# US 11,122,018 B2 · Secure end-to-end transport through intermediary nodes

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,122,018 B2
- Document ID: US11122018B2
- Status: Granted
- Kind: B2
- Application number: 17/218,842
- Filed: 2021-03-31
- Published: 2021-07-15
- Granted: 2021-09-14
- Earliest claimed: 2002-01-08
- Assignees: Seven Networks, LLC
- Applicants: Seven Networks, LLC
- Inventors: Lee R. Boynton; Trevor A. Fiatal; Scott M. Burke; Mark Sikes
- Web page: https://patentgrep.com/patent/US11122018B2

## CPC

- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 63/0272: {Virtual private networks}
- H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes}
- H04L 63/0464: {using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it}
- H04L 63/0471: {applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04W 12/03: Protecting confidentiality, e.g. by encryption
- H04B 7/0417: Feedback systems
- H04B 7/0617: {for beam forming}
- H04L 51/58: Message adaptation for wireless communication
- H04L 63/0281: {Proxies}
- H04L 67/04: specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
- H04L 67/1095: Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
- H04L 67/14: Session management (for real-time applications in data packet communications networks H04L65/1066)
- H04L 69/329: in the application layer [OSI layer 7]
- H04L 2209/80: Wireless
- H04W 4/12: Messaging; Mailboxes; Announcements
- H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W 52/0261: {managing power supply demand, e.g. depending on battery level}
- H04W 76/10: Connection setup
- H04W 88/06: adapted for operation in multiple networks {or having at least two operational modes}, e.g. multi-mode terminals
- Y02D 10/00: Energy efficient computing, e.g. low power processors, power management or thermal management
- Y02D 30/70: in wireless communication networks
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)
- H04B: TRANSMISSION
- Y02D: CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE

## Abstract

A communication network encrypts a first portion of a transaction associated with point-to-point communications using a point-to-point encryption key. A second portion of the transaction associated with end-to-end communications is encrypted using an end-to-end encryption key.

## Claims

### Claim 1

A system for processing a transaction, the system having at least one processor configured for:
receiving an identifier sent from a first computer;
issuing a token for the first computer, wherein a first point-to-point security association is negotiated with the first computer and a second point-to-point security association is negotiated with a second computer;
receiving a transaction message from the second computer, the transaction message comprising control data and payload data, wherein:
the control data provides authentication of a source of the transaction and includes the token; and
the token provides transaction routing information; and
transmitting the payload data to the first computer based on the token.

### Claim 2 (depends on 1)

The system of claim 1, wherein the payload data is transmitted to the first computer via one or more intermediary servers.

### Claim 3 (depends on 2)

The system of claim 2, wherein the payload data is encrypted with a security association not known to the intermediary servers.

### Claim 4 (depends on 1)

The system of claim 1, wherein the token is issued to the first computer after authenticating the first computer.

### Claim 5 (depends on 1)

The system of claim 1, wherein the first computer is a mobile device and the second computer is a personal computer.

### Claim 6 (depends on 1)

The system of claim 1, wherein the first computer and the system are coupled over a mobile network that provides an Internet protocol (IP) infrastructure of a wireless service provider.

### Claim 7 (depends on 1)

The system of claim 1, wherein the payload data is decrypted and displayed on the first computer.

### Claim 8

A method implemented on a system for processing a transaction, the method comprising:
receiving an identifier sent from a first computer;
issuing a token for the first computer, wherein a first point-to-point security association is negotiated with the first computer and a second point-to-point security association is negotiated with a second computer;
receiving a transaction message from the second computer, the transaction message comprising control data and payload data, wherein:
the control data provides authentication of a source of the transaction and includes the token; and
the token provides transaction routing information; and
transmitting the payload data to the first computer based on the token.

### Claim 9 (depends on 8)

The method of claim 8, wherein the payload data is transmitted to the first computer via one or more intermediary servers.

### Claim 10 (depends on 9)

The method of claim 9, wherein the payload data is encrypted with a security association not known to the intermediary servers.

### Claim 11 (depends on 8)

The method of claim 8, wherein the token is issued to the first computer after authenticating the first computer.

### Claim 12 (depends on 8)

The method of claim 8, wherein the first computer is a mobile device and the second computer is a personal computer.

### Claim 13 (depends on 8)

The method of claim 8, wherein the first computer and the system are coupled over a mobile network that provides an Internet protocol (IP) infrastructure of a wireless service provider.

### Claim 14 (depends on 8)

The method of claim 8, wherein the payload data is decrypted and displayed on the first computer.