Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Protection at a particular protocol layer
Reexamination Certificate
1999-06-10
2002-10-22
Darrow, Justin T. (Department: 2132)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Protection at a particular protocol layer
C713S152000, C713S153000, C380S258000, C380S270000, C455S550100, C455S560000
Reexamination Certificate
active
06470447
ABSTRACT:
FIELD OF INVENTION
The present invention relates to mobile computing and, in particular, to a mechanism enabling modification of the operation of a mobile device when it crosses a country boundary in order to maintain conformance with different countries' legislative requirements such as cryptographic restrictions or other area-specific communications requirements.
BACKGROUND OF THE INVENTION
There are differing laws in different countries as to the strength and/or types of cryptography which are allowed, including differences between European countries, with some authorities wanting to ensure that authorised signal interception remains technically feasible. For example, a country may permit use of the RSA cryptographic algorithm with 512 bit keys but not using a key length of 1024 bits, or a country may permit use of DES but not 3DES, or use of any cryptographic algorithms up to 128 bit key length. There are also instances where certain countries are on a prohibited list such that exchanging encrypted data with any enterprises in that country is not permitted.
Mobile devices such as cellular telephones and communications-enabled Personal Digital Assistants (PDAs) are now capable of running application programs in addition to exchanging voice data, and cellular telephones are frequently used as the mechanism for portable computers to connect to a network to exchange data with other computers. Although encryption/decryption is a good idea when carrying out any sensitive transaction, such as an on-line credit-card purchase or an exchange of confidential information, encryption of data flows is particularly important for wireless communications since wireless communications are easier to intercept than communications sent via wired connections.
Any enterprises and individuals wishing to exchange encrypted data in the mobile environment, as well as any enterprise selling mobile computing devices, will soon face the problem of how to ensure that users of mobile computing devices and the parties they exchange data with conform to the legislative cryptography requirements of the countries at each end of the communication link. This is a particular problem since the mobile devices can be moved across country boundaries, such that a static solution would be inadequate. This problem will be faced by, for example, banks with networked computers which enable application programs running on mobile devices to communicate with application programs on the bank's computer systems and will also be faced by the mobile user. The bank will require a mechanism to ensure conformance to various national laws if its international business is to be approved by regulatory authorities in the respective countries.
U.S. Pat. No. 5,781,628 discloses selectively restricting encryption of communications within a telecommunications network in accordance with prohibitions on encryption for particular countries. U.S. Pat. No. 5,781,628 only discloses disabling encryption capabilities when required and this does not take account of the more subtle cryptographic requirements which are in place in many countries. For example, as noted above, use of cryptographic algorithms may be permitted if the key bit length is no more than a defined maximum or it may be that only certain types of cryptographic algorithm are prohibited.
Furthermore, U.S. Pat. No. 5,781,628 does not disclose any mechanism which enables performance of a selection of cryptographic components with reference to the specific requirements of communicating application programs running on communications devices. Indeed, U.S. Pat. No. 5,781,628 includes no disclosure of any mechanism which takes account of whether encryption is actually required. Although this might appear inessential to the simple determination in U.S. Pat. No. 5,781,628 of whether to disable all cryptographic functions for voice calls (in accordance with the strict legislative requirements of some countries), it does not provide adequate support for communicating application programs which have a required minimum security level. U.S. Pat. No. 5,781,628 does not enable a consideration of both relevant cryptographic restrictions and application requirements and a decision to be made on whether to break a communication connection or proceed with communication using a restricted cryptography level.
Cryptographic requirements are one of many examples of differences between the laws of different countries, and as such are one example of legislative requirements which would benefit from a method and mechanism for ensuring conformance to the different laws for mobile devices. As another example, legislation may prohibit a computing device user from using certain technology within prohibited countries (for example, if that technology is relevant to defence). As a further example, legislation may dictate the language which must be used for financial institutions' electronic transactions.
DISCLOSURE OF THE INVENTION
The present invention provides a method and a mechanism for dynamically controlling the performance of operations of a mobile device in accordance with legislative requirements of the particular location of the mobile device and in accordance with the requirements of application programs at either end of the communication link. The controlled operations are preferably communication-related operations such as encryption and decryption or applying of digital signatures.
In a first aspect, the invention provides a method and a mechanism that can be used to automatically switch cryptography strength and/or type when mobile computing devices cross country boundaries, or to break the mobile device's connection in a controlled way. This facilitates conformance of the mobile device's communications to different countries' cryptographic requirements.
The country of location of a mobile computing device is determined, and then information is obtained for identifying permitted cryptographic strengths or types for the identified location country. For example, the permitted cryptographic strengths or types may be identified in terms of specific permitted or prohibited algorithm names or key bit lengths. The provided information may also identify other country-specific communication prohibitions or restrictions.
A cryptographic component implementing a permitted algorithm is then selected for encrypting data in accordance with the requirements of the application programs at both ends of the communication and in accordance with the information on cryptographic restrictions, or the communication connection may be broken or the device or its encryption capabilities may be disabled.
In a first embodiment, the invention is implemented in an application service component for a first computing device. The application service component is responsive to an identification of at least the country location of the first computing device to obtain information for identifying cryptographic components which can be used in the identified country without contravening legislative restrictions. The application service component either selects or validates selection of a cryptographic component in accordance with the obtained information and in accordance with communication requirements of a first application program located on the first computing device, for encrypting and decrypting data.
If the first computing device initiated the communication, it then preferably initiates validation of the selection in accordance with communication requirements of a second application program located on a second computing device with which data will be exchanged. The initiation of validation with reference to the second application's requirements may simply involve sending a request to a second computing device for creation of a communication channel, or may involve an explicit validation request.
Either the step of obtaining information to identify permitted cryptographic components, or the step of selecting or validating selection of a cryptographic component, or a subsequent validation step pe
Lambert Howard Shelton
Orchard James Ronald Lewis
Darrow Justin T.
Ray-Yarletts Jeanine S.
LandOfFree
Enabling conformance to legislative requirements for mobile... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Enabling conformance to legislative requirements for mobile..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Enabling conformance to legislative requirements for mobile... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-2931486