes 2 communicating over a network of intermediary communication nodes 3 with one or several communication schemes received from a network node 1.
  • the security is further increased by providing a way to change every step of a communication path between to communication end nodes regularly according to the communication schemes.
  • Figure 2 shows a network node 1, for distributing a communication scheme 4 to provide a way to enable secure communication between communication nodes 2, 3, according to some aspects of the disclosure.
  • the figure illustrates a network node comprising communication circuitry 11 and processing circuit 12.
  • the network node further comprises a memory 13 for storing data.
  • the memory may be any type of memory suitable for a wireless communication device.
  • Figure 3 shows a communication node 2, 3, for using a communication scheme 4 to provide a way to enable secure communication between communication nodes, according to some aspects of the disclosure.
  • the figure illustrates a communication node comprising communication circuitry 21 and processing circuit 22.
  • the communication node further comprises a memory 23 for storing data.
  • the memory may be any type of memory suitable for a wearable communication device.
  • the network node may take the form of the communication node of figure 3 and the communication node may take the form of the network node of figure 2.
  • Figure 4 and 5 shows examples of communication schemes according to some aspects of the disclosure.
  • Figure 6 is a flow diagram depicting example operations which may be taken by the network node.
  • Figure 7 is a flow diagram depicting example operations which may be taken by the communication node. All steps of the flow diagrams will be described hereafter, with reference to all of the drawings, in a logical order of the steps and not in the order of which device performs which steps.
  • the method of the system of a network node 1 and at least one communication node 2, 3 comprises to determine SI, in the network node, a set of available Internet Protocol, IP, addresses and a set of ports associated with each IP address.
  • the processing circuitry 12 of the network node is configured to determine SI the set of available Internet Protocol, IP, addresses and a set of ports associated with each IP address
  • the processing circuitry comprises a determining unit 121 for the determining.
  • the determining of available IP addresses comprises for example to check a list of available IP addresses. According to some aspects, it is up to the owner of the system to provide a list of available IP addresses. It may also comprise to order a new set of IP addresses of an external provider.
  • the method further comprises to divide S2, in the network node 1, a time frame in time slots.
  • the processing circuitry 12 of the network node is configured to divide S2 the time frame in time slots.
  • the processing circuitry comprises a divider 122 for the dividing.
  • the time frame may be any time frame and is set according to how long the system owner wants the system to be in use. If a system owner wants the system to work for a long time, the time frame is for example 60 years. If the system owner wants the system to be limited to a shorter time, the time frame is for example 1 year or any time frame decided upon by the system owner.
  • the length of the time slots is also determined by the system owner. According to some aspects the time slots are any length between 10 and 30 seconds or 30 and 59.9 seconds. Too short time lengths will heavily burden routers 3 which will have to update address lists very often. Too long times will give potential interceptors more time to compromise the communication. Port scanning by an interceptor takes about 60 seconds so a time slot is preferentially shorter than 60 seconds. According to some aspects at least two time slots comprise unequal length with respect to one another. In other words, the time slots do not need to be the same length. As an example, one time slot may be 10 seconds and another time slots may be 30 seconds. This can be used to further thwart attempts to compromise the communication.
  • the method further comprises to associate S3, in the network node 1, each time slot with an IP address of the available IP addresses, with a port associated with the IP address and with a unique cryptographic key, thereby setting up a communication scheme 4 for secure communication.
  • the processing circuitry 12 of the network node is configured to perform the associating S3.
  • the processing circuitry comprises an associating unit 123 for the associating.
  • the communication scheme is for example a list as illustrated in figure 4, where the first row 100, 110, 120, etc. comprises a list of the time slots, the second row 200, 210, 220 etc. comprises a list of IP addresses, the third row 300, 310, 320 etc. comprises a list of ports and the fourth row 400, 410, 420 etc.
  • the communication scheme comprises time slots associated with IP addresses, port numbers and cryptographic keys which the communication nodes shall use to communicate.
  • the associating S3 comprises that the combination of an IP address and port are different in adjacent time slots. In other words, they may not be the same in adjacent time slots. If they are the same, the time the system uses the same combination of address and port may be long enough to initiate a DoS attack or to get hold of valuable information.
  • the associating S3 comprises, according to some aspects, to associate S31 each time slot with a random IP address of the available IP addresses and with a random port associated with the random IP address.
  • the processing circuitry 12 of the network node is configured to associate S31 the time slots with random IP addresses and ports.
  • the processing circuitry comprises an associating unit 1231 for the associating. In other words, the assigning of IP address and port to the time slots is random, or at least pseudo random, so that there is no way to predict the communication scheme 4.
  • the unique cryptographic key is unique for all time slots. For maximum security the unique cryptographic key is never reused.
  • the method further comprises to distribute S4, from the network node 1, the communication scheme to the at least one communication node 2, 3.
  • the processing circuitry 12 of the network node is configured to distribute S4 the communication scheme.
  • the processing circuitry comprises a distributor 124 for the distributing.
  • the communication scheme is set up and distributed by the network node.
  • the distributing S4 comprises storing S41 the communication scheme 4 on a physical entity and physically distributing S42 the physical entity with the communication scheme stored thereon to the at least one communication node.
  • the processing circuitry 12 of the network node is configured to store S41 the communication scheme and to physically distribute S42 the physical entity.
  • the processing circuitry comprises a storing unit 1241 and a physical distributer 1242.
  • the physical entity is for example a YubiKeyTM.
  • a YubiKeyTM is a device that you register with a service that supports two-factor authentication. Two-factor authentication means that each time you log in, the service will request proof that you have your YubiKeyTM in addition to your regular username and password.
  • the communication scheme By physically distributing the communication scheme, it is ensured that the number of communication nodes in possession of the communication scheme is controlled. It is also easy to know if the communication scheme has been compromised by losing one of the physical entities. In other words, the physical distribution of the communication scheme ensures a more secure system.
  • the communication scheme is, according to some aspects, distributed digitally over a secure channel to the at least one communication node. It might be considered easier for a system owner to distribute the communication scheme digitally than to distribute it physically. According to some aspects, one part of the communication scheme is distributed physically and a second part is distributed digitally. Both parts of the communication scheme are then required at the communication node to be useable.
  • the network node wishes to communicate securely using a communication scheme, then, according to some aspects, the network node is a communication node.
  • method to produce the communication scheme 4 is performed in a communication node and the communication scheme is then distributed to the other communication nodes which will be part of the routing path between the communication end nodes.
  • the network node is a server and the disturbing S4 comprises distributing S43 the communication scheme 4 to at least two communication nodes to enable the at least two communication nodes to communicate with each other securely.
  • the processing circuitry 12 of the network node is configured to distribute S43 the communication scheme.
  • the processing circuitry comprises a distributing unit 1243 for distributing.
  • the server may then be a control central for all communication schemes and handle which end notes will communicate with what communication scheme and also control cancellations of communication schemes. Note that more than two communication end nodes cannot communicate with each other using the same communication scheme at the same time because then there would be an address conflict.
  • the network node may be unconnected to any network and only distribute the communication scheme physically. In this way, the network node is non-compromisable by network attacks.
  • the service owner may want to put a time limit on certain communication nodes.
  • the distributing S4 comprises, according to some aspects, to distribute S44 a communication scheme which comprises a limited communication scheme 5 based on a second time frame, which second time frame is a subframe of the time frame, for time limited access to the secure communication.
  • the processing circuitry 12 of the network node is configured to distribute S44 the communication scheme.
  • the processing circuitry comprises a distributer 1244 for distributing. In other words, it is possible to provide a communication node with a communication scheme limited in time. This is used with, for example, time limited subscriptions. An example of a time limited subscription is when a user has bought time limited access to a game.
  • Another example is when one main communication end node is to receive regular updates from several other communication end nodes.
  • the main communication end node then has a complete communication scheme and the other communication end nodes only has the communication scheme for the time slots that they are to use to send updates to the main communication end node.
  • the capacity of the main communication end node does not have to be so large then since it only receives one report at the time and it will not be possible for the other communication end nodes to send anything during the times that their communication scheme does not cover.
  • the limited communication scheme is for example a list as illustrated in figure 5, where the first row 120, 130, 140 comprises a list of the time slots, the second row 220, 230, 240 comprises a list of IP addresses, the third row 320, 330, 340 comprises a list of ports and the fourth row 420, 430, 440 comprises unique cryptographic keys.
  • the method further comprises to receive S100, in the at least one communication node 2, 3, the communication scheme 4, 5 from the network node.
  • the processing circuitry 22 of the communication node is configured to receive S100 the communication scheme.
  • the processing circuitry comprises a receiver 221 for receiving.
  • the communication scheme is either distributed digitally of physically, so the communication scheme is according to some aspects received digitally and according to some aspects physically.
  • the method further comprises to communicate S300, in one of the at least one communication nodes 2, 3, with another communication node in possession of a corresponding communication scheme by hopping between the IP addresses and ports according to the communication scheme and encrypting the communication using the unique cryptographic key.
  • the processing circuitry 22 of the communication node is configured to communicate S300, via the communication circuitry 21, with another communication node.
  • the processing circuitry comprises a communicator 223 for communicating. By communicating using the communication scheme, a secure communication is ensured.
  • the overlap is to provide time for the communicating communication nodes to inform connected communication nodes 3 of the address and port change so that communication is not interrupted.
  • Network equipment between communicating communication nodes is informed of changes to IP addresses and ports prior to address hops such that uninterrupted communication between communication nodes is maintained.
  • the communication nodes will only be able communicate during the time slots where the communication scheme is the same. So if the communication scheme is only partially the same, only the parts that are the same will be used for communication.
  • the communication scheme is set up and distributed so that the communication nodes to be communicating know how and when to use what addresses and ports. By combining address hopping, port hopping and unique cryptographic keys, it is extremely hard, if not impossible, for an external entity to intercept all communication between end users. It is equally hard to perform a Denial-of- Service, DoS, attack.
  • the communication node is an communication end node 2 according to some aspects. Thus secure communication between communication end nodes is provided.
  • An communication end node should be interpreted as the communication node that is the first sender or final receiver of a communication. It should be noted that the disclosure may be used only in the communication end nodes and let regular routers handle the communication path between the communication end nodes.
  • the communication node is an intermediate communication node 3, such as a network router.
  • An intermediate communication node should be interpreted as a communication node that passes a communication along, i.e. it is not the first sender or the final receiver of a communication. If intermediate communication nodes communicate according to a communication scheme, the route for communication between communication end nodes will continuously change. Thus the security of the communication is increased.
  • the communication node When both the communication end nodes and intermediary communication nodes communicate according to communication schemes one of the communication end nodes sends a communication to an intermediary communication node, the communication node will pass the communication to the next intermediary communication node according to a communication scheme in the intermediary communication node.
  • the communication schemes in the intermediary communication nodes are arranged so that the path taken by the communication from one communication end node to another communication end node continuously changes but so that there is always a continuous route between the communication end nodes. In other words, even if the route changes so that the communication is sent via different routes, there is always a continuous train of intermediary communication nodes for the communication to reach the communication end nodes. Looking at figure 1, when the two communication end nodes 2 are communicating, there are several possible routes over the intermediary communication nodes 3.
  • the route will be predetermined using communication schemes and will change for every time slot.
  • the route may be any route between the communication end nodes.
  • the communication schemes in the intermediary communication nodes may be distributed before placing the intermediary communication nodes at their location.
  • the intermediary communication nodes have communication schemes stored before placing the communication nodes at their routing position.
  • the network node has then distributed the communication schemes to the intermediary communication nodes before placing them.
  • the communication end nodes will communicate with a communication scheme with several different IP addresses to the same communication end node.
  • the IP addresses of the communication scheme are just different IP addresses to the same communication end node.
  • I n the case of intermediary communication nodes, when an intermediary communication node changes the IP address it is sending to, the communication node sends the communication to a different communication node. I.e. the IP addresses of the intermediary communication nodes do not change.
  • the method comprises, according to some aspects, to continuously updating S200 routing tables in the intermediary communication node 3 based on the communication scheme.
  • the processing circuitry 22 of the communication node is configured to update S200 the routing tables.
  • the processing circuitry comprises an updating unit 222 for updating.
  • the intermediate communication nodes prevents from getting distracted by communications other than the ones using communication schemes according to this disclosure by only listening to ports specified in the communication schemes and/or using a known cryptographic key.
  • the communication schemes will be the same in the communication end nodes but in the intermediary communication nodes the communication schemes will be corresponding to make sure that communications are routed to the right communication end node. It should also be noted that, according to some aspects, the intermediary communication nodes does not need to know the final destination of a communication to send it to the next router since the whole routing path is already determined in the scheme.
  • the method comprises, according to some aspects, changing S5 the communication scheme 4, 5 in at least one of the at least one communication nodes to disable communication between the communication nodes using that communication scheme.
  • the processing circuitry 12 of the network node is configured to change S5 the communication scheme. According to some aspects, the processing circuitry comprises a changing unit 125 for changing.
  • the changed communication scheme is distributed to at least one communication node to replace the one already used there.
  • the communication scheme is changed in an communication end node, communication between the communication end nodes in possession of the now different communication schemes is cancelled. In other words, if the communication end nodes do not have the same communication scheme 4, communication will be disabled. This is useful if the network node suspects that the communication between communication nodes has been compromised or if one of the communication end nodes is no longer trusted or when a subscription of an communication end node runs out.
  • the communication scheme is erased at one communication end node to prevent from further communication with the other communication end node(s).
  • the method of the network node 1 comprises: determining SI a set of available Internet Protocol, IP, addresses and a set of ports associated with each IP address;
  • the method of the communication node 2, 3 comprises: receiving S100 a communication scheme from a network node 1, wherein the communication scheme comprises a set of time slots, wherein each time slot is associated with an IP address of a set of available IP addresses, with a port associated with the IP address and with a unique cryptographic key; and communicating S300 with another communication node in possession of a corresponding communication scheme by hopping between the IP addresses and ports according to the communication scheme and encrypting the communication using the unique cryptographic key.
  • the communication node is enabled to communicate according to the communication scheme.
  • the flow diagrams of figures 6 and 7 comprises some operations which are illustrated with a solid border and some operations which are illustrated with a dashed border.
  • the operations which are comprised in a solid border are operations which are comprised in the broadest example embodiment.
  • the operations which are comprised in a dashed line are example embodiments which may be comprised in, or a part of, or are further operations which may be taken in addition to the operations of the broader example embodiments. It should be appreciated that the operations need not be performed in order. Furthermore, it should be appreciated that not all of the operations need to be performed. Also, the functions or steps noted in the blocks can according to some aspects of the disclosure be executed continuously in a loop.
  • the description of the example embodiments provided herein have been presented for purposes of illustration.
  • the various example embodiments described herein are described in the general context of method steps or processes, which may be implemented according to some aspects by a non- transitory computer readable medium, which, when executed on a network node, causes the network node to perform one or several of the methods according to above.
  • the computer program embodied in a computer-readable medium, includes computer-executable instructions, such as program code, executed by computers in networked environments.
  • a computer-readable medium may include removable and non-removable storage devices 13 including, but not limited to, Read Only Memory, ROM, Random Access Memory, RAM, compact discs, CDs, digital versatile discs, DVD, etc.
  • program modules may include routines, programs, objects, components, data structures, etc. that performs particular tasks or implement particular abstract data types.
  • Computer-executable instructions, associated data structures, and program modules represent examples of program code for executing steps of the methods disclosed herein. The particular sequence of such executable instructions or associated data structures represents examples of corresponding acts for implementing the functions described in such steps or

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

The disclosure relates to a system, devices and methods for distributing and using a communication scheme for way to enable secure communication between communication nodes in a network. A method comprises determining (S1), in the network node, a set of available IP addresses and a set of ports, dividing (S2), in the network node, a time frame in time slots, associating (S3), in the network node, each time slot with an IP address, with a port associated with the IP address and with a unique cryptographic key, distributing (S4), from the network node, the communication scheme to the communication node, receiving (S100), in the communication node, the communication scheme and communicating (S300), in the communication node, with another communication node in possession of a corresponding communication scheme by hopping between the IP addresses and ports according to the communication scheme and encrypting the communication using the unique cryptographic key.

Description

SECURE DATA TRANSFER
TECHNICAL FIELD
The present disclosure relates generally to a system, devices and methods thereof for providing a way to enable secure communication between communication nodes in a network.
BACKGROUND
With basically the whole world connected to the internet, an increasing issue is to secure the communicated information. Communicated information is at risk at being interrupted and/or compromised by external attackers.
Denial-of-Service, DoS, attacks are one of the most common ways to make resources unavailable to intended users. DoS attacks are commonly executed by saturating the target machine with communication requests so that it cannot handle the communication to the intended users. Specifically, a DoS attack is often directed at a specific port of a specific IP address.
The risk of having communicated information compromised, e.g. tapped or changed by an external part, is especially a big problem for companies with trade secrets and for the military.
Several methods exist to prevent attacks or at least to make it difficult to perform attacks. US 8301789 B2 describes one example of such a method. The document describes a port hopping technique where ports are dynamically switched during a communication session between two devices. The decision to switch ports is based on data length or packet count of a given transaction.
One drawback with the above method is that the number of ports is very limited so an attacker may for example perform a DoS attack on all ports to interrupt the communication. The switching also requires computational power of the device when they determine when and where to switch.
There is always the need to reduce the risk of external attacks and to make communication as secure and fool proof as possible. With increasing use of temporary subscriptions to, for example, the use of computer games, there is also a need to provide secure ways of controlling access to data by external users.
SUMMARY
With the above description in mind, then, an aspect of the present invention is to provide a system, devices and methods thereof, which seek to mitigate, alleviate, or eliminate one or more of the above-identified deficiencies in the art and disadvantages singly or in any combination.
These and further objects are achieved by a method in a system, and devices, for distributing and using a communication scheme to provide a way to enable secure communication between communication nodes. The communication is both secure and robust and easy for a system owner to control.
The present disclosure is defined by the appended claims. Various advantageous embodiments of the disclosure are set forth by the appended claims as well as by the following description and the accompanying drawings.
According to some aspects the disclosure provides for a method performed in a system of a network node and at least one communication node.
According to some aspects, the method comprises: determining, in the network node, a set of available Internet Protocol, IP, addresses and a set of ports associated with each IP address;
dividing, in the network node, a time frame in time slots;
associating, in the network node, each time slot with an IP address available IP addresses, with a port associated with the IP address and with a unique cryptographic key, thereby setting up a communication scheme for secure communication;
distributing, from the network node, the communication scheme to the at least one communication node;
receiving, in the at least one communication node, the communication scheme the network node; communicating, in one of the at least one communication nodes, with another communication node in possession of a corresponding communication scheme by hopping between the IP addresses and ports according to the communication scheme and encrypting the communication using the unique cryptographic key.
By performing the above steps, a way to enable secure communication between communication nodes is provided. The communication scheme is set up and distributed so that the communication nodes to be communicating know how and when to use what addresses and ports. By combining address hopping, port hopping and unique cryptographic keys, it is extremely hard, if not impossible, for an external entity to intercept all communication between end users. It is equally hard to perform a Denial-of- Service, DoS, attack. The time slots of communication scheme are determined by the system owner so it is easy for the owner to control the timing of all communication and to cancel communications, as will be described later. According to some aspects the communication node is an communication end node. Thus secure communication between communication end nodes is provided.
According to some aspects the communication node is an intermediate communication node, such as a network router. If intermediate communication nodes communicate according to a communication scheme, the route for communication between communication end nodes will continuously change. Thus, the security of the communication is increased.
According to some aspects the method comprises: continuously updating routing tables in the intermediary communication node based on the communication scheme.
By continuously updating the routing table according to the communication scheme it is ensured that the communication is sent the right way to end up at the right communication end node.
According to some aspects the disclosure provides for a method performed in a network node, for distributing a communication scheme to provide a way to enable secure communication between communication nodes. According to some aspects, the method comprises: determining a set of available Internet Protocol, IP, addresses and a set of ports associated with each IP address;
dividing a time frame in time slots;
- associating each time slot with an IP address of the available IP addresses, with a port associated with the IP address and with a unique cryptographic key, thereby setting up a communication scheme for secure communication; and distributing the communication scheme to at least one communication node.
Thus, the communication scheme is set up and distributed by the network node. According to some aspects the distributing comprises: storing the communication scheme on a physical entity; and
physically distributing the physical entity with the communication scheme stored thereon to the at least one communication node.
By physically distributing the communication scheme, it is ensured that the number of communication nodes in possession of the communication scheme is controlled. It is also easy to know if the communication scheme has been compromised by losing one of the physical entities. In other words, the physical distribution of the communication scheme ensures a more secure system.
According to some aspects the associating comprises that the combination of an IP address and port are different in adjacent time slots. If they are the same, the time the system uses the same combination of address and port may be long enough to initiate a DoS attack or to get hold of valuable information.
According to some aspects the associating comprises to associate each time slot with a random IP address of the available IP addresses and with a random port associated with the random IP address. In other words, the assigning of IP address and port to the time slots is random so that there can be no way to predict the communication scheme.
According to some aspects the network node is a communication node. Hence, method to produce the communication scheme is performed in a communication node and the communication scheme is then distributed to the other communication node with which the communication node will communicate.
According to some aspects the network node is a server and the disturbing comprises distributing the communication scheme to at least two communication nodes to enable the at least two communication nodes to communicate with each other securely. The server may then be a control central for all communication schemes and handle which end notes will communication with what communication scheme and also control cancellations of communication schemes.
According to some aspects the unique cryptographic key is unique for all time slots. For maximum security the unique cryptographic key is never reused.
According to some aspects at least two time slots comprise unequal length with respect to one another. In other words, the time slots do not need to be the same length. This can be used to further thwart attempts to compromise the communication.
According to some aspects the time slots are any length between 10 and 30 seconds or 30 and 59.9 seconds. Too short time lengths will heavily burden routers which will have to update address lists very often. Too long times will give potential interceptors more time to compromise the communication.
According to some aspects wherein the method comprises: changing the communication scheme in at least one of the at least one communication nodes to disable communication between the communication nodes using that communication scheme.
If the communication nodes do not have the same communication scheme, communication will be disabled. This is useful if the network node suspects that the communication between communication nodes has been compromised or if one of the communication nodes is no longer trusted.
According to some aspect the distributing comprises to distribute a communication scheme which comprises a limited communication scheme based on a second time frame, which second time frame is a subframe of the time frame, for time limited access to the secure communication. In other words, it is possible to provide a communication node with a communication scheme limited in time.
According to some aspects the disclosure provides for a method performed in a
communication node, for using a communication scheme to provide a way to enable secure communication between communication nodes.
According to some aspect the method comprises: receiving a communication scheme from a network node, wherein the communication scheme comprises a set of time slots, wherein each time slot is associated with an IP address of a set of available IP addresses, with a port associated with the IP address and with a unique cryptographic key; and communicating with another communication node in possession of a corresponding communication scheme by hopping between the IP addresses and ports according to the communication scheme and encrypting the communication using the unique cryptographic key. Hence, the communication node is enabled to communicate according to the communication scheme.
According to some aspects the disclosure provides for a system of a network node and at least one communication node.
According to some aspect the network node comprises communication circuitry and processing circuit. The processing circuitry is configured to: o determine a set of available Internet Protocol, IP, addresses and a set of ports associated with each IP address;
o divide a time frame in time slots;
o associate each time slot with an IP address of the available IP addresses, with a port associated with the IP address and with a unique cryptographic key, thereby setting up a communication scheme for secure communication; and
o distribute, via the communication circuitry, the communication scheme to at least one communication node. The at least one communication node comprises communication circuitry and processing circuit. The processing circuitry is configured to: o receive, via the communication circuitry, a communication scheme from a network node, wherein the communication scheme comprises a set of time slots, wherein each time slot is associated with an IP address of a set of available IP addresses, with a port associated with the IP address and with a unique cryptographic key; and
o communicate, via the communication circuitry, with another communication node in possession of a corresponding communication scheme by hopping between the IP addresses and ports according to the communication scheme and encrypting the communication using the unique cryptographic key.
The advantages have been previously discussed.
According to some aspects the disclosure provides for a network node. According to some aspect the network node comprises communication circuitry and processing circuit. The processing circuitry is configured to: o determine a set of available Internet Protocol, IP, addresses and a set of ports associated with each IP address;
o divide a time frame in time slots;
o associate each time slot with an IP address of the available IP addresses, with a port associated with the IP address and with a unique cryptographic key, thereby setting up a communication scheme for secure communication; and
o distribute the communication scheme to at least one communication node.
The advantages have been previously discussed.
According to some aspects the disclosure provides for a communication node.
According to some aspects the communication node comprises communication circuitry and processing circuit. The processing circuitry is configured to: o receive a communication scheme from a network node, wherein the communication scheme comprises a set of time slots, wherein each time slot is associated with an IP address of a set of available IP addresses, with a port associated with the IP address and with a unique cryptographic key; and
o communicate with another communication node in possession of a corresponding communication scheme by hopping between the IP addresses and ports according to the communication scheme and encrypting the communication using the unique cryptographic key. The advantages have been previously discussed.
According to some aspects the disclosure provides for a non-transitory computer readable medium, which, when executed on a network node, causes the network node to perform the method according to above when discussing the network node.
BRIEF DESCRIPTION OF THE DRAWINGS The foregoing will be apparent from the following more particular description of the example embodiments, as illustrated in the accompanying drawings in which like reference characters refer to the same parts throughout the different views. The drawings are not necessarily to scale, emphasis instead being placed upon illustrating the example embodiments. Figure 1 illustrates an example of two communication end nodes communicating over a network of communication nodes with a communication scheme received from the network node,
Figures 2 illustrate an example of a network node,
Figures 3 illustrate an example of a communication node,
Figures 4 illustrate an example of a communication scheme,
Figures 5 illustrate an example of a limited communication scheme,
Figures 6 is a flow chart illustrating the proposed method, performed in the network node.
Figure 7 is a flow chart illustrating the proposed method, performed in the communication node. DETAILED DESCRIPTION
Aspects of the present disclosure will be described more fully hereinafter with reference to the accompanying drawings. The device and method disclosed herein can, however, be realized in many different forms and should not be construed as being limited to the aspects set forth herein.
The terminology used herein is for the purpose of describing particular aspects of the disclosure only, and is not intended to limit the invention. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. Embodiments of the present invention will be exemplified using a network node and a communication node such as a mobile phone or a router. However, it should be appreciated that the invention is as such equally applicable to any communication devices which may function as a network node or a communication node over a communication network. Examples of such devices may for instance be any type of mobile phone, smartphone, laptop (such as standard, ultra portables, netbooks, and micro laptops), handheld computers, portable digital assistants, tablet computers, touch pads, gaming devices, accessories to mobile phones, e.g. wearable communication devices in the form of headphones/-sets, visors/goggles, bracelets, wristbands, necklaces, watches, headbands, rings, etc. It should be noted that a communication device is any communication device equipped with communication means and can be e.g. a camera, a lamp post or vehicle.
Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs. It will be further understood that terms used herein should be interpreted as having a meaning that is consistent with their meaning in the context of this specification and the relevant art and will not be interpreted in an idealized or overly formal sense unless expressly so defined herein.
Figure 1 shows an example of a system, for distributing and using a communication scheme 4 to provide a way to enable secure communication between communication nodes, with communication end nodes 2 communicating over a network of intermediary communication nodes 3 with one or several communication schemes received from a network node 1. By establishing a common communication scheme for the two communication end nodes they can communicate securely and continuously during a time set by a system owner. By also providing corresponding communication schemes to the intermediary communication nodes in between the communication end nodes, the security is further increased by providing a way to change every step of a communication path between to communication end nodes regularly according to the communication schemes.
Figure 2 shows a network node 1, for distributing a communication scheme 4 to provide a way to enable secure communication between communication nodes 2, 3, according to some aspects of the disclosure. The figure illustrates a network node comprising communication circuitry 11 and processing circuit 12. The network node further comprises a memory 13 for storing data. The memory may be any type of memory suitable for a wireless communication device.
Figure 3 shows a communication node 2, 3, for using a communication scheme 4 to provide a way to enable secure communication between communication nodes, according to some aspects of the disclosure. The figure illustrates a communication node comprising communication circuitry 21 and processing circuit 22. The communication node further comprises a memory 23 for storing data. The memory may be any type of memory suitable for a wearable communication device. It should be noted that the network node may take the form of the communication node of figure 3 and the communication node may take the form of the network node of figure 2.
Figure 4 and 5 shows examples of communication schemes according to some aspects of the disclosure.
Figure 6 is a flow diagram depicting example operations which may be taken by the network node. Figure 7 is a flow diagram depicting example operations which may be taken by the communication node. All steps of the flow diagrams will be described hereafter, with reference to all of the drawings, in a logical order of the steps and not in the order of which device performs which steps. The method of the system of a network node 1 and at least one communication node 2, 3 comprises to determine SI, in the network node, a set of available Internet Protocol, IP, addresses and a set of ports associated with each IP address. According to some aspects, the processing circuitry 12 of the network node is configured to determine SI the set of available Internet Protocol, IP, addresses and a set of ports associated with each IP address According to some aspects, the processing circuitry comprises a determining unit 121 for the determining. The determining of available IP addresses comprises for example to check a list of available IP addresses. According to some aspects, it is up to the owner of the system to provide a list of available IP addresses. It may also comprise to order a new set of IP addresses of an external provider.
The method further comprises to divide S2, in the network node 1, a time frame in time slots. According to some aspects, the processing circuitry 12 of the network node is configured to divide S2 the time frame in time slots. According to some aspects, the processing circuitry comprises a divider 122 for the dividing. The time frame may be any time frame and is set according to how long the system owner wants the system to be in use. If a system owner wants the system to work for a long time, the time frame is for example 60 years. If the system owner wants the system to be limited to a shorter time, the time frame is for example 1 year or any time frame decided upon by the system owner.
The length of the time slots is also determined by the system owner. According to some aspects the time slots are any length between 10 and 30 seconds or 30 and 59.9 seconds. Too short time lengths will heavily burden routers 3 which will have to update address lists very often. Too long times will give potential interceptors more time to compromise the communication. Port scanning by an interceptor takes about 60 seconds so a time slot is preferentially shorter than 60 seconds. According to some aspects at least two time slots comprise unequal length with respect to one another. In other words, the time slots do not need to be the same length. As an example, one time slot may be 10 seconds and another time slots may be 30 seconds. This can be used to further thwart attempts to compromise the communication.
The method further comprises to associate S3, in the network node 1, each time slot with an IP address of the available IP addresses, with a port associated with the IP address and with a unique cryptographic key, thereby setting up a communication scheme 4 for secure communication. According to some aspects, the processing circuitry 12 of the network node is configured to perform the associating S3. According to some aspects, the processing circuitry comprises an associating unit 123 for the associating. The communication scheme is for example a list as illustrated in figure 4, where the first row 100, 110, 120, etc. comprises a list of the time slots, the second row 200, 210, 220 etc. comprises a list of IP addresses, the third row 300, 310, 320 etc. comprises a list of ports and the fourth row 400, 410, 420 etc. comprises unique cryptographic keys. The communication scheme comprises time slots associated with IP addresses, port numbers and cryptographic keys which the communication nodes shall use to communicate. According to some aspects the associating S3 comprises that the combination of an IP address and port are different in adjacent time slots. In other words, they may not be the same in adjacent time slots. If they are the same, the time the system uses the same combination of address and port may be long enough to initiate a DoS attack or to get hold of valuable information. For an unpredictable system the associating S3 comprises, according to some aspects, to associate S31 each time slot with a random IP address of the available IP addresses and with a random port associated with the random IP address. According to some aspects, the processing circuitry 12 of the network node is configured to associate S31 the time slots with random IP addresses and ports. According to some aspects, the processing circuitry comprises an associating unit 1231 for the associating. In other words, the assigning of IP address and port to the time slots is random, or at least pseudo random, so that there is no way to predict the communication scheme 4.
According to some aspects the unique cryptographic key is unique for all time slots. For maximum security the unique cryptographic key is never reused. The method further comprises to distribute S4, from the network node 1, the communication scheme to the at least one communication node 2, 3. According to some aspects, the processing circuitry 12 of the network node is configured to distribute S4 the communication scheme. According to some aspects, the processing circuitry comprises a distributor 124 for the distributing. Thus, the communication scheme is set up and distributed by the network node. For a way to control the distribution S4 the distributing S4 comprises storing S41 the communication scheme 4 on a physical entity and physically distributing S42 the physical entity with the communication scheme stored thereon to the at least one communication node. According to some aspects, the processing circuitry 12 of the network node is configured to store S41 the communication scheme and to physically distribute S42 the physical entity. According to some aspects, the processing circuitry comprises a storing unit 1241 and a physical distributer 1242. The physical entity is for example a YubiKey™. A YubiKey™ is a device that you register with a service that supports two-factor authentication. Two-factor authentication means that each time you log in, the service will request proof that you have your YubiKey™ in addition to your regular username and password.
By physically distributing the communication scheme, it is ensured that the number of communication nodes in possession of the communication scheme is controlled. It is also easy to know if the communication scheme has been compromised by losing one of the physical entities. In other words, the physical distribution of the communication scheme ensures a more secure system.
As opposed to distributing the communication scheme physically, the communication scheme is, according to some aspects, distributed digitally over a secure channel to the at least one communication node. It might be considered easier for a system owner to distribute the communication scheme digitally than to distribute it physically. According to some aspects, one part of the communication scheme is distributed physically and a second part is distributed digitally. Both parts of the communication scheme are then required at the communication node to be useable.
It is possible that the network node wishes to communicate securely using a communication scheme, then, according to some aspects, the network node is a communication node. Hence, method to produce the communication scheme 4 is performed in a communication node and the communication scheme is then distributed to the other communication nodes which will be part of the routing path between the communication end nodes.
If the network node 1 is to enable two other devices, i.e. communication nodes 2, 3, to communicate, the network node, according to some aspects, is a server and the disturbing S4 comprises distributing S43 the communication scheme 4 to at least two communication nodes to enable the at least two communication nodes to communicate with each other securely. According to some aspects, the processing circuitry 12 of the network node is configured to distribute S43 the communication scheme. According to some aspects, the processing circuitry comprises a distributing unit 1243 for distributing. The server may then be a control central for all communication schemes and handle which end notes will communicate with what communication scheme and also control cancellations of communication schemes. Note that more than two communication end nodes cannot communicate with each other using the same communication scheme at the same time because then there would be an address conflict. This is not true when one communication node is broadcasting data; then several communication nodes can listen to the broadcasting communication node. According to some aspects the network node may be unconnected to any network and only distribute the communication scheme physically. In this way, the network node is non-compromisable by network attacks.
In some cases the service owner may want to put a time limit on certain communication nodes. The distributing S4 comprises, according to some aspects, to distribute S44 a communication scheme which comprises a limited communication scheme 5 based on a second time frame, which second time frame is a subframe of the time frame, for time limited access to the secure communication. According to some aspects, the processing circuitry 12 of the network node is configured to distribute S44 the communication scheme. According to some aspects, the processing circuitry comprises a distributer 1244 for distributing. In other words, it is possible to provide a communication node with a communication scheme limited in time. This is used with, for example, time limited subscriptions. An example of a time limited subscription is when a user has bought time limited access to a game. Another example is when one main communication end node is to receive regular updates from several other communication end nodes. The main communication end node then has a complete communication scheme and the other communication end nodes only has the communication scheme for the time slots that they are to use to send updates to the main communication end node. The capacity of the main communication end node does not have to be so large then since it only receives one report at the time and it will not be possible for the other communication end nodes to send anything during the times that their communication scheme does not cover. The limited communication scheme is for example a list as illustrated in figure 5, where the first row 120, 130, 140 comprises a list of the time slots, the second row 220, 230, 240 comprises a list of IP addresses, the third row 320, 330, 340 comprises a list of ports and the fourth row 420, 430, 440 comprises unique cryptographic keys. The method further comprises to receive S100, in the at least one communication node 2, 3, the communication scheme 4, 5 from the network node. According to some aspects, the processing circuitry 22 of the communication node is configured to receive S100 the communication scheme. According to some aspects, the processing circuitry comprises a receiver 221 for receiving. As previously discussed, the communication scheme is either distributed digitally of physically, so the communication scheme is according to some aspects received digitally and according to some aspects physically.
The method further comprises to communicate S300, in one of the at least one communication nodes 2, 3, with another communication node in possession of a corresponding communication scheme by hopping between the IP addresses and ports according to the communication scheme and encrypting the communication using the unique cryptographic key. According to some aspects, the processing circuitry 22 of the communication node is configured to communicate S300, via the communication circuitry 21, with another communication node. According to some aspects, the processing circuitry comprises a communicator 223 for communicating. By communicating using the communication scheme, a secure communication is ensured.
When hopping between addresses and ports, there is, according to some aspects, a small overlap in the time slots. The overlap is to provide time for the communicating communication nodes to inform connected communication nodes 3 of the address and port change so that communication is not interrupted. Network equipment between communicating communication nodes is informed of changes to IP addresses and ports prior to address hops such that uninterrupted communication between communication nodes is maintained.
The communication nodes will only be able communicate during the time slots where the communication scheme is the same. So if the communication scheme is only partially the same, only the parts that are the same will be used for communication. By performing the above, a way to enable secure communication between communication nodes is provided. The communication scheme is set up and distributed so that the communication nodes to be communicating know how and when to use what addresses and ports. By combining address hopping, port hopping and unique cryptographic keys, it is extremely hard, if not impossible, for an external entity to intercept all communication between end users. It is equally hard to perform a Denial-of- Service, DoS, attack.
The communication node is an communication end node 2 according to some aspects. Thus secure communication between communication end nodes is provided. An communication end node should be interpreted as the communication node that is the first sender or final receiver of a communication. It should be noted that the disclosure may be used only in the communication end nodes and let regular routers handle the communication path between the communication end nodes.
According to some aspects the communication node is an intermediate communication node 3, such as a network router. An intermediate communication node should be interpreted as a communication node that passes a communication along, i.e. it is not the first sender or the final receiver of a communication. If intermediate communication nodes communicate according to a communication scheme, the route for communication between communication end nodes will continuously change. Thus the security of the communication is increased.
When both the communication end nodes and intermediary communication nodes communicate according to communication schemes one of the communication end nodes sends a communication to an intermediary communication node, the communication node will pass the communication to the next intermediary communication node according to a communication scheme in the intermediary communication node. The communication schemes in the intermediary communication nodes are arranged so that the path taken by the communication from one communication end node to another communication end node continuously changes but so that there is always a continuous route between the communication end nodes. In other words, even if the route changes so that the communication is sent via different routes, there is always a continuous train of intermediary communication nodes for the communication to reach the communication end nodes. Looking at figure 1, when the two communication end nodes 2 are communicating, there are several possible routes over the intermediary communication nodes 3. The route will be predetermined using communication schemes and will change for every time slot. Thus the route may be any route between the communication end nodes. It should be noted that the communication schemes in the intermediary communication nodes may be distributed before placing the intermediary communication nodes at their location. In other words, the intermediary communication nodes have communication schemes stored before placing the communication nodes at their routing position. The network node has then distributed the communication schemes to the intermediary communication nodes before placing them. An advantage with having an entire route between communication end nodes that continuously changes path, or routing path, is that it is almost impossible for an external attacker to intercept the communication on its way; because the way is not set.
Note that, according to some aspects, the communication end nodes will communicate with a communication scheme with several different IP addresses to the same communication end node. In other words, the IP addresses of the communication scheme are just different IP addresses to the same communication end node. I n the case of intermediary communication nodes, when an intermediary communication node changes the IP address it is sending to, the communication node sends the communication to a different communication node. I.e. the IP addresses of the intermediary communication nodes do not change.
When the communication node is an intermediary communication node, the method comprises, according to some aspects, to continuously updating S200 routing tables in the intermediary communication node 3 based on the communication scheme. According to some aspects, the processing circuitry 22 of the communication node is configured to update S200 the routing tables. According to some aspects, the processing circuitry comprises an updating unit 222 for updating. By continuously updating the routing table according to the communication scheme, it is ensured that the communication is sent the right way to end up at the right communication end node. The term continuously here means that the routing tables are updated for each time slot.
By using the method not only in the communication end nodes, but also in intermediate communication nodes, security is increased further. The whole route, in every intermediary communication node, from communication end node to communication end node will then hop for every time slot. The time slots of communication scheme are determined by the system owner so it is easy for the owner to control the timing of all communication and to cancel communications, as will be described later. According to some aspects, the intermediate communication nodes prevents from getting distracted by communications other than the ones using communication schemes according to this disclosure by only listening to ports specified in the communication schemes and/or using a known cryptographic key.
Note that the communication schemes will be the same in the communication end nodes but in the intermediary communication nodes the communication schemes will be corresponding to make sure that communications are routed to the right communication end node. It should also be noted that, according to some aspects, the intermediary communication nodes does not need to know the final destination of a communication to send it to the next router since the whole routing path is already determined in the scheme. For cancelling communication with an end the method comprises, according to some aspects, changing S5 the communication scheme 4, 5 in at least one of the at least one communication nodes to disable communication between the communication nodes using that communication scheme. According to some aspects, the processing circuitry 12 of the network node is configured to change S5 the communication scheme. According to some aspects, the processing circuitry comprises a changing unit 125 for changing. The changed communication scheme is distributed to at least one communication node to replace the one already used there. When the communication scheme is changed in an communication end node, communication between the communication end nodes in possession of the now different communication schemes is cancelled. In other words, if the communication end nodes do not have the same communication scheme 4, communication will be disabled. This is useful if the network node suspects that the communication between communication nodes has been compromised or if one of the communication end nodes is no longer trusted or when a subscription of an communication end node runs out. According to some aspects, the communication scheme is erased at one communication end node to prevent from further communication with the other communication end node(s). According to the above, and according to some aspects, the method of the network node 1 comprises: determining SI a set of available Internet Protocol, IP, addresses and a set of ports associated with each IP address;
- dividing S2 a time frame in time slots;
associating S3 each time slot with an IP address of the available IP addresses, with a port associated with the IP address and with a unique cryptographic key, thereby setting up a communication scheme for secure communication; and distributing S4 the communication scheme to at least one communication node.
According to the above, and according to some aspects, the method of the communication node 2, 3 comprises: receiving S100 a communication scheme from a network node 1, wherein the communication scheme comprises a set of time slots, wherein each time slot is associated with an IP address of a set of available IP addresses, with a port associated with the IP address and with a unique cryptographic key; and communicating S300 with another communication node in possession of a corresponding communication scheme by hopping between the IP addresses and ports according to the communication scheme and encrypting the communication using the unique cryptographic key.
Hence, the communication node is enabled to communicate according to the communication scheme.
It should be appreciated that the flow diagrams of figures 6 and 7 comprises some operations which are illustrated with a solid border and some operations which are illustrated with a dashed border. The operations which are comprised in a solid border are operations which are comprised in the broadest example embodiment. The operations which are comprised in a dashed line are example embodiments which may be comprised in, or a part of, or are further operations which may be taken in addition to the operations of the broader example embodiments. It should be appreciated that the operations need not be performed in order. Furthermore, it should be appreciated that not all of the operations need to be performed. Also, the functions or steps noted in the blocks can according to some aspects of the disclosure be executed continuously in a loop. The description of the example embodiments provided herein have been presented for purposes of illustration. The description is not intended to be exhaustive or to limit example embodiments to the precise form disclosed, and modifications and variations are possible in light of the above teachings or may be acquired from practice of various alternatives to the provided embodiments. The examples discussed herein were chosen and described in order to explain the principles and the nature of various example embodiments and its practical application to enable one skilled in the art to utilize the example embodiments in various manners and with various modifications as are suited to the particular use contemplated. The features of the embodiments described herein may be combined in all possible combinations of methods, apparatus, modules, systems, and computer program products. It should be appreciated that the example embodiments presented herein may be practiced in any combination with each other.
It should be noted that the word "comprising" does not necessarily exclude the presence of other elements or steps than those listed. It should further be noted that any reference signs do not limit the scope of the claims, that the example embodiments may be implemented at least in part by means of both hardware and software, and that several "means" or "devices" may be represented by the same item of hardware.
The various example embodiments described herein are described in the general context of method steps or processes, which may be implemented according to some aspects by a non- transitory computer readable medium, which, when executed on a network node, causes the network node to perform one or several of the methods according to above. The computer program, embodied in a computer-readable medium, includes computer-executable instructions, such as program code, executed by computers in networked environments. A computer-readable medium may include removable and non-removable storage devices 13 including, but not limited to, Read Only Memory, ROM, Random Access Memory, RAM, compact discs, CDs, digital versatile discs, DVD, etc. Generally, program modules may include routines, programs, objects, components, data structures, etc. that performs particular tasks or implement particular abstract data types. Computer-executable instructions, associated data structures, and program modules represent examples of program code for executing steps of the methods disclosed herein. The particular sequence of such executable instructions or associated data structures represents examples of corresponding acts for implementing the functions described in such steps or processes.
In the drawings and specification, there have been disclosed exemplary embodiments. However, many variations and modifications can be made to these embodiments. Accordingly, although specific terms are employed, they are used in a generic and descriptive sense only and not for purposes of limitation, the scope of the embodiments being defined by the following claims.

Claims
A method, performed in a system comprising a network node (1) and at least one communication node (2,
3), for distributing and using a communication scheme (4) to provide a way to enable secure communication between communication nodes, the method comprises:
determining (SI), in the network node, a set of available Internet Protocol, IP, addresses and a set of ports associated with each IP address;
dividing (S2), in the network node, a time frame in time slots;
associating (S3), in the network node, each time slot with an IP address of the available IP addresses, with a port associated with the IP address and with a unique cryptographic key, thereby setting up a communication scheme for secure communication;
distributing (S4), from the network node, the communication scheme to the at least one communication node;
receiving (S100), in the at least one communication node, the communication scheme from the network node;
communicating (S300), in one of the at least one communication nodes, with another communication node in possession of a corresponding communication scheme by hopping between the IP addresses and ports according to the communication scheme and encrypting the communication using the unique cryptographic key.
The method according to claim 1, wherein the communication node is an communication end node (2).
The method according to claim 1, wherein the communication node is an intermediate communication node (3), such as a network router.
4. The method according to claim 3, comprising:
continuously updating (S200) routing tables in the intermediary communication node (3) based on the communication scheme.
A method, in a network node (1), for distributing a communication scheme (4) to provide a way to enable secure communication between communication nodes (2, 3), the method comprises:
determining (SI) a set of available Internet Protocol, IP, addresses and a set of ports associated with each IP address;
dividing (S2) a time frame in time slots;
associating (S3) each time slot with an IP address of the available IP addresses, with a port associated with the IP address and with a unique cryptographic key, thereby setting up a communication scheme for secure communication; and distributing (S4) the communication scheme to at least one communication node.
The method according to claim 5, wherein the distributing (S4) comprises:
storing (S41) the communication scheme (4) on a physical entity; and
physically distributing (S42) the physical entity with the communication scheme stored thereon to the at least one communication node.
The method according to claim 5 or 6, wherein the associating (S3) comprises that the combination of an IP address and port are different in adjacent time slots.
The method according to any one of claims 5 to 7, wherein the associating (S3) comprises to associate (S31) each time slot with a random IP address of the available IP addresses and with a random port associated with the random IP address.
The method according to any one of claims 5 to 8, wherein the network node is a communication node.
The method according to any one of claims 5 to 8, wherein the network node is a server and the disturbing (S4) comprises distributing (S43) the communication scheme (4) to at least two communication nodes (2, 3) to enable the at least two communication nodes to communicate with each other securely.
11. The method according to any one of claims 5 to 10, wherein the unique cryptographic key is unique for all time slots.
12. The method according to any one of claims 5 to 11, wherein at least two time slots comprise unequal length with respect to one another.
13. The method according to any one of claims 5 to 12, wherein the time slots are any length between 10 and 30 seconds or 30 and 59.9 seconds.
14. The method according to any one of claims 5 to 13, wherein the method comprises:
changing (S5) the communication scheme (4) in at least one of the at least one communication nodes to disable communication between the communication nodes using that communication scheme.
The method according to any one of claims 5 to 14, wherein the distributing (S4) comprises to distribute (S44) a communication scheme which comprises a limited communication scheme (5) based on a second time frame, which second time frame is a subframe of the time frame, for time limited access to the secure communication.
A method, in a communication node (2, 3), for using a communication scheme (4) to provide a way to enable secure communication between communication nodes, the method comprising:
receiving (S100) a communication scheme from a network node (1), wherein the communication scheme comprises a set of time slots, wherein each time slot is associated with an IP address of a set of available IP addresses, with a port associated with the IP address and with a unique cryptographic key; and communicating (S300) with another communication node in possession of a corresponding communication scheme by hopping between the IP addresses and ports according to the communication scheme and encrypting the communication using the unique cryptographic key.
17. The method according to claim 16, wherein the communication node is an communication end node (2).
18. The method according to claim 16, wherein the communication node is an intermediate communication node (3), such as a network router.
19. The method according to claim 18, comprising:
continuously updating (S200) routing tables in the intermediary communication node (3) based on the communication scheme.
20. A system of a network node (1) and at least one communication node (2, 3), wherein the network node comprising:
communication circuitry (11);
processing circuit (12) configured to:
o determine (SI) a set of available Internet Protocol, IP, addresses and a set of ports associated with each IP address;
o divide (S2) a time frame in time slots;
o associate (S3) each time slot with an IP address of the available IP addresses, with a port associated with the IP address and with a unique cryptographic key, thereby setting up a communication scheme (4) for secure communication; and
o distribute (S4), via the communication circuitry, the communication scheme to at least one communication node;
and wherein the at least one communication node comprising:
- communication circuitry (21);
processing circuit (22) configured to:
o receive (S100), via the communication circuitry, a communication scheme from a network node, wherein the communication scheme comprises a set of time slots, wherein each time slot is associated with an IP address of a set of available IP addresses, with a port associated with the IP address and with a unique cryptographic key; and o communicate (S300), via the communication circuitry, with another communication node in possession of a corresponding communication scheme by hopping between the IP addresses and ports according to the communication scheme and encrypting the communication using the unique cryptographic key.
A network node (1), comprising:
communication circuitry (11);
processing circuit (12) configured to:
o determine (SI) a set of available Internet Protocol, IP, addresses and a set of ports associated with each IP address;
o divide (S2) a time frame in time slots;
o associate (S3) each time slot with an IP address of the available IP addresses, with a port associated with the IP address and with a unique cryptographic key, thereby setting up a communication scheme (4) for secure communication; and
o distribute (S4) the communication scheme to at least one communication node.
A communication node (2, 3) comprising:
communication circuitry (21);
processing circuit (22) configured to:
o receive (SlOO) a communication scheme (4) from a network node, wherein the communication scheme comprises a set of time slots, wherein each time slot is associated with an IP address of a set of available IP addresses, with a port associated with the IP address and with a unique cryptographic key; and o communicate (S300) with another communication node in possession of a corresponding communication scheme by hopping between the IP addresses and ports according to the communication scheme and encrypting the communication using the unique cryptographic key.
23. A non-transitory computer readable medium, which, when executed on a network node, causes the network node to perform the method according to any of claims 5 to 15.
PCT/SE2015/050260 2015-03-09 2015-03-09 Secure data transfer Ceased WO2016144217A1 (en)

Priority Applications (3)

Application Number Priority Date Filing Date Title
PCT/SE2015/050260 WO2016144217A1 (en) 2015-03-09 2015-03-09 Secure data transfer
US15/556,669 US10841095B2 (en) 2015-03-09 2015-03-09 Secure data transfer
SE1751040A SE542300C2 (en) 2015-03-09 2015-03-09 Secure data transfer

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/SE2015/050260 WO2016144217A1 (en) 2015-03-09 2015-03-09 Secure data transfer

Publications (1)

Publication Number Publication Date
WO2016144217A1 true WO2016144217A1 (en) 2016-09-15

Family

ID=56878616

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/SE2015/050260 Ceased WO2016144217A1 (en) 2015-03-09 2015-03-09 Secure data transfer

Country Status (3)

Country Link
US (1) US10841095B2 (en)
SE (1) SE542300C2 (en)
WO (1) WO2016144217A1 (en)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10841095B2 (en) * 2015-03-09 2020-11-17 Saab Ab Secure data transfer

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2001082548A2 (en) * 2000-04-17 2001-11-01 Ladr It Corporation Method and system for protection against denial of service attacks
US20030177382A1 (en) * 2002-03-16 2003-09-18 Yoram Ofek Trusted flow and operation control method
US20080313348A1 (en) * 2007-06-18 2008-12-18 Cameron Craig Morris Techniques for port hopping
EP2512093A1 (en) * 2000-04-26 2012-10-17 VirnetX Inc. Improvements to an agile network protocol for secure communications with assured system availability

Family Cites Families (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6477665B1 (en) * 1999-08-31 2002-11-05 Accenture Llp System, method, and article of manufacture for environment services patterns in a netcentic environment
US20070070996A1 (en) * 2005-09-26 2007-03-29 Oran David R Port hopping scheme for peer-to-peer connections
JP4626811B2 (en) * 2005-09-29 2011-02-09 日本電気株式会社 Port hopping detection system, port hopping detection device, port hopping detection method, and program
US8559369B2 (en) * 2006-02-22 2013-10-15 Elad Barkan Wireless internet system and method
US8572717B2 (en) * 2008-10-09 2013-10-29 Juniper Networks, Inc. Dynamic access control policy with port restrictions for a network security appliance
US9479480B2 (en) * 2010-01-29 2016-10-25 Citrix Systems, Inc. Systems and methods of using SSL pools for WAN acceleration
US8793792B2 (en) * 2010-05-07 2014-07-29 Raytheon Company Time-key hopping
US8443416B2 (en) * 2011-05-06 2013-05-14 Novell, Inc. Techniques for secure channel messaging
CN102347865B (en) * 2011-11-04 2015-02-25 华为技术有限公司 Ethernet ring path locating method as well as switching equipment and system
US9424064B2 (en) * 2014-08-01 2016-08-23 Raytheon Bbn Technologies Corp. Adaptor implementation for internet protocol address and port hopping
US20160192194A1 (en) * 2014-12-29 2016-06-30 Gongming Yang Secure way to build internet credit system and protect private information
US10841095B2 (en) * 2015-03-09 2020-11-17 Saab Ab Secure data transfer

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2001082548A2 (en) * 2000-04-17 2001-11-01 Ladr It Corporation Method and system for protection against denial of service attacks
EP2512093A1 (en) * 2000-04-26 2012-10-17 VirnetX Inc. Improvements to an agile network protocol for secure communications with assured system availability
US20030177382A1 (en) * 2002-03-16 2003-09-18 Yoram Ofek Trusted flow and operation control method
US20080313348A1 (en) * 2007-06-18 2008-12-18 Cameron Craig Morris Techniques for port hopping

Also Published As

Publication number Publication date
SE1751040A1 (en) 2017-08-30
US20180069701A1 (en) 2018-03-08
US10841095B2 (en) 2020-11-17
SE542300C2 (en) 2020-04-07

Similar Documents

Publication Publication Date Title
US8687544B2 (en) Apparatus for distributing data traffic in heterogeneous wireless networks
US10084756B2 (en) Anonymous communications in software-defined networks via route hopping and IP address randomization
US11902320B2 (en) Moving target defense systems and methods
Mershad et al. A framework for secure and efficient data acquisition in vehicular ad hoc networks
EP3195557B1 (en) Establishing trust between two devices
Yao et al. Source address validation solution with OpenFlow/NOX architecture
US8898735B2 (en) Network apparatus based on content name, method of generating and authenticating content name
KR20190002638A (en) How to Protect Transactions for the Allocation of Internet Resources with Block Chaining
EP2912799B1 (en) Methods and apparatus for data security in mobile ad hoc networks
WO2016016656A1 (en) Improvements in and relating to secret communications
Raza et al. vepc-sec: Securing lte network functions virtualization on public cloud
US10841095B2 (en) Secure data transfer
Alani IoT lotto: Utilizing IoT devices in brute-force attacks
US10498700B2 (en) Transmitting network traffic in accordance with network traffic rules
Patil et al. Improved ALERT protocol in MANET with strategies to prevent DOS & MITM attacks
CN109450849B (en) Cloud server networking method based on block chain
KR20190083498A (en) packet filtering system for preventing DDoS attack
Varshney et al. An Improved AODV protocol to detect malicious node in Ad hoc network
Cao et al. psav: A practical and decentralized inter-as source address validation service framework
Haque et al. Comparative study on Wireless threats and their Classification
KR102840745B1 (en) Resource curation system with enhanced security between p2p based on dht and trust zone
Schatz et al. Hydra: practical metadata security for contact discovery, messaging, and voice calls
KR101591306B1 (en) Method and apparatus for communication using virtual MAC address
US20260019358A1 (en) Endpoint identity and relationship obfuscation
Khasnikar Anonymity protection using ALERT in MANET

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 15884806

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 1751040-5

Country of ref document: SE

WWE Wipo information: entry into national phase

Ref document number: 15556669

Country of ref document: US

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 15884806

Country of ref document: EP

Kind code of ref document: A1