Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Particular node for directing data and applying cryptography
Reexamination Certificate
1999-03-04
2003-01-14
Darrow, Justin T. (Department: 2132)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Particular node for directing data and applying cryptography
C713S151000, C713S162000, C380S248000, C380S270000, C709S225000, C455S412100, C455S433000, C455S445000, C370S389000
Reexamination Certificate
active
06507908
ABSTRACT:
BACKGROUND OF THE INVENTION
1. Field of the Invention
The present invention relates, in general, to secure communications, and, more particularly, to secure data communications with a mobile computer over an insecure network.
2. Relevant Background
A typical computing environment includes a secure network, such as a local area network (LAN) or wide area network (WAN) that can only be accessed by computers that are authorized by the network administrator to have access. These networks are non-public and so security can be readily controlled with conventional password management techniques. Mobile users can access the network through, for example, dial-up connections through server or gateway that verifies the user's identity and access privileges.
An important use of the Internet and other public data communication networks is the ability to exchange data between mobile computers and an organization's secure internal network. However, the public network is not secure. An internal secure network uses a gateway machine or “firewall” to couple the internal network to the external insecure network. A firewall is a hardware and/or software system designed to prevent unauthorized access to or from a private network. A firewall examines all packets entering and exiting the private network and blocks those that fail to meet specified security criteria. In an Internet environment, the gateway performs security operations on the IP layer by using, for example SunScreen™ SKIP, (SunScreen is a trademark of Sun Microsystems, Inc.). SKIP is a public key certificate-based key-management scheme which provides key-management for Internet protocols. Data communications using a secure gateway in this manner are referred to as “secure IP”.
All external hosts must be able to communicate with the internal network using secure IP at any time, but must also be allowed to reach the internal network while transmitting in the clear. This is useful if some services on the internal network must be accessible by the general public (e.g., web server or software download access) and by privileged users such as employees which may have additional rights on those services, e.g., downloading proprietary information. Because of this, a gateway device cannot always provide authorization control simply by filtering out transmissions received in the clear.
Prior secure IP systems provide authorization control using access control lists (ACLs) that list each IP network address (or other unique network identifier) that is authorized to access a particular resource on the internal network. In general, a gateway can place a static IP address on its ACL and authorize communication from that address to access services on the internal secure network. While this system addresses some problems related to access control, it does not authenticate that the received data packet truly originated from a particular machine.
A particular difficulty arises in that hosts coupled to the external network may be both regular “static” Internet nodes (i.e., having a permanently assigned IP address) or mobile nodes (i.e., nodes having a dynamically assigned IP address). It is also possible for a host with a static address to be in secure mode at some time, and be in a clear mode at some other time (e.g., the host running Windows(™) and Unix at different times). Moreover, two mobile hosts with different security properties may appear under the same dynamically assigned IP address at different times. In these instances merely relying on authorization based on the incoming packet's IP address is insufficient. The gateway machine must be able to authenticate or verify that data received from a remote system truly originated from that system. This situation must be correctly handled by the gateway to prevent, for example, hijacking of TCP connections.
For example, when an outside machine using secureIP disconnects from the Internet, thereby relinquishing its IP address, it can be replaced by a second machine transmitting in the clear that has been assigned the first machine's IP address. From the secure network's perspective, the incoming TCP packets may have come from either a second machine using the first machine's IP address, or from the first machine that is now sending in the clear. The second machine will not be able to break the secureIP security, but it may be able to send data in the clear that will reach the internal network. Desirably, the gateway must detect the difference between these two situations, and hinder the second machine's attempts to send packets on behalf of the old machine. At the same time, the gateway must not allow the fallback to clear text to be abused by an enemy to force all communication to go on in the clear. However, the incoming IP packets do not identify any machine-specific information that would enable the gateway to distinguish between the first machine and the second machine using the same IP address.
Many proposed approaches to mobile user security require the mobile user to specially configure the security software on the mobile machine. However, this makes the security software more difficult to install and use which is undesirable. To encourage widespread use of secureIP on a variety of machines, it is desirable that the software devices install out of the box, without significant effort to specially configure the software.
Prior solutions, including SKIP and similar IP security protocols, offer support for mobile hosts by either assigning them a permanent ID (called a master key ID or MKID in SKIP) that is stored in the mobile machine and is transferred with every IP packet. Alternatively, a new security association may be established each time a new mobile IP address is acquired. Although these solutions prevent an intruder with a hijacked IP address from reading encrypted packets, they do not solve the problem of address hijacking so long as the gateway allows the mobile host to send data in the clear. In these cases, the intruder may set the MKID field to zero to force communication in the clear while the security association is maintained by the gateway.
Moreover, this approach does not allow machines on the internal network to find out whether the incoming link is secure. The gateway holds the list of authorized addresses and performs the encryption/decryption functions. This information is not transmitted or shared with the internal network devices. Hence, the internal network machines cannot tell from examining the header of a received packet whether the packet was from a secureIP link or received in the clear. It would be useful for the internal devices to be aware of this information so that they could take intelligent action in response to receiving a packet with unexpected security properties.
Another approach uses “firewalls” which give the capability to do address translation for topology hiding. This hinders non-authorized user's efforts to find out about the structure and potentially vulnerable points of the internal network. Although this approach makes address hijacking less effective, it does not prevent its occurrence. Another solution relies on control messages transmitted from mobile hosts to establish IP tunnels. These tunnels provide a mechanism needed to redirect data addressed to the mobile host to a dynamically assigned IP address. Tunnels hinder address hijacking by encrypting packet header information as well as the packet payload, but are difficult to set up and require complex security management mechanisms.
The Internet Engineering Task Force (IETF) working groups for mobile IP have focused on one potential solution for the support of mobile hosts in the current Internet structure. For this, mobile hosts get assigned a “home IP address”, and a temporary routing address that is used to address traffic. In the gateway from the mobile network to the traditional Internet, address translation and rerouting may be performed, such that the mobile node appears to be reachable on its home address at all times. This approach can result i
Darrow Justin T.
Hogan & Hartson LLP
Kubida William J.
Langley Stuart T.
Sun Microsystems Inc.
LandOfFree
Secure communication with mobile hosts does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Secure communication with mobile hosts, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Secure communication with mobile hosts will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3056305